WCU / Cybersecurity
~/CSC 471/Class 03/KP 14
Class 03 · KP 14 / 21

Following the Saved-RBP Chain

  • Each frame's saved RBP points at the previous frame's saved RBP.
  • This forms a linked list of frames walking toward higher addresses.
  • Just above each saved RBP sits that frame's return address.
  • A debugger reconstructs a backtrace by walking this chain:
  • Read return address at [rbp+8].
  • Follow saved RBP at [rbp] to the next frame.
  • Repeat until the chain ends.
  • Compilers may omit the frame pointer (-fomit-frame-pointer); then tools rely on .eh_frame unwind data instead.