Method FinalUserFrame

pkg/callstack/callstack.go:212–234

FinalUserFrame returns the final frame that corresponds to the user code execution. That usually translates to the last frame before ntdll or kernel32 modules.

()

// to the user code execution. That usually translates to
// the last frame before ntdll or kernel32 modules.
func (s *Callstack) FinalUserFrame() *Frame {
	if s.IsEmpty() {
		return nil
	}

	var n int
	for n = s.Depth() - 1; n > 0; n-- {
		f := (*s)[n]
		if f.Addr.InSystemRange() {
			continue
		}
		mod := filepath.Base(strings.ToLower(f.Module))
		if mod != "ntdll.dll" && mod != "kernel32.dll" && mod != "kernelbase.dll" {
			break
		}
	}

	if n >= 0 && n < s.Depth()-1 {
		return &(*s)[n]
	}

	return nil
}

// FinalUserspaceFrame returns the final userspace frame. This
// frame is typically backed by the ntdll module.