比如Mac上的Crash

Process:               Tutorial [18372]
Path:                  /Users/USER/Downloads/*/Tutorial.app/Contents/MacOS/Tutorial
Identifier:            com.mydemo.Tutorial
Version:               1.0 (1)
Code Type:             X86-64 (Native)
Parent Process:        ??? [1]
Responsible:           Tutorial [18372]
User ID:               502

Date/Time:             2021-03-22 11:40:53.133 +0800
OS Version:            macOS 11.2.1 (20D74)
Report Version:        12

Time Awake Since Boot: 910000 seconds
Time Since Wake:       9000 seconds

System Integrity Protection: enabled

Crashed Thread:        27  CaptureThread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       EXC_I386_GPFLT
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Segmentation fault: 11
Termination Reason:    Namespace SIGNAL, Code 0xb
Terminating Process:   exc handler [18372]

Thread 0:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib          0x00007fff2054ae7e mach_msg_trap + 10
1   libsystem_kernel.dylib          0x00007fff2054b1f0 mach_msg + 60
2   com.apple.CoreFoundation        0x00007fff20677bf7 __CFRunLoopServiceMachPort + 316
3   com.apple.CoreFoundation        0x00007fff206762ca __CFRunLoopRun + 1315
4   com.apple.CoreFoundation        0x00007fff206756ce CFRunLoopRunSpecific + 563
5   com.apple.HIToolbox             0x00007fff288fd630 RunCurrentEventLoopInMode + 292
6   com.apple.HIToolbox             0x00007fff288fd42c ReceiveNextEventCommon + 709
7   com.apple.HIToolbox             0x00007fff288fd14f _BlockUntilNextEventMatchingListInModeWithFilter + 64
8   com.apple.AppKit                0x00007fff22e959b1 _DPSNextEvent + 883
9   com.apple.AppKit                0x00007fff22e94177 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1366
10  com.apple.AppKit                0x00007fff22e8668a -[NSApplication run] + 586
11  com.apple.AppKit                0x00007fff22e5a96f NSApplicationMain + 816
12  libdyld.dylib                   0x00007fff2059a621 start + 1

Thread 25:
0   libsystem_pthread.dylib         0x00007fff2057b458 start_wqthread + 0

Thread 26:
0   libsystem_kernel.dylib          0x00007fff2054d8e2 __psynch_cvwait + 10
1   libsystem_pthread.dylib         0x00007fff2057fe6f _pthread_cond_wait + 1254
2   libc++.1.dylib                  0x00007fff204e6d83 std::__1::condition_variable::__do_timed_wait(std::__1::unique_lock<std::__1::mutex>&, std::__1::chrono::time_point<std::__1::chrono::system_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 93
3   com.mydemoSdk            0x00000001024bcf15 0x101c85000 + 8617749
4   com.mydemoSdk             0x00000001024bcd2c 0x101c85000 + 8617260
5   libsystem_pthread.dylib         0x00007fff2057f950 _pthread_start + 224
6   libsystem_pthread.dylib         0x00007fff2057b47b thread_start + 15

Thread 27 Crashed:: CameraCaptureOutputThread
0   com.mydemoSdk             0x00000001024c59d4 0x101c85000 + 8653268
1   com.mydemoSdk            0x00000001024b0cfa 0x101c85000 + 8568058
2   com.mydemoSdk            0x00000001024b2694 0x101c85000 + 8574612
3   com.mydemoSdk            0x00000001024b8920 0x101c85000 + 8599840
4   com.mydemoSdk            0x0000000102568bc7 0x101c85000 + 9321415
5   com.mydemoSdk            0x000000010256a039 0x101c85000 + 9326649
6   com.mydemoSdk            0x00000001020d2fb9 0x101c85000 + 4513721
7   com.mydemoSdk            0x00000001020d30cc 0x101c85000 + 4513996
8   libsystem_pthread.dylib         0x00007fff2057f950 _pthread_start + 224
9   libsystem_pthread.dylib         0x00007fff2057b47b thread_start + 15

分析Log

从上面的crash log看，程序crash在了线程CaptureThread（“Crashed Thread: 27 CaptureThread”）里面。
我们往下找“Thread: 27 CaptureThread”就可以看到crash的调用栈，这个时候就可以用atos获得在哪个函数里crash了。

atos使用

我们需要“com.mydemoSdk”对应的带符号表的库，比如上面的符号表的库是mydemoSdk.framework.dSYM。
那么执行

atos -o mydemoSdk.framework.dSYM/Contents/Resources/DWARF/mydemoSdk -arch x86_64 -l 0x101c85000 0x00000001024c59d4 0x00000001024b0cfa 0x00000001024b2694 0x00000001024b8920 0x0000000102568bc7 0x000000010256a039 0x00000001020d2fb9 0x00000001020d30cc

-l表示crash的调用栈地址，在后面把调用栈的地址都加上，记得-l第一个设置上（0x101c85000），他是模块加载的基地址，如“0 com.mydemoSdk 0x00000001024c59d4 0x101c85000 + 8653268”， 0x101c85000 就是基地址， 8653268是偏移量，0x00000001024c59d4=0x101c85000 + 8653268。
-arch表示芯片架构，如Mac的intel芯片是x86_64，iOS手机是arm64或armv7。

xcrun直接获得所有的调用栈

atos手动将所有的调用栈地址加上，会比较麻烦，xcrun可以自动获得所有的调用栈。
执行

xcrun atos -o mydemoSdk.framework.dSYM/Contents/Resources/DWARF/mydemoSdk -arch x86_64 -f Tutorial_2021-03-22-114106_B-70KRJ1WT-1802.crash > my.sym.txt

打开my.sym.txt文件，搜索crash的thread名字，就可以看到函数调用栈。