iOS 如何调试第三方统计到的崩溃报告

有一点要记住，不要指望着复现bug靠断点调试，有些bug，例如多线程引起的，很难复现

---

核心命令

dwarfdump --lookup 0x0007434d  -arch arm7 uau1.3.0.app.dSYM
1

---

dSYM文件

XCode中 
Window->Organizer->选择提交到App Store的Archies->右键，showin finder 
右键－>显示包内容，在dsym文件件里的就是符号表文件。这里包含着debug信息 

或者window->Orgainzer，直接download dsym

---

崩溃报告

以我收到的这个为例

-[NSNull length]: unrecognized selector sent to instance 0x198705e70
(null)
(
    0   CoreFoundation                      0x00000001862442f4 <redacted> + 160
    1   libobjc.A.dylib                     0x0000000197a680e4 objc_exception_throw + 60
    2   CoreFoundation                      0x000000018624b3a4 <redacted> + 0
    3   CoreFoundation                      0x0000000186248154 <redacted> + 928
    4   CoreFoundation                      0x000000018614accc _CF_forwarding_prep_0 + 92
    5   Foundation                          0x00000001871b2d98 <redacted> + 212
    6   Foundation                          0x00000001871b2c88 <redacted> + 200
    7   Foundation                          0x00000001871b3014 <redacted> + 52
    8   ?????????                           0x00000001000bf900 ????????? + 358656
    9   ?????????                           0x00000001000bf748 ????????? + 358216
    10  libdispatch.dylib                   0x00000001980b9994 <redacted> + 24
    11  libdispatch.dylib                   0x00000001980b9954 <redacted> + 16
    12  libdispatch.dylib                   0x00000001980be20c _dispatch_main_queue_callback_4CF + 1608
    13  CoreFoundation                      0x00000001861fb7f8 <redacted> + 12
    14  CoreFoundation                      0x00000001861f98a0 <redacted> + 1492
    15  CoreFoundation                      0x00000001861252d4 CFRunLoopRunSpecific + 396
    16  GraphicsServices                    0x000000018f93b6fc GSEventRunModal + 168
    17  UIKit                               0x000000018aceafac UIApplicationMain + 1488
    18  ?????????                           0x000000010007528c ????????? + 53900
    19  libdyld.dylib                       0x00000001980e6a08 <redacted> + 4
)

dSYM UUID: 916F22F5-F3B1-3709-BB7E-5B11267B5D1F
CPU Type: arm64
Slide Address: 0x0000000100000000
Binary Image: ???
Base Address: 0x0000000100068000
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

第一部分，看看UUID

916F22F5-F3B1-3709-BB7E-5B11267B5D1F
1

使用命令查看dsym文件的uuid

huangwenchendeMacBook-Pro:Dsym调试 huangwenchen$ dwarfdump --uuid uau1.3.0.app.dSYM/
UUID: EC087835-FA55-36F2-B4D9-430BF6C2BA69 (armv7) uau1.3.0.app.dSYM/Contents/Resources/DWARF/Name
UUID: 916F22F5-F3B1-3709-BB7E-5B11267B5D1F (arm64) uau1.3.0.app.dSYM/Contents/Resources/DWARF/Name
1
2
3

对照可以看到，uuid是一致的，那么这个dsym文件可用

---

找到?????部分

之所以要找到这部分，是因为crash log中call tree没办法识别的部分，往往就是自己代码的部分。

我的Crash Log中，分别是这三行

    8   ?????????                           0x00000001000bf900 ????????? + 358656
    9   ?????????                           0x00000001000bf748 ????????? + 358216
    18  ?????????                           0x000000010007528c ????????? + 53900
1
2
3
4

然后，用命令定位到代码crash处

huangwenchendeMacBook-Pro:Dsym调试 huangwenchen$ dwarfdump --lookup 0x000000010007528c  -arch arm64 uau1.3.0.app.dSYM
1
2

看到Log

Looking up address: 0x000000010007528c in .debug_info... found!

0x000ada5c: Compile Unit: length = 0x00001139  version = 0x0002  abbr_offset = 0x00000000  addr_size = 0x08  (next CU at 0x000aeb99)

0x000ada67: TAG_compile_unit [99] *
             AT_producer( "Apple LLVM version 7.0.0 (clang-700.1.76)" )
             AT_language( DW_LANG_ObjC )
             AT_name( "/Users/huangwenchen/Desktop/nativeios/StampApp/StampApp/UAUOneStampMarketInfo.m" )
             AT_stmt_list( 0x0003647f )
             AT_comp_dir( "/Users/huangwenchen/Desktop/nativeios/StampApp" )
             AT_APPLE_optimized( 0x01 )
             AT_APPLE_major_runtime_vers( 0x02 )
             AT_low_pc( 0x0000000100074674 )
             AT_high_pc( 0x000000010007597c )

0x000adf2d:     TAG_subprogram [106] *
                 AT_low_pc( 0x0000000100075278 )
                 AT_high_pc( 0x0000000100075298 )
                 AT_frame_base( reg31 )
                 AT_object_pointer( {0x000adf50} )
                 AT_name( "-[UAUOneStampMarketInfo insitutionName]" )
                 AT_decl_file( "/Users/huangwenchen/Desktop/nativeios/StampApp/StampApp/UAUOneStampMarketInfo.m" )
                 AT_decl_line( 122 )
                 AT_prototyped( 0x01 )
                 AT_type( {0x000adcd1} ( NSString* ) )
                 AT_APPLE_optimized( 0x01 )
Line table dir : '/Users/huangwenchen/Desktop/nativeios/StampApp/StampApp'
Line table file: 'UAUOneStampMarketInfo.m' line 123, column 12 with start address 0x0000000100075288

Looking up address: 0x000000010007528c in .debug_frame... not found.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

其中，这两行

  AT_name( "-[UAUOneStampMarketInfo insitutionName]" )
                 AT_decl_file( "/Users/huangwenchen/Desktop/nativeios/StampApp/StampApp/UAUOneStampMarketInfo.m" )
1
2

基本上定定位到了UAUOneStampMarketInfo.m，中的insitutionName方法。 
再结合

[NSNull length]: 
这个错误，也就定位到了是因为后台返回了NSNull对象，自己没做检查

---

这个命令还有很多用法

hangwenchendeMacBook-Pro:Dsym调试 huangwenchen$ dwarfdump --help

NAME
    dwarfdump -- dump DWARF debug information.

SYNOPSIS
    dwarfdump [options] file1 file2 ...

DESCRIPTION
    For each operand that names a mach-o or 32 bit ELF file, dwarfdump
    disassembles the DWARF data found within the file. Only the .debug_info
    section is disassembled unless one of the --debug-XXXX or --all options
    are specified.

    The following options are available:

    -a, --all
        Dump disassembly of all DWARF sections -- by default only the
        .debug_info section is disassembled, or individual sections can be
        specified by using the --debug-XXXX options.

    --arch=ARCH
        Dump DWARF debug information for the specified CPU architecture.
        Architectures may be specified by name or by number.  This option
        can be specified multiple times, once for each desired
        architecture. All architectures will be disassembled by default.

    -c, --show-children
        Show a DIE's children when using the --debug-info=OFFSET, --find,
        and --name options.

    --eh-frame[=SECTION]
        Dump exception handling frame information from the optional SECTION
        parameter. The __eh_frame section will be dumped by default.

    -e, --english
        Print dwarf tags and attributes in a more readable format instead
        of using the DWARF TAG_ and AT_ definitions.

    --file-stats[=size]
        Show file composition statistics for any input files. Each file's
        contents are analyzed and broken down into byte counts for the
        following categories: symbol table, string table, text and code,
        DWARF debug information, STABS debug information, and other. When
        multiple files are specified, byte count totals for each category
        will be displayed at the end of the table.  Specify the optional
        'size' argument to show all byte count results using unit suffixes:
        Byte, Kilobyte, Megabyte, Gigabyte, Terabyte and Petabyte. This
        option can be useful in tracking the size and makeup of mach-o
        binary files, and also allows easy comparison between DWARF and
        STABS built binaries and related object files.

    -f PATTERN, --find=PATTERN
        Search for the exact text PATTERN in the .debug_pubnames section
        and print the matching debug information entries. Use the --regex
        option to have PATTERN become a regular expression for more
        flexible pattern matching.

        When there is no .debug_pubnames section or the name of the DIE you
        are looking for is not found in the .debug_pubnames section, try
        using the slower but more complete --name option.

    -F, --show-form
        Show DWARF form types after the DWARF attribute types.

    -h, -?, --help
        Show help and usage for this command.

    -i, --ignore-case
        Ignore case distinctions in when finding by name using strings or
        regular expressions.

    -n PATTERN, --name=PATTERN
        Find and print all DIE entries whose name (DW_AT_name attribute)
        matches the exact text in PATTERN. Use the --regex option to
        have PATTERN become a regular expression for more flexible pattern
        matching.

    --lookup=ADDRESS
        Lookup ADDRESS in the debug information and print out any available
        file, function, block and line table details.

    -o PATH, --out-file=PATH
        Redirect output to a file specified by PATH.

    -p, --show-parents
        Show a DIE's parents when using the --debug-info=OFFSET, --find,
        and --name options.

    -r N, --recurse-depth=N
        Only recurse to a child depth of N when displaying the DWARF
        information.

    -u, --uuid
        Show the UUID for each architecture.

    -x, --regex
        Treat any PATTERN strings as regular expressions when searching
        instead of just as an exact string match.

    -v, --verbose
        Display verbose information when dumping. This can help to debug
        DWARF issues.

    --verify
        Verify the structure of the DWARF information by verifying the
        compile unit chains, die relationships graph, and address ranges.

    --version
        Display the current version and build date of the dwarfdump binary.

    --debug-abbrev
    --debug-aranges
    --debug-frame[=OFFSET]
    --debug-info[=OFFSET]
    --debug-inlined
    --debug-line[=OFFSET]
    --debug-macinfo[=OFFSET]
    --debug-pubnames[=PATTERN]
    --debug-pubtypes[=PATTERN]
    --debug-str
    --apple-names[=PATTERN]
    --apple-types[=PATTERN]
    --apple-exttypes[=PATTERN]
    --apple-namespaces[=PATTERN]
    --apple-objc[=PATTERN]
        Dump the specified DWARF section by name. Only the .debug_info
        section is disassembled by default. Some entries support adding a
        '=OFFSET' as a way to provide an optional offset of the exact entry
        to dump within the respective section. When an OFFSET is provided,
        only the entry at that offset will be dumped, else the entire
        section will be dumped. Some options support an optional '=PATTERN'
        parameter that will search the section for an entry with a matching
        name. Children of items at OFFSETs can be dumped by also using the
        --show-children option where applicable.