stackwalkerc - Windows single header stack walker in C (DbgHelp.DLL)

Overview

stackwalkerc - Windows single header stack walker in C (DbgHelp.DLL)

Features

  • Can be used in C or C++ code
  • Super simple API
  • Single header library makes integration into projects easy and fast
  • Overridable memory allocations and assertion
  • Zero heap allocations in callstack function (sw_show_callstack)
  • No extra header inclusions except lightweight stdbool.h and stdint.h for delclarations
  • Reporting of loaded modules and symbol search paths of the executable
  • Callstack reporting of other threads and processes
  • Callstack reporting in system exceptions
  • Does not depend on DbgHelp.DLL to be included with the executable, this library dynamically loads the DbgHelp.dll from common system paths

Usage

This is a single header library, so all you need is include the file in your source and you are good to go:

// SW_IMPL includes implementation as well, you can skip this if you only want the declarations
#define SW_IMPL
#include "stackwalker.h"

Optionally, you can override some base functionality like function visibility, assertion and malloc, before including stackwalkerc.h:

#define SW_API_DECL static  // declars everything as static so only visible to current translation unit
#define SW_ASSERT(e)  MyAssert(e)       // override assert
#define SW_MALLOC(size)  MyMalloc(size) // override default stdc malloc
#define SW_FREE(ptr) MyFree(ptr)        //  override default stdc free
#define SW_IMPL
#include "stackwalker.h"

The API usage is super simple. There is more functionality like listing symbol search paths and loaded modules, for more detailed example, check out example.cpp for details.

line_filename, entry->line, entry->und_fullname); } int main(int argc, char* argv[]) { sw_callbacks callbacks = { .callstack_entry = callstack_entry }; sw_context* stackwalk = sw_create_context_capture(SW_OPTIONS_ALL, callbacks, NULL); if (!stackwalk) { puts("ERROR: stackwalk init"); return -1; } sw_show_callstack(stackwalk, NULL); // Second parameter NULL means that stackwalker should resolve for current thread sw_destroy_context(g_stackwalk); return 0; } ">
static void callstack_entry(const sw_callstack_entry* entry, void* userptr)
{
    printf("\t%s(%d): %s\n", entry->line_filename, entry->line, entry->und_fullname);
}

int main(int argc, char* argv[]) 
{
    sw_callbacks callbacks = {
        .callstack_entry = callstack_entry
    };
    sw_context* stackwalk = sw_create_context_capture(SW_OPTIONS_ALL, callbacks, NULL);
    if (!stackwalk) {
        puts("ERROR: stackwalk init");
        return -1;
    }
    sw_show_callstack(stackwalk, NULL); // Second parameter NULL means that stackwalker should resolve for current thread
    sw_destroy_context(g_stackwalk);
    return 0;
}

To build the example, just make sure you have the right compiler flags (build debug symbols) and also link with Version.lib. The main API will be loaded dyamically from dbghelp.dll in common system paths (see sw__init_internal to see the search paths for the DLL file):

MSVC:

cd example
cl /Od /Zi Version.lib example.cpp

Clang (win):

cd example 
clang -g -O0 -lVersion example.cpp -o example.exe

Acknowledgments

Almost all of the Windows API usage for StackWalk are taken from StackWalker project by Jochen Kalmbach. For detailed information on how to use the API, read the Kalmbach's article on CodeProject.
This is actually a much more simplified (and improved imo) and straight-to-the-point version of StackWalker library.
This project only supports msvc2015+/clang(windows) compilers, if you prefer C++ API or want support for older Visual studio versions, check out Kalmbach's StackWalker library mentioned above.

License (BSD 2-clause)

Copyright 2021 Sepehr Taghdisian. All rights reserved.

https://github.com/septag/stackwalker.c

Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:

   1. Redistributions of source code must retain the above copyright notice,
      this list of conditions and the following disclaimer.

   2. Redistributions in binary form must reproduce the above copyright notice,
      this list of conditions and the following disclaimer in the documentation
      and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY COPYRIGHT HOLDER ``AS IS'' AND ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
EVENT SHALL COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
You might also like...
A DLL & Code Injection C++ library for Windows.
A DLL & Code Injection C++ library for Windows.

syringe - A DLL & Code Injection C++ library for Windows. syringe is a DLL & Code Injection C++ library for Windows that contains different techniques

A rewrite of the old legacy software
A rewrite of the old legacy software "depends.exe" in C# for Windows devs to troubleshoot dll load dependencies issues.

Dependencies - An open-source modern Dependency Walker Download here (If you're running an AV, use this download instead) NB : due to limitations on /

Add a directory to dynamic DLL search path on Windows.

DLLLoaderHelper Add a directory to DLL search path for Windows. Say you are building a library, :library_name, which loads some 3rd party shared libra

Exploits the Wii U's bluetooth stack to gain IOSU kernel access via bluetooth.

BluuBomb Exploits the Wii U's bluetooth stack to gain IOSU kernel access via bluetooth. For a more detailed write-up see WRITEUP.md. Not to be confuse

Stack-based texture generation tool written in C99!
Stack-based texture generation tool written in C99!

Stack-based texture generation tool written in C99! Brought to you by @zaklaus and contributors Introduction zpl.texed is a cross-platform stack-based

Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.
Thread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners and analysts.

Thread Stack Spoofing PoC A PoC implementation for an advanced in-memory evasion technique that spoofs Thread Call Stack. This technique allows to byp

A stack-based esolang

Bolet 🍄 A stack-based esolang. Not a serious project. Hello world Bolet uses the postfix notation, like most stack-based languages. In order to make

LoRa Driver for Semtech SX1262 on Linux (PineDio USB Adapter) and BL602 (PineDio Stack BL604)
LoRa Driver for Semtech SX1262 on Linux (PineDio USB Adapter) and BL602 (PineDio Stack BL604)

LoRa Driver for Semtech SX1262 on Linux (PineDio USB Adapter) and BL602 (PineDio Stack BL604) Read the articles... "Build a Linux Driver for PineDio L

Tiny and portable usb host and device stack for mcu with usb ip

Tiny and portable usb host and device stack for mcu with usb ip

Comments
  • Undefined reference - question

    Undefined reference - question

    Hello,

    I see this error when it links the project under C. stackwalkerc.h:555: undefined reference to `__current_exception_context'

    Do you have solution?

    opened by asor 1
Owner
Sepehr Taghdisian
https://twitter.com/septagh http://glitterbombg.com/blog
Sepehr Taghdisian
Implements a Windows service (in a DLL) that removes the rounded corners for windows in Windows 11

ep_dwm Implements a Windows service that removes the rounded corners for windows in Windows 11. Tested on Windows 11 build 22000.434. Pre-compiled bin

Valentin-Gabriel Radu 24 Dec 29, 2022
Collection of DLL function export forwards for DLL export function proxying

dll-exports Collection of DLL function export forwards for DLL export function proxying. Typical usecase is for backdooring applications for persisten

Magnus Stubman 58 Dec 6, 2022
A method from GH on how to stream a dll without touching disk, TAGS: fortnite cheat fortnite injector dll injector

dll-encryptor People who make pay hacks typically have down syndrome and are incapable of using their brains in any fashion, and yet these bath salt s

Micca 2 Nov 24, 2021
Shared to msvcrt.dll or ucrtbase.dll and optimize the C/C++ application file size.

VC-LTL - An elegant way to compile lighter binaries. 简体中文 I would like to turn into a stone bridge, go through 500 years of wind, 500 years of Sun, ra

Chuyu Team 266 Jan 1, 2023
DLL Hooker using DLL Redirection

DLLHooker DLL Hooker using DLL Redirection. Development Environment IDE: Visual Studio 2019 Demonstration References [1] https://www.exploit-db.com/do

Jack Ren 1 Jan 21, 2022
A single file, single function, header to make notifications on the PS4 easier

Notifi Synopsis Adds a single function notifi(). It functions like printf however the first arg is the image to use (NULL and any invalid input should

Al Azif 9 Oct 4, 2022
New lateral movement technique by abusing Windows Perception Simulation Service to achieve DLL hijacking code execution.

BOF - Lateral movement technique by abusing Windows Perception Simulation Service to achieve DLL hijacking ServiceMove is a POC code for an interestin

Chris Au 190 Nov 14, 2022
A simple utility that cold patches dwm (uDWM.dll) in order to disable window rounded corners in Windows 11

Win11DisableRoundedCorners A simple utility that cold patches the Desktop Window Manager (uDWM.dll) in order to disable window rounded corners in Wind

Valentin-Gabriel Radu 516 Dec 27, 2022
Spotify AdBlocker for Windows, written in C. DLL Injection.

Spotify AdBlock Windows Spotify Ad Block, in C ! Build Open an issue with information related if any error occurs. mingw32-make all Tested gcc: # gcc

Ii64人 1 Nov 2, 2021
Simple, fully external, smart, fast, JSON-configurated, feature-rich Windows x86 DLL Memory Dumper with Code Generation. Written in Modern C++.

altdumper Simple, fully external, smart, fast, JSON-configurated, feature-rich Windows x86 DLL Memory Dumper with Code Generation. Written in Modern C

cristei 14 Sep 9, 2022