What addresses do we get after we call SymGetLineFromAddr64() and SymGetSymFromAddr64() WinAPI functions?

Question

[IMAGEHLP_SYMBOL64][1] *pSym = NULL;
[IMAGEHLP_LINE64][2] Line;
STACKFRAME64 s; 
int d = 0;

//In my code I obtain the return address from the stack frame of function foo() which was called from function bar() and assign it to s.AddrPC.Offset. Now I call - 

SymGetLineFromAddr64(this->m_hProcess, s.AddrPC.Offset, &(d), &Line) 

SymGetSymFromAddr64(this->m_hProcess, s.AddrPC.Offset, &(d), pSym))

//We pass the current process HANDLE
//pSym->Name = bar

What addresses do these contain?

Line.Address;

pSym->Address;

Found! pSym->Address gives the virtual address for the function name

I have been trying to figure this out for a long time. Any help will be appreciated.

Instead of editing your question to contain the answer, write an actual answer below, and accept that. — jalf, Dec 31 '10 at 16:08
@jalf: It's not a complete answer and I don't want to accept my own answer. If I find out the answer I would delete the question. — Bruce, Jan 05 '11 at 05:05
Judging by the number of views I don't think anyone is interested in the question :) But I understand your viewpoint and will not delete the question. I want to give someone else a chance to answer the question and get points instead of doing so myself. — Bruce, Jan 05 '11 at 13:15

score 0 · Answer 1 · edited May 23 '17 at 11:44

Here is what you were looking for:

From help page , structure of IMAGEHLP_SYMBOL64 is the below:

typedef struct _IMAGEHLP_SYMBOL64 {
  DWORD   SizeOfStruct;
  DWORD64 Address;
  DWORD   Size;
  DWORD   Flags;
  DWORD   MaxNameLength;
  TCHAR   Name[1];
} IMAGEHLP_SYMBOL64, *PIMAGEHLP_SYMBOL64;

Address being the address of the symbol.

In your case, pSym->Address appears to be the virtual address for the function name.

This question is also very similar to StackWalk64 on Windows - Get symbol name .

What addresses do we get after we call SymGetLineFromAddr64() and SymGetSymFromAddr64() WinAPI functions?

1 Answers1