• Android NDK JNI 开发native层崩溃日志栈分析 空指针异常（Cause: null pointer dereference）

    问题：

    在Android的JNI开发中，你是否看到如下一堆崩溃日志，不知如何下手分析问题，崩溃在哪一行？

    1. 11-16 17:20:44.844 23077 23077 W test_jni_h: jni_preload: Starting for process=ln
    2. 11-16 17:20:44.844 23077 23077 W test_jni_h: jni_preload: =============================== Call doJniMain()
    3. 11-16 17:20:44.844 23077 23077 W test_jni_h: doJniMain: Starting for process=ln, isHook=CONFIG:VPN:SE_MAIN:SIG:PT1:AES, is_preload=1
    4. 11-16 17:20:44.845 23077 23077 F libc    : Fatal signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0 in tid 23077 (ln), pid 23077 (ln)
    5. 11-16 17:20:44.857  2599  5691 I MiuiNetworkPolicy: bandwidth: 15 KB/s, Max bandwidth: 1846 KB/s
    6.  
    7. ....
    8. 11-16 17:20:44.892 23080 23080 I crash_dump64: obtaining output fd from tombstoned, type: kDebuggerdTombstoneProto
    9. 11-16 17:20:44.893  1120  1120 I tombstoned: received crash request for pid 23077
    10. 11-16 17:20:44.895 23080 23080 I crash_dump64: performing dump of process 23077 (target tid = 23077)
    11. 11-16 17:20:44.902 23081 23081 E .android.camera: Not starting debugger since process cannot load the jdwp agent.
    12.  
    13. ....
    14. 11-16 17:20:45.103 23080 23080 F DEBUG   : *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
    15. 11-16 17:20:45.103 23080 23080 F DEBUG   : Build fingerprint: 'Xiaomi/cupid/cupid:13/TKQ1.220807.001/V14.0.8.0.TLCCNXM:user/release-keys'
    16. 11-16 17:20:45.103 23080 23080 F DEBUG   : Revision: '0'
    17. 11-16 17:20:45.103 23080 23080 F DEBUG   : ABI: 'arm64'
    18. 11-16 17:20:45.103 23080 23080 F DEBUG   : Timestamp: 2023-11-16 17:20:44.913140070+0800
    19. 11-16 17:20:45.103 23080 23080 F DEBUG   : Process uptime: 2s
    20. 11-16 17:20:45.103 23080 23080 F DEBUG   : ZygotePid: 108306913
    21. 11-16 17:20:45.103 23080 23080 F DEBUG   : Cmdline: ln -s /data/app/~~yJTBwDTAb9UQbvJ96gDx8g==/com.test.zwwx-ZA2ckl4hnybAXhmaCpjn7Q==/lib/arm64/libtbs.libtencentpos.so.so /data/user/0/com.test.zwwx/app_tbs_64/core_static_tbs_tmp/libtencentpos.so
    22. 11-16 17:20:45.103 23080 23080 F DEBUG   : pid: 23077, tid: 23077, name: ln  >>> ln <<<
    23. 11-16 17:20:45.103 23080 23080 F DEBUG   : uid: 10398
    24. 11-16 17:20:45.103 23080 23080 F DEBUG   : tagged_addr_ctrl: 0000000000000001 (PR_TAGGED_ADDR_ENABLE)
    25. 11-16 17:20:45.103 23080 23080 F DEBUG   : pac_enabled_keys: 000000000000000f (PR_PAC_APIAKEY, PR_PAC_APIBKEY, PR_PAC_APDAKEY, PR_PAC_APDBKEY)
    26. 11-16 17:20:45.103 23080 23080 F DEBUG   : signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000000
    27. 11-16 17:20:45.103 23080 23080 F DEBUG   : Cause: null pointer dereference
    28. 11-16 17:20:45.103 23080 23080 F DEBUG   :     x0  0000000000000000  x1  0000000000000073  x2  0000000000000000  x3  0000000000000000
    29. 11-16 17:20:45.103 23080 23080 F DEBUG   :     x4  00000000c0300c03  x5  0000000040100401  x6  000000000000003c  x7  62682e6d6f632f30
    30. 11-16 17:20:45.103 23080 23080 F DEBUG   :     x8  b400007170487fb2  x9  0000000000000001  x10 000000003a534947  x11 000000003a534947
    31. 11-16 17:20:45.103 23080 23080 F DEBUG   :     x12 000000003a534947  x13 0000000000000050  x14 000000004749533a  x15 000000003a565000
    32. 11-16 17:20:45.103 23080 23080 F DEBUG   :     x16 00000071f0d81ab0  x17 00000071f0d00200  x18 0000007225754000  x19 0000007204c0c2f8
    33. 11-16 17:20:45.103 23080 23080 F DEBUG   :     x20 0000007204d0e000  x21 0000007204cd2000  x22 0000007fd4689e8b  x23 0000007204d0e000
    34. 11-16 17:20:45.104 23080 23080 F DEBUG   :     x24 0000007fd4689e8b  x25 0000007204cd0000  x26 0000007fd4689f10  x27 0000007fd4689e40
    35. 11-16 17:20:45.104 23080 23080 F DEBUG   :     x28 0000007204c02000  x29 0000007fd4686090
    36. 11-16 17:20:45.104 23080 23080 F DEBUG   :     lr  00000071f0d509ec  sp  0000007fd4686090  pc  00000071f0d00270  pst 0000000040001000
    37. 11-16 17:20:45.104 23080 23080 F DEBUG   : backtrace:
    38. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #00 pc 0000000000086270  /apex/com.android.runtime/lib64/bionic/libc.so (__strchr_aarch64+112) (BuildId: 607a29162b319a50c57abd2b2141d335)
    39. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #01 pc 00000000000d69e8  /apex/com.android.runtime/lib64/bionic/libc.so (strstr+28) (BuildId: 607a29162b319a50c57abd2b2141d335)
    40. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #02 pc 0000000000086ffc  /data/app/~~yJTBwDTAb9UQbvJ96gDx8g==/com.test.zwwx-ZA2ckl4hnybAXhmaCpjn7Q==/lib/arm64/libtest64.so
    41. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #03 pc 0000000000074f28  /data/app/~~yJTBwDTAb9UQbvJ96gDx8g==/com.test.zwwx-ZA2ckl4hnybAXhmaCpjn7Q==/lib/arm64/libtest64.so
    42. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #04 pc 0000000000054078  /data/app/~~yJTBwDTAb9UQbvJ96gDx8g==/com.test.zwwx-ZA2ckl4hnybAXhmaCpjn7Q==/lib/arm64/libtest64.so
    43. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #05 pc 0000000000054a3c  /data/app/~~yJTBwDTAb9UQbvJ96gDx8g==/com.test.zwwx-ZA2ckl4hnybAXhmaCpjn7Q==/lib/arm64/libtest64.so
    44. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #06 pc 0000000000052b28  /apex/com.android.runtime/bin/linker64 (__dl__ZN6soinfo17call_constructorsEv+752) (BuildId: 92b6d7d677c276f6b53d86e83a2c0bc0)
    45. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #07 pc 00000000000528d0  /apex/com.android.runtime/bin/linker64 (__dl__ZN6soinfo17call_constructorsEv+152) (BuildId: 92b6d7d677c276f6b53d86e83a2c0bc0)
    46. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #08 pc 00000000000b7a08  /apex/com.android.runtime/bin/linker64 (__dl__ZL29__linker_init_post_relocationR19KernelArgumentBlockR6soinfo+4204) (BuildId: 92b6d7d677c276f6b53d86e83a2c0bc0)
    47. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #09 pc 00000000000b6944  /apex/com.android.runtime/bin/linker64 (__dl___linker_init+832) (BuildId: 92b6d7d677c276f6b53d86e83a2c0bc0)
    48. 11-16 17:20:45.104 23080 23080 F DEBUG   :       #10 pc 00000000000554c8  /apex/com.android.runtime/bin/linker64 (__dl__start+8) (BuildId: 92b6d7d677c276f6b53d86e83a2c0bc0)
    49. 11-16 17:20:45.104 22354 22584 W weworklocal: [22354:22584:1116/17:20:45.104:W:(tcp_connection.cpp:132)] GapTcpConnection(0): Performing destruction reset
    50. 11-16 17:20:45.104 22354 22584 I pjsip:  : [, , 0]:fd_list_del:173
    51.  
    52. .....
    53. 11-16 17:20:45.154 23081 23118 D CAM_HybridZoomingSystem: [1.0, 2.0]
    54. 11-16 17:20:45.157  2599  6270 W NativeCrashListener: Couldn't find ProcessRecord for pid 23077

    别着急，请看本文即可轻松拿捏Native层的崩溃栈。

    准本分析

    实际上android已经为开发者提供了崩溃栈的分析工具: ndk-stack。

    准备一下三个东西：

    1. 准备分析工具：

    ndk工具，由于使用ndk开发jni并编译，一定有这个工具了。

    2. 需要分析的so文件:

    在你编译项目的输出目录下，比如Android.mk编译出来的目录为：

    工程根目录下的...xxx/xxx/Demo/obj/local/， 里面有armeabi-v7a和arm64-v8a等等子目录，Cmake编译的在 build output（自己研究下）。

    在...xxx/xxx/Demo/obj/local/当前目录下执行也可，也可以直接拷贝出来在某个自己的目录下。

    3. 崩溃栈日志：

    把adb logcat 抓出来的本亏日志文件（如果太多，可以直接去一个完整的崩溃栈）拷贝到分析目录下。 注：不在分析目录下分析就放在任意地方，能找到就行。

    分析问题

    下面以分析arm64-v8a目录下的

    在...xxx/xxx/Demo/obj/local/打开Terminal终端，执行命令：

     ndk-stack -sym arm64-v8a/ -dump arm64-v8a/hook_preload_fatal_log.txt

    1. 执行命令
    2. 		user@hulk-shell_test-shell_test_vpn:~/projects/shell_test/shell_test_vpn/encap/shell_test/mam/ShellTest/obj/local$
    3. 		user@hulk-shell_test-shell_test_vpn:~/projects/shell_test/shell_test_vpn/encap/shell_test/mam/ShellTest/obj/local$ ndk-stack -sym arm64-v8a/ -dump arm64-v8a/hook_preload_fatal_log.txt
    4. 				********** Crash dump: **********
    5. 		Build fingerprint: 'Xiaomi/cupid/cupid:13/TKQ1.220807.001/V14.0.8.0.TLCCNXM:user/release-keys'
    6. 		pid: 23077, tid: 23077, name: ln  >>> ln <<<
    7. 				signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0000000000000000
    8. 		Stack frame #00 pc 0000000000086270  /apex/com.android.runtime/lib64/bionic/libc.so (__strchr_aarch64+112) (BuildId: 607a29162b319a50c57abd2b2141d335)
    9. 		Stack frame #01 pc 00000000000d69e8  /apex/com.android.runtime/lib64/bionic/libc.so (strstr+28) (BuildId: 607a29162b319a50c57abd2b2141d335)
    10. 		Stack frame #02 pc 0000000000086ffc  /data/app/~~yJTBwDTAb9UQbvJ96gDx8g==/com.test.zwwx-ZA2ckl4hnybAXhmaCpjn7Q==/lib/arm64/libtest64.so: Routine is_shell_test at /home/user/projects/shell_test/shell_test_vpn/encap/shell_test/mam/ShellTest/jni/./enc_dec.c:8701
    11. 		Stack frame #03 pc 0000000000074f28  /data/app/~~yJTBwDTAb9UQbvJ96gDx8g==/com.test.zwwx-ZA2ckl4hnybAXhmaCpjn7Q==/lib/arm64/libtest64.so: Routine initPackageName(char*) at /home/user/projects/shell_test/shell_test_vpn/encap/shell_test/mam/ShellTest/jni/./app-context.cc:231
    12. 		Stack frame #04 pc 0000000000054078  /data/app/~~yJTBwDTAb9UQbvJ96gDx8g==/com.test.zwwx-ZA2ckl4hnybAXhmaCpjn7Q==/lib/arm64/libtest64.so: Routine doJniMainExt(char*, char*, char*, char*, char*, char*, char*, char*, char*, char*, char*, char*, char*, int) at /home/user/projects/shell_test/shell_test_vpn/encap/shell_encap/mam/ShellTest/jni/./Java_com_hulk_test_jni_h.cc:400
    13. 		Stack frame #05 pc 0000000000054a3c  /data/app/~~yJTBwDTAb9UQbvJ96gDx8g==/com.test.zwwx-ZA2ckl4hnybAXhmaCpjn7Q==/lib/arm64/libtest64.so: Routine jni_preload() at /home/user/projects/shell_test/shell_test_vpn/encap/shell_test/mam/ShellTest/jni/./Java_com_hulk_test_jni_h.cc:633 (discriminator 12)
    14. 		Stack frame #06 pc 0000000000052b28  /apex/com.android.runtime/bin/linker64 (__dl__ZN6soinfo17call_constructorsEv+752) (BuildId: 92b6d7d677c276f6b53d86e83a2c0bc0)
    15. 		Stack frame #07 pc 00000000000528d0  /apex/com.android.runtime/bin/linker64 (__dl__ZN6soinfo17call_constructorsEv+152) (BuildId: 92b6d7d677c276f6b53d86e83a2c0bc0)
    16. 		Stack frame #08 pc 00000000000b7a08  /apex/com.android.runtime/bin/linker64 (__dl__ZL29__linker_init_post_relocationR19KernelArgumentBlockR6soinfo+4204) (BuildId: 92b6d7d677c276f6b53d86e83a2c0bc0)
    17. 		Stack frame #09 pc 00000000000b6944  /apex/com.android.runtime/bin/linker64 (__dl___linker_init+832) (BuildId: 92b6d7d677c276f6b53d86e83a2c0bc0)
    18. 		Stack frame #10 pc 00000000000554c8  /apex/com.android.runtime/bin/linker64 (__dl__start+8) (BuildId: 92b6d7d677c276f6b53d86e83a2c0bc0)
    19. 		user@hulk-shell_test-shell_test_vpn:~/projects/shell_test/shell_test_vpn/encap/shell_test/mam/ShellTest/obj/local$

    结论

    看上面的执行结果，函数调用关系如下:

    Routine jni_preload() > Routine doJniMainExt() > initPackageName(char*) > is_shell_test() 函数，位于 enc_dec.c:8701 enc_dec文件的8701行么，如下：

    Routine is_shell_test at /home/user/projects/shell_test/shell_test_vpn/encap/shell_test/mam/ShellTest/jni/./enc_dec.c:8701

  • 相关阅读:
    传统 Web 框架部署与迁移
    react中路由版本问题
    RS485和RS232有什么区别？工业网关能用吗？
    java版直播商城免费搭建平台规划及常见的营销模式+电商源码+小程序+三级分销+二次开发
    基于PHP+MySQL高校毕业设计管理系统的设计与实现
    Dubbo详解，用心看这一篇文章就够了【重点】
    @ConfigurationProperties与@Value区别
    STM32单片机PID控制数控恒流源-100mA~+100mA输出正负恒流源
    nginx+lua+redis实现灰度发布
    华为OD机试 - 计算最大乘积（2022Q4 100分）
  • 原文地址：https://blog.csdn.net/zhanghao_Hulk/article/details/134448358