Call Stack Acquisition from Memory Dumps Without Frame Pointers

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing memory forensics technologies struggle to acquire a call stack indicating the operation state of an application from a memory dump, especially in environments where no frame pointer is used, leading to difficulties in obtaining execution context and potentially incorrect return addresses.

Innovation Solution

A call stack acquisition device that reproduces the memory space, acquires execution context, and specifies the stack position using a stack pointer, then interprets metadata to trace return addresses and build a call stack, even in environments without frame pointers.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If frame pointer tracing is used to acquire return addresses, then the call stack can be accurately acquired in traditional environments, but the method becomes inapplicable in 64-bit Windows environments where frame pointers are not used

Engineering Contradiction:

Improvecall stack acquisition accuracyVSAvoidcompatibility with different execution environments

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The invention changes the fundamental parameter of stack trace acquisition from frame pointer-based to stack pointer-based. By using the stack pointer (rsp register) to directly access the stack and interpret metadata to determine return address offsets, the method adapts to 64-bit Windows environments where frame pointers are eliminated, while maintaining call stack acquisition accuracy across different execution environments

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

Instead of tracing forward from frame pointers as in traditional methods, the invention inverts the approach by starting from the current stack pointer position and working backward through the stack to acquire return addresses. This inversion allows direct access to the stack without relying on frame pointer chains, making the method compatible with environments where frame pointers are not used

Inventive Principle:

Principle #13The other way round (Inversion)

2Productivity

If compiler optimization is applied to eliminate frame pointers, then execution efficiency is improved, but the ability to acquire return addresses through traditional stack tracing is lost

Engineering Contradiction:

Improveexecution efficiencyVSAvoidloss of frame pointer information

Core Design Contradiction:

ProductivityVSLoss of information

Solution Approach 1:

The invention introduces metadata interpretation as an intermediary mechanism. Instead of directly relying on frame pointers, the stack pointer is used to access metadata that contains information about function prologue/epilogue structures. This metadata acts as a mediator that bridges the gap between the optimized code without frame pointers and the need to acquire return addresses for call stack reconstruction

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The invention replaces the mechanical frame pointer tracing system with a metadata-based interpretation system. By using the stack pointer to access and interpret function metadata, the method substitutes the traditional frame pointer mechanism with a more flexible approach that works in optimized environments where frame pointers are eliminated for performance reasons

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Quantity of substance

If typical memory dump analysis is performed, then memory data can be extracted, but execution context information such as stack pointer position and frame pointer value is unavailable

Engineering Contradiction:

Improvememory data extractionVSAvoidloss of execution context

Core Design Contradiction:

Quantity of substanceVSLoss of information

Solution Approach 1:

The invention performs preliminary identification of execution context structures within the memory dump. By systematically searching for and identifying thread information structures, stack pointer values, and metadata patterns before attempting call stack acquisition, the method recovers execution context information that would otherwise be lost in typical memory dump analysis

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention enables the memory dump itself to provide execution context information through self-identification. By designing the method to automatically identify and extract stack pointer positions, thread information, and metadata structures from the raw memory dump without requiring external context files, the system makes the memory dump self-sufficient for call stack reconstruction

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS11182479B2Call stack acquisition device, call stack acquisition method, and call stack acquisition program

Publication Date: 2021.11.23 NIPPON TELEGRAPH & TELEPHONE CORP

AI summary

A call stack acquisition device reproduces, from a memory dump, a memory space of a process to which a thread as a production target of a call stack belongs. Then, the call stack acquisition device acquires execution context of the thread by acquiring, from a virtual memory space, register information of the thread, which is stored in a memory by an OS. In addition, the call stack acquisition device acquires a current stack position and a currently executed function from the acquired execution context. Thereafter, the call stack acquisition device acquires the call stack by tracing return addresses of a series of functions as callers of the currently executed function on the stack from metadata of an execution file of the process including the thread.