function RealReadFromProcessMemory64(const AhProcess: THANDLE; const AqwBaseAddress:Int64; const AlpBuffer: Pointer; const ASize: DWORD; var ANumberOfBytesRead: DWORD):BOOL;stdcall;
var
st : DWORD;
begin
Result := ReadProcessMemory(AhProcess, Pointer(AqwBaseAddress), AlpBuffer, ASize, st);
ANumberOfBytesRead := st;
end;
function RealReadFromProcessMemory32(const AhProcess: THANDLE; const AqwBaseAddress:DWORD; const AlpBuffer: Pointer; const ASize: DWORD; var ANumberOfBytesRead: DWORD):BOOL;stdcall;
var
st : DWORD;
begin
Result := ReadProcessMemory(AhProcess, Pointer(AqwBaseAddress), AlpBuffer, ASize, st);
ANumberOfBytesRead := st;
end;
function GetStackFrame(var dwRetArray :StackframeArr):Integer;
var
ContextRecord:TContext;
StackFrame:TSTACKFRAME64;
begin
ContextRecord.ContextFlags:=CONTEXT_FULL;
if GetThreadContext(GetCurrentThread,ContextRecord) then
begin
SetLength(dwRetArray,0); Result:=0;
FillChar(StackFrame, sizeof(StackFrame), 0);
StackFrame.AddrPC.Offset := ContextRecord.Eip;
StackFrame.AddrStack.Offset := ContextRecord.Esp;
StackFrame.AddrFrame.Offset := ContextRecord.Ebp;
StackFrame.AddrPC.Mode :=AddrModeFlat;
StackFrame.AddrStack.Mode :=AddrModeFlat;
StackFrame.AddrFrame.Mode := AddrModeFlat;
while StackWalk64(IMAGE_FILE_MACHINE_I386,GetCurrentProcess, GetCurrentThread,StackFrame,@ContextRecord,@RealReadFromProcessMemory64,nil,nil,nil) do
//while StackWalk(IMAGE_FILE_MACHINE_I386,GetCurrentProcess, GetCurrentThread,StackFrame,@ContextRecord,@RealReadFromProcessMemory32,nil,nil,nil) do
begin
if (StackFrame.AddrReturn.Offset <> 0) then
begin
//FLogManager.Log('Stack frame:' + IntToHex(Cardinal(Pointer(StackFrame.AddrPC.Offset)), 8));
SetLength(dwRetArray,High(dwRetArray)+2);
dwRetArray[High(dwRetArray)]:=StackFrame.AddrReturn.Offset;
Inc(Result);
end;
end;
end;
end;
