Open psec opened 7 years ago
@mxmssh already added this I believe?
we have this option in drltrace (-print_ret_addr).
Right. For drstrace I would think just the direct caller would not normally be sufficient: it's going to always be a winapi routine (your NtOpenSection example must be some unusual app doing raw syscalls?). A callstack to connect it back to the app would be more useful.
A callstack feature is already under #1756. I would say close this one in favor of that.
It would be useful to have the option to display the address of the caller or the return address in drstrace.
For example, the output under this option would read:
NtOpenSection ret addr: 0x00405340 arg 0: 0x001ffb5c (type=HANDLE*, size=0x4) arg 1: 0xf (type=unsigned int, size=0x4) ...