Disclosure of Invention
Aiming at the defects in the prior art, the first aspect of the invention provides a stack backtracking method which is low in implementation difficulty, can quickly and completely backtrack a complete stack and effectively improves the efficiency of stack backtracking.
In order to achieve the above purposes, the technical scheme adopted by the invention is as follows:
a method of stack backtracking, the method comprising the steps of:
recording the stack information, the stack depth and the return address of the function;
determining a return address of the function and a stack address of the parent function through the stack frame address;
when the return address of the function and the stack address of the parent function are both effective, directly updating the return address of the function and the stack address of the parent function, and then continuing backtracking until the call stack backtracking is completed;
when the return address of the function or the stack address of the parent function is invalid, determining and updating the return address of the function and the stack address of the parent function according to the stacking information of the function and the stack depth of the function, and then continuing backtracking until the call stack backtracking is completed.
In some embodiments, when the return address of the function or the stack address of the parent function is invalid, determining and updating the return address of the function and the stack address of the parent function according to the stack entry information of the function and the stack depth of the function, and then continuing the backtracking until the call stack backtracking is completed, the method includes:
when the return address of the function or the stack address of the parent function is invalid, jumping to an abnormal instruction address;
acquiring the stack information of the function and the offset of the return address of the function relative to the stack frame address;
reading the return address of the function through the offset of the return address of the function relative to the stack frame address;
calculating the length of the function stack according to the stacking information of the function to calculate the frame address of the parent function stack;
and updating the return address of the function and the stack address of the parent function, terminating the backtracking if the backtracking is finished, determining the return address of the function and the stack address of the parent function again through the stack frame address if the backtracking is not finished, and continuously backtracking the call stack information until the call stack backtracking is finished.
In some embodiments, said jumping to an excepted instruction address when the return address of the function or the stack address of the parent function is invalid comprises:
setting an abnormal instruction address by using a sigsetjmp function;
when the return address of the function or the stack address of the parent function is invalid, the siglongjmp function is used to jump to an abnormal instruction address.
In some embodiments, when the stack base address is 0 or the maximum level of the call stack to be traced is traced, the tracing end is determined.
In some embodiments, the determining the return address of the function and the stack address of the parent function by the stack frame address includes:
determining the return address of the function according to the position of the current stack frame + 4;
and determining the stack address of the parent function according to the content of the current stack frame.
In some embodiments, the recording the stack entry information, the function stack depth, and the function return address of the function includes:
reading ELF file information, recording the starting address and the ending address of a function, the instruction address of an operation stack in the function, the stack length of the instruction operation, the stack length of the function accumulation operation and the function return address, and generating an information table of the function stack-in and stack-out operation.
In some embodiments, the information table of the function push operation is created in the order of the function instruction addresses from small to large.
The second aspect of the invention provides a stack backtracking device which has low implementation difficulty, can quickly and completely backtrack a complete stack and effectively improves the efficiency of stack backtracking.
In order to achieve the above purposes, the technical scheme adopted by the invention is as follows:
an apparatus for stack backtracking, comprising:
the recording module is used for recording the stack entry information, the function stack depth and the function return address of the function;
the addressing module is used for determining a return address of the function and a stack address of a parent function through a stack frame address;
a backtracking module for, in use,
when the return address of the function and the stack address of the parent function are both effective, directly updating the return address of the function and the stack address of the parent function, and then continuing backtracking until the call stack backtracking is completed;
when the return address of the function or the stack address of the parent function is invalid, determining and updating the return address of the function and the stack address of the parent function according to the stacking information of the function and the stack depth of the function, and then continuing backtracking until the call stack backtracking is completed.
In some embodiments, the backtracking module performs: when the return address of the function or the stack address of the parent function is invalid, according to the stacking information of the function and the stack depth of the function, the return address of the function and the stack address of the parent function are determined and updated, and then backtracking is continued until call stack backtracking is completed, wherein the backtracking method comprises the following steps:
when the return address of the function or the stack address of the parent function is invalid, jumping to an abnormal instruction address;
acquiring the stack information of the function and the offset of the return address of the function relative to the stack frame address;
reading the return address of the function through the offset of the return address of the function relative to the stack frame address;
calculating the length of the function stack according to the stacking information of the function to calculate the frame address of the parent function stack;
and updating the return address of the function and the stack address of the parent function, terminating the backtracking if the backtracking is finished, determining the return address of the function and the stack address of the parent function again through the stack frame address if the backtracking is not finished, and continuously backtracking the call stack information until the call stack backtracking is finished.
In some embodiments, the recording module performs: recording the stack information, the stack depth and the return address of the function, including:
reading ELF file information, recording the starting address and the ending address of a function, the instruction address of an operation stack in the function, the stack length of the instruction operation, the stack length of the function accumulation operation and the function return address, and generating an information table of the function stack-in and stack-out operation.
Compared with the prior art, the invention has the advantages that:
the method for backtracking the stack comprises the steps of creating an information table of function stacking and popping operation, recording stacking information of functions and function stacking depth, directly backtracking the function stack through the stack frame in the process of backtracking the stack with the stack frame structure, and finding the return address and the stack depth of the function and updating the stack base address by inquiring the information of the information table of the function stacking and popping operation if the stack frame structure does not exist, so as to continue backtracking. The method can quickly and completely trace back the complete stack, effectively improves the efficiency of stack tracing, has small implementation difficulty compared with the mode of judging the stack entry information by an instruction analysis method in the prior art, has wide applicability because the reason of cpu instruction difference does not need to be considered, and is suitable for most embedded systems.
Detailed Description
The present invention will be described in further detail with reference to the accompanying drawings and examples.
Referring to fig. 1, an embodiment of the present invention provides a method for stack backtracking, including the following steps:
s1, recording the stack entry information, the function stack depth and the function return address of the function.
In some embodiments, recording the stack information, the stack depth and the return address of the function is realized by creating an information table of the function stack push operation.
Specifically, the information of the ELF file is read first, the ELF file is composed of 4 parts, one of the parts is a section header table, the part records the header table information of the section, and a section records many contents, such as common code segments, data segments, and bss segments, which are found through the section header table, because each record has an offset, the position of the section is found through the offset, so that the partial contents of the section are analyzed.
Reading eh _ frame section information of the ELF file, recording a starting address and an ending address of a function, an instruction address of an operation stack in the function, a stack length of the instruction operation, a stack length of the operation accumulated by the function and a function return address in sequence according to a function instruction address, and generating an information table of function stack-in and stack-out operation until the establishment of all dependent dynamic library information tables is completed.
In some preferred embodiments, the information table of the function push and pull operation is created according to the order from small to large of the function instruction address, and may also be created according to the order from large to small of the function instruction address as needed, which is not limited herein.
And S2, determining the return address of the function and the stack address of the parent function through the stack frame address.
It should be noted that, in some embodiments, the return address of the function is the position of +4 of the current stack frame, and then the stack address of the parent function is found according to the content of the current stack frame.
And S3, when the return address of the function and the stack address of the parent function are both effective, directly updating the return address of the function and the stack address of the parent function, and then continuing backtracking until the call stack backtracking is completed.
And S4, when the return address of the function or the stack address of the parent function is invalid, determining and updating the return address of the function and the stack address of the parent function according to the stacking information of the function and the stack depth of the function, and then continuing backtracking until the call stack backtracking is completed.
Specifically, referring to fig. 2, in some embodiments, step S4 includes the following steps:
s41, when the return address of the function or the stack address of the parent function is invalid, jumping to an abnormal instruction address.
In a specific implementation, the sigsetjmp function may be used to set an exceptional instruction address, and when the return address of the function or the stack address of the parent function is invalid, the siglongjmp function may be used to jump to the exceptional instruction address.
And S42, acquiring the stack entry information of the function and the offset of the return address of the function relative to the stack frame address.
S43, reading the return address of the function through the offset of the return address of the function relative to the stack frame address.
And S44, calculating the length of the function stack increase according to the stacking information of the function to calculate the frame address of the parent function stack.
And S45, updating the return address of the function and the stack address of the parent function, terminating the backtracking if the backtracking is finished, determining the return address of the function and the stack address of the parent function again through the stack frame address if the backtracking is not finished, and continuously backtracking the call stack information until the call stack backtracking is finished.
It should be noted that, if the return address of the function or the stack frame address of the parent function is invalid, the information of the function stack push operation is looked up in the information table of the above function stack push operation by the current function instruction address, and the information table of the function stack push operation returns the current function through the function pointer until the stack length of the instruction address operation and the offset of the return address of the function relative to the stack frame.
And then calculating a stack pointer of the return address of the function according to the offset, reading the return address of the function, updating the stack address of the parent function according to the offset, and then continuing to trace back.
It can be understood that if the return address of the function and the stack address of the parent function are both valid, the return address of the function and the stack address of the parent function are directly updated, and then the backtracking is continued.
In both cases, it is necessary to determine whether to terminate the backtracking, specifically, when the stack base address is 0 or the backtracking is to the set maximum level of the call stack to be backtracked, it is determined that the backtracking is finished.
It is worth noting that the stack base address being 0 means that the call relation of the function has ended. And backtracking to the maximum level, for example, the user needs to backtrack the 10-layer call stack, and if the 10-layer call stack is backtracked, the backtracking is ended.
In summary, the method for stack trace-back of the present invention records the stack information of the function and the stack depth of the function by creating an information table of the function stack pull-in operation, and directly traces back the function stack through the stack frame in the stack trace-back process with the stack frame structure, and if the stack frame structure does not exist, finds the return address and the stack depth of the function and updates the stack base address by querying the information table of the function stack pull-in operation, and continues trace-back. The method can quickly and completely trace back the complete stack, effectively improves the efficiency of stack tracing, has small implementation difficulty compared with the mode of judging the stack entry information by an instruction analysis method in the prior art, has wide applicability because the reason of cpu instruction difference does not need to be considered, and is suitable for most embedded systems.
Correspondingly, the embodiment of the invention also provides a device for stack backtracking, which comprises a recording module, an addressing module and a backtracking module.
The recording module is used for recording the stack entry information, the function stack depth and the function return address of the function. The addressing module is used for determining a return address of the function and a stack address of the parent function through the stack frame address;
the backtracking module is used for: when the return address of the function and the stack address of the parent function are both effective, the return address of the function and the stack address of the parent function are directly updated, and then the backtracking is continued until the call stack backtracking is completed.
When the return address of the function or the stack address of the parent function is invalid, determining and updating the return address of the function and the stack address of the parent function according to the stacking information of the function and the stack depth of the function, and then continuing backtracking until the call stack backtracking is completed.
In some embodiments, the backtracking module performs: when the return address of the function or the stack address of the parent function is invalid, according to the stacking information of the function and the stack depth of the function, the return address of the function and the stack address of the parent function are determined and updated, and then backtracking is continued until call stack backtracking is completed, wherein the backtracking method comprises the following steps:
when the return address of the function or the stack address of the parent function is invalid, a jump is made to the exceptional instruction address. And acquiring the stack pushing information of the function and the offset of the return address of the function relative to the stack frame address. The return address of the function is read by its offset from the stack frame address. And calculating the length of the function stack growth according to the stacking information of the function so as to calculate the frame address of the parent function stack.
And updating the return address of the function and the stack address of the parent function, terminating the backtracking if the backtracking is finished, determining the return address of the function and the stack address of the parent function again through the stack frame address if the backtracking is not finished, and continuously backtracking the call stack information until the call stack backtracking is finished.
Further, when the return address of the function or the stack address of the parent function is invalid, the jump is made to the abnormal instruction address, in a specific implementation, the abnormal instruction address may be set by using a sigsetjmp function, and when the return address of the function or the stack address of the parent function is invalid, the jump is made to the abnormal instruction address by using a siglongijmp function.
Further, in the process of judging whether the backtracking is finished, when the stack base address is 0 or the maximum level of the call stack to be backtracked is backtracked, the backtracking is judged to be finished.
In some embodiments, the addressing module performs: determining a return address of the function and a stack address of the parent function by the stack frame address, comprising:
and determining the return address of the function according to the position of the current stack frame +4, and determining the stack address of the parent function according to the content of the current stack frame.
In some embodiments, the recording module performs: recording the stack information, the stack depth and the return address of the function, including:
reading ELF file information, recording the starting address and the ending address of a function, the instruction address of an operation stack in the function, the stack length of the instruction operation, the stack length of the function accumulation operation and the function return address, and generating an information table of the function stack-in and stack-out operation.
Further, the information table of the function stack-in and stack-out operation is created according to the sequence of the function instruction addresses from small to large.
In summary, the device for stack trace back of the present invention records the stack information of the function and the stack depth of the function by creating an information table for the stack pull-in operation of the function, directly traces back the function stack through the stack frame in the process of stack trace back with the stack frame structure, and finds the return address and the stack depth of the function and updates the stack base address by querying the information table for the stack pull-in operation of the function if the stack frame structure does not exist, and continues trace back. The method can quickly and completely trace back the complete stack, effectively improves the efficiency of stack tracing, has small implementation difficulty compared with the mode of judging the stack entry information by an instruction analysis method in the prior art, has wide applicability because the reason of cpu instruction difference does not need to be considered, and is suitable for most embedded systems.
The present invention is not limited to the above-described embodiments, and it will be apparent to those skilled in the art that various modifications and improvements can be made without departing from the principle of the present invention, and such modifications and improvements are also considered to be within the scope of the present invention. Those not described in detail in this specification are within the skill of the art.