If you want to perform symbol lookup in a stripped executable, you must specify the --export-dynamic option when linking the program. This option causes the linker to add all symbols to the dynamic symbol table, which is the set of symbols that is visible from dynamic objects at run time. If you use gcc to link the objects, specify the option as -Wl,--export-dynamic to pass the correct option to the linker.

Note also that f you want to look up symbols in shared libraries or unstripped executables, the --export-dynamic option is not required.

DTrace supports the use of the ustack action with both 32-bit and 64-bit binaries, for example:

stack ustack(int nframes, int strsize) 
stack ustack(int nframes)
stack ustack(void)

The ustack action records a user stack trace to the directed buffer. The user stack is nframes in depth. If nframes is not specified, the number of stack frames that is recorded is the number specified by the ustackframes option. While ustack is able to determine the address of the calling frames when the probe fires, the stack frames are not translated into symbols until the ustack action is processed at user level by the DTrace consumer. If strsize is specified and is non-zero, ustack allocates the specified amount of string space and then uses it to perform address-to-symbol translation directly from the kernel. Such direct user symbol translation is used only with stacktrace helpers that support this usage with DTrace. If such frames cannot be translated, the frames appear only as hexadecimal addresses.

The following example traces a stack with no address-to-symbol translation:

# dtrace -n syscall::write:entry'/pid == $target/{ustack(); exit(0)}' -c "./mytestprog -v"
dtrace: description 'syscall::write:entry' matched 1 probe
mytestprog (Version 1.0)
CPU     ID                    FUNCTION:NAME
  2      6                      write:entry 

The ustack symbol translation occurs after the stack data is recorded. Therefore, the corresponding user process might exit before symbol translation can be performed, making stack frame translation impossible. If the user process exits before symbol translation is performed, dtrace outputs a warning message, followed by the hexadecimal stack frames.