如何分析tombstone文件

68 阅读 0 评论 45 点赞

我是靠谱客的博主碧蓝樱桃，最近开发中收集的这篇文章主要介绍如何分析tombstone文件，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

tombstone一般是由Dalvik错误、状态监视调试器、C层代码以及libc的一些问题导致的。当系统发生tombstone的时候，kernel首先会上报一个严重的警告信号（signal）,上层接收到之后，进程的调试工具会把进程中当时的调用栈现场保存起来，并在系统创建了data/tombstones目录后把异常时的进程信息写在此目录里面，开发者需要通过调用栈来分析整个调用流程来找出出问题的点。"tombstone文件位于手机/data/tombstones/ 目录下，诸如/tombstone/tombstone_00，/tombstone/tombstone_01，/tombstone/tombstone_02此类。

如以下tombstone文件:

*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Build fingerprint: 'TCL/idol347/idol347:5.0.2/LRX22G/2682:userdebug/release-keys'
Revision: '0'
ABI: 'arm'
pid: 8115, tid: 8162, name: QSTileHost  >>> com.android.systemui <<<
signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0xa55ca998
    r0 a55ca998  r1 a55ca99e  r2 00000054  r3 12b28941
    r4 000000c8  r5 b6fcede4  r6 00000001  r7 b6fcede4
    r8 136a68e0  r9 b8c8fd38  sl 00000001  fp 13255c60
    ip a55cbff0  sp a57e59d8  lr a55ca6e7  pc b6f880b2  cpsr 600f0030
    d0  72426863726f5474  d1  7373656e74686769
    d2  0000005c0000003d  d3  b90512500000003d
    d4  0063006900760065  d5  006c006f00500065
    d6  004d007900001915  d7  45b300003f800000
    d8  0000000000000000  d9  0000000000000000
    d10 0000000000000000  d11 0000000000000000
    d12 0000000000000000  d13 0000000000000000
    d14 0000000000000000  d15 0000000000000000
    d16 0000000000000000  d17 0000272d00000000
    d18 00000000ffffffff  d19 0000000100000000
    d20 0000000000000000  d21 0000000000a1999a
    d22 0000000000000000  d23 0000000000000000
    d24 3f6293aba995d593  d25 be63c064abf00000
    d26 0000000001433334  d27 0000000000a1999a
    d28 bfa87a4b027e9b95  d29 4000000000000000
    d30 bfa8492528c8cabf  d31 bfa84923ecc28000
    scr 20000011

backtrace:
    #00 pc 000100b2  /system/lib/libc.so (strcpy+5)
    #01 pc 000006e3  /system/lib/libtorch.so
    #02 pc 00000373  <unknown>

stack:
         a57e5998  00000043  
         a57e599c  00000043  
         a57e59a0  00000000  
         a57e59a4  00550000  
         a57e59a8  b5373430  /system/lib/libart.so
         a57e59ac  b8c90401  [heap]
         a57e59b0  a6f9ab59  /data/dalvik-cache/arm/system@priv-app@SystemUI@SystemUI.apk@classes.dex
         a57e59b4  00000002  
         a57e59b8  a57e5a38  [stack:8162]
         a57e59bc  a57e5a38  [stack:8162]
         a57e59c0  a57e5a70  [stack:8162]
         a57e59c4  12b28941  
         a57e59c8  00000000  
         a57e59cc  000000c8  
         a57e59d0  b6fcede4  
         a57e59d4  00000001  
    #00  a57e59d8  a55ca998  /system/lib/libtorch.so
         ........  ........
    #01  a57e59d8  a55ca998  /system/lib/libtorch.so
         a57e59dc  000000c8  
         a57e59e0  b6fcede4  
         a57e59e4  a55ca6e7  /system/lib/libtorch.so

通过查看backtrace，然后运用addr2line工具依次查看对应的带symbol的库文件。

一般情况下问题大多出现在第三方引入的库。

addr2line位于项目prebuilts目录下：

 
/prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.8/bin/arm-linux-androideabi-addr2line

symbol库位于项目out目录下：

 
   /out/target/product/idol347/symbols/system/lib/libtorch.so

1.在终端执行： addr2line -e 共享库共享库地址 -Cfip

./prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.8/bin/arm-linux-androideabi-addr2line -e out/target/product/idol347/symbols /system/lib/libtorch.so 000006e3 -Cfip

 
   user@aclgcl-ubnt:/data1/AJ9_3$ ./prebuilts/gcc/linux-x86/arm/arm-linux-androideabi-4.8/bin/arm-linux-androideabi-addr2line -e out/target/product/idol347/symbols
/system/lib/libtorch.so 000006e3 -Cfip 

strcpy at /data1/AJ9_3/bionic/libc/include/string.h:119 (inlined by) SetTorchBrightness at /data1/AJ9_3/frameworks/base/packages/SystemUI/jni/torchnative.cpp:157

2.然后查看/data1/AJ9_3/frameworks/base/packages/SystemUI/jni/torchnative.cpp:157 文件

151 
152 static jint SetTorchBrightness(JNIEnv *env, jobject thiz,jint brightness) {
153   TCTALOGE("==========SetTorchBrightness");
154   int result;
155 
156         char *ptr = "test";
157         strcpy(ptr, "TEST");
158 
159   /*[FEATURE]-MOD-BEGIN by TCTNB.(Mingchun.Li), 2013/01/18,FR-386117,set the different levels of brightness.*/
160   if (brightness == 1){
161       brightness = LEVEL_51NIT;
162   } else if (brightness == 2){
163       brightness = LEVEL_128NIT;
164   } else if (brightness == 3){
165       brightness = LEVEL_204NIT;
166   } else if (brightness == 0){
167       brightness = LEVEL_0NIT;
168   }
169   /*[FEATURE]-MOD-END by TCTNB.(mingchun.Li),2013/01/18,FR-386117.*/
170 
171   //[BUGFIX] Mod-BEGIN-by-TSCD.jin.dong 01/14/2015 PR-890978
172   result = write_int(TORCH_FILE,brightness);
173   //TCTALOGE("+++++get_torch_path()= %s",get_torch_path());
174   //result = write_int(get_torch_path(),brightness);
175   //[BUGFIX] Mod-END-by-TSCD.jin.dong 01/14/2015 PR-890978
176   return result;
177 }
178

很容易发现问题就出现在torchnative.cpp SetTorchBrightness()中strcpy（）函数，不能向ptr进行字符串拷贝。