Patent ID: 8850408

Claim:
A computer-implemented method for determining program flow, the method comprising: determining an address range of potential function addresses for a computer program; extracting raw stack information from execution of the computer program based at least in part on the determined address range, where the raw stack information includes a plurality of addresses, each one of the plurality of addresses in the extracted raw stack information having an associated stack depth that indicates a distance from a start of a stack for the executed computer program to the respective one of the plurality of addresses within the stack; parsing the raw stack information by using the associated stack depth for respective ones of the plurality of addresses to identify which of the plurality of addresses are function addresses associated with active functions of the computer program, where identification of which ones of the plurality of addresses are associated with active functions further includes determining an address distance between at least one of the plurality of addresses and a return address; constructing a call stack based at least in part on the identified ones of the plurality of addresses that are associated with active functions of the executed computer program; and presenting the constructed call stack of the computer program to a display.