Hooking signals and dumping the callstack

Hooking the signals and dumping the backtraces Thierry GAYET

GOAL  The main goal of this document is to provide some information about the signal handling used for dumping the bacltrace due after a crash.

A backtrace is a list of the function calls that are currently active in a thread. The usual way to inspect a backtrace of a program is to use an external debugger such as gdb. H owever, sometimes it is useful to obtain a backtrace programmatically from within a program, e.g., for the purposes of logging or diagnostics. The header file `execinfo.h' declares three functions that obtain and manipulate backtraces of the current thread.  Function: int backtrace(void **buffer, int size) The backtrace function obtains a backtrace for the current thread, as a list of pointers, and places the information into buffer. The argument size should be the number of void * elements that will fit into buffer. The return value is the actual number of entries of buffer that are obtained, and is at most size. The pointers placed in buffer are actually return addresses obtained by inspecting the stack, one return address per stack frame. Note that certain compiler optimizations may interfere with obtaining a valid backtrace. Function inlining causes the inlined function to not have a stack frame; tail call optimization replaces one stack frame with another; frame pointer elimination will stop backtrace from interpreting the stack contents correctly. Usage

 Function: char ** backtrace_symbols (void *const *buffer, int size) The backtrace_symbols function translates the information obtained from the backtrace function into an array of strings. The argument buffer should be a pointer to an array of addresses obtained via the backtrace function, and size is the number of entries in that array (the return value of backtrace). The return value is a pointer to an array of strings, which has size entries just like the array buffer. Each string contains a printable representation of the corresponding element of buffer. It includes the function name (if this can be determined), an offset into the function, and the actual return address (in hexadecimal). Currently, the function name and offset only be obtained on systems that use the ELF binary format for programs and libraries. On other systems, only the hexadecimal return address will be present. Also, you may need to pass additional flags to the linker to make the function names available to the program. (For example, on systems using GNU ld, you must pass (-rdynamic.) The return value of backtrace_symbols is a pointer obtained via the malloc function, and it is the responsibility of the caller to free that pointer. Note that only the return value need be freed, not the individual strings. The return value is NULL if sufficient memory for the strings cannot be obtained. Usage

 Function: void backtrace_symbols_fd (void *const *buffer, int size, int fd) The backtrace_symbols_fd function performs the same translation as the function backtrace_symbols function. Instead of returning the strings to the caller, it writes the strings to the file descriptor fd, one per line. It does not use the malloc function, and can therefore be used in situations where that function might fail. The following program illustrates the use of these functions. Note that the array to contain the return addresses returned by backtrace is allocated on the stack. Therefore code like this can be used in situations where the memory handling via malloc does not work anymore (in which case the backtrace_symbols has to be replaced by a backtrace_symbols_fd call as well). The number of return addresses is normally not very large. Even complicated programs rather seldom have a nesting level of more than, say, 50 and with 200 possible entries probably all programs should be covered. Usage

#include <execinfo.h> #include <stdio.h> #include <stdlib.h> /* Obtain a backtrace and print it to stdout. */ void print_trace(void) { void* array[10]; size_t size; char** strings; size_t i; size = backtrace(array, 10); strings = backtrace_symbols(array, size); printf ("Obtained %zd stack frames.\n", size); for (i = 0; i < size; i++) { printf ("%s\n", strings[i]); } /* FOR */ free (strings); } /* print_trace */ /* A dummy function to make the backtrace more interesting. */ void dummy_function(void) { print_trace(); } /* dummy_function */ Int main(void) { dummy_function (); return 0; } First example

#include <stdio.h> #include <stdlib.h> #include <signal.h> #include <unistd.h> #include <sys/times.h> #include <sys/ucontext.h> #include <asm/unistd.h> #include <execinfo.h> struct dict_entry { int num; const char *s; }; #define DICT_ENTRY_END { -1, NULL } #define PRINTF(fmt...) fprintf(stderr,fmt); static int mainpid=0; /* * Simple dictionary * Search an array terminated by an entry with s field set to NULL * If number not found, return "(unknown)" string */ static const char * search_dict(const struct dict_entry *dict, int num) { const struct dict_entry *p = dict; while (p->s) { if (num == p->num) return p->s; p++; } return "(unknown)"; } Second example 1/6

static const struct dict_entry sig_names[] = { {SIGHUP, "SIGHUP"}, {SIGINT, "SIGINT"}, {SIGQUIT, "SIGQUIT"}, {SIGILL, "SIGILL"}, {SIGTRAP, "SIGTRAP"}, {SIGABRT, "SIGABRT"}, {SIGBUS, "SIGBUS"}, {SIGFPE, "SIGFPE"}, {SIGKILL, "SIGKILL"}, {SIGSEGV, "SIGSEGV"}, {SIGPIPE, "SIGPIPE"}, {SIGALRM, "SIGALRM"}, {SIGTERM, "SIGTERM"}, {SIGSTKFLT, "SIGSTKFLT"}, {SIGCHLD, "SIGCHLD"}, {SIGCONT, "SIGCONT"}, {SIGSTOP, "SIGSTOP"}, {SIGTSTP, "SIGTSTP"}, {SIGTTIN, "SIGTTIN"}, {SIGTTOU, "SIGTTOU"}, {SIGURG, "SIGURG"}, {SIGXCPU, "SIGXCPU"}, {SIGXFSZ, "SIGXFSZ"}, {SIGVTALRM, "SIGVTALRM"}, {SIGPROF, "SIGPROF"}, {SIGWINCH, "SIGWINCH"}, {SIGPOLL, "SIGPOLL"}, {SIGPWR, "SIGPWR"}, {SIGSYS, "SIGSYS"}, DICT_ENTRY_END }; Second example 2/6

static void show_stack() { void *trace[16]; char **messages = (char **)NULL; int i, trace_size = 0; trace_size = backtrace(trace, 16); /* overwrite sigaction with caller's address */ messages = backtrace_symbols(trace, trace_size); /* skip first stack frame (points here) */ printf("CALLSTACK:\n"); for (i=1; i<trace_size; ++i) printf("%s\n", messages[i]); free (messages); } Second example 3/6

Second example 4/6 void sigdemux(int sig, struct siginfo *si, void *v) { const char *signame; //struct ucontext *sc=(struct ucontext *)v; //struct sigcontext *regs; int si_code; si_code = si->si_code & 0xffff; signame = search_dict(sig_names, sig); if (sig != SIGINT) { PRINTF("\n!==========================!\n"); PRINTF("SIG %s (#%i) received in PID %ld\n",signame,sig,syscall(__NR_gettid)); PRINTF("Errno\t%i\nPID\t%i\naddr\t0x%08x\n\n", (int)si->si_errno, (int)si->si_pid, (int)si->si_addr); show_stack(); PRINTF("\n!==========================!\n"); kill(mainpid,SIGINT); exit(-1); } if (getpid()==mainpid) { exit(0); } return; }

Second example 5/6 int sig_init(int pid) { struct sigaction si_segv; int rc; si_segv.sa_sigaction = sigdemux; si_segv.sa_flags = SA_SIGINFO; mainpid=pid; rc = sigaction(SIGINT,&si_segv,NULL); if (rc<0) { goto sig_error; } rc = sigaction(SIGSEGV,&si_segv,NULL); if (rc<0) { goto sig_error; } rc = sigaction(SIGILL,&si_segv,NULL); if (rc<0) { goto sig_error; } rc = sigaction(SIGFPE,&si_segv,NULL); if (rc<0) { goto sig_error; } rc = sigaction(SIGBUS,&si_segv,NULL); if (rc<0) { goto sig_error; } rc = sigaction(SIGPIPE,&si_segv,NULL); if (rc<0) { goto sig_error; } sig_error: return rc; }

 The behavior is quite easy, 'cos there is just a registry at the beginning of the process : int main(int argc, char* argv[], char* env[]) (...) sig_init(getpid()) (...) Usage of the second source code (6/6)

The processed crashed I got automatically following stack trace: !==========================! SIG SIGSEGV (#11) received in PID 2794 Errno 0 PID 0 addr 0x00000000 Got signal faulty address is (nil), from 0xb750bca4 [bt] Execution path: [bt] /usr/lib/libsystem_api_adapter_configuration_repository.so.1(_ZN26DbusLocalStorageRepository7getItemERKSs+0x3a) [0xb750bca4] [bt] [0xffffe40c] [bt] /usr/lib/libsystem_api_adapter_configuration_repository.so.1(_ZN26DbusLocalStorageRepository7getItemERKSs+0x3a) [0xb750bca4] [bt] /usr/lib/libsystem_api_adapter_configuration_repository.so.1(_ZN3com11Technicolor23ConfigurationRepository30LocalStorageRepository_adaptor13_getItem_stubERKN4DBus11CallMessageE+0x6d) [0xb750cac9] [bt] /usr/lib/libsystem_api_adapter_configuration_repository.so.1(_ZNK4DBus8CallbackIN3com11Technicolor23ConfigurationRepository30LocalStorageRepository_adaptorENS_7MessageERKNS_11CallMessageEE4callES8_+0x60) [0xb750f23c] [bt] /usr/lib/libdbus-c++-1.so.0(_ZN4DBus16InterfaceAdaptor15dispatch_methodERKNS_11CallMessageE+0x135) [0xb6f669f5] [bt] /usr/lib/libdbus-c++-1.so.0(_ZN4DBus13ObjectAdaptor14handle_messageERKNS_7MessageE+0xd0) [0xb6f6d0a0] [bt] /usr/lib/libdbus-c++-1.so.0(_ZN4DBus13ObjectAdaptor7Private21message_function_stubEP14DBusConnectionP11DBusMessagePv+0xb9) [0xb6f6b509] [bt] /usr/lib/libdbus-1.so.3(+0x1822f) [0xb6f3122f] [bt] /usr/lib/libdbus-1.so.3(dbus_connection_dispatch+0x365) [0xb6f244cd] [bt] /usr/lib/libdbus-c++-1.so.0(+0x1c280) [0xb6f73280] [bt] /usr/lib/libdbus-c++-1.so.0(_ZN4DBus10Dispatcher16dispatch_pendingEv+0x4e) [0xb6f7b94e] [bt] /usr/lib/libdbus-c++-1.so.0(_ZN4DBus13BusDispatcher12do_iterationEv+0x23) [0xb6f82653] [bt] /usr/lib/libdbus-c++-1.so.0(_ZN4DBus13BusDispatcher5enterEv+0x40) [0xb6f82370] [bt] /usr/lib/libsystem_api_adapter_dbus.so.1(+0x6e0f) [0xb703ce0f] [bt] [0x12] [bt] /lib/libc.so.6(clone+0x5e) [0xb6cec8de] I can see that function that crashed was well DbusLocalStorageRepositorygetItem function. Result

More help http://www.delorie.com/gnu/docs/glibc/libc_665.html

Hooking signals and dumping the callstack

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Hooking signals and dumping the callstack (20)

Recently uploaded (20)

Hooking signals and dumping the callstack