__builtin_return_address()引发的思考

基本含义

__builtin_return_address（0）返回当前函数的返回地址
__builtin_return_address（1）返回当前函数的调用函数的返回地址
__builtin_return_address（2）返回当前函数的调用函数的调用函数的返回地址

编译出来的实际效果

void tt3(){
    LOGD("tt3 called  %p",__builtin_return_address(0));
    LOGD("tt3 called  %p",__builtin_return_address(1));
    LOGD("tt3 called  %p",__builtin_return_address(2));
}

void tt2(){
    LOGD("tt2 called  %p",__builtin_return_address(0));
    LOGD("tt2 called  %p",__builtin_return_address(1));
    tt3();
}

void tt1(){
    LOGD("tt1 called 0 %p",__builtin_return_address(0));
    tt2();
}

---

tt1

tt2

tt3

由此可见就是使用 FP 串联了整个函数调用堆栈，上述的 函数(__builtin_return_address) 也就是通过串联起来的 [FP,#0x4] 操作完成了对上一级 LR 的查找

由此可以可以配合 dobby 对函数hook并打印出 lr 调用链

    int level=4;
    u_long lr0,lr1,lr2,lr3,lr4;
    [&]()->void {
        // 调用这个 registerLR 本身也会触发一次函数调用 会有一个lr，故从1开始
        switch (level) {
            case 1:
                lr0 = reinterpret_cast(__builtin_return_address(1));
                LOGD("LR -> %p",(void*)(lr0-soAddr));
                break;
            case 2:
                lr1 = reinterpret_cast(__builtin_return_address(1));
                lr0 = reinterpret_cast(__builtin_return_address(2));
                LOGD("LR -> %p %p",(void*)(lr0-soAddr),(void*)(lr1-soAddr));
                break;
            case 3:
                lr2 = reinterpret_cast(__builtin_return_address(1));
                lr1 = reinterpret_cast(__builtin_return_address(2));
                lr0 = reinterpret_cast(__builtin_return_address(3));
                LOGD("LR -> %p %p %p",(void*)(lr0-soAddr),(void*)(lr1-soAddr),(void*)(lr2-soAddr));
                break;
            case 4:
                lr3 = reinterpret_cast(__builtin_return_address(1));
                lr2 = reinterpret_cast(__builtin_return_address(2));
                lr1 = reinterpret_cast(__builtin_return_address(3));
                lr0 = reinterpret_cast(__builtin_return_address(4));
                LOGD("LR -> %p %p %p %p",(void*)(lr0-soAddr),(void*)(lr1-soAddr),(void*)(lr2-soAddr),(void*)(lr3-soAddr));
                break;
            case 5:
                lr4 = reinterpret_cast(__builtin_return_address(1));
                lr3 = reinterpret_cast(__builtin_return_address(2));
                lr2 = reinterpret_cast(__builtin_return_address(3));
                lr1 = reinterpret_cast(__builtin_return_address(4));
                lr0 = reinterpret_cast(__builtin_return_address(5));
                LOGD("LR -> %p %p %p %p %p",(void*)(lr0-soAddr),(void*)(lr1-soAddr),(void*)(lr2-soAddr),(void*)(lr3-soAddr),(void*)(lr4-soAddr));
                break;
        }
    }();

这个写法比较简陋了，也算是偷懒借用内建函数（__builtin_return_address）完成了栈的回溯，当然也可以稍微麻烦一点，dobby 配合 asm内嵌汇编 完成每一个函数栈的拆解，本质都是用到了 FP 串联起了整个函数调用链这样一个大思路