Kernel: Is it possible to lookup functions symbol name from address in code?

Having called RtlCaptureStackBackTrace() at some point in my code, and as an example
I call

    for (int i = 0; i < frames; i++) {
        DbgPrint("[%d] %p\n", i, stack[i]);
    }

To print out the addresses. In debugger I can use dt <address> to get function name.

But it would be convenient if I could have

        DbgPrint("[%d] %p\n", i, print_symbol(stack[i]));

where print_symbol(address) returns the function name string.

Is this possible from a Windows Driver? The kernel equivalent of SymFromAddr().

You can't do any of that symbolic name lookup stuff from kernel mode on the target. You could farm if off to user mode I suppose.

Back to doing it from the debugger, best thing I can think is to make them DML links to save you some typing. For example:

    PVOID frames[8];
    USHORT count;
    
    count = RtlCaptureStackBackTrace(0, 8, &frames[0], NULL);
            
    for (ULONG i = 0; i < count; i++) {
        DbgPrint("[%u] <?dml?><exec cmd=\"ln %p\">%p</exec>\n", 
                 i,
                 frames[i],
                 frames[i]);
    }

Gives you clickable links in the output:

image

It would be nice if there was a way to force the debugger to run these then it sees them but I don't know of any way (aside from maybe writing your own extension)

1 Like

Ah neat, that is something at least.
Cheers,