Memory dump file analysis method and device, electronic equipment and storage medium

Abstract

The present application relates to the technical field of computer processing, in particular to a memory dump file analysis method and device, electronic equipment and storage medium, the method comprises the following steps: obtaining a target memory dump file corresponding to a target software crash, the target software does not carry a program database file when being released; when the target software does not carry the program database file, obtaining an address mapping table of the target software, the address mapping table is used to represent the mapping relationship between a first function address in the program database file and a corresponding second function address in the target software without the program database file; mapping the function address in the target memory dump file based on the address mapping table of the target software, and determining the readable symbol information corresponding to the target memory dump file. The address mapping table of the target software is used to realize the mapping of the address of the library without the pdb dump file to the function symbol.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer processing, and in particular to a memory dump file analysis method and device, an electronic device and a storage medium. BACKGROUND

[0002] In computer software, when software encounters a crash problem, also known as a crash problem, such as program exit or restart, a memory dump file (i.e., a dump file) is often used to locate and solve such problems. By analyzing the function call stack and variable information of the crash site in the dump file, the address information of the crash site recorded in the dump file can be converted into user-readable symbol information, such as file, line number, function name, etc., so as to further analyze the relevant code or construct an environment for reproduction, and then reproduce the problem analysis and verification.

[0003] However, because of various factors such as security and performance, some commercial software stable releases do not include a pdb version when compiled or do not release a pdb file when released, which will result in the dump file not being able to parse the relevant libraries or modules without a pdb symbol, so that the corresponding library in the dump file does not have a pdb file, and therefore symbol parsing cannot be performed, and the user can only see the unreadable 16-bit address information, making it difficult to further locate. SUMMARY

[0004] Therefore, embodiments of the present application provide a memory dump file analysis method and device, an electronic device and a storage medium to solve the problem that a dump file cannot be symbolically parsed.

[0005] According to a first aspect, embodiments of the present application provide a memory dump file analysis method, comprising:

[0006] Obtaining a target memory dump file corresponding to a target software crash;

[0007] When the target software does not include a program database file, obtaining an address mapping table of the target software, the address mapping table being used to represent a mapping relationship between a first function address in a program database file and a corresponding second function address in a program database file without a program database file;

[0008] Mapping a function address in the target memory dump file based on the address mapping table of the target software, and determining readable symbol information corresponding to the target memory dump file.

[0009] The memory dump file analysis method provided by the embodiment of the application realizes the mapping of the first function address in the program database file and the corresponding second function address in the program database file, converts the second function address corresponding to each stack frame in the target memory dump file into the first function address and the corresponding symbol information, and uses the first function address to obtain the corresponding readable symbol information, thereby realizing the mapping of the address of the library without the program database to the function symbol for the dump file, and realizing the symbol analysis and the restoration of the call stack.

[0010] In some embodiments, the determination manner of the address mapping table comprises:

[0011] Obtaining the source code of the target software recorded in the target memory dump file;

[0012] Compiling the source code with the program database file to determine a first compiled file;

[0013] Disassembling the first compiled file and a second compiled file of the target software without the program database file to obtain a first disassembled file and a second disassembled file respectively;

[0014] Querying the second function address in the target memory dump file in the second disassembled file to obtain the second assembly instruction corresponding to the second function address;

[0015] Based on the second assembly instruction, performing fuzzy matching in the first disassembled file to determine the first function address corresponding to the second function address, so as to determine the address mapping table.

[0016] The memory dump file analysis method provided by the embodiment of the application realizes the mapping of the first function address in the program database file and the corresponding second function address in the program database file, converts the second function address corresponding to each stack frame in the target memory dump file into the first function address and the corresponding symbol information, and uses the first function address to obtain the corresponding readable symbol information, thereby realizing the mapping of the address of the library without the program database to the function symbol for the dump file, and realizing the symbol analysis and the restoration of the call stack.

[0017] In some embodiments, the querying of the second function address in the target memory dump file in the second disassembled file to obtain the second assembly instruction corresponding to the second function address comprises:

[0018] Performing call stack analysis on the target memory dump file to obtain the absolute function address recorded in the call stack;

[0019] Using the absolute function address to determine the relative offset address to obtain the second function address;

[0020] Based on the second function address, querying in the second disassembled file to determine the second assembly instruction.

[0021] The memory dump file analysis method provided by the embodiment of the application converts an absolute function address into a relative offset address, so that an accurate query result can be obtained from a second disassembled file.

[0022] In some embodiments, the determining of the first function address corresponding to the second function address based on the fuzzy matching of the second assembly instruction in the first disassembled file to determine the address mapping table comprises:

[0023] The second assembly function block is determined based on the position of the second assembly instruction in the second disassembled file.

[0024] The first assembly function block is obtained by segmenting a code segment of the first disassembled file.

[0025] The first function address is determined by matching the second assembly function block with the first assembly function block.

[0026] The mapping relationship between the first function address and the second function address is established to determine the address mapping table.

[0027] The memory dump file analysis method provided by the embodiment of the application can solve the problems of hundreds or thousands of matching instructions for one instruction, the relative address in the instruction, the inaccurate matching, the large number of similar functions, and the inconsistent order of functions on both sides, by expanding the function block of a single instruction and matching the function blocks, so that the matching accuracy and efficiency are improved.

[0028] In some embodiments, the matching of the second assembly function block with the first assembly function block to determine the first function address comprises:

[0029] The second assembly function block is matched with the first assembly function block to obtain a selectable assembly function block.

[0030] The instructions in the second assembly function block are matched with the instructions in the selectable assembly function block, the selectable assembly function block is filtered, and a target assembly function block is determined.

[0031] The first assembly instruction corresponding to the second assembly instruction in the target assembly function block is queried, and the first function address of the first assembly instruction is determined.

[0032] The memory dump file analysis method provided by the embodiment of the application gradually narrows down the matching range by matching the instructions in the function blocks one by one on the basis of the function block matching, so that the matching efficiency is improved on the basis of ensuring the matching accuracy.

[0033] In some embodiments, the address mapping table includes a global mapping table and a local mapping table, the local mapping table being used to represent a mapping relationship of frequently used function addresses of the target memory dump file, the function addresses in the target memory dump file are mapped based on the address mapping table of the target software, and readable symbol information corresponding to the target memory dump file is determined, including:

[0034] The local mapping table is queried by using the function addresses in the target memory dump file, and a first hit result is determined;

[0035] When the first hit result is a miss, the global mapping table is queried by using the function addresses in the target memory dump file, and a second hit result is determined;

[0036] When the second hit result is a miss, a mapping result of the function addresses in the target memory dump file is determined based on the same manner of determining the address mapping table, so as to determine the readable symbol information corresponding to the target memory dump file and update the address mapping table.

[0037] The analysis method of the memory dump file provided in the embodiment of the application can improve the matching efficiency by the multi-level cache mode, for the low matching time performance caused by the matching of the instruction disassembly file, and the large number of assembly files.

[0038] In some embodiments, the function addresses in the target memory dump file are mapped based on the address mapping table of the target software, and the readable symbol information corresponding to the target memory dump file is determined, including:

[0039] The first compiled file is converted into a first symbol file;

[0040] The third function addresses in the first symbol file are converted into corresponding fourth function addresses without a program database file based on the address mapping table, so as to obtain a second symbol file;

[0041] The second symbol file is parsed, and the readable symbol information corresponding to the target memory dump file is determined.

[0042] The analysis method of the memory dump file provided in the embodiment of the application can improve the matching efficiency by the multi-level cache mode, for the low matching time performance caused by the matching of the instruction disassembly file, and the large number of assembly files.

[0043] According to a second aspect, the embodiment of the application further provides an analysis device of a memory dump file, including:

[0044] The first obtaining module is configured to obtain a target memory dump file corresponding to a target software crash;

[0045] The second obtaining module is configured to obtain an address mapping table of the target software when the target software does not have a program database file, the address mapping table being used to represent a mapping relationship between a first function address in the program database file and a second function address corresponding to the first function address in the target software without the program database file;

[0046] The mapping module is configured to map a function address in the target memory dump file based on the address mapping table of the target software, and determine readable symbol information corresponding to the target memory dump file.

[0047] According to a third aspect, an electronic device is provided, including a memory and a processor, which are in communication connection with each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the memory dump file analysis method in the first aspect or any one of the implementation manners of the first aspect.

[0048] According to a fourth aspect, a computer readable storage medium is provided, which stores computer instructions for causing the computer to perform the memory dump file analysis method in the first aspect or any one of the implementation manners of the first aspect.

[0049] It should be noted that the corresponding beneficial effects of the memory dump file analysis device, the electronic device and the computer readable storage medium provided by the embodiments of the present application are described above in the description of the beneficial effects of the memory dump file analysis method, and will not be described here. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the specific embodiments of the present application or the technical solutions in the prior art, the following will briefly introduce the drawings needed to be used in the specific embodiments or prior art description. Obviously, the drawings described below are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0051] Figure 1 is a flowchart of the memory dump file analysis method according to the embodiments of the present application;

[0052] Figure 2 is a flowchart of the address mapping table determination method according to the embodiments of the present application;

[0053] Figures 3a-3c is a schematic diagram of the function block matching according to the embodiments of the present application;

[0054] Figure 4 is a flow chart of the analysis method of the memory dump file according to an embodiment of the present application;

[0055] Figure 5 is a structural block diagram of the analysis device of the memory dump file according to an embodiment of the present application;

[0056] Figure 6 is a hardware structure schematic diagram of the electronic device provided by the embodiment of the present application. DETAILED DESCRIPTION

[0057] To make the objectives, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some but not all of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the protection scope of the present application.

[0058] For a library with source code when compiling but without pdb file when publishing, the dump file does not have the related library or module resolution of the pdb symbol. To solve this problem, the existing technology generally analyzes the dump file in the following ways: (1) analyzing the dump file through a debugger such as vs or windbg; (2) analyzing the dump file through a reverse analysis tool such as IDA; (3) manually analyzing the stack, function address and assembly instructions in the dump to try to restore the call stack; (4) asking for technical support from commercial software publishers or open source community forums of open source software.

[0059] However, for way (1), vs or windbg, the pdb symbol file is needed, and for vs, the pdb file must be matched with the software and library when compiling (verified by uuid, timestamp, etc.), and without the pdb, the address cannot be resolved to the symbol, and windbg can resolve part of the symbol by relying on the export table symbol of the software or library, but for a large number of non-exported symbols (functions, variables, etc.), it is still impossible to resolve.

[0060] For way (2), for the reverse tool such as IDA, it will compare the address and assembly instructions recorded in the dump with the database of IDA, and generate imitated symbol names (function, variable names, etc.) after matching, but the actual function names of the software are quite different, and further matching is needed according to experience, but the accuracy cannot be guaranteed.

[0061] For mode (3), manual analysis needs to have stack, assembly and other underlying knowledge, and is time-consuming and laborious, and is also difficult to completely restore, in addition, experience is not good to promote.

[0062] For mode (4), it is difficult to match the user's needs in terms of problem solving time, cost and the like.

[0063] Based on this, the embodiment of the application provides an analysis method of a memory dump file, and a technical scheme for symbol analysis of a function address of a dump file when a crash occurs for a source code but a release version without a pdb file is realized. That is, the unreadable 16 hexadecimal information recorded in the dump file, such as the function address, is converted into readable symbol information, such as the function name and the variable name, to facilitate further analysis and positioning of the problem.

[0064] According to the embodiment of the application, an analysis method of a memory dump file is provided, and it should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a group of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in an order different from that shown herein.

[0065] In the embodiment, an analysis method of a memory dump file is provided, which can be used for electronic devices such as computers, servers, mobile terminals and the like, Figure 1 The flowchart of the analysis method of the memory dump file according to the embodiment of the application is shown in FIG. 1, which includes the following steps: Figure 1

[0066] S11, a target memory dump file corresponding to a target software crash is acquired.

[0067] As described above, when the software crashes, that is, a crash problem occurs, the system generates a target memory dump file, that is, a dump file, to analyze the function call stack and variable information of the crash scene. For the target software, when a stable version is released, some have a program database file, and some do not have a program database file, which is set according to actual needs.

[0068] S12, when the target software does not have a program database file, an address mapping table of the target software is acquired.

[0069] The address mapping table is used to represent the mapping relationship between a first function address in the program database file and a corresponding second function address in the program database file.

[0070] ​For the publisher, whether to take pdb is determined. In addition, the release library, such as dll, if compiled with pdb file, the address of its corresponding pdb file and the unique identifier of the pdb file will be recorded in the dll file header structure, and the identification software is also read the relevant information in dll to judge whether there is pdb file. If dll records pdb, it needs to go to the corresponding directory of the symbol server to find pdb and other symbol files. For the library with pdb in the stable version, convert it into sym file (i.e. the format of breakPad open source platform symbol file), store it in the corresponding directory of dump analysis server (create multi-level directory according to the name and uuid of pdb library), when the target software crashes, upload the dump file to the analysis server for dump analysis, for the case with pdb (or sym file), the function address can be directly converted to function name and other symbol information according to the pdb or sym file analysis. For the analysis of dump file, windbg is generally used, and pdb is used to convert the symbol. If breakPad analysis platform is used, pdb needs to be converted into sym file. In addition, some are local analysis, and some need to be uploaded and analyzed through server, etc. Here, the analysis method of pdb file is not limited in any way, and can be set according to actual needs.

[0071] If dll does not record pdb, the address mapping table of target software is obtained to perform address mapping. As described above, if no pdb file is taken, the symbol analysis of dump file cannot be performed, and only 16 hexadecimal address information can be obtained. Therefore, through the address mapping table, the function address in the dump file is mapped to the function address in the pdb file, and the subsequent symbol information analysis can be performed.

[0072] The address mapping table can be accumulated and stored every time the dump file of target software is analyzed; or it can be obtained by manual analysis, etc. Here, the specific obtaining method of address mapping table is not limited in any way, as long as the address mapping table can realize the mapping between the first function address in the program database file and the corresponding second function address in the program database file without program database file.

[0073] S13, mapping the function address in the target memory dump file based on the address mapping table of the target software, determining the readable symbol information corresponding to the target memory dump file.

[0074] For the function address in the target memory dump file, the address mapping table of the target software is utilized to map the function address, to obtain the mapped function address in the pdb file. For the address mapping, the function address in the target memory dump file can be queried in the address mapping table, or other ways can be adopted, which are not limited herein.

[0075] The mapped function address is utilized to search the map file and the cod file, or according to the DIA related interface provided by windows, the corresponding file and line number information can be obtained according to the pdb file, so as to complete the analysis of the function address in the dump file to the function name, file and line number, and to complete the restoration of the call stack, to determine the readable symbol information corresponding to the target memory dump file. Since the address information recorded in the stack needs to be converted into readable function name, file and line number, etc. for convenient analysis, otherwise the address information is all hexadecimal numbers, which is difficult to analyze. Among them, the map file and the cod file are mainly used for accurate segmentation of functions in the matching process (for example, filling the function tail with cc), and positioning the address to the crash file name and line number information.

[0076] That is, after the function address in the target memory dump file is mapped to obtain the mapped function address in the pdb file, the analysis method of the dump file generated after the software crash with the pdb file is similar to that described above, which will not be repeated here.

[0077] The analysis method of the memory dump file provided in the embodiment utilizes the address mapping table of the target software to realize the mapping of the second function address in the program database file to the corresponding first function address in the program database file, converts the second function address corresponding to each stack frame in the target memory dump file to the first function address and the corresponding symbol information, utilizes the first function address to obtain the corresponding readable symbol information, realizes the mapping of the address of the dump file without the pdb library to the function symbol, and realizes the symbol analysis and the restoration of the call stack.

[0078] In some embodiments, as shown in Figure 2 The determination method of the mapping address table includes:

[0079] S21, obtaining the source code of the target software recorded in the target memory dump file.

[0080] The corresponding function address and module name / library name, etc. are recorded in the dump file, according to which the source code corresponding to the library name can be confirmed. According to the library name and the compilation project file, all the source files can be determined, so as to obtain the source code recorded in the target memory dump file.

[0081] S22, compile the source code with the program database file to determine a first compiled file.

[0082] According to the source code obtained in S21, a corresponding first compiled file is recompiled. Specifically, the compiler has corresponding parameters, and the symbol files such as pdb, map, and cod generated during compilation can be set. This is defined in the compiler manual.

[0083] S23, disassemble the first compiled file and the second compiled file of the target software without the program database file to obtain a first disassembled file and a second disassembled file, respectively.

[0084] The second compiled file of the target software without the program database file is obtained, and the first compiled file and the second compiled file are disassembled to obtain a first disassembled file corresponding to the pdb file and a second disassembled file corresponding to the pdb file. The second compiled file is the binary program of the published target software without the program database file.

[0085] S24, query the second function address in the second disassembled file in the target memory dump file.

[0086] The second function address in the target memory dump file is used to query the second disassembled file of the corresponding pdb-free library to obtain the second assembly instruction corresponding to the second function address.

[0087] In some embodiments, S24 includes:

[0088] (1) Call stack analysis is performed on the target memory dump file to obtain an absolute function address recorded in the call stack.

[0089] (2) The relative offset address is determined using the absolute function address to obtain the second function address.

[0090] (3) Based on the second function address, the second disassembled file is queried to determine the second assembly instruction.

[0091] The function address recorded in each stack frame of the dump file is an absolute function address. The relative offset address is obtained by removing the module address from the absolute function address. The relative offset address is the second function address. The second function address is used to query the second disassembled file to obtain the second assembly instruction. The absolute function address is converted to the relative offset address to ensure accurate query results from the second disassembled file.

[0092] S25, based on the second assembly instruction, fuzzy matching is performed in the first disassembled file to determine the first function address corresponding to the second function address to determine the address mapping table.

[0093] The second assembly instruction is used to perform fuzzy matching in the first disassembly file, so that a unique matching address is obtained according to a fuzzy matching algorithm, that is, the first function address is obtained. After the second function address corresponding to the first function address is determined, an association between the two is established, that is, the address mapping table is constructed.

[0094] Fuzzy matching refers to matching the second function address and the assembly instruction (disassembly file of the library without pdb) obtained in the previous step with the address and assembly instruction in the first disassembly file of the library with pdb, so as to match the corresponding function name and other symbol information.

[0095] After matching, the addresses of the original library without pdb can be converted into the corresponding function addresses of the library with pdb. According to the function address (with pdb), the function name can be obtained, so as to become readable information for further analysis.

[0096] The method for determining the address mapping table provided in the embodiment is to obtain the source code of the target software recorded in the target memory dump file, to compile the source code with the program database file to obtain a first compiled file, and to determine the address mapping table by combining the fuzzy matching method. Since the address mapping table is obtained depending on the source code of the target software, the accuracy of the address mapping table is ensured.

[0097] In some embodiments, the S25 includes:

[0098] (1) Based on the position of the second assembly instruction in the second disassembly file, instruction expansion is performed to determine the second assembly function block.

[0099] (2) The code segment of the first disassembly file is segmented to obtain the first assembly function block.

[0100] (3) The second assembly function block is matched with the first assembly function block to determine the first function address.

[0101] (4) The mapping relationship between the first function address and the second function address is established to determine the address mapping table.

[0102] Since one instruction can be mapped to hundreds of matching instructions, the instruction contains a relative address, cannot be accurately matched, similar functions are many, and the order of functions on both sides is inconsistent, based on this, by expanding the function block of a single instruction and relying on the function block to match, the matching accuracy and efficiency are improved. Specifically, the function address generally corresponds to an assembly instruction. If only one assembly instruction is used for matching, the matching result can be thousands of instructions, so expand the multiple instructions (including the assembly instruction of the function address) in the function block to obtain a second assembly function block; the code of the first disassembled file is segmented using the map file to obtain a first assembly function block, and all instructions in the second assembly function block and each first assembly function block are compared to determine the corresponding first function address.

[0103] As described above, the mapping relationship between the first function address and the second function address is established, and the address mapping table is determined.

[0104] In some embodiments, step (3) of S25 described above comprises:

[0105] 3.1) Match the second assembly function block with the first assembly function block to obtain a selectable assembly function block.

[0106] 3.2) Match each instruction in the second assembly function block with each instruction in the selectable assembly function block, filter the selectable assembly function block, and determine a target assembly function block.

[0107] 3.3) Query the first assembly instruction corresponding to the second assembly instruction in the target assembly function block to determine the first function address of the first assembly instruction.

[0108] When matching the second assembly function block with the first assembly function block, a matching result of multiple consecutive function blocks can be obtained. Matching these function blocks from the first assembly function block is called a selectable assembly function block. Utilizing local consecutive multiple function blocks for matching (parameter adjustable), as shown in Figure 3a There are two matching function blocks on the left and right sides, and they are consecutive. In actual situations, there can be a situation where dozens of consecutive function blocks are matched. In this case, the matching probability is very high, and it can be basically determined as matching, which can be considered almost 100% reliable. "Parameter adjustable" means that several consecutive function blocks are matched and can be determined as the final match. This parameter is not fixed. In theory, the higher the value set, the greater the matching accuracy, but the number of matches determined by this method will be less, that is, the matching rate will decrease, so a balanced value needs to be selected as the block number parameter, which is generally 3-5.

[0109] On this basis, each instruction in the second assembly function block is matched with each instruction in the optional assembly function block, the optional assembly function block is screened, and the target assembly function block is determined. That is, in all function blocks, a function block with the highest matching degree is found. For each instruction in the function block, if all instructions (each instruction generally includes an operation code and an operation number part, here the operation code and the operation number of the same instruction on both sides are matched) are matched, the score is 2, and if the operation code can be matched but the operation number is not matched, the score is 1. In this way, the sum of the scores of all instructions of the function block is calculated to obtain the best matching function block. As shown in Figure 3b The left function A and the right function are matched, the left function A and the right function B and C are similar, but according to the algorithm, the matching degree of the function B is higher, and the cumulative score is 15. Since the function A and the function B are inconsistent in the operation number of the place identified by the arrow 1 in the figure, the score of the instruction is 1, and the cumulative score is 15. Similarly, the matching degree of the function A and the function C is 14, so the matching function of the left function A is the right function B.

[0110] It should be noted that because of the recompilation, even if the functions on both sides are the same, the offset address may be different because the function order may be different. Therefore, even if the operation number (often the offset address) is different, it may be the same function. Therefore, this matching process is called fuzzy matching.

[0111] After the target assembly function block is determined, the first assembly instruction corresponding to the second assembly instruction in the target assembly function block is queried, and the first function address of the first assembly instruction is determined.

[0112] Of course, the following special scenarios may also occur in the matching process. For example, as shown in Figure 3c The function block on one side has no cc padding (composed of functions A and B, and the function A has no cc padding at the end), and the function block on the other side has cc padding (composed of functions A and B, and the function A has cc padding at the end). Therefore, the cc padding on the right side needs to be removed, and then the matching is performed after padding. Otherwise, if the number of matching function blocks is set to 2, it will be considered that the function blocks on both sides are not matched.

[0113] On the basis of function block matching, the instructions in the function block are matched one by one, the matching range is gradually narrowed, and the matching efficiency is improved on the basis of ensuring the accuracy of matching.

[0114] In this embodiment, a memory dump file analysis method is provided, which can be used in electronic devices such as computers, servers, mobile terminals, etc. Figure 4 The flowchart of the memory dump file analysis method according to the embodiment of the present application is shown in Figure 4As shown, the flow includes the following steps:

[0115] S31, obtain the target memory dump file corresponding to the target software crash.

[0116] For details, please refer to Figure 1 S11 of the embodiment shown, which will not be repeated here.

[0117] S32, when the target software does not have a program database file, obtain the address mapping table of the target software.

[0118] The address mapping table is used to represent the mapping relationship between the first function address in the program database file and the corresponding second function address in the program database file.

[0119] The address mapping table mainly stores the mapping relationship of the function address in the library without pdb to the corresponding function address in the library with pdb, and the specific function name can be obtained from the latter. The address mapping table includes a global mapping table and a local mapping table, and the local mapping table is used to represent the mapping relationship of the frequently used function address of the target memory dump file. Specifically, the global mapping table is the mapping relationship of all function addresses, and the local mapping table is the mapping relationship of the functions recorded in the stack during the analysis of the dump file. According to the principle of locality, these are more likely to appear in other dump files.

[0120] For the determination method of the address mapping table, please refer to Figure 2 The description of the embodiment shown will not be repeated here.

[0121] S33, mapping the function address in the target memory dump file based on the address mapping table of the target software, and determining the readable symbol information corresponding to the target memory dump file.

[0122] Specifically, the above S33 includes:

[0123] S331, query the local mapping table using the function address in the target memory dump file to determine the first hit result.

[0124] For the target memory dump file, first query the local mapping table for each function address in the heap frame to determine whether it can be queried to determine the first hit result. If it can be queried, the mapping is ended.

[0125] S332, when the first hit result is a miss, query the global mapping table using the function address in the target memory dump file to determine the second hit result.

[0126] When a hit is not found in the local mapping table, the function address in the target memory dump file is used to query the global mapping table to determine whether a second-level hit result can be obtained to determine the mapping result.

[0127] S333, when the second-level hit result is a miss, the mapping result of the function address in the target memory dump file is determined based on the same manner of determining the address mapping table to determine the readable symbol information corresponding to the target memory dump file and update the address mapping table.

[0128] When a hit is not found in the global mapping table, the mapping result of the function address in the target memory dump file is determined by performing the determination manner of the address mapping table as shown in the following. Figure 2

[0129] At the same time, after obtaining the mapping result, the mapping result of this time is added to the address mapping table to update the address mapping table. It should be noted that the address mapping table here includes the global mapping table and the local mapping table. The local mapping table is empty at the first time of dump analysis, and the global mapping table is also only a cache of full functions of some known libraries. With the accumulation of the analysis results of subsequent dump files, the global mapping table and the local mapping table will be automatically updated. If the function address in other dump files is in the global mapping table and the local mapping table, it is not necessary to go through the process of extracting source code, generating decompiled files, etc., and the global mapping table and the local mapping table can be directly matched.

[0130] The analysis method of the memory dump file provided in the embodiment can improve the matching efficiency through the multi-level cache manner for the instruction disassembly file matching, the assembly file matching, etc.

[0131] In some embodiments, if the dump file is parsed by relying on the breakPad platform, correspondingly, the above S33 includes:

[0132] (1) converting the first compiled file into a first symbol file.

[0133] (2) converting the third function address in the first symbol file into the corresponding fourth function address without a program database file based on the address mapping table to obtain a second symbol file.

[0134] (3) parsing the second symbol file to determine the readable symbol information corresponding to the target memory dump file.

[0135] ​If the dump file is parsed by relying on the breakPad platform, after the first compiled file is obtained, it is converted into a first symbol file, i.e. a sym file. At this time, the sym file is a file with a pdb file. Then, the third function address in the first symbol file is converted into a fourth function address without a pdb library by using the address mapping table, to obtain a second symbol file, i.e. a sym file without a pdb file. After the second symbol file is obtained, the breakPad platform can parse the dump file to determine readable symbol information corresponding to the dump file.

[0136] The breakPad platform is a general platform for analyzing dump files, but it also needs a sym file converted from a release version matched with a pdb. In fact, the sym file mainly stores the corresponding relationship between a function address and a function name, a file, a line number, etc. According to a global mapping table, a compiled file with a pdb library, i.e. a first compiled file, is converted to obtain a sym file. Then, the third function address in the sym file is replaced into a fourth function address in a file without a pdb library according to the mapping table, which is equivalent to simulating a sym file corresponding to a library without a pdb. In this way, the breakPad platform can parse the function symbol in the library without a symbol.

[0137] The analysis method for the memory dump file provided in the embodiment of the present application realizes the mapping of the address of the library without a pdb to the function symbol of the dump file, realizes the symbol parsing and the restoration of the call stack. Manual analysis no longer depends on a person who must have professional system knowledge such as assembly, stack and exception handling. The software can realize the one-step implementation, and ordinary developers can also use it. The full-amount cache of the address mapping is also realized, so that the restoration can be quickly realized, and the developers or maintainers of the library for help are no longer relied on, and the time and other costs are greatly improved.

[0138] In the embodiment, an analysis device for a memory dump file is also provided. The device is used to implement the above-described embodiments and preferred embodiments, and will not be described again. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware or a combination of software and hardware is also possible and is conceived.

[0139] The embodiment provides an analysis device for a memory dump file, as shown in Figure 5 , comprising:

[0140] A first obtaining module 41 is configured to obtain a target memory dump file corresponding to a target software after a crash.

[0141] The second obtaining module 42 is configured to obtain an address mapping table of the target software when the target software does not have a program database file, the address mapping table being used to represent a mapping relationship between a first function address in a program database file and a corresponding second function address in a target software without a program database file;

[0142] The mapping module 43 is configured to map a function address in the target memory dump file based on the address mapping table of the target software, and determine readable symbolic information corresponding to the target memory dump file.

[0143] In some embodiments, the determining module of the address mapping table comprises:

[0144] The first obtaining unit is configured to obtain source code of the target software recorded in the target memory dump file;

[0145] The compiling unit is configured to compile the source code to obtain a first compiled file;

[0146] The disassembling unit is configured to disassemble the first compiled file and a second compiled file of the target software without the program database file to obtain a first disassembled file and a second disassembled file, respectively;

[0147] The first querying unit is configured to query a second assembly instruction corresponding to the second function address in the target memory dump file in the second disassembled file;

[0148] The matching unit is configured to perform fuzzy matching in the first disassembled file based on the second assembly instruction to determine a first function address corresponding to the second function address, so as to determine the address mapping table.

[0149] In some embodiments, the querying unit comprises:

[0150] The parsing subunit is configured to perform call stack parsing on the target memory dump file to obtain an absolute function address recorded in the call stack;

[0151] The first determining subunit is configured to determine a relative offset address by using the absolute function address to obtain the second function address;

[0152] The second determining subunit is configured to query the second assembly instruction in the second disassembled file based on the second function address.

[0153] In some embodiments, the matching unit comprises:

[0154] The expansion subunit is configured to perform instruction expansion based on a position of the second assembly instruction in the second disassembly file, and determine a second assembly function block.

[0155] The division subunit is configured to divide the code segment of the first disassembly file to obtain a first assembly function block.

[0156] The first matching subunit is configured to match the second assembly function block with the first assembly function block, and determine the first function address.

[0157] The establishment subunit is configured to establish a mapping relationship between the first function address and the second function address, to determine the address mapping table.

[0158] In some embodiments, the first matching subunit includes:

[0159] The second matching subunit is configured to match the second assembly function block with the first assembly function block, to obtain a selectable assembly function block.

[0160] The third matching subunit is configured to match each instruction in the second assembly function block with each instruction in the selectable assembly function block, filter the selectable assembly function block, and determine a target assembly function block.

[0161] The query subunit is configured to query a first assembly instruction corresponding to the second assembly instruction in the target assembly function block, and determine the first function address of the first assembly instruction.

[0162] In some embodiments, the address mapping table includes a global mapping table and a local mapping table, the local mapping table is configured to represent a mapping relationship of frequently used function addresses of the target memory dump file, and the mapping module 43 includes:

[0163] The second query unit is configured to query the local mapping table by using a function address in the target memory dump file, to determine a first hit result.

[0164] The third query unit is configured to query the global mapping table by using the function address in the target memory dump file when the first hit result is a miss, to determine a second hit result.

[0165] The mapping unit is configured to determine a mapping result of the function address in the target memory dump file based on a same manner of determining the address mapping table when the second hit result is a miss, to determine readable symbolic information corresponding to the target memory dump file and update the address mapping table.

[0166] In some embodiments, the mapping module 43 includes:

[0167] The first conversion unit is used to convert the first compiled file into a first symbol file;

[0168] The second conversion unit is used to convert the address of the third function in the first symbol file into the address of the corresponding fourth function in the program database file based on the address mapping table, so as to obtain the second symbol file.

[0169] The parsing unit is used to parse the second symbol file and determine the readable symbol information corresponding to the target memory dump file.

[0170] In this embodiment, the memory dump file analysis device is presented in the form of a functional unit. Here, a unit refers to an ASIC circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0171] Further functional descriptions of the above modules are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0172] This invention also provides an electronic device having the above-described features. Figure 5 The device shown is for analyzing memory dump files.

[0173] Please see Figure 6 , Figure 6 This is a schematic diagram of the structure of an electronic device provided in an optional embodiment of the present invention, such as... Figure 6 As shown, the electronic device may include: at least one processor 51, such as a CPU (Central Processing Unit), at least one communication interface 53, memory 54, and at least one communication bus 52. The communication bus 52 is used to enable communication between these components. The communication interface 53 may include a display screen or a keyboard; optionally, the communication interface 53 may also include a standard wired interface or a wireless interface. The memory 54 may be high-speed RAM (Random Access Memory) or non-volatile memory, such as at least one disk storage device. Optionally, the memory 54 may also be at least one storage device located remotely from the aforementioned processor 51. The processor 51 may be combined with... Figure 5 The described apparatus has an application program stored in memory 54, and the processor 51 calls the program code stored in memory 54 to perform any of the above method steps.

[0174] The communication bus 52 can be a peripheral component interconnect (PCI) bus, an extended industry standard architecture (EISA) bus, or the like. The communication bus 52 can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, Figure 6 Only one thick line is used to represent the communication bus 52, but this does not mean that there is only one bus or only one type of bus.

[0175] The memory 54 can include a volatile memory, such as a random-access memory (RAM), and can also include a non-volatile memory, such as a flash memory, a hard disk drive (HDD), or a solid-state drive (SSD). The memory 54 can also include a combination of the above-mentioned types of memories.

[0176] The processor 51 can be a central processing unit (CPU), a network processor (NP), or a combination of a CPU and an NP.

[0177] The processor 51 can further include a hardware chip. The hardware chip can be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The PLD can be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0178] Optionally, the memory 54 is further configured to store program instructions. The processor 51 can invoke the program instructions to implement the analysis method of the memory dump file as shown in any embodiment of the present application.

[0179] The embodiment of the present application also provides a non-transitory computer storage medium, which stores computer executable instructions, and the computer executable instructions are used for executing the memory dump file analysis method in any method embodiment described above. The storage medium can be a disk, an optical disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a Flash Memory, a Hard Disk Drive (HDD) or a Solid-State Drive (SSD), etc. The storage medium can also include a combination of the above-mentioned storage devices.

[0180] Although the embodiments of the present application are described in conjunction with the drawings, various modifications and changes can be made by those skilled in the art without departing from the spirit and scope of the present application, and such modifications and changes are intended to fall within the scope of the appended claims.

Claims

1. A method of analyzing a memory dump file, characterized by, The method comprises the following steps: obtaining a target memory dump file corresponding to a target software crash; when the target software does not have a program database file, obtaining an address mapping table of the target software, the address mapping table being used to represent a mapping relationship between a first function address in the program database file and a corresponding second function address in the target software without the program database file; mapping a function address in the target memory dump file based on the address mapping table of the target software, and determining readable symbol information corresponding to the target memory dump file; wherein the determination method of the address mapping table comprises: obtaining source code of the target software recorded in the target memory dump file; compiling the source code with the program database file to determine a first compiled file; disassembling the first compiled file and a second compiled file of the target software without the program database file to obtain a first disassembled file and a second disassembled file, respectively; querying a second assembly instruction corresponding to the second function address in the second disassembled file in the target memory dump file; based on the second assembly instruction, performing fuzzy matching in the first disassembled file to determine the first function address corresponding to the second function address, so as to determine the address mapping table.

2. The method of claim 1, wherein, The querying of the second assembly instruction corresponding to the second function address in the second disassembled file in the target memory dump file comprises: performing call stack analysis on the target memory dump file to obtain an absolute function address recorded in the call stack; determining a relative offset address based on the absolute function address to obtain the second function address; based on the second function address, querying in the second disassembled file to determine the second assembly instruction.

3. The method of claim 1, wherein, The fuzzy matching of the second assembly instruction in the first disassembled file to determine the first function address corresponding to the second function address, so as to determine the address mapping table, comprises: based on the position of the second assembly instruction in the second disassembled file, performing instruction expansion to determine a second assembly function block; segmenting a code segment of the first disassembled file to obtain a first assembly function block; matching the second assembly function block with the first assembly function block to determine the first function address; establishing a mapping relationship between the first function address and the second function address to determine the address mapping table.

4. The method of claim 3, wherein, The matching of the second assembly function block with the first assembly function block to determine the first function address comprises: matching the second assembly function block with the first assembly function block to obtain a selectable assembly function block; matching each instruction in the second assembly function block with each instruction in the selectable assembly function block, screening the selectable assembly function block to determine a target assembly function block; querying a first assembly instruction corresponding to the second assembly instruction in the target assembly function block to determine the first function address of the first assembly instruction.

5. The method of claim 1, wherein, The address mapping table includes a global mapping table and a local mapping table used to represent the mapping relationship of frequently used function addresses of the target memory dump file, the function addresses in the target memory dump file are mapped based on the address mapping table of the target software, and readable symbol information corresponding to the target memory dump file is determined, including: The local mapping table is queried by using the function addresses in the target memory dump file to determine a first hit result; When the first hit result is a miss, the global mapping table is queried by using the function addresses in the target memory dump file to determine a second hit result; When the second hit result is a miss, the mapping result of the function addresses in the target memory dump file is determined based on the same manner of determining the address mapping table, so as to determine the readable symbol information corresponding to the target memory dump file and update the address mapping table.

6. The method of claim 1, wherein, The function addresses in the target memory dump file are mapped based on the address mapping table of the target software, and the readable symbol information corresponding to the target memory dump file is determined, including: The first compiled file is converted into a first symbol file; The third function addresses in the first symbol file are converted into corresponding fourth function addresses without a program database file based on the address mapping table, and a second symbol file is obtained; The second symbol file is parsed to determine the readable symbol information corresponding to the target memory dump file.

7. An analyzing apparatus of a memory dump file, characterized by comprising: It includes: A first obtaining module is configured to obtain a target memory dump file corresponding to a target software after a crash; A second obtaining module is configured to obtain an address mapping table of the target software when the target software does not have a program database file, the address mapping table being used to represent the mapping relationship between first function addresses in the program database file and corresponding second function addresses without the program database file; A mapping module is configured to map the function addresses in the target memory dump file based on the address mapping table of the target software, and determine the readable symbol information corresponding to the target memory dump file; The determination manner of the address mapping table includes: Obtaining the source code of the target software recorded in the target memory dump file; Compiling the source code with a program database file to determine a first compiled file; Disassembling the first compiled file and a second compiled file of the target software without the program database file to obtain a first disassembled file and a second disassembled file, respectively; Querying the second function addresses in the target memory dump file corresponding to the second assembly instructions in the second disassembled file; Based on the second assembly instructions, fuzzy matching is performed in the first disassembled file to determine the first function addresses corresponding to the second function addresses, so as to determine the address mapping table.

8. An electronic device, comprising: It includes: A memory and a processor are communicatively connected between each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the memory dump file analysis method in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for causing a computer to execute the analysis method of the memory dump file according to any one of claims 1-6.

Images