Anti-Assembly debug Android

https://code.google.com/p/android/issues/detail?id=73076

http://my.unix-center.net/~Simon_fu/?p=527

There are a lot of crash in the process of porting Android, especially when you start the Android process. Generally these problems can be solved by looking at the code, of course, there are some more "enchanting" problems, it is very difficult to find the clue, in the Logcat log will only print some crash stacks, this information is difficult to help us locate the problem. Describe the use of disassembly during Android porting, based on an individual instance.

First look at one of the logcat I met about crash printing information:

I/debug (1417): * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ***I/DEBUG (1417): Build fingerprint: Eneric/sdk/generic/:eclair/eclair/eng.simon.20100607.133011:eng/test-keys ' I/debug (1417): pid:1434, tid:1460 >& Gt;> system_server <<<i/debug (1417): Signal (SIGSEGV), fault addr 00000000i/debug (1417): ZR 000000  XX at 00000000 V0 00007265 v1 00193228i/debug (1417): A0 00000001 A1 0000000a A2 00193228 A3 001f2ccfi/debug ( 1417): t0 00193228 t1 80000008 T2 8007e8dc T3 fffffff8i/debug (1417): T4 00030465 T5 00000000 T6 00200073 T7 0  0000000i/debug (1417): s0 2fa0786c s1 30564f00 S2 7ef5d990 S3 2fa0786ci/debug (1417): S4 30465000 S5 00100000 S6 7b10a8b4 S7 00000001i/debug (1417): T8 00000000 T9 7ef50d44 K0 00000000 K1 00000000i/debug (1417): GP 7ef6   Fd60 sp 30564e90 s8 2fa07858 ra 7ef53470i/debug (1417): Hi 0000000f lo 04444444 BVA 00007265 EPC 7ef534a4i/debug (1417): #00 pc 7ef534a4/system/lib/libc.soi/debug (1417): #01 RA 7ef53470/system/lib/libc.soi/debug (1417): I/DEBUG (1417): Code around Pc:i/debug (1417): 7ef53494 afa7002c afa40030 1040000b afa50028i/debug (1417): 7ef534a4 8c4a00 XX 8c440008 8c590004 8fa2001ci/debug (1417): 7ef534b4 0320f809 ac4a0034 8fa9001c 8d220034i/debug (1417): I/DEBUG ( 1417): Code around Lr:i/debug (1417): 7ef53460 afbc0010 8f9987c4 0320f809 00808021i/debug (1417): 7ef53470 afa2001c 8fa8001c 8fa6001c 8fa3001ci/debug (1417): 7ef53480 8d07000c 8cc40010 8c650008 8c420034i/debug (1417): I/DEBUG (141 7): Stack:i/debug (1417): 30564e50 00000000i/debug (1417): 30564e54 00000000i/debug (1417): 30564e5 8 00000000i/debug (1417): 30564e5c 00000000i/debug (1417): 30564e60 00009004i/debug (1417): 30564e 00000000i/debug (1417): 30564e68 00000000i/debug (1417): 30564e6c 00000000i/debug (1417): 30564 E70 00000009i/debug ( 1417): 30564e74 00000000i/debug (1417): 30564e78 00000000i/debug (1417): 30564e7c 7ef12af4/system/ Lib/libc.soi/debug (1417): 30564e80 7ef6fd60i/debug (1417): 30564e84 00000000i/debug (1417): 30564e    00000000i/debug (1417): 30564e8c 7ef53470/system/lib/libc.soi/debug (1417): 30564e90 7ef6fd60i/debug (1417): 30564e94 00000000i/debug (1417): 30564e98 30564eb4i/debug (1417): 30564e9c 00000000i/debu     G (1417): 30564ea0 7ef6fd60i/debug (1417): 30564ea4 7b10a8e8/system/lib/libsqlite.soi/debug (1417): 30564ea8 7b10a8b4/system/lib/libsqlite.soi/debug (1417): 30564eac 00193228 [Heap]i/debug (1417): 305 64eb0 2fa07870i/debug (1417): 30564eb4 00000000i/debug (1417): 30564eb8 0000000ai/debug (1417): 30 564ebc 001F2CCF [Heap]i/debug (1417): 30564ec0 00000001i/debug (1417): 30564ec4 7ef537fc/system/lib/li Bc.soi/debug (1417):    30564ec8 00193228 [Heap]i/debug (1417): 30564ECC 30564f00i/debug (1417): 30564ed0 7ef5d990/system/ Lib/libc.soi/debug (1417): 30564ed4 2fa0786ci/debug (1417): 30564ed8 30465000i/debug (1417): 30564e DC 00100000 [Heap]i/debug (1417): 30564ee0 7b10a8b4/system/lib/libsqlite.soi/debug (1417): 30564ee4 00 000001i/debug (1417): 30564ee8 2fa07858i/debug (1417): 30564EEC 7ef530ac/system/lib/libc.soi/debug (1 417): 30564EF0 7b10a8b4/system/lib/libsqlite.soi/debug (1417): 30564ef4 2fa0786ci/debug (1417): 3056 4ef8 00000000i/debug (1417): 30564EFC 00000000i/debug (1417): 30564f00 30564f00i/debug (1417): 305 64f04 00193228 [Heap]i/debug (1417): 30564f08 00000009i/debug (1417): 30564f0c 00000000i/debug (1417) : 30564f10 00000000i/debug (1417): 30564f14 00000000i/debug (1417): 30564f18 00000000i/debug (1417 ): 30564f1c 00000000i/debug (1417): 30564f20 00000000i/debug (1417): 30564f24 00000000i/debug (1417): 30564f28 000000 00i/debug (1417): 30564f2c 00000000i/debug (1417): 30564f30 00000000i/debug (1417): 30564f34 00000 000i/debug (1417): 30564f38 00000000i/debug (1417): 30564f3c 00000000i/debug (1417): 30564f40 0000 0000i/debug (1417): 30564f44 00000000i/debug (1417): 30564f48 00000000i/debug (1417): 30564f4c 000 00000i/debug (1417): 30564f50 00000000i/debug (1417): 30564f54 00000000i/debug (1417): 30564f58 00 000000i/debug (1417): 30564f5c 00000000i/debug (1417): 30564f60 00000000i/debug (1417): 30564F64 0  0000000i/debug (1417): 30564f68 00000000i/debug (1417): 30564f6c 00000000i/debug (1417): 30564f70  00000000i/debug (1417): 30564f74 00000000i/debug (1417): 30564f78 00000000i/debug (1417): 30564f7c 00000000i/debug (1417): 30564f80 00000000i/debug (1417): 30564f84 00000000i/debug (1417): 30564f88 00000000i/debug (14 : 30564f8c 00000000i/debug (1417): 30564f90 00000000i/debug (1417): 30564f94 00000000i/debug (1 417): 30564f98 00000000i/debug (1417): 30564f9c 00000000i/debug (1417): 30564fa0 00000000i/debug (  1417): 30564fa4 00000000i/debug (1417): 30564fa8 00000000i/debug (1417): 30564fac 00000000i/debug (   1417): 30564fb0 00000000i/debug (1417): 30564fb4 00000000i/debug (1417): 30564fb8 00000000i/debug   (1417): 30564FBC 00000000i/debug (1417): 30564fc0 00000000i/debug (1417): 30564fc4 00000000i/debug   (1417): 30564fc8 00000000i/debug (1417): 30564FCC 00000000i/debug (1417): 30564fd0 00000000i/debug    (1417): 30564fd4 00000000i/debug (1417): 30564fd8 00000000i/debug (1417): 30564FDC 00000000i/debug (1417): 30564FE0  00000000i/debug (1417): 30564fe4 00000000i/debug (1417): 30564fe8 00000000i/debug (1417): 30564fe C 00000000i/debug (1417): 30564ff0 00000000i/debug (1417): 30564ff4 00000000i/debug (1417): 30564f F8 00000000i/debug (1417): 30564FFC 00000000i/debug (1417): 30565000 00000000i/debug (1417): 30565 004 00000000i/debug (1417): 30565008 00000000i/debug (1417): 3056500c 00000000i/debug (1417): 3056 5010 00000000i/debug (1417): 30565014 00000000i/debug (1417): 30565018 00000000i/debug (1417): 305 6501c 00000000i/debug (1417): 30565020 00000000i/debug (1417): 30565024 00000000i/debug (1417): 30 565028 00000000i/debug (1417): 3056502c 00000000i/debug (1417): 30565030 00000000i/debug (1417): 3     0565034 00000000i/debug (1417): 30565038 00000000i/debug (1417): 3056503c 00000000i/debug (1417): 30565040 00000000w/syncManager (1434): Updating  for new accounts  ...

With this log message we can see that the libc.so crashes, and then study the stack discovery is libsqilte.so caused, then which one of the function crashes? There is no information in this. In addition, the kernel load dynamic library is dynamically loaded, Even if we disassemble libc.so and libsqlite.so, the symbol table has no way to correspond to the address in log, unless we know that the kernel loads the base address of libc.so and libsqlite.so, so that we can find the corresponding function by offset. Fortunately, Android does specify the kernel load address of most libraries in the system. File location under Build/core, there is a corresponding platform map file, such as: Arm platform file name is called Prelink-linux-arm.map,mips platform called Prelink-linux-mips.map. I am on the MIPS platform problem, so should use Prelink-linux-mips.map file to locate. The contents of the file are as follows:

# 0x7f100000-0x7fff0000 Thread 0 stack# 0x7f000000-0x7f0fffff linker# 0x70000000-0x7effffff Prelinked System Librari es# 0x60000000-0x6fffffff prelinked App libraries# 0x50000000-0x5fffffff non-prelinked Libraries# 0x40000000-0x4ffff FFF mmap ' d stuff# 0x10000000-0x3fffffff Thread stacks# 0x00080000-0x0fffffff. Text/. data/heap# Core System Librari                 eslibdl.so 0x7eff0000libc.so 0x7ef00000libstdc++.so 0x7eef0000libm.so 0x7ee90000liblog.so 0x7ee80000libcutils.so 0x7ee00000libthread_db.so 0x7ed80000libz            . So 0x7ed00000libevent.so 0x7ec80000libssl.so 0x7ec00000libcrypto.so 0x7ea00000libffi.so 0x7e980000libsysutils.so 0x7e900000# bluetoothliba2dp.so 0x7e780000audio. So 0x7e700000input.so 0x7e680000libhcid.so 0x7e600000libbluedroid.so 0x 7e580000libbluetooth.so        0x7e500000libdbus.so 0x7e400000# Extended System librarieslibril.so 0x7e300000librefere nce-ril.so 0x7e000000libwpa_client.so 0x7dc00000libnetutils.so 0x7db00000# core Dalvik Runtime support           libandroid_servers.so 0x7d900000#libicudata.so 0x7d700000libicuuc.so 0x7d500000libicui18n.so 0x7d380000libandroid_runtime.so 0x7d2a0000libnativehelper.so 0x7d200000libdvm-mips.so 0x7D180000libdv               m.so 0x7d000000# graphicslibpixelflinger.so 0x7cf00000libsurfaceflinger.so 0x7cd00000libagl.so 0x7cc00000libglesv1_cm.so 0x7cb00000libglesv2.so 0x7ca00000libopenvg_cm.so 0x7c900000l                ibopenvgu_cm.so 0x7c800000libegl.so 0x7c700000libexif.so 0x7c500000libui.so 0x7c400000libsgl.so 0x7c000000# audiolibspeech.so 0x7ba00000libaudio.so 0x7b900000           Libsonivox.so0x7b800000libsoundpool.so 0x7b700000libvorbisidec.so 0x7b600000libmedia_jni.so 0X7B500000LIBMEDIAPL ayerservice.so 0x7b480000libmedia.so 0x7b400000libfftem.so 0x7b300000libaudioflinger.so 0x7B2           00000# Assorted system librarieslibsqlite.so 0x7b100000libexpat.so 0x7b000000libwebcore.so 0x7a000000libutils.so 0x79d00000libcameraservice.so 0x79c80000libhardware.so 0X79C70000LIBHARDW are_legacy.so 0x79c00000libapp_process.so 0x79b00000libsystem_server.so 0x79a00000libime.so 0x79 800000libgps.so 0x79700000libcamera.so 0x79680000libqcamera.so 0x79400000# PV Libraries libpvasf.so 0x79200000libpvasfreg.so 0x79100000libomx_sharedlibrary.so 0x790e000 0libopencore_download.so 0x79000000libopencore_downloadreg.so 0x78f00000libopencore_net_support.so 0x78e000   00libopencore_rtsp.so         0x78d00000libopencore_rtspreg.so 0x78c00000libopencore_author.so 0x78a00000libomx_aacdec_sharedl ibrary.so 0x789c0000libomx_amrdec_sharedlibrary.so 0x78990000libomx_amrenc_sharedlibrary.so 0x78970000libomx_ avcdec_sharedlibrary.so 0x78958000libomx_m4vdec_sharedlibrary.so 0x78930000libomx_m4venc_sharedlibrary.so     0x788f0000libomx_mp3dec_sharedlibrary.so 0x788d0000libopencore_mp4local.so 0x78800000libopencore_mp4localreg.so 0x78700000libopencore_player.so 0x78400000# Opencore Hardware supportlibmm-adspsvc.so 0x783c0000lib omxcore.so 0x783a0000libomxmpeg4dec.so 0x78370000libomxh264dec.so 0x78340000libom xvidenc.so 0x78310000libopencorehw.so 0x78300000libopencore_common.so 0x78180000#libqco  Mm_omx.so 0xa5a00000# LibrariesFor specific apps or temporary librarieslibcam_ipl.so 0x6f000000libwbxml.so 0X6E800000LIBWBXML_JNI.S o 0x6e400000libxml2wbxml.so 0x6e000000libaes.so 0x6dc00000libdrm1.so 0x6d800000     libdrm1_jni.so 0x6d400000libwapcore.so 0x6d000000libstreetview.so 0x6cc00000libwapbrowsertest.so 0x6c800000libminiglobe.so 0x6c400000libearth.so 0x6c000000libembunit.so 0x6bc00000libneo n.so 0x6b800000libjni_example.so 0x6b400000libjni_load_test.so 0x6b000000libjni_lib_test.so 0x               6ac00000librunperf.so 0x6a800000libctest.so 0x6a700000libuapi_jni.so 0x6a500000librpc.so 0x6a400000libtrace_test.so 0x6a300000libsrec_jni.so 0x6a200000libcerttool_jni.so 0x6A1000       00libacc.so 0x6a000000libbinder.so 0x69f00000libskia.so 0x69000000libgles_android.so 0x68800000librs.so                0x68000000libaudiopolicygeneric.so 0x67c00000librs_jni.so 0x67800000# Sigma Designs Librariesli bcore.so 0x61400000libdisplay.so 0x61000000libdrm.so 0x60c000 00libhw.so 0x60800000libplayback.so 0x60000000

From this map file we can query the load base address of each Lib library. For example, libc.so will be loaded into the 0x7b100000 by kernel loading to 0x7ef00000,libsqlite.so. We can compare the log information of crash to the corresponding, indicating that this file in the Android loading process played a role.

Next we need to disassemble libc.so and libsqlite.so. The general Cross compiler provides disassembly tools, and my MIPS platform provides the Mips-linux-gnu-objdump command for disassembly.

Mips-linux-gnu-objdump-ds libc.so > Libc.dumpmips-linux-gnu-objdump-ds libsqlite.so > Libsqlite.dump

This allows you to get the libc and Libsqlite symbol tables. Then through the symbol table, Android loading the base address of the dynamic library, log information can be located to the problem of the function, if you are familiar with the Platform assembly language, you can read the assembly code to find the problem. This article does not specifically say how to use this three file information. With this three files, a little research can understand how to analyze.

In general, crash is not the problem of Android source code, most likely is that some of the kernel modules are not compiled in. In this case, the module associated with the mutex is not compiled into the kernel caused by the problem.

The above is a personal groping out of the method, if you have a better way or my methods have errors, please feel free.

Anti-Assembly debug Android