Engineering Report <dv> - Week 34, 2015


../_images/Valgrind-Android-bugs-status-2015-08.png ../_images/VEX-ARM-bugs-status-2015-08.png
  • From Valgrind IRC (2015-05) (看起來前面提到的兩個 unhandled ARM instruction 可以先忽略 ?)

    17:48 < jaeckel> disInstr(arm): unhandled instruction: 0xEE190F1D
    17:48 < jaeckel> does that count as error?
    17:49 < tomhughes> well that's a fatal, termingating your application now error
    17:49 < tomhughes> that means your code is executing an instruction we don't know how to emulate
    17:49 < tomhughes> I mean unless you catch the SIGILL and handle it somehow anyway
    17:51 < jaeckel> yeah, that's handled
    17:51 < jaeckel> so my application run afterwards
    17:52 < jaeckel> btw. is there a chance this gets fixed someday?
    17:52 < jaeckel> because it's marked as 'Probably WONTFIX or CANTFIX '
    17:53 < tomhughes> well how do you "handle" it? it's generally hard unless there's some other instruction you can use instead
    17:53 < jaeckel> TBH I don't know
    17:54 < tomhughes> according to it's expected
    17:54 < tomhughes> that instruction is priviliged so crypto libraries that use it in userspace just ignore the failure
    17:56 < jaeckel> okay, that would explain why it continues
    17:58 < jaeckel> so I suppose we can also ignore that this happens?
    17:58 < tomhughes> sounds like it


  • 補上 Elf32_Nhdr 的 condition 判斷,讓 issue #339861 可以 close

  • 發現原來有 for Android Emulator 的 README ,之前眼殘沒看到,接下來嘗試它能不能 work

  • Build 現在新版的 Android (開 Debug 相關 info),而不是使用現在我手機上的 Android 5.1
    • 至少要有的 compile 參數 : -g -fno-omit-frame-pointer -fno-stack-check (for better stack trace information)


  • 有些 stack trace 只顯示了 ???
    • 根據 FAQ 裡的敘述,share objects 如果被 unloaded 的話會讓 Valgrind 的 error message 變成 ??? ,workaround 為避免這些 share objects 去呼叫 dlclose

    • 範例
      • 有 debug info 而且 unstripped (最好的情況)

        Invalid write of size 1
            at 0x80483BF: really (malloc1.c:20)
            by 0x8048370: main (malloc1.c:9)
      • 沒有 debug info 而且 unstripped

        Invalid write of size 1
            at 0x80483BF: really (in /auto/homes/njn25/grind/head5/a.out)
            by 0x8048370: main (in /auto/homes/njn25/grind/head5/a.out)
      • 沒有 debug info 而且 stripped

        Invalid write of size 1
            at 0x80483BF: (within /auto/homes/njn25/grind/head5/a.out)
            by 0x8048370: (within /auto/homes/njn25/grind/head5/a.out)
            by 0x42015703: __libc_start_main (in /lib/tls/
            by 0x80482CC: (within /auto/homes/njn25/grind/head5/a.out)
      • 有 debug info 而且加了 -fomit-frame-pointer

        Invalid write of size 1
            at 0x80483C4: really (malloc1.c:20)
            by 0x42015703: __libc_start_main (in /lib/tls/
            by 0x80482CC: ??? (start.S:81)
      • unloaded shared object

        84 bytes in 1 blocks are possibly lost in loss record 488 of 713
            at 0x1B9036DA: operator new(unsigned) (vg_replace_malloc.c:132)
            by 0x1DB63EEB: ???
            by 0x1DB4B800: ???
            by 0x1D65E007: ???
            by 0x8049EE6: main (main.cpp:24)