linux下动态库so的debug方式

1. 查看哪些进程使用了特定的动态库so

# lsof /lib/arm-linux-gnueabi/libselinux.so.1

COMMAND     PID       USER  FD   TYPE DEVICE SIZE/OFF NODE NAME
init          1   sysadmin mem    REG    1,0   141608  811 /lib/arm-linux-gnueabi/libselinux.so.1
dbus-daem  3262 messagebus mem    REG    1,0   141608  811 /lib/arm-linux-gnueabi/libselinux.so.1
lsof       9552   sysadmin mem    REG    1,0   141608  811 /lib/arm-linux-gnueabi/libselinux.so.1
lsof       9555   sysadmin mem    REG    1,0   141608  811 /lib/arm-linux-gnueabi/libselinux.so.1
login     28610   sysadmin mem    REG    1,0   141608  811 /lib/arm-linux-gnueabi/libselinux.so.1

2. 查看elf文件link了哪些动态库so

方法一:

# ./tools/arm-soft-linux-gnueabi/bin/arm-soft-linux-gnueabi-ldd --root ./tools/arm-soft-linux-gnueabi/lib ./reboot
        libc.so.6 => /lib/libc.so.6 (0x8badf00d)
        ld-linux.so.3 => /lib/ld-linux.so.3 (0x8badf00d)

方法二：

# ./tools/arm-soft-linux-gnueabi/bin/arm-soft-linux-gnueabi-readelf -a ./reboot | grep NEEDED
 0x00000001 (NEEDED)                     Shared library: [libc.so.6]
 0x00000001 (NEEDED)                     Shared library: [ld-linux.so.3]

3. 将动态库so加载到的内存中的内容dump出来

使用lsof找到一个使用该so的进程，比如Pid为1.

然后‘cat /proc/1/maps_file | grep xxx.so’得到映射的虚地址空间，

最后，gdb attach 该进程，使用dump memory将so对应的地址dump出来。

4. dump 内存

方式一：

dd if=/dev/mem of=/tmp/mem_dump.bin count=1 bs=4M

方式二：

使用gdb, attach 某个进程。

(gdb) help dump
Dump target code/data to a local file.

List of dump subcommands:

dump binary -- Write target code/data to a raw binary file
dump ihex -- Write target code/data to an intel hex file
dump memory -- Write contents of memory to a raw binary file
dump srec -- Write target code/data to an srec file
dump tekhex -- Write target code/data to a tekhex file
dump value -- Write the value of an expression to a raw binary file
dump verilog -- Write target code/data to a verilog hex file
比如要dump 0x7f25c2a4e000-0x7f25c2a59000 这一块内存:

dump memory /tmp/sshd.dump 0x7f25c2a4e000 0x7f25c2a5900

方式三：

嵌入式系统可使用devmem特定的物理内存

/ # devmem 0x6ec2000
0x73A1E008

/proc/1 # devmem --help
BusyBox v1.21.1 (2023-02-03 07:55:47 UTC) multi-call binary.

Usage: devmem ADDRESS [WIDTH [VALUE]]

Read/write from physical address

        ADDRESS Address to act upon
        WIDTH   Width (8/16/...)
        VALUE   Data to be written