Go back to the function call address

Question

My question is simple : When I enter into a function call, I can't go back to this same call. Is there a functionality which could permit me to do this in x64dbg?
Or for example if we want to trace back from a chosen address...
I hope I am clear enough...

zxxc · Answer

You have two options, assuming the function is not inlined:

at the beginning of the function look at the stack, it should point to the caller. In some cases it can be possible to optimise the invocation of the function and instead of using call use jmp. For example when one function is a subset of another or in recursive functions.
I don't think it's possible via x64dbg but you could record a trace of the entire execution and then replay the bits you're interested in and check the callers. For this you could use e.g. https://rr-project.org/

Go back to the function call address

One Answer

Add your own answers!

Ask a Question