尝试定位一个程序的core dump

[复制链接]
 楼主| keer_zu 发表于 2022-11-4 17:14 | 显示全部楼层 |阅读模式
1. 拿到这个程序的coredump文件。

我的在/var/log下:xxx_18.core,18是最新编号。

然后使用gdb:

  1. $ gdb ngw ngw.18.core
  2. GNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1
  3. Copyright (C) 2018 Free Software Foundation, Inc.
  4. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
  5. This is free software: you are free to change and redistribute it.
  6. There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
  7. and "show warranty" for details.
  8. This GDB was configured as "x86_64-linux-gnu".
  9. Type "show configuration" for configuration details.
  10. For bug reporting instructions, please see:
  11. <http://www.gnu.org/software/gdb/bugs/>.
  12. Find the GDB manual and other documentation resources online at:
  13. <http://www.gnu.org/software/gdb/documentation/>.
  14. For help, type "help".
  15. Type "apropos word" to search for commands related to "word"...
  16. Reading symbols from ngw...done.

  17. warning: exec file is newer than core file.
  18. [New LWP 1]
  19. [New LWP 2]

  20. warning: Unexpected size of section `.reg/1' in core file.

  21. warning: Unexpected size of section `.reg2/1' in core file.
  22. Program terminated with signal SIGSEGV, Segmentation fault.

  23. warning: Unexpected size of section `.reg/1' in core file.

  24. warning: Unexpected size of section `.reg2/1' in core file.
  25. #0  0x100bed98 in ?? ()
  26. [Current thread is 1 (LWP 1)]
  27. (gdb) p main
  28. $1 = {int (void)} 0xbe30 <main()>


 楼主| keer_zu 发表于 2022-11-4 17:18 | 显示全部楼层
另一方面反汇编可执行文件xxx。

  1. $ aarch64-linux-gnu-objdump -ID -C -S  ./xxx > d-xxx.txt
得到反汇编代码:

526216364d89892512.png

在这里面可以找到函数的地址,就像上面main的。
接下来尝试寻找core dump的地址
您需要登录后才可以回帖 登录 | 注册

本版积分规则

个人签名:qq群:49734243 Email:zukeqiang@gmail.com

1474

主题

12900

帖子

55

粉丝
快速回复 返回顶部 返回列表