iOS 之 Thread调用栈学习

struct thread_basic_info {
        time_value_t    user_time;      /* user run time */
        time_value_t    system_time;    /* system run time */
        integer_t       cpu_usage;      /* scaled cpu usage percentage */
        policy_t        policy;         /* scheduling policy in effect */
        integer_t       run_state;      /* run state (see below) */
        integer_t       flags;          /* various flags (see below) */
        integer_t       suspend_count;  /* suspend count for thread */
        integer_t       sleep_time;     /* number of seconds that thread
                                           has been sleeping */
};

kern_return_t task_threads
(
  task_t target_task,
  thread_act_array_t *act_list,
  mach_msg_type_number_t *act_listCnt
);

task_threads 将 target_task 任务中的所有线程保存在 act_list 数组中，数组中包含 act_listCnt 个线程。

kern_return_t thread_info
(
  thread_act_t target_act,
  thread_flavor_t flavor,
  thread_info_t thread_info_out,
  mach_msg_type_number_t *thread_info_outCnt
);

kern_return_t vm_read_overwrite
(
	vm_map_t target_task,
	vm_address_t address,
	vm_size_t size,
	vm_address_t data,
	vm_size_t *outsize
);

typedef struct BSStackFrameEntry{
    const struct BSStackFrameEntry *const previous;
    const uintptr_t return_address;
} BSStackFrameEntry;
kern_return_t bs_mach_copyMem(const void *const src, void *const dst, const size_t numBytes){
    vm_size_t bytesCopied = 0;
    return vm_read_overwrite(mach_task_self(), (vm_address_t)src, (vm_size_t)numBytes, (vm_address_t)dst, &bytesCopied);
}
uintptr_t bs_mach_framePointer(mcontext_t const machineContext){
    return machineContext->__ss.__ebp;
}
int main(){
  //获取线程的state
  _STRUCT_MCONTEXT machineContext;
  mach_msg_type_number_t state_count = BS_THREAD_STATE_COUNT;
    kern_return_t kr = thread_get_state(thread, BS_THREAD_STATE, (thread_state_t)&machineContext->__ss, &state_count);
  //找出所有的函数调用地址
  BSStackFrameEntry frame = {0};
  const uintptr_t framePtr = bs_mach_framePointer(&machineContext);
  bs_mach_copyMem((void *)framePtr, &frame, sizeof(frame)) != KERN_SUCCESS)
  for(; i < 50; i++) {
        backtraceBuffer[i] = frame.return_address;
        if(backtraceBuffer[i] == 0 ||
           frame.previous == 0 ||
           bs_mach_copyMem(frame.previous, &frame, sizeof(frame)) != KERN_SUCCESS) {
            break;
        }
    }
}

struct symtab_command {
    uint32_t    cmd;        /* LC_SYMTAB */
    uint32_t    cmdsize;    /* sizeof(struct symtab_command) */
    uint32_t    symoff;        /* symbol table offset */
    uint32_t    nsyms;        /* number of symbol table entries */
    uint32_t    stroff;        /* string table offset */
    uint32_t    strsize;    /* string table size in bytes */
};

//  位于系统库  头文件中
struct nlist {
  union {
  //符号名在字符串表中的偏移量
    uint32_t n_strx;
  } n_un;
  uint8_t n_type;
  uint8_t n_sect;
  int16_t n_desc;
  //符号在内存中的地址，类似于函数指针
  uint32_t n_value;
};

symbol address ＝ frame pointer address ＋ slide

// 链接时程序的基址
uintptr_t linkedit_base = (uintptr_t)slide + linkedit_segment->vmaddr - linkedit_segment->fileoff;

// 符号表的地址 = 基址 + 符号表偏移量
nlist_t *symtab = (nlist_t *)(linkedit_base + symtab_cmd->symoff);
// 字符串表的地址 = 基址 + 字符串表偏移量
char *strtab = (char *)(linkedit_base + symtab_cmd->stroff);

// 动态符号表地址 = 基址 + 动态符号表偏移量
uint32_t *indirect_symtab = (uint32_t *)(linkedit_base + dysymtab_cmd->indirectsymoff);

/*
 * Structure filled in by dladdr().
 */
typedef struct dl_info {
        const char      *dli_fname;     /* Pathname of shared object */
        void            *dli_fbase;     /* Base address of shared object */
        const char      *dli_sname;     /* Name of nearest symbol */
        void            *dli_saddr;     /* Address of nearest symbol */
} Dl_info;

static mach_port_t main_thread_id;
+ (void)load {
    main_thread_id = mach_thread_self();
}

#if defined(__arm64__)
#define BS_THREAD_STATE_COUNT ARM_THREAD_STATE64_COUNT
#define BS_THREAD_STATE ARM_THREAD_STATE64
#define BS_FRAME_POINTER __fp
#define BS_STACK_POINTER __sp
#define BS_INSTRUCTION_ADDRESS __pc

#elif defined(__arm__)
#define BS_THREAD_STATE_COUNT ARM_THREAD_STATE_COUNT
#define BS_THREAD_STATE ARM_THREAD_STATE
#define BS_FRAME_POINTER __r[7]
#define BS_STACK_POINTER __sp
#define BS_INSTRUCTION_ADDRESS __pc

#elif defined(__x86_64__)
#define BS_THREAD_STATE_COUNT x86_THREAD_STATE64_COUNT
#define BS_THREAD_STATE x86_THREAD_STATE64
#define BS_FRAME_POINTER __rbp
#define BS_STACK_POINTER __rsp
#define BS_INSTRUCTION_ADDRESS __rip

#elif defined(__i386__)
#define BS_THREAD_STATE_COUNT x86_THREAD_STATE32_COUNT
#define BS_THREAD_STATE x86_THREAD_STATE32
#define BS_FRAME_POINTER __ebp
#define BS_STACK_POINTER __esp
#define BS_INSTRUCTION_ADDRESS __eip

#endif

bool ksdl_dladdr(const uintptr_t address, Dl_info* const info) {
    // 初始 Dl_info
    info->dli_fname = NULL;
    info->dli_fbase = NULL;
    info->dli_sname = NULL;
    info->dli_saddr = NULL;
    // image index
    const uint32_t idx = ksdl_imageIndexContainingAddress(address);
    const struct mach_header* header = _dyld_get_image_header(idx);
    // slide
    const uintptr_t imageVMAddrSlide = (uintptr_t)_dyld_get_image_vmaddr_slide(idx);
    const uintptr_t addressWithSlide = address - imageVMAddrSlide;
    // 段基址
    const uintptr_t segmentBase = ksdl_segmentBaseOfImageIndex(idx) + imageVMAddrSlide;

    // 拿到了 Pathname
    info->dli_fname = _dyld_get_image_name(idx);
    // 拿到了基地址
    info->dli_fbase = (void*)header;

    // Find symbol tables and get whichever symbol is closest to the address
    // 在符号表中查找哪个符号最接近这个指令的地址
    // nlist
    const STRUCT_NLIST* bestMatch = NULL;
    uintptr_t bestDistance = ULONG_MAX;
    // load commond
    uintptr_t cmdPtr = ksdl_firstCmdAfterHeader(header);
    // header->ncmds 代表所有的加载命令，这里进行遍历，查找 LC_SYMTAB
    if(cmdPtr == 0) {
		return false;
	}
	for(uint32_t iCmd = 0; iCmd < header->ncmds; iCmd++) {
		const struct load_command* loadCmd = (struct load_command*)cmdPtr;
		if(loadCmd->cmd == LC_SYMTAB) {
			const struct symtab_command* symtabCmd = (struct symtab_command*)cmdPtr;
			// 找到符号表
			const BS_NLIST* symbolTable = (BS_NLIST*)(segmentBase + symtabCmd->symoff);
			//  找到字符串表
			const uintptr_t stringTable = segmentBase + symtabCmd->stroff;
			// 遍历符号表
			for(uint32_t iSym = 0; iSym < symtabCmd->nsyms; iSym++) {
				// If n_value is 0, the symbol refers to an external object.
				if(symbolTable[iSym].n_value != 0) {
					uintptr_t symbolBase = symbolTable[iSym].n_value;
					uintptr_t currentDistance = addressWithSlide - symbolBase;
					// addr >= symbol.value 说明这个指令在这个函数入口中
					// 获取和address的距离找到最接近的一个
					// 离指令地址addr更近的函数入口地址，才是更准确的匹配项
					if((addressWithSlide >= symbolBase) && (currentDistance <= bestDistance)) {
						bestMatch = symbolTable + iSym;
						bestDistance = currentDistance;
					}
				}
			}
			if(bestMatch != NULL) {
				info->dli_saddr = (void*)(bestMatch->n_value + imageVMAddrSlide);
				// 符号的名字
				info->dli_sname = (char*)((intptr_t)stringTable + (intptr_t)bestMatch->n_un.n_strx);
				if(*info->dli_sname == '_') {
					info->dli_sname++;
				}
				// This happens if all symbols have been stripped.
				if(info->dli_saddr == info->dli_fbase && bestMatch->n_type == 3) {
					info->dli_sname = NULL;
				}
				break;
			}
		}
		cmdPtr += loadCmd->cmdsize;
	}

    return true;
}