linux程序crash時，通常我們可以通過gdb+core或addr2line解析出程序crash在哪一個函式中，有時crash在動態連結庫中，解析出的core可能只有一個地址，而不能知道是在哪一個函式，這時可以嘗試通過/proc/程序ID/maps的方法找到crash的位置。

一個動態庫的實現：

標頭檔案sample_fun.h

#ifndef _SAMPLE_FUN_H_
#define _SAMPLE_FUN_H_

void testFun4();

#endif

原始檔sample_fun.cpp
#include <stdio.h>
#include "sample_fun.h"

void testFun4()
{
   int* p = NULL;
   printf("%d", *p); //will crash
}
 

使用g++將這個原始檔編譯出動態庫

g++ -fPIC -shared sample_fun.cpp -o libsample_fun.so

呼叫動態庫的實現sample_main.cpp

#include <iostream>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>

#include "sample_fun.h"

using namespace std;

#define BUFFLEN 256

void testFun1();
void testFun2();
void testFun3();

int main(int argc, char** argv)
{
   int pid = getpid();
   char cmdBuf[BUFFLEN] = {0x00};
   sprintf(cmdBuf, "cat /proc/%d/maps > /home/nap/%d.maps", pid, pid); //save current process maps
   system(cmdBuf);

   testFun1();
}

void testFun1()
{
   testFun2();
}

void testFun2()
{
   testFun3();
}

void testFun3()
{
   testFun4(); //call this function will crash
}
 

將這個檔案編譯可執行程式並連線動態庫

g++ sample_main.cpp -L. libsample_fun.so -o sample_main

執行著個程式發生了crash，並且生成了core檔案，

./sample_main 

Segmentation fault (core dumped)

通過gdb+core看到了crash的地址

GNU gdb (Ubuntu/Linaro 7.4-2012.04-0ubuntu2.1) 7.4-2012.04
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-linux-gnu".
For bug reporting instructions, please see:
<http://bugs.launchpad.net/gdb-linaro/>...
Reading symbols from /home/nap/sample_main...(no debugging symbols found)...done.
[New LWP 4170]


warning: Can't read pathname for load map: Input/output error.
Core was generated by `./sample_main'.
Program terminated with signal 11, Segmentation fault.
#0  0xb773a478 in ???
(gdb) bt
#0  0xb773a478 in ???
#1  0x08048770 in ???
#2  0x08048763 in ???
(gdb) 

通過檢視程序的map可以看出crash的位置在libsample_fun.so的程式碼段，

08048000-08049000 r-xp 00000000 08:05 1059318    /home/nap/sample_main
08049000-0804a000 r--p 00000000 08:05 1059318    /home/nap/sample_main
0804a000-0804b000 rw-p 00001000 08:05 1059318    /home/nap/sample_main
b7449000-b744b000 rw-p 00000000 00:00 0 
b744b000-b7467000 r-xp 00000000 08:05 1311741    /lib/i386-linux-gnu/libgcc_s.so.1
b7467000-b7468000 r--p 0001b000 08:05 1311741    /lib/i386-linux-gnu/libgcc_s.so.1
b7468000-b7469000 rw-p 0001c000 08:05 1311741    /lib/i386-linux-gnu/libgcc_s.so.1
b7469000-b7493000 r-xp 00000000 08:05 1315013    /lib/i386-linux-gnu/libm-2.15.so
b7493000-b7494000 r--p 00029000 08:05 1315013    /lib/i386-linux-gnu/libm-2.15.so
b7494000-b7495000 rw-p 0002a000 08:05 1315013    /lib/i386-linux-gnu/libm-2.15.so
b7495000-b7638000 r-xp 00000000 08:05 1310845    /lib/i386-linux-gnu/libc-2.15.so
b7638000-b763a000 r--p 001a3000 08:05 1310845    /lib/i386-linux-gnu/libc-2.15.so
b763a000-b763b000 rw-p 001a5000 08:05 1310845    /lib/i386-linux-gnu/libc-2.15.so
b763b000-b763f000 rw-p 00000000 00:00 0 
b763f000-b7717000 r-xp 00000000 08:05 1575071    /usr/lib/i386-linux-gnu/libstdc++.so.6.0.16
b7717000-b7718000 ---p 000d8000 08:05 1575071    /usr/lib/i386-linux-gnu/libstdc++.so.6.0.16
b7718000-b771c000 r--p 000d8000 08:05 1575071    /usr/lib/i386-linux-gnu/libstdc++.so.6.0.16
b771c000-b771d000 rw-p 000dc000 08:05 1575071    /usr/lib/i386-linux-gnu/libstdc++.so.6.0.16
b771d000-b7724000 rw-p 00000000 00:00 0 
b773a000-b773b000 r-xp 00000000 08:05 1059319    /home/nap/libsample_fun.so
b773b000-b773c000 r--p 00000000 08:05 1059319    /home/nap/libsample_fun.so
b773c000-b773d000 rw-p 00001000 08:05 1059319    /home/nap/libsample_fun.so
b773d000-b773f000 rw-p 00000000 00:00 0 
b773f000-b7740000 r-xp 00000000 00:00 0          [vdso]
b7740000-b7760000 r-xp 00000000 08:05 1311879    /lib/i386-linux-gnu/ld-2.15.so
b7760000-b7761000 r--p 0001f000 08:05 1311879    /lib/i386-linux-gnu/ld-2.15.so
b7761000-b7762000 rw-p 00020000 08:05 1311879    /lib/i386-linux-gnu/ld-2.15.so
bf97d000-bf99e000 rw-p 00000000 00:00 0          [stack]

接下來我們要求出crash的函式在libsample_fun.so中的地址，計算方式如下

發生crash的地址 - 動態庫的起始地址 + 偏移地址

在我們的例子中為0xb773a478 - 0xb773a000 + 0x00000000 = 0x478

通過 nm -n libsample_fun.so將這個動態庫中的符號表按地址順序輸出

[email protected]:~$ nm -n libsample_fun.so 
         w _Jv_RegisterClasses
         w [email protected]@GLIBC_2.1.3
         w __gmon_start__
         U [email protected]@GLIBC_2.0
00000330 T _init
000003a0 t __do_global_dtors_aux
00000420 t frame_dummy
00000457 t __i686.get_pc_thunk.bx
0000045c T _Z8testFun4v
000004a0 t __do_global_ctors_aux
000004d8 T _fini
00000574 r __FRAME_END__
00001f14 d __CTOR_LIST__
00001f18 d __CTOR_END__
00001f1c d __DTOR_LIST__
00001f20 d __DTOR_END__
00001f24 d __JCR_END__
00001f24 d __JCR_LIST__
00001f28 a _DYNAMIC
00001ff4 a _GLOBAL_OFFSET_TABLE_
0000200c d __dso_handle
00002010 A __bss_start
00002010 A _edata
00002010 b completed.6159
00002014 b dtor_idx.6161
00002018 A _end

找到最接近0x478且比0x478下的地址，這個地址的函式就是發生crash的函式

使用c++filt將這個函式名打印出來

[email protected]:~$ c++filt _Z8testFun4v
testFun4()

這樣我們就找到了crash的函式。