筆記:app當機時用gdb遠端debug


參考來源:
Debugging apps or processes that crash
https://source.android.com/devices/tech/debug/gdb

1. 在目標裝置上設置debug.debuggerd.wait_for_gdb

Android 7之後可以使用內建功能, 首先設置debuggerd的property
$ adb shell setprop debug.debuggerd.wait_for_gdb true

2. 模擬APP當機

使用ps確定測試用APP是com.myapp.test
$ adb shell "ps | grep com.myapp.test"
產生SIGABRT信號模擬APP當機
$ adb shell kill -6 2823

從adb logcat中可以看到下面一段debuggerd印出的dump資訊, 有看到下面藍色部份就是表示系統已正在等待gdb連線
--------- beginning of crash
02-13 15:45:52.820  2823  2823 F libc    : Fatal signal 6 (SIGABRT), code 0 in tid 2823 (ht.mod.watchdog)
02-13 15:45:52.821  1650  1650 W         : debuggerd: handling request: pid=2823 uid=1000 gid=1000 tid=2823
02-13 15:45:52.923  3190  3190 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
02-13 15:45:52.924  3190  3190 F DEBUG   : Build fingerprint: '...:user/release-keys'
02-13 15:45:52.924  3190  3190 F DEBUG   : Revision: '0'
02-13 15:45:52.924  3190  3190 F DEBUG   : ABI: 'arm'
02-13 15:45:52.925  3190  3190 F DEBUG   : pid: 2823, tid: 2823, name: com.myapp.test  >>> com.myapp.test <<<
02-13 15:45:52.925  3190  3190 F DEBUG   : signal 6 (SIGABRT), code 0 (SI_USER), fault addr --------
...
02-13 15:45:53.701  3190  3190 F DEBUG   :     #29 pc 00001564  /system/bin/app_process32
02-13 15:45:53.869  3190  3190 I         : ***********************************************************
02-13 15:45:53.869  3190  3190 I         : * Process 2823 has been suspended while crashing.
02-13 15:45:53.869  3190  3190 I         : * To attach gdbserver and start gdb, run this on the host:
02-13 15:45:53.869  3190  3190 I         : *
02-13 15:45:53.869  3190  3190 I         : *     gdbclient.py -p 2823
02-13 15:45:53.869  3190  3190 I         : *
02-13 15:45:53.869  3190  3190 I         : * Wait for gdb to start, then press the VOLUME DOWN key
02-13 15:45:53.869  3190  3190 I         : * to let the process continue crashing.
02-13 15:45:53.869  3190  3190 I         : ***********************************************************
--------- beginning of system
02-13 15:46:02.879  1906  2155 E NativeCrashListener: Exception dealing with report
02-13 15:46:02.879  1906  2155 E NativeCrashListener: android.system.ErrnoException: read failed: EAGAIN (Try again)
...

3. 選擇本機電腦連接目標裝置的方式

我透過網路連接目標裝置,目標裝置IP是10.0.0.200 使用預設埠號5555
$ adb connect 10.0.0.200:5555

如果是透過USB連線可能就只需要connect
$ adb connect

4. 使用gdbclient.py進行目標裝置debug

進入你的AOSP的工作目錄,引用AOSP工作環境變數
$ source build/envsetup.sh

載入你的目標裝置對應設定檔,請用你的目標裝置名稱取代下面指令藍色部份
$ lunch {device_name}-user
如果你是開發版本,可能是-eng而不是-user

依照前面logcat指示使用gdbclient.py, 該程式位在 development/scripts/gdbclient.py
$ gdbclient.py -p 2823
Redirecting gdbclient output to /tmp/gdbclient-18639

GNU gdb (GDB) 7.11
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
...
warning: Could not load shared library symbols for 14 libraries, e.g. /system/framework/arm/boot-core-libart.oat.
Use the "info sharedlibrary" command to see the complete listing.
Do you need "set solib-search-path" or "set sysroot"?
y
warning: section .dynsym not found in ./out/target/product/{device_name}/symbols/system/framework/arm/boot.oat
warning: section .dynstr not found in ./out/target/product/{device_name}/symbols/system/framework/arm/boot.oat
warning: section .hash not found in ./out/target/product/{device_name}/symbols/system/framework/arm/boot.oat
warning: section .dynamic not found in ./out/target/product/{device_name}/symbols/system/framework/arm/boot.oat
__epoll_pwait () at bionic/libc/arch-arm/syscalls/__epoll_pwait.S:16
16      ldmfd   sp!, {r4, r5, r6, r7}

(gdb) i proc
process 2823
cmdline = 'com.myapp.test'
cwd = '/'
exe = '/system/bin/app_process32'

(gdb) i prog
Debugging a target over a serial line.
Program stopped at 0xacdccf28.
Type "info stack" or "info registers" for more information.

(gdb) show solib-search-path
The search path for loading non-absolute shared library symbol files is ./out/target/product/{device_name}/symbols/system/lib/:./out/target/product/{device_name}/symbols/system/lib/hw:./out/target/product/{device_name}/symbols/system/lib/ssl/engines:./out/target/product/{device_name}/symbols/system/lib/drm:./out/target/product/{device_name}/symbols/system/lib/egl:./out/target/product/{device_name}/symbols/system/lib/soundfx:./out/target/product/{device_name}/symbols/vendor/lib/:./out/target/product/{device_name}/symbols/vendor/lib/hw:./out/target/product/{device_name}/symbols/vendor/lib/egl.

(gdb) show solib-absolute-prefix
The current system root is "./out/target/product/{device_name}/symbols".

(gdb) show sysroot
The current system root is "./out/target/product/{device_name}/symbols".

留言