pg打桩调试技术在调用每个函数中增加一个计数器，来统计函数的调用顺序，待进程崩溃时打印出函数的调用顺序进行问题定位分析。

代码

arm-linux-gnueabihf-gcc -c arm_mcount.c -o arm_mcount.o

arm-linux-gnueabihf-gcc -pg arm_mcount.o main.c -o tt

不能直接通过gcc单步把.c文件编译成可执行文件，如：arm-linux-gnueabihf-gcc -pg arm_mcount_thread_v2.c main.c -o tt，因为gcc简化流程后会把自己的打桩函数也打桩，这样跑程序会报崩溃；应该单步编译成.o文件后，再全部链接.o文件成可执行文件。

root@www:~# ./tt  单步编译执行崩溃
pgd = cb294000
[be1acffc] *pgd=8b284835, *pte=00000000, *ppte=00000000
CPU: 0 PID: 791 Comm: tt Not tainted 4.9.11 #4
Hardware name: Freescale i.MX6 UltraLite (Device Tree)
task: c67bf300 task.stack: cb288000
PC is at 0x8610
LR is at 0x8617
pc : [<00008610>]    lr : [<00008617>]    psr: 400d0030
sp : be1ad000  ip : be9acdb0  fp : 00000000
r10: b6fd6000  r9 : 00000000  r8 : 00000000
r7 : be9acd28  r6 : 00000000  r5 : 00000000  r4 : be9acd48
r3 : 00008961  r2 : be9ace8c  r1 : be9ace84  r0 : 00000001
Flags: nZcv  IRQs on  FIQs on  Mode USER_32  ISA Thumb  Segment user
Control: 10c53c7d  Table: 8b294059  DAC: 00000055
CPU: 0 PID: 791 Comm: tt Not tainted 4.9.11 #4
Hardware name: Freescale i.MX6 UltraLite (Device Tree)
[<c010e540>] (unwind_backtrace) from [<c010b61c>] (show_stack+0x18/0x1c)
[<c010b61c>] (show_stack) from [<c0113300>] (__do_user_fault+0x84/0xcc)
[<c0113300>] (__do_user_fault) from [<c01135b8>] (do_page_fault+0x270/0x314)
[<c01135b8>] (do_page_fault) from [<c0101324>] (do_DataAbort+0x3c/0xbc)
[<c0101324>] (do_DataAbort) from [<c010c41c>] (__dabt_usr+0x3c/0x40)
Exception stack(0xcb289fb0 to 0xcb289ff8)
9fa0:                                     00000001 be9ace84 be9ace8c 00008961
9fc0: be9acd48 00000000 00000000 be9acd28 00000000 00000000 b6fd6000 00000000
9fe0: be9acdb0 be1ad000 00008617 00008610 400d0030 ffffffff
Segmentation fault

反汇编查看：自己调用了自己导致了问题

00008610 <__gnu_mcount_nc>:8610:   b500        push    {lr}8612:   f7ff fffd   bl  8610 <__gnu_mcount_nc>8616:   e92d 43ff   stmdb   sp!, {r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, lr}861a:  4673        mov r3, lr861c: 461d        mov r5, r3861e: 20e0        movs    r0, #224    ; 0xe08620: f7ff ef22   blx 8468 <_init+0x80>8624:   4603        mov r3, r08626: 4618        mov r0, r38628: f7ff ffbe   bl  85a8 <find_tstack>862c:   4604        mov r4, r0862e: 2c00        cmp r4, #08630: d013        beq.n   865a <__gnu_mcount_nc+0x4a>8632: 6821        ldr r1, [r4, #0]8634:   6862        ldr r2, [r4, #4]8636:   1c53        adds    r3, r2, #18638: 6063        str r3, [r4, #4]

应用测试代码：

#include <stdio.h>
#include <signal.h>
#include <stdlib.h>static void signal_bus_err(int sig)
{printf("Signal Error! Signal is %d \n", sig);// 调用pg打桩显示函数mcount_show(NULL);
}void fun()
{return;
}void main()
{mcount_init(1, NULL);signal(SIGSEGV, signal_bus_err);signal(SIGFPE, signal_bus_err);signal(SIGILL, signal_bus_err);fun();
}

非法指令错误

typedef unsigned int(*hash_func_t)(unsigned int,void *);
hash_func_t hash_func;static unsigned int hash_func_tt(unsigned int bucktes, void *key)
{printf("eason bucktes=%d \n", bucktes);return 0;
}void fun()
{hash_func = 0x8500;hash_func(1024, NULL);return;
}

./tt

Signal Error! Signal is 4
cnt:0 Function called by 00000000
cnt:96 Function called by 00000000
cnt:97 Function called by 000087d3
cnt:98 Function called by 000087a3
cnt:99 Function called by 0000877d
end

00008770 <signal_bus_err>:8770:    b580        push    {r7, lr}8772:   b082        sub sp, #88774: af00        add r7, sp, #08776: b500        push    {lr}8778:   f7ff ff04   bl  8584 <__gnu_mcount_nc>877c:   6078        str r0, [r7, #4]877e:   6879        ldr r1, [r7, #4]8780:   f648 00cc   movw    r0, #35020  ; 0x88cc8784:   f2c0 0000   movt    r0, #08788: f7ff ee18   blx 83bc <_init+0x20>878c:   2000        movs    r0, #0878e: f7ff ff43   bl  8618 <mcount_show>8792:   3708        adds    r7, #88794: 46bd        mov sp, r78796: bd80        pop {r7, pc}00008798 <fun>:8798:  b580        push    {r7, lr}879a:   af00        add r7, sp, #0879c: b500        push    {lr}879e:   f7ff fef1   bl  8584 <__gnu_mcount_nc>87a2:   f640 33b8   movw    r3, #3000   ; 0xbb887a6:    f2c0 0301   movt    r3, #187aa: f44f 4205   mov.w   r2, #34048  ; 0x850087ae:   601a        str r2, [r3, #0]87b0:   f640 33b8   movw    r3, #3000   ; 0xbb887b4:    f2c0 0301   movt    r3, #187b8: 681b        ldr r3, [r3, #0]87ba:   2100        movs    r1, #087bc: f44f 6080   mov.w   r0, #1024   ; 0x40087c0:    4798        blx r387c2: bf00        nop87c4:    bd80        pop {r7, pc}87c6:   bf00        nop000087c8 <main>:87c8:  b580        push    {r7, lr}87ca:   af00        add r7, sp, #087cc: b500        push    {lr}87ce:   f7ff fed9   bl  8584 <__gnu_mcount_nc>87d2:   2100        movs    r1, #087d4: 2001        movs    r0, #187d6: f7ff ff91   bl  86fc <mcount_init>87da:   f248 7171   movw    r1, #34673  ; 0x877187de:   f2c0 0100   movt    r1, #087e2: 200b        movs    r0, #1187e4:    f7ff edf6   blx 83d4 <_init+0x38>87e8:   f248 7171   movw    r1, #34673  ; 0x877187ec:   f2c0 0100   movt    r1, #087f0: 2008        movs    r0, #887f2: f7ff edf0   blx 83d4 <_init+0x38>87f6:   f248 7171   movw    r1, #34673  ; 0x877187fa:   f2c0 0100   movt    r1, #087fe: 2004        movs    r0, #48800: f7ff ede8   blx 83d4 <_init+0x38>8804:   f7ff ffc8   bl  8798 <fun>8808:   bd80        pop {r7, pc}880a:   bf00        nop

可以看到最后一个函数是signal_bus_err，倒数第二个是fun，最后一个是main函数，所以是在fun函数有异常，需要看代码才能确定具体问题。

非法内存

void fun()
{int *p = NULL;p[0] = 1;return;
}

root@www:~# ./tt
Signal Error! Signal is 11
cnt:0 Function called by 00000000
cnt:96 Function called by 00000000
cnt:97 Function called by 000087c7
cnt:98 Function called by 000087a5
cnt:99 Function called by 0000877d

00008770 <signal_bus_err>:8770:    b580        push    {r7, lr}8772:   b082        sub sp, #88774: af00        add r7, sp, #08776: b500        push    {lr}8778:   f7ff ff04   bl  8584 <__gnu_mcount_nc>877c:   6078        str r0, [r7, #4]877e:   6879        ldr r1, [r7, #4]8780:   f648 00bc   movw    r0, #35004  ; 0x88bc8784:   f2c0 0000   movt    r0, #08788: f7ff ee18   blx 83bc <_init+0x20>878c:   2000        movs    r0, #0878e: f7ff ff43   bl  8618 <mcount_show>8792:   3708        adds    r7, #88794: 46bd        mov sp, r78796: bd80        pop {r7, pc}00008798 <fun>:8798:  b480        push    {r7}879a:   b083        sub sp, #12879c:    af00        add r7, sp, #0879e: b500        push    {lr}87a0:   f7ff fef0   bl  8584 <__gnu_mcount_nc>87a4:   2300        movs    r3, #087a6: 607b        str r3, [r7, #4]87a8:   687b        ldr r3, [r7, #4]87aa:   2201        movs    r2, #187ac: 601a        str r2, [r3, #0]87ae:   bf00        nop87b0:    370c        adds    r7, #1287b2:    46bd        mov sp, r787b4: f85d 7b04   ldr.w   r7, [sp], #487b8:   4770        bx  lr87ba: bf00        nop000087bc <main>:87bc:  b580        push    {r7, lr}87be:   af00        add r7, sp, #087c0: b500        push    {lr}87c2:   f7ff fedf   bl  8584 <__gnu_mcount_nc>87c6:   2100        movs    r1, #087c8: 2001        movs    r0, #187ca: f7ff ff97   bl  86fc <mcount_init>87ce:   f248 7171   movw    r1, #34673  ; 0x877187d2:   f2c0 0100   movt    r1, #087d6: 200b        movs    r0, #1187d8:    f7ff edfc   blx 83d4 <_init+0x38>87dc:   f248 7171   movw    r1, #34673  ; 0x877187e0:   f2c0 0100   movt    r1, #087e4: 2008        movs    r0, #887e6: f7ff edf6   blx 83d4 <_init+0x38>87ea:   f248 7171   movw    r1, #34673  ; 0x877187ee:   f2c0 0100   movt    r1, #087f2: 2004        movs    r0, #487f4: f7ff edee   blx 83d4 <_init+0x38>87f8:   f7ff ffce   bl  8798 <fun>87fc:   bd80        pop {r7, pc}87fe:   bf00        nop

浮点运算异常

void fun()
{int a = 10;int b = 0;int c = a/b;return;
}

root@www:~# ./tt
Signal Error! Signal is 8
cnt:0 Function called by 00000000
cnt:96 Function called by 00000000
cnt:97 Function called by 000087fb
cnt:98 Function called by 000087d5
cnt:99 Function called by 000087ad

000087a0 <signal_bus_err>:87a0:    b580        push    {r7, lr}87a2:   b082        sub sp, #887a4: af00        add r7, sp, #087a6: b500        push    {lr}87a8:   f7ff ff04   bl  85b4 <__gnu_mcount_nc>87ac:   6078        str r0, [r7, #4]87ae:   6879        ldr r1, [r7, #4]87b0:   f648 30b4   movw    r0, #35764  ; 0x8bb487b4:   f2c0 0000   movt    r0, #087b8: f7ff ee18   blx 83ec <_init+0x2c>87bc:   2000        movs    r0, #087be: f7ff ff43   bl  8648 <mcount_show>87c2:   3708        adds    r7, #887c4: 46bd        mov sp, r787c6: bd80        pop {r7, pc}000087c8 <fun>:87c8:  b580        push    {r7, lr}87ca:   b084        sub sp, #1687cc:    af00        add r7, sp, #087ce: b500        push    {lr}87d0:   f7ff fef0   bl  85b4 <__gnu_mcount_nc>87d4:   230a        movs    r3, #1087d6:    60fb        str r3, [r7, #12]87d8:  2300        movs    r3, #087da: 60bb        str r3, [r7, #8]87dc:   68b9        ldr r1, [r7, #8]87de:   68f8        ldr r0, [r7, #12]87e0:  f000 f82a   bl  8838 <__aeabi_idiv>87e4:  4603        mov r3, r087e6: 607b        str r3, [r7, #4]87e8:   bf00        nop87ea:    3710        adds    r7, #1687ec:    46bd        mov sp, r787ee: bd80        pop {r7, pc}000087f0 <main>:87f0: b580        push    {r7, lr}87f2:   af00        add r7, sp, #087f4: b500        push    {lr}87f6:   f7ff fedd   bl  85b4 <__gnu_mcount_nc>87fa:   2100        movs    r1, #087fc: 2001        movs    r0, #187fe: f7ff ff95   bl  872c <mcount_init>8802:   f248 71a1   movw    r1, #34721  ; 0x87a18806:   f2c0 0100   movt    r1, #0880a: 200b        movs    r0, #11880c:    f7ff edfa   blx 8404 <_init+0x44>8810:   f248 71a1   movw    r1, #34721  ; 0x87a18814:   f2c0 0100   movt    r1, #08818: 2008        movs    r0, #8881a: f7ff edf4   blx 8404 <_init+0x44>881e:   f248 71a1   movw    r1, #34721  ; 0x87a18822:   f2c0 0100   movt    r1, #08826: 2004        movs    r0, #48828: f7ff edec   blx 8404 <_init+0x44>882c:   f7ff ffcc   bl  87c8 <fun>8830:   bd80        pop {r7, pc}8832:   bf00        nop8834:    0000        movs    r0, r0...

调试

反汇编参考：

Linux反汇编根据程序崩溃堆栈信息定位问题1_王二车的博客-CSDN博客

Linux反汇编根据程序崩溃堆栈信息定位问题2_王二车的博客-CSDN博客

Linux pg打桩(1)单线程相关推荐

linux程序打桩,一文搞懂linux的库打桩
Linux下的链接器支持一个强大的库打桩(library interpositioning),允许你阻拦对系统标准库中某个目标函数的调用,取而代之执行自己的包装函数.它可以给我们带来两个好处,一是通过 ...
Linux 库打桩机制
库打桩机制 Linux 链接器截获对共享库函数调用,转而执行自己的代码. 创建一个包装函数,对库函数进行包装(装饰器模式).利用打桩机制欺骗系统去调用包装函数. 编译时打桩 // malloc.c / ...
linux pg启动日志查看,pg日志分析
pg 日志支持多种格式,一般的平面文本还有csv 格式在postgresql.conf 里把日志格式设为 csvlog 重新加载配置文件就可以了. 把csv 导入到数据库里分析,可以充分利用sq ...
Linux pg数据库导出数据,linux下 postgres实现导出和导入
用postgres 的pg_dump可以实现从从postgres数据库中导出数据. [1]只导出所有对象的数据库结构 C:\>pg_dump -f DDDDDD.sql -i -C -E UTF ...
乘风破浪、厚积薄发国产服务器软件: LinWin Http Server
国产服务器一直存在着被国外 nginx.apache.tomcat 等垄断的局面,然而这使得在推进操作系统的国产化上是一个不小的阻碍.在国产操作系统成为趋势的背景下,也迫切的需要一款自主的国产服务器软 ...
nginx详细文档 – 安装配置，深入源码，模块编写，编译器参数，系统函数
nginx文档吴东 April 28, 2009 Contents 1前言 5 2基本配置 7 2.1安装------- 7 2.2配置说明------. 10 2.3启动和控制------ 25 ...
unixbench分析_UnixBench,Bench,SuperBench 和 Zbench 四种常用云服务器综合性能测评脚本工具的对比分析以及使用教程...
君哥今天写了一篇不用脚本进行云服务器配置真伪鉴定,网络性能测评的文章,有童鞋询问有没有更为简单高效的测试方法呢?当然有.这篇文章以4核8G5M的阿里云服务器为例,分别采用 UnixBench. Ben ...
dxc 1.0 多线程详解
进程几乎所有的操作系统都支持进程的概念,所有运行中的任务通常对应一个进程(Process).当一个程序进入内存运行时,即变成一个进程.进程是处于运行过程中的程序,并且具有一定的独立功能,进程是系统进 ...
Python | paramiko的概念及其使用
本文主要介绍 paramiko 的概念及其使用 1' 2' 3' 4. 本文环境 Centos 7.9, Python 3.7, Paramiko 2.7.2. Last Updated: 2022 ...

Linux pg打桩(1)单线程

代码

非法内存

调试

Linux pg打桩(1)单线程相关推荐

最新文章

热门文章