peadar / pstack

Print stack traces from running processes, or core files. Supports aarch64, x86_64, and i386
BSD 2-Clause "Simplified" License
142 stars 37 forks source link

Request: add pc-address #6

Closed skoperst closed 3 years ago

skoperst commented 3 years ago

Hi, it will be useful to get the pc-address , something like this:

thread: 0, lwp: 3840, type: 0

0 0x00007f18c7270376 + 0x47c62a in __pthread_cond_wait()+534 in /lib/x86_64-linux-gnu/libpthread.so.0 at futex-internal.h:183

1 0x00007f18badfe62b + 0x10376 in () in /usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so

2 0x00007f18badfe23b + 0x10223 in () in /usr/lib/x86_64-linux-gnu/dri/radeonsi_dri.so

What do you think?

peadar commented 3 years ago

Hey, I'm not sure what you mean - for example -

0 0x00007fada8f49e3c in __sigsuspend()+28 in /lib64/libc.so.6 at sigsuspend.c:26

In this case 0x00007fada8f49e3c is the PC (I assume you program counter, or, on x86, the RIP register) The symbol "__sigsuspend" starts 28 bytes before that, hence the +28 there, to indicate you're 28 bytes into that function.

What, in your case, do you intend the 0x47c62a above to indicate at the topmost frame?

skoperst commented 3 years ago

Hey, so my previous example is not correct, I'll try to explain again. Here I ran '/usr/bin/sleep' and used pstack on it: $ sudo ~/projects/pstack/build/pstack 171909

process: /proc/171909/mem
thread: 0, lwp: 171909, type: 0
#0  0x00007fdeb737e334 in __clock_nanosleep()+84 in /lib/x86_64-linux-gnu/libc.so.6 at clock_nanosleep.c:78
#1  0x00007fdeb7384047 in __nanosleep()+22 in /lib/x86_64-linux-gnu/libc.so.6 at nanosleep.c:27
warning: no compiled support for LZMA - can't decode debug data in /usr/bin/sleep
#2  0x00005635f46f0827 in <unknown>() in /usr/bin/sleep
#3  0x00005635f46f0600 in <unknown>() in /usr/bin/sleep
#4  0x00005635f46ed7b0 in <unknown>() in /usr/bin/sleep
#5  0x00007fdeb72c50b3 in __libc_start_main()+242 in /lib/x86_64-linux-gnu/libc.so.6 at libc-start.c:308
#6  0x00005635f46ed87e in <unknown>() in /usr/bin/sleep

This is my maps:

sudo cat /proc/171909/maps
5635f46eb000-5635f46ed000 r--p 00000000 08:02 12846161                   /usr/bin/sleep
5635f46ed000-5635f46f1000 r-xp 00002000 08:02 12846161                   /usr/bin/sleep
5635f46f1000-5635f46f3000 r--p 00006000 08:02 12846161                   /usr/bin/sleep
5635f46f4000-5635f46f5000 r--p 00008000 08:02 12846161                   /usr/bin/sleep
5635f46f5000-5635f46f6000 rw-p 00009000 08:02 12846161                   /usr/bin/sleep
5635f539b000-5635f53bc000 rw-p 00000000 00:00 0                          [heap]
7fdeb6d2e000-7fdeb729e000 r--p 00000000 08:02 12847762                   /usr/lib/locale/locale-archive
7fdeb729e000-7fdeb72c3000 r--p 00000000 08:02 12847219                   /usr/lib/x86_64-linux-gnu/libc-2.31.so
7fdeb72c3000-7fdeb743b000 r-xp 00025000 08:02 12847219                   /usr/lib/x86_64-linux-gnu/libc-2.31.so
7fdeb743b000-7fdeb7485000 r--p 0019d000 08:02 12847219                   /usr/lib/x86_64-linux-gnu/libc-2.31.so
7fdeb7485000-7fdeb7486000 ---p 001e7000 08:02 12847219                   /usr/lib/x86_64-linux-gnu/libc-2.31.so
7fdeb7486000-7fdeb7489000 r--p 001e7000 08:02 12847219                   /usr/lib/x86_64-linux-gnu/libc-2.31.so
7fdeb7489000-7fdeb748c000 rw-p 001ea000 08:02 12847219                   /usr/lib/x86_64-linux-gnu/libc-2.31.so
7fdeb748c000-7fdeb7492000 rw-p 00000000 00:00 0 
7fdeb74b6000-7fdeb74b7000 r--p 00000000 08:02 12845269                   /usr/lib/x86_64-linux-gnu/ld-2.31.so
7fdeb74b7000-7fdeb74da000 r-xp 00001000 08:02 12845269                   /usr/lib/x86_64-linux-gnu/ld-2.31.so
7fdeb74da000-7fdeb74e2000 r--p 00024000 08:02 12845269                   /usr/lib/x86_64-linux-gnu/ld-2.31.so
7fdeb74e3000-7fdeb74e4000 r--p 0002c000 08:02 12845269                   /usr/lib/x86_64-linux-gnu/ld-2.31.so
7fdeb74e4000-7fdeb74e5000 rw-p 0002d000 08:02 12845269                   /usr/lib/x86_64-linux-gnu/ld-2.31.so
7fdeb74e5000-7fdeb74e6000 rw-p 00000000 00:00 0 
7fff5da5b000-7fff5da7c000 rw-p 00000000 00:00 0                          [stack]
7fff5dae4000-7fff5dae8000 r--p 00000000 00:00 0                          [vvar]
7fff5dae8000-7fff5daea000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0                  [vsyscall]

Then I want to investigate where exactly is frame number 2: #2 0x00005635f46f0827 in <unknown>() in /usr/bin/sleep

It could be easier if it was shown as: #2 0x00005635f46f0827 in <unknown>() [/usr/bin/sleep + 0x5826] in /usr/bin/sleep @0x5635f46eb000+0x5826

This way I can go to my non-stripped version of /usr/bin/sleep and use gdb with the command: info symbol 0x5826

Hope it makes more sense now.

peadar commented 3 years ago

Ah You want the instruction pointer relative to the ELF object it's contained in. That's pretty simple, sure, I can add that as an option, I guess. You know you can give pstack the unstripped binary too, at least for the executable, right? (I realise you might be running pstack and gdb in two separate environments)

On Sat 6 Feb 2021, 22:25 skoperst, notifications@github.com wrote:

Hey, so my previous example is not correct, I'll try to explain again. Here I ran '/usr/bin/sleep' and used pstack on it: $ sudo ~/projects/pstack/build/pstack 171909

process: /proc/171909/mem thread: 0, lwp: 171909, type: 0

0 0x00007fdeb737e334 in __clock_nanosleep()+84 in /lib/x86_64-linux-gnu/libc.so.6 at clock_nanosleep.c:78

1 0x00007fdeb7384047 in __nanosleep()+22 in /lib/x86_64-linux-gnu/libc.so.6 at nanosleep.c:27

warning: no compiled support for LZMA - can't decode debug data in /usr/bin/sleep

2 0x00005635f46f0827 in () in /usr/bin/sleep

3 0x00005635f46f0600 in () in /usr/bin/sleep

4 0x00005635f46ed7b0 in () in /usr/bin/sleep

5 0x00007fdeb72c50b3 in __libc_start_main()+242 in /lib/x86_64-linux-gnu/libc.so.6 at libc-start.c:308

6 0x00005635f46ed87e in () in /usr/bin/sleep

This is my maps:

sudo cat /proc/171909/maps 5635f46eb000-5635f46ed000 r--p 00000000 08:02 12846161 /usr/bin/sleep 5635f46ed000-5635f46f1000 r-xp 00002000 08:02 12846161 /usr/bin/sleep 5635f46f1000-5635f46f3000 r--p 00006000 08:02 12846161 /usr/bin/sleep 5635f46f4000-5635f46f5000 r--p 00008000 08:02 12846161 /usr/bin/sleep 5635f46f5000-5635f46f6000 rw-p 00009000 08:02 12846161 /usr/bin/sleep 5635f539b000-5635f53bc000 rw-p 00000000 00:00 0 [heap] 7fdeb6d2e000-7fdeb729e000 r--p 00000000 08:02 12847762 /usr/lib/locale/locale-archive 7fdeb729e000-7fdeb72c3000 r--p 00000000 08:02 12847219 /usr/lib/x86_64-linux-gnu/libc-2.31.so 7fdeb72c3000-7fdeb743b000 r-xp 00025000 08:02 12847219 /usr/lib/x86_64-linux-gnu/libc-2.31.so 7fdeb743b000-7fdeb7485000 r--p 0019d000 08:02 12847219 /usr/lib/x86_64-linux-gnu/libc-2.31.so 7fdeb7485000-7fdeb7486000 ---p 001e7000 08:02 12847219 /usr/lib/x86_64-linux-gnu/libc-2.31.so 7fdeb7486000-7fdeb7489000 r--p 001e7000 08:02 12847219 /usr/lib/x86_64-linux-gnu/libc-2.31.so 7fdeb7489000-7fdeb748c000 rw-p 001ea000 08:02 12847219 /usr/lib/x86_64-linux-gnu/libc-2.31.so 7fdeb748c000-7fdeb7492000 rw-p 00000000 00:00 0 7fdeb74b6000-7fdeb74b7000 r--p 00000000 08:02 12845269 /usr/lib/x86_64-linux-gnu/ld-2.31.so 7fdeb74b7000-7fdeb74da000 r-xp 00001000 08:02 12845269 /usr/lib/x86_64-linux-gnu/ld-2.31.so 7fdeb74da000-7fdeb74e2000 r--p 00024000 08:02 12845269 /usr/lib/x86_64-linux-gnu/ld-2.31.so 7fdeb74e3000-7fdeb74e4000 r--p 0002c000 08:02 12845269 /usr/lib/x86_64-linux-gnu/ld-2.31.so 7fdeb74e4000-7fdeb74e5000 rw-p 0002d000 08:02 12845269 /usr/lib/x86_64-linux-gnu/ld-2.31.so 7fdeb74e5000-7fdeb74e6000 rw-p 00000000 00:00 0 7fff5da5b000-7fff5da7c000 rw-p 00000000 00:00 0 [stack] 7fff5dae4000-7fff5dae8000 r--p 00000000 00:00 0 [vvar] 7fff5dae8000-7fff5daea000 r-xp 00000000 00:00 0 [vdso] ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]

Then, I want to take gdb and look at the 2nd frame:

2 https://github.com/peadar/pstack/pull/2 0x00005635f46f0827 in () in

/usr/bin/sleep

It could be easier if it was shown as:

2 https://github.com/peadar/pstack/pull/2 0x00005635f46f0827 in ()

[/usr/bin/sleep + 0x5826] in /usr/bin/sleep @0x5635f46eb000+0x5826

Is it clearer now? This way I can go to my non-stripped version of /usr/bin/sleep and use gdb with the command: info symbol 0x5826

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/peadar/pstack/issues/6#issuecomment-774552636, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAE6NDJ2VKLXONUJYWUDTE3S5W6XJANCNFSM4VXELQIA .

peadar commented 3 years ago

Fixed in master. Pass -v, and get "@offset" added to the image name. LMK if it works for you -