Stack track determination and open gl dlls

我的梦境 提交于 2019-12-12 02:52:45

问题


After being able to determine call stack successfully (in my previous questions) - I was bit puzzled with opengl drivers.

KERNELBASE.dll                   GlobalAlloc (00007FF995B09643)
nvoglv64.DLL                     DrvPresentBuffers (0000000054F22747)
nvoglv64.DLL                     DrvPresentBuffers (0000000054F20893)
nvoglv64.DLL                     DrvPresentBuffers (0000000054F221B2)
nvoglv64.DLL                     (0000000054A6D79A)
nvoglv64.DLL                     (0000000054BA478A)
nvoglv64.DLL                     (0000000054BA60B5)
myown.dll                        my own source code(line) (00007FF96CCB6B73)

What I've briefly analyzed - direct function names are defined in opengl32.dll, which is simply a router to actual implementation - which might be NVidia or ATI or other display driver manufacturer.

But implementation jumps directly into display driver provider without caring about exported symbols.

In assembly I've noticed that most of functions have simple jumps to native implementation - for example like this:

glDrawElements:
00007FF97F0A8D80 65 FF 24 25 98 0E 00 00 jmp         qword ptr gs:[0E98h]  

This jump will land in nvoglv64.DLL.

But nvoglv64.DLL does not exports any useful symbols, so it's difficult to determine where execution was heading in call stack.

I theory I've could do quite trivial scan - load open32.dll, get all proc addresses (not sure if this can be done with Windows API, but I suspect so), then scan executable code at all positions, and detect such jump (65 FF 24 25 for 64-bit code)

but not sure how to extract "qword ptr gs:[0E98h]" data address without executing code.

So at the end I want to map address '0000000054BA60B5' to 'glDrawElements' symbol name.

Also may be it makes sense to contact driver manufacturer - may be they will export their symbols just for debuggability purpose. (May be with some underscore ? E.g. _glDrawElements )

What I have also understand is that NVidia does not necessarily provides .pdb's for their drivers ? May be this statement also not true.

Cross linked this question with NVidia forum as well: https://forums.geforce.com/default/topic/917471/geforce-drivers/stack-track-determination-and-open-gl-dlls/

来源:https://stackoverflow.com/questions/35467276/stack-track-determination-and-open-gl-dlls

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!