I'm trying to reverse a server executable(linux) and I need to find what calls sendmsg. Usually I can just use the xrefs in IDA, but in this case it doesn't show me anything. However, if I set a breakpoint at it I can see it being called when I connect. So my question to you is: how can I find out how the program got to the sendmsg?
IDA: Finding out what calls sendmsg
ida;linux
If you're breaking at the beginning of sendmsg you can look at the return value on the stack to see where the call came from.  As long as no stack frame has been created the return value should be the first thing on the stack above ESP.  Take the image below:Assuming sendmsg is where Bar() is located, the return address would be the location in Foo() after sendmsg was called.  I'm not sure which debugger you're using (would be useful information), but in GDB you can look at the top of the stack (the return value) by using the following command:(gdb) x/20xw $esp This technique is useful when following object-oriented code, and xrefs are hard to come by.BacktraceOr as suggested by Guntram Blohm you can use a backtrace.  In GDB:(gdb) bt    ; Prints entire backtrace(gdb) bt n  ; Prints 'n' innermost frames(gdb) bt -n ; Prints 'n' outermost frames