cubemx 堆栈配置

转载

mob64ca140fd7c1 2024-09-23 15:07:54

文章标签 cubemx 堆栈配置 c++ objdump 汇编堆栈 文章分类 机器学习人工智能

使用objdump分析core堆栈

文章目录

使用objdump分析core堆栈
普通程序的core分析

源代码
执行程序
使用objdump分析

core在so里面的objdump分析

源代码
运行程序
objdump

使用addr2line定位问题的行数
总结

使用c++编程的同学，经常会遇到诸如内存越界、重复释放等内存问题，大家比较习惯的追查这类问题的方式是，打开core文件的limit，生成core文件，用gdb进行分析；
但是，在实际的生产环境中。由于程序本省占用内存非常大，比如搜索的索引服务，进行core的dump不太现实，所以一般采用，在程序中捕获信号，之后打印进程的堆栈信息，再进行追查。
下面本文，就按照这种方式进行追查，首先，分析没有so的程序如何使用objdump与汇编进行分析程序的问题所在；接着分析有so的程序，如何使用objdump进行分析，希望对大家能有所帮助。

普通程序的core分析

源代码

#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>
#include <execinfo.h>

static void print_stack_fs(int sig, FILE * output)
{
    fprintf(output, "--------------------------------------\n");

	char pTime[256];
	//getSafeNow(pTime, 256);
    fprintf(output, "[%s] received signal=%d, thread_id=%ld\n",
		   	"now", sig, getpid());

    void *array[128]; // 128 stacks at most
    size_t size = backtrace(array, sizeof(array) / sizeof(array[0]));
    if (size > 0 && size < 128) {
        char ** stackLog = backtrace_symbols(array, size);
        if(stackLog) {
            for (size_t i = 0; i < size; i++) {
                fprintf(output,"%s\n", stackLog[i]);
            }
            fflush(output);
            free(stackLog);
        }
    }
}

static void sig_handler(int signo)
{
	if (signo == SIGSEGV ||
        signo == SIGBUS  ||
        signo == SIGABRT ||
        signo == SIGFPE) {

        print_stack_fs(signo, stderr);

		exit(-1);
	}
	else if (signo == SIGTERM || signo == SIGINT) {
		exit(-1);
    }
}

static void sig_register()
{
    struct sigaction sigac;
    sigemptyset(&sigac.sa_mask);
    sigac.sa_handler = sig_handler;
    sigac.sa_flags = 0;

    sigaction(SIGTERM, &sigac, 0);
    sigaction(SIGINT , &sigac, 0);
    sigaction(SIGQUIT, &sigac, 0);
    sigaction(SIGPIPE, &sigac, 0);
    sigaction(SIGBUS , &sigac, 0);
    sigaction(SIGABRT, &sigac, 0);
    sigaction(SIGFPE , &sigac, 0);
    sigaction(SIGSEGV, &sigac, 0);
}



int main(int argc, char *argv[])
{
sig_register();
    int a = 10, b = -2, c = 100;
    char * pstr = 0x00;
    int d = 100;
    *pstr = 0x00;
    return 0;
}

执行程序

关键地址：0x400add，指向出错的代码的具体的虚拟空间地址

[now] received signal=11, thread_id=1852
./a.out() [0x4008ab]
./a.out() [0x400985]
/lib64/libc.so.6(+0x362f0) [0x7fbc41a3d2f0]
./a.out() [0x400add]
/lib64/libc.so.6(__libc_start_main+0xf5) [0x7fbc41a29445]
./a.out() [0x400769]

使用objdump分析

objdump -d a.out ，分析-0x18(%rbp)的地址是变量pstr的地址，之后将pstr的放置到寄存器rax赋值，之后没有申请内存的空指针进行赋值出core，具体请看下面的汇编代码

321 0000000000400aa1 <main>:
322   400aa1:   55                      push   %rbp
323   400aa2:   48 89 e5                mov    %rsp,%rbp
324   400aa5:   48 83 ec 30             sub    $0x30,%rsp
325   400aa9:   89 7d dc                mov    %edi,-0x24(%rbp)
326   400aac:   48 89 75 d0             mov    %rsi,-0x30(%rbp)
327   400ab0:   e8 f2 fe ff ff          callq  4009a7 <_ZL12sig_registerv>
328   400ab5:   c7 45 fc 0a 00 00 00    movl   $0xa,-0x4(%rbp)					// 变量a
329   400abc:   c7 45 f8 fe ff ff ff    movl   $0xfffffffe,-0x8(%rbp)					// 变量b
330   400ac3:   c7 45 f4 64 00 00 00    movl   $0x64,-0xc(%rbp)				// 变量c
331   400aca:   48 c7 45 e8 00 00 00    movq   $0x0,-0x18(%rbp)				// 变量 pstr
332   400ad1:   00
333   400ad2:   c7 45 e4 64 00 00 00    movl   $0x64,-0x1c(%rbp)			// 变量d
334   400ad9:   48 8b 45 e8             mov    -0x18(%rbp),%rax					// 将变量pstr放到rax寄存器
335   400add:   c6 00 00                movb   $0x0,(%rax)								// 对pstr赋值，也就是对空指针赋值，找到问题
336   400ae0:   b8 00 00 00 00          mov    $0x0,%eax
337   400ae5:   c9                      leaveq
338   400ae6:   c3                      retq
339   400ae7:   66 0f 1f 84 00 00 00    nopw   0x0(%rax,%rax,1)

core在so里面的objdump分析

源代码

max.h

#ifndef __MAX_H__
#define __MAX_H__

int max(int n1, int n2, int n3);

#endif

max.cpp

#include "max.h"

int max(int n1, int n2, int n3)
{
    int max_num = n1;
    max_num = max_num < n2? n2: max_num;
    max_num = max_num < n3? n3: max_num;
    char * pstr = 0x00;
    *pstr = 0x00;
    return max_num;
}

test.cpp

#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <string.h>
#include <sys/types.h>
#include <unistd.h>
#include <execinfo.h>
#include "max.h"

static void print_stack_fs(int sig, FILE * output)
{
    fprintf(output, "--------------------------------------\n");

	char pTime[256];
	//getSafeNow(pTime, 256);
    fprintf(output, "[%s] received signal=%d, thread_id=%ld\n",
		   	"now", sig, getpid());

    void *array[128]; // 128 stacks at most
    size_t size = backtrace(array, sizeof(array) / sizeof(array[0]));
    if (size > 0 && size < 128) {
        char ** stackLog = backtrace_symbols(array, size);
        if(stackLog) {
            for (size_t i = 0; i < size; i++) {
                fprintf(output,"%s\n", stackLog[i]);
            }
            fflush(output);
            free(stackLog);
        }
    }
}

static void sig_handler(int signo)
{
	if (signo == SIGSEGV ||
        signo == SIGBUS  ||
        signo == SIGABRT ||
        signo == SIGFPE) {

        print_stack_fs(signo, stderr);

		exit(-1);
	}
	else if (signo == SIGTERM || signo == SIGINT) {
		exit(-1);
    }
}

static void sig_register()
{
    struct sigaction sigac;
    sigemptyset(&sigac.sa_mask);
    sigac.sa_handler = sig_handler;
    sigac.sa_flags = 0;

    sigaction(SIGTERM, &sigac, 0);
    sigaction(SIGINT , &sigac, 0);
    sigaction(SIGQUIT, &sigac, 0);
    sigaction(SIGPIPE, &sigac, 0);
    sigaction(SIGBUS , &sigac, 0);
    sigaction(SIGABRT, &sigac, 0);
    sigaction(SIGFPE , &sigac, 0);
    sigaction(SIGSEGV, &sigac, 0);
}



int main(int argc, char *argv[])
{
	sig_register();
    int a = 10, b = -2, c = 100;
    int d = 100;
    printf("max among 10, -2 and 100 is %d.\n", max(a, b, c));
    return 0;
}

运行程序

关键地址：./libmax.so(_Z3maxiii+0x45) [0x7fb914d6868a]

[now] received signal=11, thread_id=1893
./a.out() [0x4009fb]
./a.out() [0x400ad5]
/lib64/libc.so.6(+0x362f0) [0x7fb9141b12f0]
./libmax.so(_Z3maxiii+0x45) [0x7fb914d6868a]
./a.out() [0x400c33]
/lib64/libc.so.6(__libc_start_main+0xf5) [0x7fb91419d445]
./a.out() [0x4008b9]

objdump

针对so进行反编译，运行 objdump -d libmax.so，然后找搭配_Z3maxiii，地址是645，然后+上0x45，得到地址 68A
汇编代码：movq $0x0,-0x10(%rbp) 定义pstr，68A的地址同样是对未申请内存的地址进行赋值出错。

106 0000000000000645 <_Z3maxiii>:
107  645:   55                      push   %rbp
108  646:   48 89 e5                mov    %rsp,%rbp
109  649:   89 7d ec                mov    %edi,-0x14(%rbp)				// 参数1
110  64c:   89 75 e8                mov    %esi,-0x18(%rbp)				// 参数2
111  64f:   89 55 e4                mov    %edx,-0x1c(%rbp)				// 参数3
112  652:   8b 45 ec                mov    -0x14(%rbp),%eax
113  655:   89 45 fc                mov    %eax,-0x4(%rbp)
114  658:   8b 45 fc                mov    -0x4(%rbp),%eax
115  65b:   3b 45 e8                cmp    -0x18(%rbp),%eax
116  65e:   7d 05                   jge    665 <_Z3maxiii+0x20>
117  660:   8b 45 e8                mov    -0x18(%rbp),%eax
118  663:   eb 03                   jmp    668 <_Z3maxiii+0x23>
119  665:   8b 45 fc                mov    -0x4(%rbp),%eax
120  668:   89 45 fc                mov    %eax,-0x4(%rbp)
121  66b:   8b 45 fc                mov    -0x4(%rbp),%eax
122  66e:   3b 45 e4                cmp    -0x1c(%rbp),%eax
123  671:   7d 05                   jge    678 <_Z3maxiii+0x33>
124  673:   8b 45 e4                mov    -0x1c(%rbp),%eax
125  676:   eb 03                   jmp    67b <_Z3maxiii+0x36>
126  678:   8b 45 fc                mov    -0x4(%rbp),%eax
127  67b:   89 45 fc                mov    %eax,-0x4(%rbp)
128  67e:   48 c7 45 f0 00 00 00    movq   $0x0,-0x10(%rbp)				// pstr
129  685:   00
130  686:   48 8b 45 f0             mov    -0x10(%rbp),%rax
131  68a:   c6 00 00                movb   $0x0,(%rax)			// 对pstr赋值0，这个就是问题所在了
132  68d:   8b 45 fc                mov    -0x4(%rbp),%eax
133  690:   5d                      pop    %rbp

使用addr2line定位问题的行数

[dubaokun@localhost so]$ addr2line -e libmax.so -ifC 68a
max(int, int, int)
/home/dubaokun/github/code/engine_code/compile/objdump/so/max.cpp:9 (discriminator 3)