How to Log Stack Frames with Windows x64

Question

I am using Stackdumps with Win32, to write all return adresses into my logfile. I match these with a mapfile later on (see my article [Post Mortem Debugging][1]).

<

Answer 1

We use minidumps exclusively here. You can generate a stripped down one that just includes stack information and dump out a stack trace from a decent debugger later.

It doesn't solve your problem directly, but I think it will provide you a much better postmortem reporting mechanism.

Answer 2

Watch this, I do not know if it is relevant:
...
Working with Assembly Code Assembly code is straightforward to port to AMD64 and 64-bit Windows—and is worth the effort for performance reasons! For example, you can take advantage of the new 64-bit general-purpose registers (r8-r15), and new floating point and 128-bit SSE/SSE2/floating point registers (xmm8-xmm15). However, there are new 64-bit stack frames and calling conventions you should learn about in the ABI (application binary interface) specifications.
...

Answer 3

The trick is to stop calling StackWalk64 when it returns 0 in stk.AddrReturn.Offset. This means there are no more frames on the stack. If stk.AddrReturn.Offset is non-zero, you can use that value as the return address.

If you continue calling StackWalk64 after this, my guess is that it will try to interpret whatever is in the memory locations as being a stack and will return unpredictable data.

Answer 4

Regarding RtlCaptureStackBackTrace, one thing I've noticed on 32-bit Windows is that it fails if you pass too large a number into it for FramesToCapture. Experimentally I've identified 61 as the maximum value, for no reason that I can fathom!

Not sure if it's the same in x64, but that might explain why you're getting no info out.

Answer 5

Regarding the first issue: disable "Omit stack frames" in thre release version, and the "trivial" stack tracing code will work.

Answer 6

Found the short version with the "CaptureStackBackTraceType" really useful!

Then resolved function names of the "callers[]" using SymFromAddr(), SymInitialize(), which is mainly the version from Pedro Reis

and finally demangled the function signatures according to function to mangle/demangle functions

NOTE: GNU demangler function abi::__cxa_demangle() expects a single underscore prefix