查找内存泄漏的一个思路 ---- GDB调试汇编分析

I'm not sure how you dump all the memory to a file without doing this repeatedly (if anyone knows an automated way to get gdb to do this please let me know), but the following works for any one batch of memory assuming you know the pid:

$ cat /proc/[pid]/maps

This will be in the format (example):

00400000-00421000 r-xp 00000000 08:01 592398                             /usr/libexec/dovecot/pop3-login
00621000-00622000 rw-p 00021000 08:01 592398                             /usr/libexec/dovecot/pop3-login
00622000-0066a000 rw-p 00622000 00:00 0                                  [heap]
3e73200000-3e7321c000 r-xp 00000000 08:01 229378                         /lib64/ld-2.5.so
3e7341b000-3e7341c000 r--p 0001b000 08:01 229378                         /lib64/ld-2.5.so

Pick one batch of memory (so for example 00621000-00622000) then use gdb as root to attach to the process and dump that memory:

$ gdb --pid [pid]
(gdb) dump memory /root/output 0x00621000 0x00622000

Then analyse /root/output with the strings command, less you want the PuTTY all over your screen.

share improve this answer follow

edited Jan 15 '14 at 4:25

slm

6,5551313 gold badges4646 silver badges6767 bronze badges

answered Aug 24 '10 at 18:39

James L

5,57511 gold badge1717 silver badges2222 bronze badges

2

Is there a way of doing this in just bash/sh without gdb? – Programming4life Mar 25 '17 at 5:35
3

@Programming4life gcore(1) – julian Apr 22 '17 at 12:59

add a comment

I've made a script that accomplishes this task.

The idea commes from James Lawrie's answer and this post: http://www.linuxforums.org/forum/programming-scripting/52375-reading-memory-other-processes.html#post287195

#!/bin/bash

grep rw-p /proc/$1/maps \
| sed -n 's/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p' \
| while read start stop; do \
    gdb --batch --pid $1 -ex \
        "dump memory $1-$start-$stop.dump 0x$start 0x$stop"; \
done

put this in a file (eg. "dump-all-memory-of-pid.sh") and make it executable

usage: ./dump-all-memory-of-pid.sh [pid]

The output is printed to files with the names: pid-startaddress-stopaddress.dump

Dependencies: gdb

share improve this answer follow

edited Mar 2 '19 at 8:32

Qsiris

10333 bronze badges

answered Jul 18 '12 at 17:38

A. Nilsson

71355 silver badges77 bronze badges

2

Awesome! Just used it to discover which script a mysterious bash instance was running. – Tobia Jul 26 '16 at 17:02
1

Why are you only grepping for and dumpying ranges with rw-p permissions? – mxmlnkn Aug 4 '19 at 18:45
1

@mxmlnkn That's data (rw-p), the other ranges are for code (r-xp). If you want a dump of both, then go ahead and exchange grep for e.g. cat. – A. Nilsson Aug 5 '19 at 14:55

add a comment

try

    gcore $pid

where $pid is the actual number of the pid; for more info see: info gcore

may take some time for the dump to happen, and some memory may not be readable, but is good enough... be aware also that it can create big files, I just created a 2GB file that way..

share improve this answer follow

edited Mar 28 '15 at 2:23

answered Mar 9 '13 at 19:06

Aquarius Power

67177 silver badges1313 bronze badges

1

Is gcore dumping a sparse file? – CMCDragonkai Jul 30 '16 at 7:02
@CMCDragonkai use gcore -a PID – e2-e4 May 21 at 5:30

add a comment

Pure bash solution:

procdump() 
( 
    cat /proc/$1/maps | grep "rw-p" | awk '{print $1}' | ( IFS="-"
    while read a b; do
        dd if=/proc/$1/mem bs=$( getconf PAGESIZE ) iflag=skip_bytes,count_bytes \
           skip=$(( 0x$a )) count=$(( 0x$b - 0x$a )) of="$1_mem_$a.bin"
    done )
)

Usage: procdump PID

for a cleaner dump filter out *.so memory mapped shared libraries and empty memory ranges:

procdump()
( 
    cat /proc/$1/maps | grep -Fv ".so" | grep " 0 " | awk '{print $1}' | ( IFS="-"
    while read a b; do
        dd if=/proc/$1/mem bs=$( getconf PAGESIZE ) iflag=skip_bytes,count_bytes \
           skip=$(( 0x$a )) count=$(( 0x$b - 0x$a )) of="$1_mem_$a.bin"
    done )
)

share improve this answer follow

edited Mar 11 at 15:00

mxmlnkn

38533 silver badges1111 bronze badges

answered Jun 5 '19 at 12:03

Zibri

18111 silver badge55 bronze badges

So, from what I understand, the idea behind the cleaner dump is that only in-memory files have a size attached to the memory region in contrast to actual application memory, which has size 0 (as the size actually used size is unknown by the OS). – mxmlnkn Aug 4 '19 at 19:04
1

One issue I have with this script is that the blocksize of 1 leads to a bandwidth of unacceptably slow ~30kB/s compared to using a blocksize equal to the page size (4096 for me) for which I get ~100MB/s! See here. getconf PAGESIZE is used to get the page size and then the addresses and counts are divided by it. – mxmlnkn Aug 4 '19 at 19:30
@mxmlnkn that was lazy of me, feel free to correct my answer. – Zibri Mar 6 at 0:06
Ok, will do. Note also that the count calculation is wrong because it is done with bd-ad but bd and ad are calculated only thereafter in the first bash snippet. – mxmlnkn Mar 6 at 12:03

add a comment

man proc says :

/proc/[pid]/mem This file can be used to access the pages of a process's memory through open(2), read(2), and lseek(2).

Maybe it can help you

share improve this answer follow

answered Aug 24 '10 at 17:58

Dom

6,09311 gold badge1717 silver badges2323 bronze badges

2

That's not sufficient, reading another process needs a combination of /proc/<pid>/{mem,*maps}, ptrace, and some signal handling to avoid hanging the target process. – Tobu Mar 19 '13 at 10:57
2

@Tobu Indeed. I wrote a proof-of-concept script. – Gilles 'SO- stop being evil' Jan 15 '14 at 9:18

add a comment

I made my own program to dump the entire process memory as well, it's in C so it can be cross-compiled to Android, which is what I needed.

You can also specify IP address and tcp port. Source code here.

share improve this answer follow

edited Mar 17 '17 at 13:14

Community♦

answered Dec 27 '15 at 14:55

Tal Aloni

14122 bronze badges

add a comment

Tool to dump process to standard output, pcat/memdump:

share improve this answer follow

edited Feb 4 '13 at 21:35

answered Feb 4 '13 at 21:27

Michael Springer

1922 bronze badges

This one is obsolete (removed at maintainer's request); I installed the old package anyway and it failed with "Input/output error; did you use GCC with another machine's header files?". – Tobu Mar 19 '13 at 11:14

add a comment

You can now use procdump from SysInternals suite on Linux:

https://github.com/Microsoft/ProcDump-for-Linux

share improve this answer follow

answered Dec 7 '17 at 7:09

makumo

add a comment

If you want to dump a separate memory segment of the running process without creating huge core file (say with gcore), you can use a small tool from here. There is also one-liner in README if you wish to dump all readable segments into separate files.

share improve this answer follow

answered Jul 23 '19 at 8:33

Nopius

34922 silver badges55 bronze badges

add a comment

Highly active question. Earn 10 reputation in order to answer this question. The reputation requirement helps protect this question from spam and non-answer activity.

Not the answer you're looking for? Browse other questions tagged linux memory process or ask your own question.

相关标签：汇编 Linux环境开发_调试_定位工具

上一篇： Android开发调试神器Stetho使用

下一篇： Android Studio 常见错误总结