coredump的裁剪方法

发表时间：2024-10-15 07:24:59

coredump的裁剪方法

coredump默认情况下会将进程内的所有匿名内存页给dump出来。

/* coredump filter bits */#define MMF_DUMP_ANON_PRIVATE 2#define MMF_DUMP_ANON_SHARED 3#define MMF_DUMP_MAPPED_PRIVATE 4#define MMF_DUMP_MAPPED_SHARED 5#define MMF_DUMP_ELF_HEADERS 6#define MMF_DUMP_HUGETLB_PRIVATE 7#define MMF_DUMP_HUGETLB_SHARED 8#define MMF_DUMP_FILTER_SHIFT MMF_DUMPABLE_BITS#define MMF_DUMP_FILTER_BITS 7#define MMF_DUMP_FILTER_MASK (((1 0) { if (is_full) { write(fd, "39", 2); /*0x27 MMF_DUMP_ANON_PRIVATE|MMF_DUMP_ANON_SHARED|MMF_DUMP_MAPPED_PRIVATE|MMF_DUMP_HUGETLB_PRIVATE*/ } else { write(fd, "35", 2); /*0x23 MMF_DUMP_ANON_PRIVATE|MMF_DUMP_ANON_SHARED|MMF_DUMP_HUGETLB_PRIVATE*/ } close(fd); }}

修改filer后就能dump文件映射内存段(MMF_DUMP_MAPPED_PRIVATE)。

而此时的coredump文件非常大，一般都是2~3G，以SystemUI为例：

core文件压缩前压缩后core-ndroid.systemui-18012184M154.3M

按照coredump中占有的大小排匿名页：

file_offset virtual addr file_size mem_size...0x000000006dd4f000 0x0000007f60986000 0x0000000000103000 0x0000000000103000 RW [stack:2268]0x000000006dc49000 0x0000007f6087a000 0x0000000000103000 0x0000000000103000 RW [stack:2275]0x000000006d73d000 0x0000007f602fd000 0x0000000000103000 0x0000000000103000 RW [stack:2276]0x000000006a3ce000 0x0000007f5cf31000 0x0000000000103000 0x0000000000103000 RW [stack:2348]0x0000000069e72000 0x0000007f5b0b9000 0x0000000000103000 0x0000000000103000 RW [stack:2875]0x000000006f284000 0x0000007f62dda000 0x0000000000103000 0x0000000000103000 RW [stack:4189]0x000000006f389000 0x0000007f62edf000 0x0000000000103000 0x0000000000103000 RW [stack:4205]0x0000000084a07000 0x0000007f8024d000 0x0000000000104000 0x0000000000104000 R E /system/lib64/libcrypto.so (BuildId: a6e63a0db9e7619d2ad33c4f028d5c6c)0x000000006d534000 0x0000007f600e5000 0x0000000000109000 0x0000000000109000 R E /system/lib64/libblas.so (BuildId: f951af52fad1aa7d561d021ab1c80cab)0x0000000069d30000 0x0000007f5af52000 0x000000000011d000 0x000000000011d000 R /system/priv-app/SecurityCenter/SecurityCenter.apk0x0000000083dc6000 0x0000007f7f603000 0x0000000000137000 0x0000000000137000 R E /system/lib64/libart.so (BuildId: bf9347900a4e1fa84e9df75618d54db6) (load base 0x23000)0x000000007c10a000 0x0000007f77679000 0x0000000000141000 0x0000000000141000 R E /system/lib64/libxml2.so (BuildId: eadb3a4e20d6e9b12715ae2b5ff356d8) (load base 0x3000)0x000000007c6f1000 0x0000007f77c6b000 0x0000000000163000 0x0000000000163000 R E /data/dalvik-cache/arm64/system@framework@android-support-v13.jar@classes.dex (load base 0x178000)0x00000000877ca000 0x0000007f830a0000 0x000000000016a000 0x000000000016a000 R E /system/lib64/libicuuc.so (BuildId: affece9f885adfad1e8f976d2edb4940) (load base 0x19000)0x000000007c579000 0x0000007f77af3000 0x0000000000178000 0x0000000000178000 R /data/dalvik-cache/arm64/system@framework@android-support-v13.jar@classes.dex0x0000000085871000 0x0000007f8112d000 0x0000000000178000 0x0000000000178000 R E /system/lib64/libandroid_runtime.so (BuildId: 944b9208a384a65f9a8ed8c140aaaa19) (load base 0x30000)0x0000000045b2a000 0x000000007545a000 0x0000000000180000 0x0000000000180000 RW /dev/ashmem/dalvik-zygote space (deleted)0x0000000082c3d000 0x0000007f7e462000 0x0000000000185000 0x0000000000185000 R /dev/ashmem/dalvik-classes.dex extracted in memory from /system/priv-app/MiuiSystemUI/MiuiSystemUI.apk (deleted)0x000000007e330000 0x0000007f798ac000 0x000000000018d000 0x000000000018d000 R E /system/vendor/lib64/lib-imsqimf.so (BuildId: f5c244699ac36464c3624f113b5bdac0) (load base 0x5000)0x0000000084c08000 0x0000007f804ba000 0x0000000000191000 0x0000000000191000 R E /system/lib64/libstagefright.so (BuildId: 9c75c09de4c3b843fcdde036230fa5ac) (load base 0x46000)0x000000006eaf0000 0x0000007f61753000 0x00000000001e4000 0x00000000001e4000 R E /data/dalvik-cache/arm64/system@priv-app@MiuiKeyguard@MiuiKeyguard.apk@classes.dex (load base 0x223000)0x00000000775c6000 0x0000007f72b2e000 0x00000000001ec000 0x00000000001ec000 R /system/framework/framework-res.apk0x0000000070a57000 0x0000007f645ea000 0x00000000001f6000 0x00000000001f6000 R E /data/dalvik-cache/arm64/system@framework@miuipushsdkshared.jar@classes.dex (load base 0x207000)0x0000000069b30000 0x0000007f5ac00000 0x0000000000200000 0x0000000000200000 RW [anon:libc_malloc]0x000000006fa9e000 0x0000007f63600000 0x0000000000200000 0x0000000000200000 RW [anon:libc_malloc]0x000000007729b000 0x0000007f72800000 0x0000000000200000 0x0000000000200000 RW [anon:libc_malloc]0x0000000079691000 0x0000007f74c00000 0x0000000000200000 0x0000000000200000 RW [anon:libc_malloc]0x000000007c291000 0x0000007f77800000 0x0000000000200000 0x0000000000200000 RW [anon:libc_malloc]0x0000000070850000 0x0000007f643e3000 0x0000000000207000 0x0000000000207000 R /data/dalvik-cache/arm64/system@framework@miuipushsdkshared.jar@classes.dex0x0000000000031000 0x0000000012c00000 0x0000000000208000 0x0000000000208000 RW /dev/ashmem/dalvik-main space (deleted)0x0000000084f41000 0x0000007f807f4000 0x0000000000218000 0x0000000000218000 R E /system/lib64/libicui18n.so (BuildId: 568e215ae7171b7d181b019a97360459) (load base 0x1a000)0x000000006e8cd000 0x0000007f61530000 0x0000000000223000 0x0000000000223000 R /data/dalvik-cache/arm64/system@priv-app@MiuiKeyguard@MiuiKeyguard.apk@classes.dex0x000000007623d000 0x0000007f717a1000 0x000000000027e000 0x000000000027e000 RW /system/vendor/lib64/egl/libGLESv2_adreno.so0x0000000078027000 0x0000007f73596000 0x000000000032d000 0x000000000032d000 R /system/fonts/Miui-Light.ttf0x00000000704d3000 0x0000007f64066000 0x000000000033b000 0x000000000033b000 R E /data/dalvik-cache/arm64/system@framework@cloud-common.jar@classes.dex (load base 0x365000)0x0000000079a9b000 0x0000007f7500a000 0x0000000000355000 0x0000000000355000 R /system/fonts/NotoColorEmoji.ttf0x000000007016e000 0x0000007f63d01000 0x0000000000365000 0x0000000000365000 R /data/dalvik-cache/arm64/system@framework@cloud-common.jar@classes.dex0x0000000079df0000 0x0000007f7535f000 0x000000000037d000 0x000000000037d000 R /system/fonts/Miui-Regular.ttf0x000000007ddc7000 0x0000007f79341000 0x00000000003ba000 0x00000000003ba000 R E /system/lib64/libart-compiler.so (BuildId: 9d4bc4d801f3664a60f498526017376f) (load base 0x32000)0x000000006d840000 0x0000007f60400000 0x0000000000400000 0x0000000000400000 RW [anon:libc_malloc]0x00000000843c2000 0x0000007f7fc00000 0x0000000000400000 0x0000000000400000 RW [anon:libc_malloc]0x0000000075db1000 0x0000007f71315000 0x000000000048c000 0x000000000048c000 R E /system/vendor/lib64/egl/libGLESv2_adreno.so (load base 0x39000)0x0000000083efe000 0x0000007f7f73b000 0x00000000004af000 0x00000000004af000 R E /system/lib64/libart.so0x00000000852de000 0x0000007f80b97000 0x00000000004bc000 0x00000000004bc000 R E /system/lib64/libpdfium.so (BuildId: d233271a0367337979041d0a9cceefbb) (load base 0x1c000)0x0000000085a13000 0x0000007f812d0000 0x000000000054d000 0x000000000054d000 R E /system/lib64/libskia.so (BuildId: a8644d98d760e4fc9fdbcb139416d616) (load base 0x4d000)0x0000000077a89000 0x0000007f72ff8000 0x000000000059e000 0x000000000059e000 R /system/fonts/Miui-Bold.ttf0x000000006ce97000 0x0000007f5fa00000 0x0000000000600000 0x0000000000600000 RW [anon:libc_malloc]0x0000000000239000 0x0000000012e08000 0x000000000066c000 0x000000000066c000 RW /dev/ashmem/dalvik-main space (deleted)0x000000008817c000 0x0000007fd91bc000 0x00000000007ff000 0x00000000007ff000 RW 0x000000004932b000 0x0000000078c5b000 0x00000000007ff000 0x00000000007ff000 RW /dev/ashmem/dalvik-non moving space (deleted)0x00000000823e3000 0x0000007f7dc03000 0x0000000000800000 0x0000000000800000 RW /dev/ashmem/dalvik-allocspace main rosalloc space 1 live-bitmap 2 (deleted)0x0000000081be3000 0x0000007f7d403000 0x0000000000800000 0x0000000000800000 RW /dev/ashmem/dalvik-allocspace main rosalloc space 1 mark-bitmap 2 (deleted)0x0000000075474000 0x0000007f69007000 0x0000000000800000 0x0000000000800000 RW /dev/ashmem/dalvik-allocspace main rosalloc space live-bitmap 3 (deleted)0x0000000074c74000 0x0000007f68807000 0x0000000000800000 0x0000000000800000 RW /dev/ashmem/dalvik-allocspace main rosalloc space mark-bitmap 3 (deleted)0x000000007f2a1000 0x0000007f7aac1000 0x0000000000801000 0x0000000000801000 RW /dev/ashmem/dalvik-allocation stack (deleted)0x000000007eaa0000 0x0000007f7a2c0000 0x0000000000801000 0x0000000000801000 RW /dev/ashmem/dalvik-live stack (deleted)0x00000000764bf000 0x0000007f71a23000 0x0000000000d2d000 0x0000000000d2d000 R E /system/vendor/lib64/libllvm-glnext.so (BuildId: 3e03677902b12a49330c14952aa887e9) (load base 0x5b000)0x0000000040031000 0x000000006f961000 0x0000000000f2f000 0x0000000000f2f000 RW /data/dalvik-cache/arm64/system@framework@boot.art0x0000000086478000 0x0000007f81d4b000 0x00000000010f5000 0x00000000010f5000 R E /system/lib64/libLLVM.so (BuildId: 571f26c70c35873d3c0da4e3a037055c) (load base 0xa3000)0x00000000784c1000 0x0000007f73a30000 0x00000000011d0000 0x00000000011d0000 R /system/fonts/NotoSansCJK-Regular.ttc0x000000007abde000 0x0000007f7614d000 0x000000000152c000 0x000000000152c000 R /system/usr/icu/icudt56l.dat0x000000007c89b000 0x0000007f77e15000 0x000000000152c000 0x000000000152c000 R /system/usr/icu/icudt56l.dat0x0000000043e3c000 0x000000007376c000 0x0000000001cec000 0x0000000001cec000 R E /data/dalvik-cache/arm64/system@framework@boot.oat (load base 0x7376c000)0x0000000072c74000 0x0000007f66807000 0x0000000002000000 0x0000000002000000 R E /dev/ashmem/dalvik-jit-code-cache (deleted)0x0000000070c74000 0x0000007f64807000 0x0000000002000000 0x0000000002000000 RW /dev/ashmem/dalvik-data-code-cache (deleted)0x000000007fae2000 0x0000007f7b302000 0x0000000002001000 0x0000000002001000 RW /dev/ashmem/dalvik-card table (deleted)0x000000006a6c9000 0x0000007f5d22e000 0x00000000022c8000 0x00000000022c8000 R E /system/vendor/lib64/libllvm-qcom.so (BuildId: d04f0c912709b2087e42af548465996a) (load base 0x1a0000)0x0000000040f60000 0x0000000070890000 0x0000000002edc000 0x0000000002edc000 R /data/dalvik-cache/arm64/system@framework@boot.oat0x0000000045d40000 0x0000000075670000 0x00000000035eb000 0x00000000035eb000 /dev/ashmem/dalvik-non moving space (deleted)0x00000000008a5000 0x0000000013474000 0x000000001f78c000 0x000000001f78c000 /dev/ashmem/dalvik-main space (deleted)0x0000000020032000 0x0000000032c01000 0x000000001ffff000 0x000000001ffff000 /dev/ashmem/dalvik-main space 1 (deleted)0x0000000049b2a000 0x000000007945a000 0x0000000020000000 0x0000000020000000 RW /dev/ashmem/dalvik-free list large object space (deleted)

从上面的列表中可以看到，core文件中除了我们想要的boot.oat和boot.art和其他虚拟机相关的内存段外，

还有其他不必要的文件映射，如so的可执行段、font目录下的ttc文件、usr目录下的dat文件，没有访问权限的数据段等。

我们同样也可以通过mdevice()将这些没用的段给去掉。如下面代码中的红色部分：

static void trim_core(uintptr_t trim_type) { FILE* maps = fopen("/proc/self/maps", "r"); if (maps == nullptr) { return; } char line[4096]; while (fgets(line, sizeof(line), maps)) { uintptr_t start, end; int name_pos; char perms[5]; if (sscanf(line, "%" SCNxPTR "-%" SCNxPTR " %4s %*x %*x:%*x %*d %n", &start, &end, perms, &name_pos) == 3) { const char* name = &line[name_pos]; int perm = permision_c_to_i(perms);#define CHECK_TRIM(_trim, _perm, _name) do { if ((trim_type & _trim) == _trim) { if ((_perm == 0xf || perm == _perm) && strncmp(name, _name, sizeof(_name)-1) == 0) { skip_segment(start, end); continue; } } } while(0) CHECK_TRIM(TRIM_TYPE_JAVA, 0xf, "/dev/ashmem/dalvik"); CHECK_TRIM(TRIM_TYPE_JAVA, 0xf, "/data/dalvik-cache/"); CHECK_TRIM(TRIM_TYPE_RESERVED, 0x0, "/dev/ashmem/dalvik"); CHECK_TRIM(TRIM_TYPE_FONT, 0x4, "/system/fonts/"); CHECK_TRIM(TRIM_TYPE_USR, 0x4, "/system/usr/");#ifdef __aarch64__ CHECK_TRIM(TRIM_TYPE_LIB_CODE, 0x5, "/system/lib64/"); CHECK_TRIM(TRIM_TYPE_LIB_CODE, 0x5, "/system/vendor/lib64/");#else CHECK_TRIM(TRIM_TYPE_LIB_CODE, 0x5, "/system/lib/"); CHECK_TRIM(TRIM_TYPE_LIB_CODE, 0x5, "/system/vendor/lib/");#endif } } fclose(maps);}

裁剪后的大小如下:

core文件压缩前压缩后core-ndroid.systemui-1801900M51.3M

裁剪前后对比如下：

压缩前压缩后裁剪前2184M154.3M裁剪后900M51.3M比率41.2%33.2%

上一篇 任务管理器快捷键是哪个？

下一篇QQ克隆空间怎么装扮<登录qq空间克隆网站安全吗>