android上使用systemtap来调试native

对linux kernel的要求

因为是用来调试native，所以kernel必须支持uprobe，kernel版本做好在4.9以后，如果kernel版本没有支持uprobe
可以自己把相关代码cherry-pick过去。

对所要调试的应用程序要求

需要有带符号表的可执行程序或者动态库
一般在使用在out/target/product/xxx/symbols路径下的可执行程序或者动态库

下面举例来说明如何使用

global malloc_stack, free_stack
function filter_p()
  {
    if (pid() == target()) return 0; /*可以过滤需要调试的进程 */
    return 1;
  }
probe process("/system/lib64/libc.so").function("malloc")  //定义probe，需要trace的的函数 libc里的malloc
{
    if (filter_p()) next; //如果不是trace的进程直接退出
	//print_usyms(ubacktrace());
	//sprint_usyms(ubacktrace());
	malloc_stack[$bytes, sprint_usyms(ubacktrace())]<<<1; //哈希表，key：bytes，back trace；val : 该bytes下，相同调用路径下出现的次数
	//printf("=================%d,%s, %d %d %s\n",pid(),execname(), $bytes,@count(malloc_stack[$bytes, ubacktrace()]),sprint_usyms(ubacktrace()));

}
probe process("/system/lib64/libc.so").function("free") 
{
    if (filter_p()) next;
	//print_usyms(ubacktrace());
	free_stack[sprint_usyms(ubacktrace())]<<<1;
	//printf("=================%d,%s, %d\n",pid(),execname(),@count(free_stack[ubacktrace()]));

}
probe timer.s(15), end //每个15秒打印一次，或者CTL+C打印结果
{
  printf("\n------------------malloc-------------------------------------\n\n")
  foreach ([size, stack] in malloc_stack-) { //按照递减的打印
    printf("size: %d, times %d\n%s\n", size, @count(malloc_stack[size, stack]), stack)
  }
  printf("\n-------------------free-------------------------------------\n\n")
  foreach ([stack] in free_stack-) {
    printf("times %d\n%s\n",  @count(free_stack[stack]), stack)
  }
  delete malloc_stack
  delete free_stack
}

在编译该脚本的时候，需要在/system/lib64/路径上有相应的带符号表的可执行文件，动态库
执行的时候目标板上也需要有带符号的可执行文件动态库

这次我替换的文件有
/system/bin/linker64
/system/lib64/libc.so
可以使用改脚本来查看memtester 进程分配释放内存情况
也可以在改脚本基础上修改一下用来debug内存泄漏情况

下面是执行结果

/data/bin/staprun -c “/data/memtester 500m” malloc.ko

------------------malloc-------------------------------------

size: 32, times 72
 0x7406c3fdc4 : malloc+0x0/0x18 [/system/lib64/libc.so]
 0x7406c4f1e8 : _Znwm+0x14/0x34 [/system/lib64/libc.so]
 0x7406c4d7c4 : _ZL21initialize_propertiesv+0x1f8/0x2a0 [/system/lib64/libc.so]
 0x7406c4d3f0 : __system_properties_init+0x108/0x2e4 [/system/lib64/libc.so]
 0x7406c4053c : _ZL14__libc_preinitv+0x28/0xa8 [/system/lib64/libc.so]
 0x7406e509a8 : __dl__ZN6soinfo10call_arrayEPKcPPFvvEmb+0x16c/0x240 [/system/bin/linker64]

size: 25, times 55
 0x7406c3fdc4 : malloc+0x0/0x18 [/system/lib64/libc.so]
 0x7406c8c74c : strndup+0x24/0x54 [/system/lib64/libc.so]
 0x7406c4e608 : _ZL17read_spec_entriesPciz+0x180/0x1ec [/system/lib64/libc.so]
 0x7406c4d660 : _ZL21initialize_propertiesv+0x94/0x2a0 [/system/lib64/libc.so]
 0x7406c4d3f0 : __system_properties_init+0x108/0x2e4 [/system/lib64/libc.so]
 0x7406c4053c : _ZL14__libc_preinitv+0x28/0xa8 [/system/lib64/libc.so]
 0x7406e509a8 : __dl__ZN6soinfo10call_arrayEPKcPPFvvEmb+0x16c/0x240 [/system/bin/linker64]

size: 32, times 34
 0x7406c3fdc4 : malloc+0x0/0x18 [/system/lib64/libc.so]
 0x7406c4f1e8 : _Znwm+0x14/0x34 [/system/lib64/libc.so]
 0x7406c4d738 : _ZL21initialize_propertiesv+0x16c/0x2a0 [/system/lib64/libc.so]
 0x7406c4d3f0 : __system_properties_init+0x108/0x2e4 [/system/lib64/libc.so]
 0x7406c4053c : _ZL14__libc_preinitv+0x28/0xa8 [/system/lib64/libc.so]
 0x7406e509a8 : __dl__ZN6soinfo10call_arrayEPKcPPFvvEmb+0x16c/0x240 [/system/bin/linker64]

size: 40, times 34
 0x7406c3fdc4 : malloc+0x0/0x18 [/system/lib64/libc.so]
 0x7406c4f1e8 : _Znwm+0x14/0x34 [/system/lib64/libc.so]
 0x7406c4d6c4 : _ZL21initialize_propertiesv+0xf8/0x2a0 [/system/lib64/libc.so]
 0x7406c4d3f0 : __system_properties_init+0x108/0x2e4 [/system/lib64/libc.so]
 0x7406c4053c : _ZL14__libc_preinitv+0x28/0xa8 [/system/lib64/libc.so]
 0x7406e509a8 : __dl__ZN6soinfo10call_arrayEPKcPPFvvEmb+0x16c/0x240 [/system/bin/linker64]

size: 26, times 18
 0x7406c3fdc4 : malloc+0x0/0x18 [/system/lib64/libc.so]
 0x7406c8c74c : strndup+0x24/0x54 [/system/lib64/libc.so]
 0x7406c4e608 : _ZL17read_spec_entriesPciz+0x180/0x1ec [/system/lib64/libc.so]
 0x7406c4d660 : _ZL21initialize_propertiesv+0x94/0x2a0 [/system/lib64/libc.so]
 0x7406c4d3f0 : __system_properties_init+0x108/0x2e4 [/system/lib64/libc.so]
 0x7406c4053c : _ZL14__libc_preinitv+0x28/0xa8 [/system/lib64/libc.so]
 0x7406e509a8 : __dl__ZN6soinfo10call_arrayEPKcPPFvvEmb+0x16c/0x240 [/system/bin/linker64]

size: 29, times 15
 0x7406c3fdc4 : malloc+0x0/0x18 [/system/lib64/libc.so]
 0x7406c8c74c : strndup+0x24/0x54 [/system/lib64/libc.so]
 0x7406c4e608 : _ZL17read_spec_entriesPciz+0x180/0x1ec [/system/lib64/libc.so]
 0x7406c4d660 : _ZL21initialize_propertiesv+0x94/0x2a0 [/system/lib64/libc.so]
 0x7406c4d3f0 : __system_properties_init+0x108/0x2e4 [/system/lib64/libc.so]
 0x7406c4053c : _ZL14__libc_preinitv+0x28/0xa8 [/system/lib64/libc.so]
 0x7406e509a8 : __dl__ZN6soinfo10call_arrayEPKcPPFvvEmb+0x16c/0x240 [/system/bin/linker64]

size: **524288000**, times 1 //**这个500m 就是开始执行memtester时申请的500m，下面就是调用路径**
 0x7406c3fdc4 : malloc+0x0/0x18 [/system/lib64/libc.so]
 0x5a473ca3d0 : main+0x41c/0x908 [/data/memtester]
 0x7406c40618 : __libc_init+0x5c/0x60 [/system/lib64/libc.so]
 0x5a473c9ee4 : _start+0x0/0x8 [/data/memtester]

size: 30, times 1
 0x7406c3fdc4 : malloc+0x0/0x18 [/system/lib64/libc.so]
 0x7406c8c6f4 : strdup+0x28/0x5c [/system/lib64/libc.so]
 0x7406c4d7d4 : _ZL21initialize_propertiesv+0x208/0x2a0 [/system/lib64/libc.so]
 0x7406c4d3f0 : __system_properties_init+0x108/0x2e4 [/system/lib64/libc.so]
 0x7406c4053c : _ZL14__libc_preinitv+0x28/0xa8 [/system/lib64/libc.so]
 0x7406e509a8 : __dl__ZN6soinfo10call_arrayEPKcPPFvvEmb+0x16c/0x240 [/system/bin/linker64]
-------------------free-------------------------------------

times 121
 0x7406c3fd94 : free+0x0/0x18 [/system/lib64/libc.so]
 0x7406c4d804 : _ZL21initialize_propertiesv+0x238/0x2a0 [/system/lib64/libc.so]
 0x7406c4d3f0 : __system_properties_init+0x108/0x2e4 [/system/lib64/libc.so]
 0x7406c4053c : _ZL14__libc_preinitv+0x28/0xa8 [/system/lib64/libc.so]
 0x7406e509a8 : __dl__ZN6soinfo10call_arrayEPKcPPFvvEmb+0x16c/0x240 [/system/bin/linker64]
 0x7406e4eb64 : __dl__ZN6soinfo17call_constructorsEv+0x90/0x1a0 [/system/bin/linker64]

times 121
 0x7406c3fd94 : free+0x0/0x18 [/system/lib64/libc.so]
 0x7406c4d7fc : _ZL21initialize_propertiesv+0x230/0x2a0 [/system/lib64/libc.so]
 0x7406c4d3f0 : __system_properties_init+0x108/0x2e4 [/system/lib64/libc.so]
 0x7406c4053c : _ZL14__libc_preinitv+0x28/0xa8 [/system/lib64/libc.so]
 0x7406e509a8 : __dl__ZN6soinfo10call_arrayEPKcPPFvvEmb+0x16c/0x240 [/system/bin/linker64]
 0x7406e4eb64 : __dl__ZN6soinfo17call_constructorsEv+0x90/0x1a0 [/system/bin/linker64]

times 16
 0x7406c3fd94 : free+0x0/0x18 [/system/lib64/libc.so]
 0x7406c82ce0 : __vfprintf+0x2b1c/0x2c74 [/system/lib64/libc.so]
 0x7406c80184 : vfprintf+0x64/0xa4 [/system/lib64/libc.so]
 0x7406c7f038 : printf+0x94/0xb4 [/system/lib64/libc.so]
 0x5a473caa0c : test_stuck_address+0x5c/0x210 [/data/memtester]
 0x5a473ca620 : main+0x66c/0x908 [/data/memtester]
 0x7406c40618 : __libc_init+0x5c/0x60 [/system/lib64/libc.so]
 0x5a473c9ee4 : _start+0x0/0x8 [/data/memtester]

times 16
 0x7406c3fd94 : free+0x0/0x18 [/system/lib64/libc.so]
 0x7406c82ce0 : __vfprintf+0x2b1c/0x2c74 [/system/lib64/libc.so]
 0x7406c80184 : vfprintf+0x64/0xa4 [/system/lib64/libc.so]
 0x7406c7f038 : printf+0x94/0xb4 [/system/lib64/libc.so]
 0x5a473caa1c : test_stuck_address+0x6c/0x210 [/data/memtester]
 0x5a473ca620 : main+0x66c/0x908 [/data/memtester]
 0x7406c40618 : __libc_init+0x5c/0x60 [/system/lib64/libc.so]
 0x5a473c9ee4 : _start+0x0/0x8 [/data/memtester]

times 16
 0x7406c3fd94 : free+0x0/0x18 [/system/lib64/libc.so]
 0x7406c82ce0 : __vfprintf+0x2b1c/0x2c74 [/system/lib64/libc.so]
 0x7406c80184 : vfprintf+0x64/0xa4 [/system/lib64/libc.so]
 0x7406c7f038 : printf+0x94/0xb4 [/system/lib64/libc.so]
 0x5a473caa64 : test_stuck_address+0xb4/0x210 [/data/memtester]
 0x5a473ca620 : main+0x66c/0x908 [/data/memtester]
 0x7406c40618 : __libc_init+0x5c/0x60 [/system/lib64/libc.so]
 0x5a473c9ee4 : _start+0x0/0x8 [/data/memtester]

times 16
 0x7406c3fd94 : free+0x0/0x18 [/system/lib64/libc.so]
 0x7406c82ce0 : __vfprintf+0x2b1c/0x2c74 [/system/lib64/libc.so]
 0x7406c80184 : vfprintf+0x64/0xa4 [/system/lib64/libc.so]
 0x7406c7f038 : printf+0x94/0xb4 [/system/lib64/libc.so]
 0x5a473caa54 : test_stuck_address+0xa4/0x210 [/data/memtester]
 0x5a473ca620 : main+0x66c/0x908 [/data/memtester]
 0x7406c40618 : __libc_init+0x5c/0x60 [/system/lib64/libc.so]
 0x5a473c9ee4 : _start+0x0/0x8 [/data/memtester]

times 8
 0x7406c3fd94 : free+0x0/0x18 [/system/lib64/libc.so]
 0x7406c82ce0 : __vfprintf+0x2b1c/0x2c74 [/system/lib64/libc.so]
 0x7406c80184 : vfprintf+0x64/0xa4 [/system/lib64/libc.so]
 0x7406c7f038 : printf+0x94/0xb4 [/system/lib64/libc.so]
 0x5a473ca668 : main+0x6b4/0x908 [/data/memtester]
 0x7406c40618 : __libc_init+0x5c/0x60 [/system/lib64/libc.so]
 0x5a473c9ee4 : _start+0x0/0x8 [/data/memtester]