输出CallStack

在程序异常处理中有时需要输出CallStack，这就要用到DbgHelp

示例代码

#include <Windows.h>
#include <DbgHelp.h>
#include <stdio.h>

#pragma comment(lib, "dbghelp.lib")

void PrintCallStack(const CONTEXT * pContext)
{
	HANDLE hProcess = GetCurrentProcess();

	if (!SymInitialize(hProcess, NULL, TRUE)) {
		exit(0);
	}

	HANDLE hThread = GetCurrentThread();

	CONTEXT Context = *pContext;

	struct ReadMemoryRoutine {
		static BOOL CALLBACK Proc(HANDLE hProcess, DWORD64 lpBaseAddress, PVOID lpBuffer, DWORD nSize, LPDWORD lpNumberOfBytesRead) {
			SIZE_T st;
			BOOL bRet = ReadProcessMemory(hProcess, (LPVOID)lpBaseAddress, lpBuffer, nSize, &st);
			*lpNumberOfBytesRead = st;
			return bRet;
		}
	};

	STACKFRAME64 StackFrame;
	ZeroMemory(&StackFrame, sizeof(StackFrame));
	StackFrame.AddrPC.Offset    = Context.Eip;
	StackFrame.AddrPC.Mode      = AddrModeFlat;
	StackFrame.AddrFrame.Offset = Context.Ebp;
	StackFrame.AddrFrame.Mode   = AddrModeFlat;
	StackFrame.AddrStack.Offset = Context.Esp;
	StackFrame.AddrStack.Mode   = AddrModeFlat;
	while (1) {
		if (!StackWalk64(IMAGE_FILE_MACHINE_I386, hProcess, hThread, &StackFrame, &Context, &ReadMemoryRoutine::Proc, SymFunctionTableAccess64, SymGetModuleBase64, NULL)) {
			break;
		}
		if (StackFrame.AddrPC.Offset == 0) {
			break;
		}
		DWORD64 Displacement64;
		ULONG64 buffer[(sizeof(SYMBOL_INFO) + MAX_SYM_NAME * sizeof(TCHAR) + sizeof(ULONG64) - 1) / sizeof(ULONG64)];
		PSYMBOL_INFO pSymbol = (PSYMBOL_INFO)buffer;
		pSymbol->SizeOfStruct = sizeof(buffer);
		pSymbol->MaxNameLen = MAX_SYM_NAME;
		if (!SymFromAddr(hProcess, StackFrame.AddrPC.Offset, &Displacement64, pSymbol)) {
			strcpy_s(pSymbol->Name, MAX_SYM_NAME, "unknown symbol name");
		}
		DWORD Displacement;
		IMAGEHLP_LINE64 Line;
		ZeroMemory(&Line, sizeof(Line));
		Line.SizeOfStruct = sizeof(Line);
		if (!SymGetLineFromAddr64(hProcess, StackFrame.AddrPC.Offset, &Displacement, &Line)) {
			Line.FileName = "unknown file name";
		}
		printf_s("%s (%u): %s\n", Line.FileName, Line.LineNumber, pSymbol->Name);
	}
}

void WriteMiniDump(struct _EXCEPTION_POINTERS * pException) {
	HANDLE hFile = CreateFileA("mini_dump.dmp", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
	if (INVALID_HANDLE_VALUE == hFile) {
		exit(0);
	}
	MINIDUMP_EXCEPTION_INFORMATION cbif;
	cbif.ThreadId = GetCurrentThreadId();
	cbif.ClientPointers = TRUE;
	cbif.ExceptionPointers = pException;
	MiniDumpWriteDump(GetCurrentProcess(), GetCurrentProcessId(), hFile, MiniDumpNormal, &cbif, NULL, NULL);
	CloseHandle(hFile);
}

static LONG WINAPI MyExceptionFilter(struct _EXCEPTION_POINTERS * pException) {

	PrintCallStack(pException->ContextRecord);

	WriteMiniDump(pException);

	return EXCEPTION_EXECUTE_HANDLER;
}

int main(int argv, char ** argc)
{
	SetUnhandledExceptionFilter(MyExceptionFilter);

	_asm {cli};

	return 0;
}

当需要在某个函数中输出调用堆栈，则可以这样

void foo(void)
{
	CONTEXT Context;
	RtlCaptureContext(&Context);
	PrintCallStack(&Context);
}

但是由于RtlCaptureContext不包含顶层调用堆栈，所以还可以直接从汇编中获取Eip的方式

参见：http://jpassing.com/2008/03/12/walking-the-stack-of-the-current-thread/

void foo(void)
{
	CONTEXT Context;
	ZeroMemory( &Context, sizeof( CONTEXT ) );
	Context.ContextFlags = CONTEXT_CONTROL;
	__asm {
Label:
		mov [Context.Ebp], ebp;
		mov [Context.Esp], esp;
		mov eax, [Label];
		mov [Context.Eip], eax;
	}
	PrintCallStack(&Context);
}