手动解析App dSYM示例

前期准备

1. 崩溃日志地址(涉及敏感数据已屏蔽)
2. 对应app 的 dSYM文件，利用dwarfdump --uuid <file_to_detect>检测dSYM文件uuid和app执行文件uuid是否匹配

$ dwarfdump --uuid APP_BUNDLE_NAME.app.dSYM

UUID: F181E27B-CE37-3525-93FD-DC3A16827D20 (armv7) APP_BUNDLE_NAME.app.dSYM/Contents/Resources/DWARF/APP_BUNDLE_NAME
UUID: 3D16DCD2-749C-3D41-BEF1-333E55AA28BB (arm64) APP_BUNDLE_NAME.app.dSYM/Contents/Resources/DWARF/APP_BUNDLE_NAME

$ dwarfdump --uuid APP_BUNDLE_NAME/Payload/APP_BUNDLE_NAME.app/APP_BUNDLE_NAME 

UUID: F181E27B-CE37-3525-93FD-DC3A16827D20 (armv7) APP_BUNDLE_NAME/Payload/APP_BUNDLE_NAME.app/APP_BUNDLE_NAME
UUID: 3D16DCD2-749C-3D41-BEF1-333E55AA28BB (arm64) APP_BUNDLE_NAME/Payload/APP_BUNDLE_NAME.app/APP_BUNDLE_NAME

出错堆栈

0 libobjc.A.dylib   0x00000001941bbbdc objc_msgSend + 28
1 UIKit 0x00000001885f0f74 0x00000001881fc000 + 4149108
2 UIKit 0x00000001882e5bec 0x00000001881fc000 + 957420
3 UIKit 0x00000001882e5960 0x00000001881fc000 + 956768
4 UIKit 0x00000001882ec5e0 0x00000001881fc000 + 984544
5 UIKit 0x00000001882095f8 0x00000001881fc000 + 54776
6 UIKit 0x000000018822aa34 0x00000001881fc000 + 191028
7 UIKit 0x0000000188209310 0x00000001881fc000 + 54032
8 UIKit 0x0000000188209310 0x00000001881fc000 + 54032
9 UIKit 0x000000018822aa34 0x00000001881fc000 + 191028
10 UIKit    0x0000000188209310 0x00000001881fc000 + 54032
11 UIKit    0x0000000188209310 0x00000001881fc000 + 54032
12 UIKit    0x0000000188209310 0x00000001881fc000 + 54032
13 UIKit    0x0000000188209310 0x00000001881fc000 + 54032
14 UIKit    0x0000000188209310 0x00000001881fc000 + 54032
15 UIKit    0x0000000188209310 0x00000001881fc000 + 54032
16 UIKit    0x00000001882089e0 0x00000001881fc000 + 51680
17 Foundation   0x0000000184891908 0x000000018483c000 + 350472
18 UIKit    0x00000001882088a0 0x00000001881fc000 + 51360
19 UIKit    0x00000001882143a0 0x00000001881fc000 + 99232
20 UIKit    0x00000001883000b0 0x00000001881fc000 + 1065136
21 UIKit    0x0000000188344128 0x00000001881fc000 + 1343784
22 UIKit    0x00000001883439f0 0x00000001881fc000 + 1341936
23 UIKit    0x000000018840d5c4 0x00000001881fc000 + 2168260
24 UIKit    0x0000000188241418 0x00000001881fc000 + 283672
25 UIKit    0x000000018840d430 0x00000001881fc000 + 2167856
26 UIKit    0x0000000188241418 0x00000001881fc000 + 283672
27 UIKit    0x000000018822a52c 0x00000001881fc000 + 189740
28 UIKit    0x000000018840d068 0x00000001881fc000 + 2166888
29 UIKit    0x0000000188241418 0x00000001881fc000 + 283672
30 UIKit    0x000000018822a52c 0x00000001881fc000 + 189740
31 UIKit    0x0000000188240db4 0x00000001881fc000 + 282036
32 UIKit    0x0000000188200750 0x00000001881fc000 + 18256
33 CoreFoundation   0x0000000183a16a50 0x0000000183938000 + 911952
34 CoreFoundation   0x0000000183a139dc 0x0000000183938000 + 899548
35 CoreFoundation   0x0000000183a13dbc 0x0000000183938000 + 900540
36 CoreFoundation   0x00000001839410a4 CFRunLoopRunSpecific + 396
37 GraphicsServices 0x000000018cadb5a4 GSEventRunModal + 168
38 UIKit    0x0000000188272aa4 UIApplicationMain + 1488
39 APP_BUNDLE_NAME  0x0000000100327938 0x00000001000a0000 + 2652472
40 libdyld.dylib    0x0000000194816a08 0x0000000194814000 + 10760

分析数据

• Stack Address（栈地址）: 0x0000000100327938
• Load Address（首地址）: 0x00000001000a0000
• Slide Value（32位虚拟地址）: 0x00004000
• Slide Value（64位虚拟地址）: 0x0000000100000000
• Symbol Offset（偏移量）: 2652472
• File Address（32位文件地址）: 0x28B938
• File Address（64位文件地址）: 0x100287938

注意虚拟地址区分32位（LC_SEGMENT）和64位（LC_SEGMENT_64）段的不同

数据关系说明

数据关系说明

获取虚拟地址

对于 ATOS，它会主动帮你计算虚拟地址，只要你提供了首地址和栈地址；对于 dwarfdump 和 lldb 而言，它们需要使用文件地址，所以还需要虚拟地址。我们可以使用 otool来获取 dSYM 文件中的虚拟地址。

$ otool -l APP_BUNDLE_NAME.app.dSYM/Contents/Resources/DWARF/APP_BUNDLE_NAME

     ...
Load command 3
      cmd LC_SEGMENT
  cmdsize 736
  segname __TEXT
   vmaddr 0x00004000
   vmsize 0x00c3c000
  fileoff 0
 filesize 0
  maxprot 0x00000005
 initprot 0x00000005
   nsects 10
    flags 0x0
     ...
Load command 3
      cmd LC_SEGMENT_64
  cmdsize 952
  segname __TEXT
   vmaddr 0x0000000100000000
   vmsize 0x0000000000d94000
  fileoff 0
 filesize 0
  maxprot 0x00000005
 initprot 0x00000005
   nsects 11
    flags 0x0
     ...

使用ATOS进行符号化

atos -arch \<architecture\> -o \<binary filename\> -l \<load address\> \<stack address 1\> \<stack address 2\> ...

$ atos -arch arm64 -o APP_BUNDLE_NAME.app.dSYM/Contents/Resources/DWARF/APP_BUNDLE_NAME 
-l 0x00000001000a0000 0x0000000100327938

main (in ) (main.m:14)

使用lldb进行符号化

(lldb) target create --arch arm64 ./APP_BUNDLE_NAME.app.dSYM/Contents/Resources/DWARF/APP_BUNDLE_NAME

Current executable set to './APP_BUNDLE_NAME.app.dSYM/Contents/Resources/DWARF/APP_BUNDLE_NAME' (arm64).

(lldb) image lookup --address 0x100287938

      Address: APP_BUNDLE_NAME[0x0000000100287938] (APP_BUNDLE_NAME.__TEXT.__text + 2632468)
      Summary: APP_BUNDLE_NAME`main + 88 at main.m:14

使用dwarfdump进行符号化

$ dwarfdump --lookup 0x100287938 --arch arm64 APP_BUNDLE_NAME.app.dSYM

----------------------------------------------------------------------
 File: APP_BUNDLE_NAME.app.dSYM/Contents/Resources/DWARF/APP_BUNDLE_NAME (arm64)
----------------------------------------------------------------------
Looking up address: 0x0000000100287938 in .debug_info... found!

0x002942c4: Compile Unit: length = 0x0000024d  version = 0x0002  
abbr_offset = 0x00000000  addr_size = 0x08  (next CU at 0x00294515)

0x002942cf: TAG_compile_unit [106] *
             AT_producer( "Apple LLVM version 8.1.0 (clang-802.0.38)" )
             AT_language( DW_LANG_ObjC )
             AT_name( "/Users/user/APP_PROJECT_NAME/APP_PROJECT_NAME/main.m" )
             AT_stmt_list( 0x00128d9d )
             AT_comp_dir( "/Users/user/APP_PROJECT_NAME" )
             AT_APPLE_optimized( 0x01 )
             AT_APPLE_major_runtime_vers( 0x02 )
             AT_low_pc( 0x00000001002878d8 )
             AT_high_pc( 0x0000000100287960 )

0x00294480:     TAG_subprogram [226] *
                 AT_low_pc( 0x00000001002878e0 )
                 AT_high_pc( 0x0000000100287960 )
                 AT_frame_base( reg29 )
                 AT_name( "main" )
                 AT_decl_file( "/Users/user/APP_PROJECT_NAME/APP_PROJECT_NAME/main.m" )
                 AT_decl_line( 12 )
                 AT_prototyped( 0x01 )
                 AT_type( {0x002944c7} ( int ) )
                 AT_external( 0x01 )
                 AT_APPLE_optimized( 0x01 )
Line table dir : '/Users/user/APP_PROJECT_NAME/APP_PROJECT_NAME'
Line table file: 'main.m' line 14, column 16 with start address 0x0000000100287924

Looking up address: 0x0000000100287938 in .debug_frame... not found.