[TOC]
本文轉(zhuǎn)載于同事的分享文章 siyi.xie究流，在這里記錄一下
[TOC]
iOS crash分析
符號(hào)化（symbolicate)
內(nèi)存地址的解析仑鸥， 是指從 內(nèi)存地址 到 符號(hào)邀跃。
Thread 21 Crashed:
0 libsystem_kernel.dylib 0x00000001957b3270 0x195798000 + 111216
1 libsystem_pthread.dylib 0x0000000195851224 0x19584c000 + 21028
2 libsystem_c.dylib 0x000000019572ab14 0x1956c8000 + 404244
3 libc++abi.dylib 0x00000001947fd414 0x1947fc000 + 5140
4 libc++abi.dylib 0x000000019481cb88 0x1947fc000 + 134024
5 libobjc.A.dylib 0x000000019502c3bc 0x195024000 + 33724
6 libc++abi.dylib 0x0000000194819bb0 0x1947fc000 + 121776
7 libc++abi.dylib 0x0000000194819474 0x1947fc000 + 119924
8 libobjc.A.dylib 0x000000019502c200 0x195024000 + 33280
9 CoreFoundation 0x00000001848ce21c 0x1847a8000 + 1204764
10 TouchPalDialer 0x000000010052e2c4 0x100028000 + 5268164
11 TouchPalDialer 0x000000010052e038 0x100028000 + 5267512
12 libsystem_platform.dylib 0x0000000195848948 0x195844000 + 18760
13 TouchPalDialer 0x00000001009106b4 0x100028000 + 9340596
14 TouchPalDialer 0x00000001009106b4 0x100028000 + 9340596
15 TouchPalDialer 0x0000000100918024 0x100028000 + 9371684
16 TouchPalDialer 0x00000001009cd354 0x100028000 + 10113876
17 TouchPalDialer 0x00000001009ce940 0x100028000 + 10119488
18 TouchPalDialer 0x0000000100909a08 0x100028000 + 9312776
19 TouchPalDialer 0x00000001009cf698 0x100028000 + 10122904
20 libsystem_pthread.dylib 0x000000019584fe7c 0x19584c000 + 15996
21 libsystem_pthread.dylib 0x000000019584fdd8 0x19584c000 + 15832
22 libsystem_pthread.dylib 0x000000019584cfac 0x19584c000 + 4012
這里的內(nèi)存地址是指程序運(yùn)行時(shí)的內(nèi)存地址（區(qū)別于程序編譯之后的內(nèi)存地址）
符號(hào)是指人類可讀的代碼信息赔蒲，一般包括文件名诱担、類型、函數(shù)名转砖、行數(shù)。
比如以下是一行解析后的符號(hào)信息：
1 -[ContactEditNoteView saveNote] (in TouchPalDialer) (ContactEditNoteView.m:98)
收集crash
crash的源頭
uncaught exception導(dǎo)致程序終止鲸伴；程序被終止前府蔗，exception能被uncaught exception hangler處理。
iOS Developer Library: Uncaught Exceptions
If an exception is not caught, it is intercepted by a function called the uncaught exception handler. The uncaught exception handler always causes the program to exit but may perform some task before this happens.
uncaught exception的來(lái)源：
- 內(nèi)核
- 其他進(jìn)程
- 本身的進(jìn)程
Handling unhandled exceptions and signals
An unhandled signal can come from three places: the kernel, other processes or the application itself. The two most common signals that cause crashes are:
EXC_BAD_ACCESS is a Mach exception sent by the kernel to your application when you try to access memory that is not mapped for your application. If not handled at the Mach level, it will be translated into a SIGBUS or SIGSEGV BSD signal.
SIGABRT is a BSD signal sent by an application to itself when an NSException or obj_exception_throw is not caught.
Mac OS X內(nèi)核架構(gòu)如下圖所示汞窗。mach的exception可能會(huì)通過(guò)BSD被轉(zhuǎn)換成UNIX類似的signal姓赤。
捕獲crash
如果被轉(zhuǎn)成了NSException,可以通過(guò)
NSSetUncaughtExecptionHandler()捕獲；如果以
unix signal的形式發(fā)送給相應(yīng)的線程仲吏，則可以通過(guò)C的函數(shù)注冊(cè)對(duì)應(yīng)的信號(hào)函數(shù)來(lái)處理signal(int sig, sig_t func)
獲取crash的具體信息
[NSException callStackSymbols];int backtrace(void** array, int size);
char** backtrace_symbols(void* const* array, int size);
對(duì)比
| 捕獲crash的入口 | API | 獲取crash具體信息 | 說(shuō)明 |
|---|---|---|---|
NSExecption |
NSSetUncaughtExecptionHandler() |
[NSException callStackSymbols] |
|
signal |
signal(int sig, sig_t func) |
int backtrace(void** array, int size); char** backtrace_symbols(void* const* array, int size); |
收集crash的步驟
注冊(cè)
UncaughtExecptionHandler和signal(int sig, sig_t func)通過(guò)對(duì)應(yīng)方法獲取 函數(shù)調(diào)用棧的符號(hào)：
[NSException callStackSymbols]或者backtrace_symbols(void* const* array, int size)保存成文件不铆，并上傳到服務(wù)器
根據(jù)調(diào)用棧信息和符號(hào)表文件（.dSYM文件）進(jìn)行符號(hào)解析。通常使用的命令是：
atos裹唆。比如atos -o ./TouchPalDialer.app/TouchPalDialer -arch arm64 -s 0x2760 0x00000001004ed148
收集到的crash實(shí)例
以下是實(shí)際代碼中收集的crash信息誓斥，來(lái)自于文件ios_crash.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>abstract</key>
<string>UncaughtSignalException: Signal 10 was raised.</string>
<key>app_name</key>
<string>com.cootek.Contacts</string>
<key>app_version</key>
<string>5384</string>
<key>detail</key>
<string>0 TouchPalDialer 0x00000001005e533c _ZNSbItSt11char_traitsItESaItEE7reserveEm + 378016 |
1 TouchPalDialer 0x00000001005e4fd4 _ZNSbItSt11char_traitsItESaItEE7reserveEm + 377144 |
2 libsystem_platform.dylib 0x0000000197b4094c _sigtramp + 52 |
3 TouchPalDialer 0x0000000100a46624 _ZNSt8_Rb_treeISbItSt11char_traitsItESaItEESt4pairIKS3_St6vectorIiSaIiEEESt10_Select1stIS9_ESt4lessIS3_ESaIS9_EE4findERS5_ + 3160 |
4 TouchPalDialer 0x0000000100a46624 _ZNSt8_Rb_treeISbItSt11char_traitsItESaItEESt4pairIKS3_St6vectorIiSaIiEEESt10_Select1stIS9_ESt4lessIS3_ESaIS9_EE4findERS5_ + 3160 |
5 TouchPalDialer 0x0000000100a462e4 _ZNSt8_Rb_treeISbItSt11char_traitsItESaItEESt4pairIKS3_St6vectorIiSaIiEEESt10_Select1stIS9_ESt4lessIS3_ESaIS9_EE4findERS5_ + 2328 |
6 TouchPalDialer 0x0000000100a4bc20 _ZNSt8_Rb_treeIjSt4pairIKjN7orlando7VipInfoEESt10_Select1stIS4_ESt4lessIjESaIS4_EE4findERS1_ + 632 |
7 TouchPalDialer 0x00000001005416c0 _ZNSt6vectorISsSaISsEE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPSsS1_EERKSs + 666676 |
8 TouchPalDialer 0x0000000100540914 _ZNSt6vectorISsSaISsEE13_M_insert_auxEN9__gnu_cxx17__normal_iteratorIPSsS1_EERKSs + 663176 |
9 libdispatch.dylib 0x00000001979693ac <redacted> + 24 |
10 libdispatch.dylib 0x000000019796936c <redacted> + 16 |
11 libdispatch.dylib 0x00000001979734c0 <redacted> + 1216 |
12 libdispatch.dylib 0x000000019796c474 <redacted> + 132 |
13 libdispatch.dylib 0x0000000197975224 <redacted> + 664 |
14 libdispatch.dylib 0x000000019797675c <redacted> + 108 |
15 libsystem_pthread.dylib 0x0000000197b452e4 _pthread_wqthread + 816 |
16 libsystem_pthread.dylib 0x0000000197b44fa8 start_wqthread + 4</string>
<key>device</key>
<string>iPhone7,1</string>
<key>manufacturer</key>
<string>Apple</string>
<key>os_name</key>
<string>iOS</string>
<key>os_version</key>
<string>iOS 8.1.2</string>
<key>slide</key>
<integer>933888</integer>
<key>timestamp</key>
<string>1456103577</string>
</dict>
</plist>
工具: atos
關(guān)鍵：load address, slide
atos -- convert numeric addresses to symbols of binary images or processes
atos [-o <binary-image-file>] [-p <pid> | <partial-executable-name>] [-arch architecture]
[-l <load-address>] [-s <slide>] [-printHeader] [-f <address-input-file>]
[<address> ...]
使用atos使用舉例：
atos -o ./TouchPalDialer.app/TouchPalDialer -arch arm64 -s 0x2760 0x00000001004ed148
注意：
命令atos中輸入的解析地址要求是構(gòu)建的內(nèi)存地址（built address）（因?yàn)檫@個(gè)地址是要對(duì)應(yīng)于dSYM文件的，而dSYM文件是在構(gòu)建產(chǎn)生的）许帐，而獲取并上傳的函數(shù)調(diào)用棧的地址是程序在運(yùn)行時(shí)的內(nèi)存地址劳坑，稱之為實(shí)際加載地址。
蘋果開發(fā)者文檔(Technical Note TN2123)指出成畦，需要區(qū)分兩個(gè)加載地址（load address）：實(shí)際加載地址 期望加載地址
實(shí)際加載地址 (actual load address)
是指程序運(yùn)行時(shí)的地址距芬。每次程序裝載(load)都可能不同。期望加載地址 (intented load address)
是指編譯之后指定的加載地址羡鸥。
偏移量 = 實(shí)際加載地址 - 期望加載地址
slide = acutal load address - intended load addrss
獲取load address,slide
-
加載地址(load address)
如果能夠獲取有系統(tǒng)的CrashReporter產(chǎn)生的完成的崩潰日志文件(.crash文件)蔑穴，則從其中的Binary Images部分獲取當(dāng)前程序的**實(shí)際加載地址(acutal load address)**
舉例如下：
Binary Images:
0x100028000 - 0x100c53fff TouchPalDialer arm64 <a197140a05563a0c983ef71bb8a83e1b> /var/mobile/Containers/Bundle/Application/C5B024A9-A8CC-4F1D-8613-99376B830C3E/TouchPalDialer.app/TouchPalDialer
0x1200c0000 - 0x1200e7fff dyld arm64 <36eff49275c23d2d815e48af33eea471> /usr/lib/dyld
0x182e60000 - 0x182e7dfff libJapaneseConverter.dylib arm64 <39642fdaade73029adb01e10922d2ba3> /System/Library/CoreServices/Encodings/libJapaneseConverter.dylib
-
偏移量(slide)
調(diào)用底層C的API獲取，_dyld_get_image_vmaddr_slide(uint32_t image_index)
舉例如下：
+ (long) getImageSlide {
long slide = -1;
for (uint32_t i = 0; i < _dyld_image_count(); i++) {
if (_dyld_get_image_header(i)->filetype == MH_EXECUTE) {
slide = _dyld_get_image_vmaddr_slide(i);
break;
}
}
return slide;
}
參考資料
How to read objective-c stack traces
http://stackoverflow.com/questions/6462214/how-to-read-objective-c-stack-tracesTechnical Note TN2151
Understanding and Analyzing iOS Application Crash Reports
https://developer.apple.com/library/ios/technotes/tn2151/_index.htmlTechnical Note TN2123
CrashReporter
https://developer.apple.com/library/mac/technotes/tn2004/tn2123.htmlDemystifying iOS Application Crash Logs
http://www.raywenderlich.com/23704/demystifying-ios-application-crash-logsSymbolicating Your iOS Crash Reports
https://possiblemobile.com/2015/03/symbolicating-your-ios-crash-reports/Exploring iOS Crash Reports
https://www.plausible.coop/blog/?p=176intended load addressvsactual load address
http://www.cocoabuilder.com/archive/xcode/312725-can-symbolicate-crash-reports.htmltools
man atos
https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/atos.1.htmlTales From The Crash Mines: Issue #1, by Landon Fuller
https://www.mikeash.com/pyblog/tales-from-the-crash-mines-issue-1.html你的iOS安裝包真的“脫光”了么
http://zhuanlan.zhihu.com/geek-makes-life-better/19925959使用Symbolicatecrash和xcrun atos分析crash log
http://blog.csdn.net/mkhgg/article/details/17247673stackoverflow
How to read objective-c stack traces
http://stackoverflow.com/questions/6462214/how-to-read-objective-c-stack-tracesiOS crash reports: atos not working as expected
http://stackoverflow.com/questions/13574933/ios-crash-reports-atos-not-working-as-expected
dwarfdump: 關(guān)于XCode編譯完App之后生成的dSYM文件
http://blog.csdn.net/yan8024/article/details/8186760使用dwarfdump檢查dSYM和app是否匹配
http://blog.csdn.net/yan8024/article/details/8186774load address
Can't symbolicate crash reports
http://www.cocoabuilder.com/archive/xcode/312725-can-symbolicate-crash-reports.htmlDebugging stack traces
http://www.cocoabuilder.com/archive/cocoa/276690-debugging-stack-traces.htmlstatic or dynamic libraries Dynamic linking on iOS
http://ddeville.me/2014/04/dynamic-linking/The LLDB Debugger
http://lldb.llvm.org/symbolication.html
補(bǔ)充資料
memory layout 內(nèi)存布局
虛擬內(nèi)存地址惧浴，從低地址到高地址
- Text segment
- Initialized data segment
- Uninitialized data segment
- Stack
- Heap
函數(shù)調(diào)用棧 callstack
函數(shù)壓棧 push, 函數(shù)退棧 pop
實(shí)際代碼：TPUncaughtExceptionHandler.m
+ (void) attachHandler {
NSSetUncaughtExceptionHandler(&UncaughtExceptionHandler);
for(int i = 0; i< signalCounts; i++) {
signal(monitorSignals[i], SignalHandler__);
}
}
// The signal handler for bad signls defined in monitorSignals array
// Gather callstack, convert to exception and then use the same exception handling approach.
void SignalHandler__(int signal) {
NSMutableDictionary *info =
[NSMutableDictionary
dictionaryWithObject:[NSNumber numberWithInt:signal]
forKey:SignalKey];
NSArray *callStack = [TPUncaughtExceptionHandler backtrace];
[info setObject:callStack forKey:CallStackKey];
[info setObject:@([TPUncaughtExceptionHandler getImageSlide]) forKey:SlideKey];
[TPUncaughtExceptionHandler handleExceptionAndExit:
[NSException
exceptionWithName:UncaughtSignalExceptionName
reason:[NSString stringWithFormat:@"Signal %d was raised.", signal]
userInfo:info]];
}
+ (NSArray *)backtrace
{
const int maxCount = 128;
void* callstack[maxCount];
int count = backtrace(callstack, maxCount);
char **strs = backtrace_symbols(callstack, count);
NSMutableArray *backtrace = [NSMutableArray arrayWithCapacity:count];
for (int i = 0; i < count; i++)
{
[backtrace addObject:[NSString stringWithUTF8String:strs[i]]];
}
free(strs);
return backtrace;
}
/**
*
* @return the slide of this binary image
*/
+ (long) getImageSlide {
long slide = -1;
for (uint32_t i = 0; i < _dyld_image_count(); i++) {
if (_dyld_get_image_header(i)->filetype == MH_EXECUTE) {
slide = _dyld_get_image_vmaddr_slide(i);
break;
}
}
cootek_log(@"TPUncaughtExceptionHandler, slide: %s", @(slide).description);
return slide;
}
通過(guò)backtrace獲取的crash信息
0 TouchPalDialer 0x00000001004ff418 _ZNSbItSt11char_traitsItESaItEE7reserveEm + 370100 |
1 TouchPalDialer 0x00000001004ff154 _ZNSbItSt11char_traitsItESaItEE7reserveEm + 369392 |
2 libsystem_platform.dylib 0x000000019506094c _sigtramp + 52 |
3 TouchPalDialer 0x00000001008e5ed4 _ZN15CTXAppidConvert17IsConnectionAppIdEPKc + 720196 |
4 TouchPalDialer 0x00000001008e5ed4 _ZN15CTXAppidConvert17IsConnectionAppIdEPKc + 720196 |
5 TouchPalDialer 0x00000001008dacb4 _ZN15CTXAppidConvert17IsConnectionAppIdEPKc + 674596 |
6 TouchPalDialer 0x00000001008e2098 _ZN15CTXAppidConvert17IsConnectionAppIdEPKc + 704264 |
7 TouchPalDialer 0x00000001009973c8 _ZNSt8_Rb_treeIiSt4pairIKiPN7orlando12YellowSearchEESt10_Select1stIS5_ESt4lessIiESaIS5_EE4findERS1_ + 223600 |
8 TouchPalDialer 0x00000001009989b4 _ZNSt8_Rb_treeIiSt4pairIKiPN7orlando12YellowSearchEESt10_Select1stIS5_ESt4lessIiESaIS5_EE4findERS1_ + 229212 |
9 TouchPalDialer 0x00000001008d3a7c _ZN15CTXAppidConvert17IsConnectionAppIdEPKc + 645356 |
10 TouchPalDialer 0x0000000100999730 _ZNSt8_Rb_treeIiSt4pairIKiPN7orlando12YellowSearchEESt10_Select1stIS5_ESt4lessIiESaIS5_EE4findERS1_ + 232664 |
11 libsystem_pthread.dylib 0x0000000195067dc8 <redacted> + 164 |
12 libsystem_pthread.dylib 0x0000000195067d24 <redacted> + 0 |
13 libsystem_pthread.dylib 0x0000000195064ef8 thread_start + 4
