Question

我在某些地方看到了一些价值，但不确定它在我的程序中的起源。我如何确定这个值最初来自哪里？

我希望记录以下事件类型：

源自常量，算术表达式或系统调用的值 - 初始事件;
该值已分配给某个变量（或从中检索）;
该值作为参数传递或从某个函数返回;
该值存储在某些结构中（或从中检索）;
通过使用特定内容注释源代码，我触发了此值的历史记录转储。

例如，对于此示例代码：

#include <stdlib.h>

struct SomeStruct {
    int a;
    int b;
};

struct SomeStruct *globalvar;

int f1(struct SomeStruct* par) {
    return par->a;
}

int f2(struct SomeStruct* par, int q) {
    par->a = q;
    return par->b;
}

void trace_value(int g) {} /* dummy */

int main(void) {
    int f = 31337;

    globalvar = malloc(sizeof(*globalvar));
    f2(globalvar, f);
    struct SomeStruct q = *globalvar;
    int g = f1(&q);

    trace_value(g);

    return 0;
}

它应该返回类似

的内容

value 31337 originated from constant at fate.c:18
assigned to variable at fate.c:18
retrieved from variable at fate.c:21
passed as argument to function at fate.c:21
received as arument to a function at fate.c:12
assigned to struct field at fate.c:13
copied as a part of struct at fate.c:22
retrieved from struct field at fate.c:9
returned from function at fate.c:10
assigned to variable at fate.c:23
retrieved from variable at fate.c:25
traced at fate.c:25

我该怎么做或类似的东西？我希望Valgrind或GDB或某些组合能够做到这一点。

Answer 1

使用反向gdb和来自MarkPlotnick使用gdb观察点的注释中的idea2的idea1组合。这是演示会话，比原始答案更完整：

$ gcc -ggdb -Dtrace_value=exit fate.c -o fate
$ gdb -quiet -args ./fate 
Reading symbols from /home/vi/code/_/fate...done.
(gdb) break main
Breakpoint 1 at 0x8048482: file fate.c, line 18.
(gdb) r
Starting program: /home/vi/code/_/fate 
warning: Could not load shared library symbols for linux-gate.so.1.
Do you need "set solib-search-path" or "set sysroot"?

Breakpoint 1, main () at fate.c:18
18      int f = 31337;
(gdb) record
(gdb) break 25
(gdb) # traced at fate.c:25
Breakpoint 2 at 0x80484d2: file fate.c, line 25.
(gdb) c
Continuing.

Breakpoint 2, main () at fate.c:25
25      trace_value(g);
(gdb) # retrieved from variable at fate.c:25
(gdb) watch g
Hardware watchpoint 3: g
(gdb) reverse-continue 
Continuing.
Hardware watchpoint 3: g

Old value = 31337
New value = 134513899
0x080484ce in main () at fate.c:23
23      int g = f1(&q);
(gdb) # assigned to variable at fate.c:23
(gdb) # returned from function at fate.c:10
(gdb) reverse-step
f1 (par=0xffffd670) at fate.c:10
10  }
(gdb) list
5   
6   struct SomeStruct *globalvar;
7   
8   int f1(struct SomeStruct* par) {
9       return par->a;
10  }
11  
12  int f2(struct SomeStruct* par, int q) {
13      par->a = q;
14      return par->b;
(gdb) # retrieved from struct field at fate.c:9
(gdb) print par
$3 = (struct SomeStruct *) 0xffffd670
(gdb) print ((struct SomeStruct *) 0xffffd670)->a
$4 = 31337
(gdb) watch ((struct SomeStruct *) 0xffffd670)->a
Hardware watchpoint 4: ((struct SomeStruct *) 0xffffd670)->a
(gdb) reverse-continue 
Continuing.
Hardware watchpoint 4: ((struct SomeStruct *) 0xffffd670)->a

Old value = 31337
New value = -134716508
0x080484ba in main () at fate.c:22
22      struct SomeStruct q = *globalvar;
(gdb) # copied as a part of struct at fate.c:22
(gdb) print globalvar->a
$5 = 31337
(gdb) watch globalvar->a
Hardware watchpoint 5: globalvar->a
(gdb) reverse-continue 
Continuing.
Hardware watchpoint 5: globalvar->a

Old value = 31337
New value = 0
0x0804846f in f2 (par=0x804a008, q=31337) at fate.c:13
13      par->a = q;
(gdb) # assigned to struct field at fate.c:13
(gdb) # received as arument to a function at fate.c:12
(gdb) list
8   int f1(struct SomeStruct* par) {
9       return par->a;
10  }
11  
12  int f2(struct SomeStruct* par, int q) {
13      par->a = q;
14      return par->b;
15  }
16  
17  int main() {
(gdb) bt
#0  0x0804846f in f2 (par=0x804a008, q=31337) at fate.c:13
#1  0x080484b0 in main () at fate.c:21
(gdb) reverse-finish 
Run back to call of #0  0x0804846f in f2 (par=0x804a008, q=31337) at fate.c:13
0x080484ab in main () at fate.c:21
21      f2(globalvar, f);
(gdb) # passed as argument to function at fate.c:21
(gdb) # retrieved from variable at fate.c:21
(gdb) watch f
Hardware watchpoint 6: f
(gdb) reverse-finish 
"finish" not meaningful in the outermost frame.
(gdb) reverse-continue 
Continuing.
Warning:
Could not insert hardware watchpoint 6.
Could not insert hardware breakpoints:
You may have requested too many hardware breakpoints/watchpoints.

(gdb) delete
Delete all breakpoints? (y or n) y
(gdb) watch f
Hardware watchpoint 7: f
(gdb) reverse-continue 
Continuing.

No more reverse-execution history.
main () at fate.c:18
18      int f = 31337;
(gdb) # assigned to variable at fate.c:18
(gdb) # value 31337 originated from constant at fate.c:18

问题陈述中的所有预期消息都对应于您在gdb输出中看到的一些信息（如注释中所示）。

Answer 2

我相信它可以通过称为“反向调试”的技术在运行时手动手动（即在gdb会话上运行）完成。我还没有尝试过，但GDB 7.0版文档claims，在某些平台上支持它。

该方法类似于：

本地化在最后一个地方使用变量的单步（即“起点”）
分析堆栈帧的源代码（因此您需要调试符号和代码部分）（例如，通过list），以便了解如何获取（或可能修改）此值（例如从参数传递到功能）
退回到上一个堆栈帧并从上一步重复，除非找到其原点

以下是您的示例代码的概念验证会话。我编辑了一下，因为trace_value函数未定义。请注意，record命令可能会严重降低程序的执行速度。

$ gdb -q a.out 
Reading symbols from /home/grzegorz/workspace/a.out...done.
(gdb) b main
Breakpoint 1 at 0x400502: file fate.c, line 22.
(gdb) run
Starting program: /home/grzegorz/workspace/a.out 

Breakpoint 1, main () at fate.c:22
22      int f = 31337;
Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.149.el6_6.5.x86_64
(gdb) record
(gdb) b trace_value
Breakpoint 2 at 0x4004f8: file fate.c, line 19.
(gdb) c
Continuing.

Breakpoint 2, trace_value (g=31337) at fate.c:19
19  void trace_value(int g){}
(gdb) info args
g = 31337
(gdb) reverse-finish
Run back to call of #0  trace_value (g=31337) at fate.c:19
0x0000000000400550 in main () at fate.c:29
29      trace_value(g);
(gdb) bt
#0  0x0000000000400550 in main () at fate.c:29
(gdb) list 29
24      globalvar = malloc(sizeof(*globalvar));
25      f2(globalvar, f);
26      struct SomeStruct q = *globalvar;
27      int g = f1(&q);
28  
29      trace_value(g);
30  
31      return 0;
32  }

很少有东西可能需要一些解释。您需要首先为main设置断点，因为这是程序执行开始时，然后通过record命令启用会话记录。然后在trace_value函数处设置第二个断点，并使用continue命令（简称c）。这使您可以记录整个执行过程，直到输入trace_value为止。您可以将其视为上述“起点”。

这当然不是完整的故事。如前所述，您需要分析当前堆栈帧的源代码，然后决定下一步该做什么。您可以根据当前情况使用reverse-step或reverse-finish命令。

如何追踪特定值的“命运”？

2 个答案: