[JoshMcguigan]

> Normally Luke would group the same functions together but since I don’t have debugging symbols I had to eyeball nearby addresses to guess if it’s the same place.

I really enjoyed this article, but I do have a question about this part. Why would a single function be listed at mutliple addresses?

[kuroguro]

Well it's not actually the function's start address, it's the instruction pointer's address for the top function (so it moves around while executing).

And going down the call tree, it's also not the start address, but the return address - so the place where in the previous function called this one.

Without debug symbols there's no way to tell if we're inside the same function block or not - it's all just addresses somewhere in the machine code.

[tiddles]

I'd guess it's just using the value of the instruction pointer at each point it samples, and the way to resolve the function from that is to look backwards to find the symbol of the function it's in. As he has no symbols Luke has no (easy) way of knowing where functions start so it can't do this lookup.