-1

Possible Duplicate:
use callback function to report stack backtrace

Given a void *eip and an array of struct function symbols that contain the address, symbolic name, and binding of all function symbols in the file, how do I determine the function running at the time of the error?

Community
  • 1
  • 1
user363069
  • 9
  • 2

1 Answers1

1

If the executing module isn't relocated at runtime, you could probably try to check if your EIP lies between two function addresses in your function symbols.

JPD002
  • 171
  • 2
  • 3
  • Even if it is relocated, the OS will provide a way to retrieve the relocation offset, and after subtracting this off EIP the same thing can be done. – j_random_hacker Nov 16 '10 at 00:08