《软件调试的艺术》笔记--使用其他调试工具

1.splint

splint是一个开源的静态代码检查工具，使用方法如下：

待检测的程序程序如下：

#include <stdio.h>

static void display(int i)
{
	printf("i = %d\n",i);
}

int main(void)
{
	int i,j;
	i = 1;
	i = i + 1;
	display(i);
	return 0;
}

调试如下：

$ splint main.c 
Splint 3.1.2 --- 03 May 2009

main.c: (in function main)
main.c:10:8: Variable j declared but not used
  A variable is declared but never used. Use /*@unused@*/ in front of
  declaration to suppress message. (Use -varuse to inhibit warning)


Finished checking --- 1 code warning

提示定义了一个变量j但是从来没有使用过。

将j定义去掉后，再进行检测：

$ splint main.c 
Splint 3.1.2 --- 03 May 2009

Finished checking --- no warnings

splint有一大推flag可以使用，使用时标志前加’+‘或’-’，'+'标志开启这个标志，'-'表示关闭此标志。

下列语句用于检查程序中数据的越界问题。

splint +bounds main.c

2.strace

strace常用来跟踪进程执行时的系统调用和所接收的信号。

对上面的程序进行追踪测试：

$ strace ./a.out 
execve("./a.out", ["./a.out"], [/* 50 vars */]) = 0
brk(0)                                  = 0x1033000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f64fa550000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=77020, ...}) = 0
mmap(NULL, 77020, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f64fa53d000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\30\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1815224, ...}) = 0
mmap(NULL, 3929304, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f64f9f70000
mprotect(0x7f64fa125000, 2097152, PROT_NONE) = 0
mmap(0x7f64fa325000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b5000) = 0x7f64fa325000
mmap(0x7f64fa32b000, 17624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f64fa32b000
close(3)                                = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f64fa53c000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f64fa53b000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f64fa53a000
arch_prctl(ARCH_SET_FS, 0x7f64fa53b700) = 0
mprotect(0x7f64fa325000, 16384, PROT_READ) = 0
mprotect(0x600000, 4096, PROT_READ)     = 0
mprotect(0x7f64fa552000, 4096, PROT_READ) = 0
munmap(0x7f64fa53d000, 77020)           = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f64fa54f000
write(1, "i = 2\n", 6i = 2
)                  = 6
exit_group(0)                           = ?

3.ltrace

ltrace用来跟踪进程调用库函数的情况。

对上面的程序进行追踪测试：

$ ltrace ./a.out 
__libc_start_main(0x400518, 1, 0x7ffff364a1a8, 0x400550, 0x4005e0 <unfinished ...>
printf("i = %d\n", 2i = 2
)                                                                   = 6
+++ exited (status 0) +++