title: Wierd results when trying to back trace inside an injected dll
body: <p>Here is my problem. I detoured the "ScriptTextOut" function and I'm attempting to find where it was called from. Here is my dll (I use Microsoft Detour):</p>
  
  <pre><code>#pragma comment(lib, "detours.lib")
  
  #include &lt;Windows.h&gt;
  #include &lt;detours.h&gt;
  #include &lt;tchar.h&gt;
  #include &lt;string&gt;
  #include &lt;iostream&gt;
  #include &lt;Usp10.h&gt;
  #include &lt;Dbghelp.h&gt;
  
  HRESULT (WINAPI * Real_ScriptTextOut)(const HDC hdc, SCRIPT_CACHE *psc, int x, int y, UINT fuOptions, const RECT *lprc, const SCRIPT_ANALYSIS *psa, const WCHAR *pwcReserved, int iReserved,
      const WORD *pwGlyphs, int cGlyphs, const int *piAdvance, const int *piJustify, const GOFFSET *pGoffset) = ScriptTextOut;
  
  // function used to back trace where the function was called from
  void printStack()
  {
       unsigned int   i;
       void         * stack[ 100 ];
       unsigned short frames;
       SYMBOL_INFO  * symbol;
       HANDLE         process;
  
       process = GetCurrentProcess();
  
       SymInitialize( process, NULL, TRUE );
  
       frames               = CaptureStackBackTrace( 0, 100, stack, NULL );
       symbol               = ( SYMBOL_INFO * )calloc( sizeof( SYMBOL_INFO ) + 256 * sizeof( char ), 1 );
       symbol-&gt;MaxNameLen   = 255;
       symbol-&gt;SizeOfStruct = sizeof( SYMBOL_INFO );
  
       for( i = 0; i &lt; frames; i++ )
       {
           SymFromAddr( process, ( DWORD64 )( stack[ i ] ), 0, symbol );
  
           printf( "%i: %s - 0x%0X\n", frames - i - 1, symbol-&gt;Name, symbol-&gt;Address );
       }
  
       free( symbol );
  }
  
  // My ScriptTextOut function
  HRESULT WINAPI Mine_ScriptTextOut(const HDC hdc, SCRIPT_CACHE *psc, int x, int y, UINT fuOptions, const RECT *lprc, const SCRIPT_ANALYSIS *psa, const WCHAR *pwcReserved, int iReserved,
      const WORD *pwGlyphs, int cGlyphs, const int *piAdvance, const int *piJustify, const GOFFSET *pGoffset)
  {
      printStack();
  
      return Real_ScriptTextOut(hdc, psc, x, y, fuOptions, lprc, psa, pwcReserved, iReserved, pwGlyphs, cGlyphs, piAdvance, piJustify, pGoffset);
  }
  
  BOOL APIENTRY DllMain( HANDLE hModule, DWORD  ul_reason_for_call, LPVOID lpReserved  )
  {
      switch (ul_reason_for_call)
      {
      case DLL_PROCESS_ATTACH:
  
          AllocConsole();
          freopen("CONOUT$", "w", stdout);
  
          DetourTransactionBegin(); 
          DetourUpdateThread(GetCurrentThread());
  
          DetourAttach(&amp;(PVOID&amp;)Real_ScriptTextOut, Mine_ScriptTextOut);
  
          DetourTransactionCommit();
  
          break;
  
      case DLL_PROCESS_DETACH:
          FreeConsole();
  
          DetourTransactionBegin(); 
          DetourUpdateThread(GetCurrentThread());
  
          DetourDetach(&amp;(PVOID&amp;)Real_ScriptTextOut, Mine_ScriptTextOut);
  
          DetourTransactionCommit();
          break;
      }
  
      return TRUE;
  }
  </code></pre>
  
  <p>So the detour function works as expected, but the printStack() function print some wierd results... Here, take a look:</p>
  
  <p><img src="https://i.stack.imgur.com/K1Y2h.png" alt="PrintStack output"></p>
  
  <p>Why is it wierd, you may ask? Well, I expected to find the function that called ScriptTextOut, but the function before "Mine_ScriptTextOut" is "ScriptApplyDigitSubstitution", and while these 2 are clearly related, one doesn't call the other...</p>
  
  <p>When testing my PrintStack function outside an injected dll, everything worked out fine:</p>
  
  <pre><code>#include &lt;Windows.h&gt;
  #include &lt;Dbghelp.h&gt;
  #include &lt;cstdio&gt;
  
  void printStack()
  {
       unsigned int   i;
       void         * stack[ 100 ];
       unsigned short frames;
       SYMBOL_INFO  * symbol;
       HANDLE         process;
  
       process = GetCurrentProcess();
  
       SymInitialize( process, NULL, TRUE );
  
       frames               = CaptureStackBackTrace( 0, 100, stack, NULL );
       symbol               = ( SYMBOL_INFO * )calloc( sizeof( SYMBOL_INFO ) + 256 * sizeof( char ), 1 );
       symbol-&gt;MaxNameLen   = 255;
       symbol-&gt;SizeOfStruct = sizeof( SYMBOL_INFO );
  
       for( i = 0; i &lt; frames; i++ )
       {
           SymFromAddr( process, ( DWORD64 )( stack[ i ] ), 0, symbol );
  
           printf( "%i: %s - 0x%0X\n", frames - i - 1, symbol-&gt;Name, symbol-&gt;Address );
       }
  
       free( symbol );
  }
  
  void dontprint()
  {
  }
  
  void foo()
  {
      printStack();
  }
  
  void test()
  {
      dontprint();
      foo();
  }
  
  
  int main()
  {
      dontprint();
      test();
      return 0;
  }
  </code></pre>
  
  <p>Here is the correct output:</p>
  
  <p><img src="https://i.stack.imgur.com/p6xRc.png" alt="PrintStack correct output"></p>
  
  <p>Any idea what is happening?</p>