1. Why do crash logs need to be parsed

The crash log thread traceback is shown, where the call stacks are binary addresses rather than readable function names so the crash log needs to be parsed into an understandable function call stack.

2. GeneratedSYMSymbol file

crashlogParsing requires debugging symbol table filesdSYM(debugging symbols).dSYMThe file is actually taken fromMach-OFile Indicates the directory for extracting debugging information. When compiling the project,debugMode is selected by defaultdSYMThe configuration file is available inBuild Setting|Build OptionIn the changes.dSYMFile generation takes timecrashlogParsing, optionally not generating.

2.1 DebugCan be inDeriveDataThe dSYM file is obtained from the

2.2 Packaging can be generated at the time.achiveDirectory to find the correspondingdSYMfile

2 Analytical Methods

2.1 the Xcode parsing

willcrashlog,dSYMFile and executable files in the same directory, and thencrashlogDrag and drop toDevicelogRight,Re-symbolicate LogYou can parse it.

2.2 Use symbolicatecrash command line parsing

  • 1. Find firstsymbolicatecrashThe path of the

The usual path for Symbolicatecrash is/Applications/Xcode.app/Contents/SharedFrameworks/DVTFoundation.framework/Versions/A/Resources/symbolicatecrash

  • 2. Command line parsing

First copy the crash logs, dSYM, and Symbolicatecrash into the same folder, then CD it to the current folder and run the following command to parse./symbolicatecrash temp.crash testxcConfig.app.dSYM > result.log

  • 3. Run the command for the first timeexport DEVELOPER_DIR="/Applications/XCode.app/Contents/Developer"

3. Analytic principle

DSYM file introduction

The real data store is DWARF files, DWARF(Debuging With Arbitrary Format) being the standard Format for storing and processing debugging information in file formats such as ELF and Mach-O. The data in DWARF is highly compressed and can be passeddwarfdumpCommand to extract readable information, such as. Debug_info and. Debug_line. Note:ELF,Mach-OFormat files used to store binaries, executables, object code, and shared libraries.

Analytical process

  1. Calculates the address in the symbol table corresponding to the crash address

The following figure shows an example of a Crashlog file. Is aExceptionIn the red box on the right, the first column is the run time stack address, the second column is the start address of the process at run time (testxcConfig all lines start address is the same), and the third column is the run time offset address.Run time stack address = run time start address + offset address, as in behavior 4.0x1022CD990 = 0x1022C8000 + 0x5990 (22928)According to the principle that the virtual memory offset address remains unchanged, the address in the symbol table corresponding to the crash address can be obtained as long as the starting address of the TEXT segment of the symbol table is known and the offset (0x5990) is added. The starting address of the TEXT segment of the symbol table can be obtained by running the following command.Then the crash address (0x1022cd990) corresponding address in symbol table is:0x100005990 =0x0000000100000000+0x59902) Address remapping after obtaining symbol table address, indebug-infoSection to find those that contain the addressDIE(Debug Information Entry)The unit can obtain the function name (name), the file path (decl file) and the number of lines (DECl line) corresponding to the symbolic address, as shown in the figure below.The above steps resolve the relevant information of the function. The next step is to obtain the exact number of lines corresponding to the address, which requires the help ofdebug_lineChapters,debug_lineChapter takes the file as the unit, accurately records the symbol table address corresponding to each line in the file,0x100005990The correspondingAppDelegate.mThe first20Line.3) Manually parse crashlog when there is a completecrashlogFile and correspondingdSYMThe above procedure can be written byXcodeAutomatic completion. But for the user feedbackcrash, the user needs to manually copy the local crashlogFile, while usuallyCrashlog articleIf you want to copy the thread that crashed, you can copy the thread that crashedcrashInformation, and through manual parsing. Manual parsingcrashYou can useDwarfdump, atosTool, run the following command.

  • Methods a

  • Method 2

  • Methods three

Methods two and three are usedatosParse, the difference is that method three does not need to obtain the symbol table address, after the first address is the run-time stack address, the second to last address is the start address of the process. Another application scenario for manual resolution is that if a developer logs a run-time binary address to follow up on an accidental problem, the correspondingdSYMThe file manually resolves the plaintext of the calling function.

4. Frequently Asked Questions

  1. How to findcrashlogThe correspondingdSYMFile?

Open the terminal and run the following command to obtain the valuedSYMFile correspondinguuid, and with thecrashlogfileBinary ImageThe following character comparison, if the characters are exactly the same, it indicatesdSYMFile with thecrashlogThe corresponding. Alternatively, you can use the mdfind command to find the specified UUIDdSYMFile, as shown below, uUID should be capitalized and converted to format, as shown belowmdfind "com_apple_xcode_dsym_uuids == D5644244-F2C4-3C96-BD63-EF0F4DA518FA"

  1. How to Manually generatedSYMFile?

If you forget before compilingbuildsettingSelect Generate fromdSYMFile, however, the app crashes again, so you can manually generate it from the app’s executable filedSYMFile./Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/dsymutil /Users/ranjingfu/Desktop/testxcConfig/testxcConfig.app/testxcConfig -o out.dSYM It is worth noting that only executable files aredebugThe debug symbol table file can only be manually extracted using the above method(dSYM).releasePatterns cannot be extracted. becausedebugThe product will save debugging information, andreleaseThe product doesn’t,dSYMThe files are extracted from the debugging information.

Parsed crash log instance