如何跟踪特定值的 "fate"？

Question

我在某些地方看到了一些价值，但不确定它起源于我的程序的何处。我如何找出这个值最初来自哪里？

我希望记录以下事件类型：

源自常量、算术表达式或系统调用的值 - 初始事件；
该值已分配给某个变量（或从中检索）；
该值作为参数传递或return来自某个函数；
该值已存储到（或从中检索到）某个结构；
通过用特定的东西注释源代码，我触发了这个值的历史转储。

例如，对于此示例代码：

#include <stdlib.h>

struct SomeStruct {
    int a;
    int b;
};

struct SomeStruct *globalvar;

int f1(struct SomeStruct* par) {
    return par->a;
}

int f2(struct SomeStruct* par, int q) {
    par->a = q;
    return par->b;
}

void trace_value(int g) {} /* dummy */

int main(void) {
    int f = 31337;

    globalvar = malloc(sizeof(*globalvar));
    f2(globalvar, f);
    struct SomeStruct q = *globalvar;
    int g = f1(&q);

    trace_value(g);

    return 0;
}

应该return类似于

value 31337 originated from constant at fate.c:18
assigned to variable at fate.c:18
retrieved from variable at fate.c:21
passed as argument to function at fate.c:21
received as arument to a function at fate.c:12
assigned to struct field at fate.c:13
copied as a part of struct at fate.c:22
retrieved from struct field at fate.c:9
returned from function at fate.c:10
assigned to variable at fate.c:23
retrieved from variable at fate.c:25
traced at fate.c:25

我该怎么做或做类似的事情？我希望 Valgrind 或 GDB 或某些组合应该能够做到这一点。

Answer 1

我相信它可以在运行时通过称为 "reverse debugging" 的技术 手动完成 （即运行在 gdb 会话中）。我还没有尝试过，但是 GDB 7.0 版文档 claims，它在某些平台上受支持。

该方法类似于：

本地化最后一个地方使用变量的单步（也就是你的"starting point"）
分析堆栈帧的源代码（所以你需要可用的调试符号和代码段）（例如通过list），这样你就知道这个值是如何通过（例如从参数传递给函数）
退回上一个堆栈帧并从上一步重复，除非找到它的来源

这是您的示例代码的一些概念验证会话。我对其进行了一些编辑，因为 trace_value 函数未定义。请注意，record 命令可能会严重降低程序的执行速度。

$ gdb -q a.out 
Reading symbols from /home/grzegorz/workspace/a.out...done.
(gdb) b main
Breakpoint 1 at 0x400502: file fate.c, line 22.
(gdb) run
Starting program: /home/grzegorz/workspace/a.out 

Breakpoint 1, main () at fate.c:22
22      int f = 31337;
Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.149.el6_6.5.x86_64
(gdb) record
(gdb) b trace_value
Breakpoint 2 at 0x4004f8: file fate.c, line 19.
(gdb) c
Continuing.

Breakpoint 2, trace_value (g=31337) at fate.c:19
19  void trace_value(int g){}
(gdb) info args
g = 31337
(gdb) reverse-finish
Run back to call of #0  trace_value (g=31337) at fate.c:19
0x0000000000400550 in main () at fate.c:29
29      trace_value(g);
(gdb) bt
#0  0x0000000000400550 in main () at fate.c:29
(gdb) list 29
24      globalvar = malloc(sizeof(*globalvar));
25      f2(globalvar, f);
26      struct SomeStruct q = *globalvar;
27      int g = f1(&q);
28  
29      trace_value(g);
30  
31      return 0;
32  }

很少有事情需要解释。你需要先在main设置断点，因为这是程序开始执行的时候，然后通过record命令开启session recording。然后在trace_value函数处设置第二个断点并使用continue命令（简称c）。这允许您记录整个执行直到输入 trace_value 的时刻。您可能会认为它是上面描述的 "starting point"。

这当然不是全部。如前所述，您需要分析当前堆栈框架的源代码，然后决定下一步做什么。您可以根据当前情况使用reverse-step或reverse-finish命令。

Answer 2

结合使用反向 gdb 和 MarkPlotnick 关于使用 gdb 观察点的评论中的 idea2。这是演示会话，比原始答案更完整：

$ gcc -ggdb -Dtrace_value=exit fate.c -o fate
$ gdb -quiet -args ./fate 
Reading symbols from /home/vi/code/_/fate...done.
(gdb) break main
Breakpoint 1 at 0x8048482: file fate.c, line 18.
(gdb) r
Starting program: /home/vi/code/_/fate 
warning: Could not load shared library symbols for linux-gate.so.1.
Do you need "set solib-search-path" or "set sysroot"?

Breakpoint 1, main () at fate.c:18
18      int f = 31337;
(gdb) record
(gdb) break 25
(gdb) # traced at fate.c:25
Breakpoint 2 at 0x80484d2: file fate.c, line 25.
(gdb) c
Continuing.

Breakpoint 2, main () at fate.c:25
25      trace_value(g);
(gdb) # retrieved from variable at fate.c:25
(gdb) watch g
Hardware watchpoint 3: g
(gdb) reverse-continue 
Continuing.
Hardware watchpoint 3: g

Old value = 31337
New value = 134513899
0x080484ce in main () at fate.c:23
23      int g = f1(&q);
(gdb) # assigned to variable at fate.c:23
(gdb) # returned from function at fate.c:10
(gdb) reverse-step
f1 (par=0xffffd670) at fate.c:10
10  }
(gdb) list
5   
6   struct SomeStruct *globalvar;
7   
8   int f1(struct SomeStruct* par) {
9       return par->a;
10  }
11  
12  int f2(struct SomeStruct* par, int q) {
13      par->a = q;
14      return par->b;
(gdb) # retrieved from struct field at fate.c:9
(gdb) print par
 = (struct SomeStruct *) 0xffffd670
(gdb) print ((struct SomeStruct *) 0xffffd670)->a
 = 31337
(gdb) watch ((struct SomeStruct *) 0xffffd670)->a
Hardware watchpoint 4: ((struct SomeStruct *) 0xffffd670)->a
(gdb) reverse-continue 
Continuing.
Hardware watchpoint 4: ((struct SomeStruct *) 0xffffd670)->a

Old value = 31337
New value = -134716508
0x080484ba in main () at fate.c:22
22      struct SomeStruct q = *globalvar;
(gdb) # copied as a part of struct at fate.c:22
(gdb) print globalvar->a
 = 31337
(gdb) watch globalvar->a
Hardware watchpoint 5: globalvar->a
(gdb) reverse-continue 
Continuing.
Hardware watchpoint 5: globalvar->a

Old value = 31337
New value = 0
0x0804846f in f2 (par=0x804a008, q=31337) at fate.c:13
13      par->a = q;
(gdb) # assigned to struct field at fate.c:13
(gdb) # received as arument to a function at fate.c:12
(gdb) list
8   int f1(struct SomeStruct* par) {
9       return par->a;
10  }
11  
12  int f2(struct SomeStruct* par, int q) {
13      par->a = q;
14      return par->b;
15  }
16  
17  int main() {
(gdb) bt
#0  0x0804846f in f2 (par=0x804a008, q=31337) at fate.c:13
#1  0x080484b0 in main () at fate.c:21
(gdb) reverse-finish 
Run back to call of #0  0x0804846f in f2 (par=0x804a008, q=31337) at fate.c:13
0x080484ab in main () at fate.c:21
21      f2(globalvar, f);
(gdb) # passed as argument to function at fate.c:21
(gdb) # retrieved from variable at fate.c:21
(gdb) watch f
Hardware watchpoint 6: f
(gdb) reverse-finish 
"finish" not meaningful in the outermost frame.
(gdb) reverse-continue 
Continuing.
Warning:
Could not insert hardware watchpoint 6.
Could not insert hardware breakpoints:
You may have requested too many hardware breakpoints/watchpoints.

(gdb) delete
Delete all breakpoints? (y or n) y
(gdb) watch f
Hardware watchpoint 7: f
(gdb) reverse-continue 
Continuing.

No more reverse-execution history.
main () at fate.c:18
18      int f = 31337;
(gdb) # assigned to variable at fate.c:18
(gdb) # value 31337 originated from constant at fate.c:18

问题陈述中的所有预期消息都对应于您在 gdb 输出中看到的某些信息（如评论中所示）。

如何跟踪特定值的 "fate"？

How do I trace "fate" of a particular value?

c

gdb

valgrind

trace