Walking a mixed stack

Question

Hi!
I'm trying to read a mixed-callstack with ICorDebug.
I managed to read unamanged frames from the top of the stack but then I get to the managed frames.
I'm using "GetActiveChain" in order to get the first managed frame with "GetActiveFrame", but then I get a NULL frame with "reason" = CHAIN_ENTER_UNMANAGED
(which I understand that implies it's not a all-frames-managed chain).
Is there a way to input the chain with a frame address from which I'll be able to get its caller and so on?

 

I have just learned of DbgEng can also read managed frames. Would you recommand using it instead of ICorDebug?
Will it be more suitable for my purposes?

thanks :)

Answer 1

I'm unaware of support for managed frames in dbgeng. The WinDbg extension SOS will process managed frames, but this isn't done through a public API, currently. If you can give us a bit more context on where you learned that, we can definitely comment further.

Generally, the way you do this via the ICorDebugChain interfaces is to use EnumerateFrames to get frames for managed chains (as you probably already know) and then to use a native unwinder to get frames for unmanaged chains. You can use the GetStackRange API to understand the boundaries of your native frames within the chain.

As for how to unwind the native frames, you might find the following helpful: http://blogs.msdn.com/b/vcblog/archive/2010/01/05/dia-based-stack-walking.aspx. It covers a few APIs you can use to unwind and provides a sample using the DIA APIs.

Hope that helps.

Jon

 

Answer 2

I read about using DbgEng here:
http://www.steveniemitz.com/Blog/post/Building-a-mixed-mode-stack-walker-Part-1.aspx

And what am I supposed to compare the values outputed from GetStackRange with? :)

Hmm... and one more question:
What does "ICorDebugChain" mean?
MSDN says:
"The stack frames in a chain occupy contiguous stack space and share the same thread and context. A chain may represent either managed or unmanaged code chains. An empty ICorDebugChain instance represents an unmanaged code chain."

Does this means that a once I get to the end of a managed chain, a new unmanaged chain begins and vice versa?
Can a managed chain follow another managed chain, and if so - why?