Linux Program Analysis method

1. Background

In reality, we need to learn existing software construction methods, or maintain old software, or add new features, or optimize performance,

At this time the face of the code is not written by themselves, how to quickly know what the code library is doing, how the source files are organized, how the modules interact?

2. Operation of the program

A) application: Usually a syntax tree structure, tree leaf nodes or simple operations (+ 、-、 = etc.), or system calls (read, write, sleep),

The root of the tree is usually main; if there are multiple threads/processes, there will be multiple trees, and loops will occur when recursive calls occur.

b) Kernel: The kernel is the middle layer between application and hardware, the interaction method is soft interrupt and hard interrupt;

The application uses the int instruction to trigger the system call, the device uses IRQ interrupt to trigger the event notification, the kernel uses in/out instruction to read and write the device;

Therefore, the kernel generally consists of two parts: the initialization process (registering various interrupt processors), interrupt processing process (various interrupt response routines);

Finally, for interrupts to be auto-switched contexts (register state), scheduling is required for multitasking execution (which threads are suspended and which threads are running).

c) Regardless of the application or the kernel, an execution flow is a tree, and the nodes in the tree correspond to a function that can read and write global variables and their own local variables.

3. Analysis methods

All programs have a startup process, and for the core there is an interrupt response process, the data is created on demand, the key is the process of understanding.

The process contains the relationship between the end point (function) and the node (call and be tuned), which is a graph of the direction;

The edge that flows into the node speaks to its purpose, and the side that exits the node speaks of its implementation.

Here is a tool for automatically generating flowcharts from Source: CallGraph

The tool automatically recognizes the function call relationship and outputs a forward graph, which can then be used to generate a visual chart using the dot command of Graphviz

The save format can be PDF, PNG, SVG, and so on.

4. Example Analysis

The following is an example of linux-0.11 code analysis:

$ git clone https://github.com/gnprice/callgraph.git

After downloading, you need to modify Print_dot to avoid the display:

~/projects/callgraph[master]$ gitdiffdiff--git A/callgraph b/Callgraphindex E771dce. A79FCD8100755---A/CallGraph+ + + bcallgraph@@- the, A+ the, A@@ def print_dot (refs, nonstatic): Size= (scale[0] * One-1, scale[1] *8.5-1) # inches; Letter1"marginsPrint'Strict digraph calls {'Print'RANKDIR=LR;'-Print'size= "%f,%f";'%size-Print'Ratio=fill;'-Print'rotate=90;'+# Print'size= "%f,%f";'%size+# Print'Ratio=fill;'+# Print'rotate=90;'Print'center=1;'-Print'margin=0;'-Print'page= "8.5,11";'+# Print'margin=0;'+# Print'page= "8.5,11";'funs=Set (Refs.keys ()) forF, callsinchSorted (Refs.iteritems ()): Shape='Box' ifFinchnonstaticElse 'plaintext'

$ Curl-o https://www.kernel.org/pub/linux/kernel/Historic/old-versions/linux-0.11.tar.gz

$ TAR-XF linux-0.11.tar.gz

$ CD Linux-0.11/init

~/projects/linux-0.11/init

$ Cat Main.c | ~/projects/callgraph/callgraph | Dot-tpng > Main.png

The single-file init/main.c call graph is as follows:

Call graph for the entire kernel subdirectory:

$ find Kernel-type f-name "*.c"-o-name "*.h" | Xargs Cat | ~/projects/callgraph/callgraph | Dot-tpng > Kernel.png

Linux Program Analysis method