Method WalkAndResolveStack

PeaceMaker Kernel/StackWalker.cpp:125–198

Walk the stack of the current thread and resolve the module associated with the return addresses. @param ResolvedStack - Caller-supplied array of return address information that this function populates. @param ResolvedStackSize - The number of return addresses to resolve. @param ResolvedStackTag - The tag to allocate ResolvedStack with. */

	@param ResolvedStackTag - The tag to allocate ResolvedStack with.
*/
VOID
StackWalker::WalkAndResolveStack (
	_Inout_ PSTACK_RETURN_INFO* ResolvedStack,
	_Inout_ ULONG* ResolvedStackSize,
	_In_ ULONG ResolvedStackTag
	)
{
	PVOID* stackReturnPtrs;
	ULONG capturedReturnPtrs;
	ULONG i;
	
	capturedReturnPtrs = 0;
	*ResolvedStack = NULL;

	//
	// Allocate space for the return addresses.
	//
	stackReturnPtrs = RCAST<PVOID*>(ExAllocatePoolWithTag(PagedPool, sizeof(PVOID) * *ResolvedStackSize, STACK_WALK_ARRAY_TAG));
	if (stackReturnPtrs == NULL)
	{
		DBGPRINT("StackWalker!WalkAndResolveStack: Failed to allocate space for temporary stack array.");
		goto Exit;
	}

	memset(stackReturnPtrs, 0, sizeof(PVOID) * *ResolvedStackSize);

	//
	// Get the return addresses leading up to this call.
	//
	capturedReturnPtrs = RtlWalkFrameChain(stackReturnPtrs, *ResolvedStackSize, 1);
	if (capturedReturnPtrs == 0)
	{
		DBGPRINT("StackWalker!WalkAndResolveStack: Failed to walk the stack.");
		goto Exit;
	}

	NT_ASSERT(capturedReturnPtrs < ResolvedStackSize);

	*ResolvedStackSize = capturedReturnPtrs;

	//
	// Allocate space for the stack return info array.
	//
	*ResolvedStack = RCAST<PSTACK_RETURN_INFO>(ExAllocatePoolWithTag(PagedPool, sizeof(STACK_RETURN_INFO) * *ResolvedStackSize, ResolvedStackTag));
	if (*ResolvedStack == NULL)
	{
		DBGPRINT("StackWalker!WalkAndResolveStack: Failed to allocate space for stack info array.");
		goto Exit;
	}
	memset(*ResolvedStack, 0, sizeof(STACK_RETURN_INFO) * *ResolvedStackSize);


	//
	// Iterate each return address and fill out the struct.
	//
	for (i = 0; i < capturedReturnPtrs; i++)
	{
		(*ResolvedStack)[i].RawAddress = stackReturnPtrs[i];