I'm investigating a bug that happens in proprietary DLL that doesn't have PDB symbols.The callstack looks like this:KernelBase.dll!7710c54f()[Frames below may be incorrect and/or missing, no symbols loaded for KernelBase.dll]    msvcr90.dll!__CxxThrowException@8()ScrUsSsDtceLib.dll!5ec92ef1()ScrUsSsDtceLib.dll!5ec91ec4()ScrUsSsDtceLib.dll!5ec96f86()ScrUsSsDtceLib.dll!5ec9de1c()ScrUsSsDtceLib.dll!5ec9d5f5()ScrUsSsDtceLib.dll!5ecc2f5d()vcomp90.dll!_vcomp::ParallelRegion::HandlerThreadFunc(void *,unsigned long)vcomp90.dll!_vcomp::NullAPCFunc(unsigned long)kernel32.dll!759b336a()ntdll.dll!777e9902()ntdll.dll!777e98d5()Also I see the following DLL exports in Dependency Walker.Ordinal Hint    Entry Point Function1   0   0x000135D0  IScrUsDtce2D::IScrUsDtce2D(void)2   1   0x00013B30  IScrUsDtce3D::IScrUsDtce3D(void)3   2   0x00013F50  IScrUsDtce2D::~IScrUsDtce2D(void)4   3   0x00013B50  IScrUsDtce3D::~IScrUsDtce3D(void)5   4   0x00012AA0  class IScrUsDtce2D & IScrUsDtce2D::operator=(class IScrUsDtce2D const &)6   5   0x00012AD0  class IScrUsDtce3D & IScrUsDtce3D::operator=(class IScrUsDtce3D const &)7   6   0x000139A0  int IScrUsDtce2D::FilterImage(unsigned short const *,unsigned short *,int,int)8   7   0x00013DC0  int IScrUsDtce3D::FilterVolume(int,unsigned char const * const *,unsigned char * *,int)9   8   0x00013620  int IScrUsDtce2D::Init(char const *,struct UsDtceImgInfo const &,enum IScrUsDtce2D::ProcType,unsigned short const *)10  9   0x00013BA0  int IScrUsDtce3D::Init(char const *,struct UsDtceImgInfo const &,enum IScrUsDtce3D::ProcType)11  10  0x000137F0  int IScrUsDtce2D::InitSSC(char const *,struct UsDtceImgInfo const &,enum IScrUsDtce2D::ProcType,unsigned short const *,bool,float *,int)Is there any way to understand which functions are called?UPD: I understand that bigger part of the callstack addresses may be private functions.
Translate addresses on stack to the exported function names
debugging
post unadulterated stack use kb and paste the exact outputit is kinda difficult to understand what the symbols are in the stack pasteif they are return address ebp , args ?   most of the time you may need a disassembler application like ida / radare2 etc that does some extra work to analyze function boundaries and possibly name themfor example this is a stack from livekd.exe from sysinternals0:002> ~0kb # ChildEBP RetAddr  Args to Child              00 0021eab0 77546a64 7570179c 000000cc 00000000 ntdll!KiFastSystemCallRet01 0021eab4 7570179c 000000cc 00000000 00000000 ntdll!NtWaitForSingleObject+0xc02 0021eb20 76bebaf3 000000cc ffffffff 00000000 KERNELBASE!WaitForSingleObjectEx+0x9803 0021eb38 76bebaa2 000000cc ffffffff 00000000 kernel32!WaitForSingleObjectExImplementation+0x75*** ERROR: Module load completed but symbols could not be loaded for e:\sysint\livekd.exe04 0021eb4c 00076038 000000cc ffffffff 00000000 kernel32!WaitForSingleObject+0x12WARNING: Stack unwind information not available. Following frames may be wrong.05 0021fae8 000795e6 00000001 002fbec0 002fbee8 livekd+0x603806 0021fb30 76bf3c45 7ffdf000 0021fb7c 775637eb livekd+0x95e607 0021fb3c 775637eb 7ffdf000 770c043e 00000000 kernel32!BaseThreadInitThunk+0xe08 0021fb7c 775637be 00079663 7ffdf000 00000000 ntdll!__RtlUserThreadStart+0x7009 0021fb94 00000000 00079663 7ffdf000 00000000 ntdll!_RtlUserThreadStart+0x1byou can find where livekd is loaded with 0:002> lm m live*Browse full module liststart    end        module name00070000 0010d000   livekd     (no symbols)       now assume you load it in radare2 with the same base address 0x70000 you can seek to the return address in stack 0x76038radare does some analysis and says this address belongs to main()radare2 -B 0x70000 -AA e:\SYSINT\livekd.exe[0x00079663]> s 0x76038[0x00076038]> pd 5|           0x00076038      6860894200     push 0x428960|           0x0007603d      ffd6           call esi|           0x0007603f      6860894200     push 0x428960|           0x00076044      c705c47b4200.  mov dword [0x427bc4], 0     ; [0x427bc4:4]=-1|           0x0007604e      ff158c704100   call dword [0x41708c][0x00076038]> afnmain <-------------[0x00076038]>another example [0x00076038]> s 0x795e6[0x000795e6]> afnentry0  <----------------[0x000795e6]>