Friday, 13 September 2013

StackWalk64 returns weird addresses

StackWalk64 returns weird addresses

I use StackWalk64 to print a stack trace when the application crashes and
I noticed that sometimes it goes crazy and starts giving strange random
addresses at some point that belong neither to the application nor to any
of the DLLs loaded by it. For example:
#0 77c93e23 ntdll.dll
#1 77c93aa4 ntdll.dll
#2 00492ac1 *.exe
#3 00450689 *.exe
#4 0048c387 *.exe
#5 0048c4bc *.exe
#6 00488afd *.exe
#7 00495151 *.exe
#8 00495161 *.exe
#9 ffc30000 <--- the fun part begins here
#10 e8042474
#11 ffffffbf
#12 c01bd8f7
#13 4859d8f7 *.exe
#14 247c83c3 *.exe
#15 06740008 *.exe
#16 412d01c6 *.exe
#17 8b56d8f7
#18 f7d233f1
#19 83082474
#20 057609fa *.exe
#21 eb57c280
#22 30c28003 *.exe
#23 85411188
#24 c6e677c0
#25 8a490001
#26 88018a16
#27 06884911 *.exe
#28 72f13b46 *.exe
#29 55c35ef2 *.exe
#30 7d83ec8b *.exe
#31 458b0a10 *.exe
#32 850a7508
#33 6a067dc0 *.exe
#34 eb0a6a01
#35 ff006a05
#36 4d8b1075 *.exe
#37 ff9fe80c
#38 458bffff *.exe
#39 5d59590c *.exe
#40 244c8bc3 *.exe
#41 24448b08 *.exe
#42 ff006a04
#43 e8102474
#44 ffffff85
#45 1024448b *.exe
#46 e8c35959
I solved this by checking the most significant bit in the address and
discarding following frames. But is it really a good solution? I mean,
StackWal64 may be giving me those "incorrect" frames for a reason.

No comments:

Post a Comment