Android二进制文件的qemu用户仿真中的段错误

【问题标题】：Segfault in qemu user emulation of Android binaryAndroid二进制文件的qemu用户仿真中的段错误
【发布时间】：2020-12-14 11:40:41
【问题描述】：

我在 Ubuntu 18.04 x64 主机上运行 qemu，并尝试使用 Android NDK 对为 Android（用于 aarch64 或 i386）构建的动态二进制文件进行用户模拟，但我总是遇到段错误。例如：

建造 
$ i686-linux-android28-clang hello_world.c -o hello_world
检查依赖关系和路径 
$ file ./hello_world

./hello_world: ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /system/bin/linker, not stripped

$ readelf -d ./hello_world

Dynamic section at offset 0xef4 contains 24 entries:
  Tag        Type                         Name/Value
 0x00000003 (PLTGOT)                     0x1fdc
 0x00000002 (PLTRELSZ)                   48 (bytes)
 0x00000017 (JMPREL)                     0x318
 0x00000014 (PLTREL)                     REL
 0x00000015 (DEBUG)                      0x0
 0x00000006 (SYMTAB)                     0x200
 0x0000000b (SYMENT)                     16 (bytes)
 0x00000005 (STRTAB)                     0x270
 0x0000000a (STRSZ)                      96 (bytes)
 0x6ffffef5 (GNU_HASH)                   0x2d0
 0x00000001 (NEEDED)                     Shared library: [libdl.so]
 0x00000001 (NEEDED)                     Shared library: [libc.so]
 ...
复制到 Pixel 2 Android 9 i386 的解压 Android 模拟器映像。 
$ ls ~/android_28_img/
acct        cache    d             dev   init.environ.rc       init.usb.rc       metadata  oem      sbin     sys         vendor
bin         charger  data          etc   init.rc               init.zygote32.rc  mnt       proc     sdcard   system
bugreports  config   default.prop  init  init.usb.configfs.rc  lost+found        odm       product  storage  ueventd.rc

$ sudo cp ./hello_world ~/android_28_img/system/bin
也在那里复制静态 qemu 
$ sudo cp /usr/bin/qemu-i386-static ~/android_28_img/system/bin
以各种方式运行模拟器 
$ sudo chroot /home/user/android_28_img ./system/bin/qemu-i386-static /system/bin/hello_world
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault

$ qemu-i386 -L /home/user/android_38_img ./system/bin/hello_world
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault
跟踪 
$ sudo chroot /home/user/android_28_img ./system/bin/qemu-i386-static -strace /system/bin/hello_world
60785 set_thread_area(0xffffa3f0) = 0
60785 mmap2(NULL,20480,PROT_NONE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0xff6a5000
60785 madvise(-9809920,20480,12,-9809920,-8432404,-23672) = 0
60785 prctl(1398164801,0,-9809920,20480,-8681506,-23528) = -1 errno=22 (Invalid argument)
60785 mprotect(0xff6a6000,12288,PROT_READ|PROT_WRITE) = 0
60785 prctl(1398164801,0,-9805824,12288,-8681440,-23528) = -1 errno=22 (Invalid argument)
60785 set_tid_address(-8432484,0,20480,-9781248,-8432492,-23480) = 60785
60785 faccessat(AT_FDCWD,"/dev/urandom",R_OK,AT_SYMLINK_NOFOLLOW|0xff7f601c) = -1 errno=2 (No such file or directory)
60785 futex(0xff7f2a44,FUTEX_PRIVATE_FLAG|FUTEX_WAKE,2147483647,NULL,NULL,0) = 0
60785 sched_getscheduler(0,0,-8432496,-8432492,-8432492,-23528) = 0
60785 mmap2(NULL,20480,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0xff6a0000
60785 madvise(-9830400,20480,12,-9830400,-8432404,-23688) = 0
60785 mprotect(0xff6a0000,4096,PROT_NONE) = 0
60785 sigaltstack(0xffffa3e8,(nil)) = 0
60785 prctl(1398164801,0,-9826304,16384,-8681429,-23528) = -1 errno=22 (Invalid argument)
60785 prctl(1398164801,0,-9830400,4096,-8681409,-23528) = -1 errno=22 (Invalid argument)
60785 mprotect(0xff7eb000,24576,PROT_READ) = 0
60785 mprotect(0xff7f4000,4096,PROT_READ) = 0
60785 mprotect(0xff7f4000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff7f4000,4096,PROT_READ) = 0
60785 mmap2(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0xff69f000
60785 madvise(-9834496,4096,12,-9834496,-8432404,-23848) = 0
60785 prctl(1398164801,0,-9834496,4096,-8680817,-23704) = -1 errno=22 (Invalid argument)
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0
60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mprotect(0xff69f000,4096,PROT_READ|PROT_WRITE) = 0

60785 mprotect(0xff69f000,4096,PROT_READ) = 0
60785 mmap2(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0xff69e000
60785 madvise(-9838592,4096,12,-9838592,-8432404,-24136) = 0
60785 prctl(1398164801,0,-9838592,4096,-8693379,-23944) = -1 errno=22 (Invalid argument)
60785 mmap2(NULL,12,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0xff69d000
60785 madvise(-9842688,12,12,-9842688,-8432404,-24280) = 0
60785 prctl(1398164801,0,-9842688,12,-8693213,-24136) = -1 errno=22 (Invalid argument)
60785 getrandom(-23744,40,1,40,-23744,-23768) = 40
60785 mmap2(NULL,1096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0xff69c000
60785 madvise(-9846784,1096,12,-9846784,-8432404,-23896) = 0
60785 prctl(1398164801,0,-9846784,1096,-8682952,-23752) = -1 errno=22 (Invalid argument)
60785 mmap2(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0xff69b000
60785 madvise(-9850880,4096,12,-9850880,-8432404,-24072) = 0
60785 prctl(1398164801,0,-9850880,4096,-8693379,-23880) = -1 errno=22 (Invalid argument)
60785 mmap2(NULL,12,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0xff69a000
60785 madvise(-9854976,12,12,-9854976,-8432404,-24216) = 0
60785 prctl(1398164801,0,-9854976,12,-8693213,-24072) = -1 errno=22 (Invalid argument)
60785 mmap2(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0xff699000
60785 madvise(-9859072,4096,12,-9859072,-8432404,-23640) = 0
60785 prctl(1398164801,0,-9859072,4096,-8728674,-23496) = -1 errno=22 (Invalid argument)
60785 mprotect(0xff699000,4096,PROT_READ|PROT_WRITE) = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=1, si_addr=0x0000014e} ---
qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Segmentation fault
查看崩溃转储 
$ sudo apport-unpack /var/crash/_usr_bin_qemu-i386.101461.crash ~/crash-unpacked/
$ gdb /usr/bin/qemu-i386 ~/crash-unpacked/CoreDump

$ gdb /usr/bin/qemu-i386 ~/crash-unpacked/CoreDump
GNU gdb (Ubuntu 8.1-0ubuntu3.2) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
pwndbg: loaded 175 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Reading symbols from /usr/bin/qemu-i386...(no debugging symbols found)...done.
[New LWP 61385]
[New LWP 61386]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `qemu-i386 -L /home/user/android_28_img ./system/bin/hello_world'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f0853f7b2e6 in __GI___sigsuspend (set=0x7ffdb0445f48) at ../sysdeps/unix/sysv/linux/sigsuspend.c:26
26  ../sysdeps/unix/sysv/linux/sigsuspend.c: No such file or directory.
[Current thread is 1 (Thread 0x7f0855413e00 (LWP 61385))]
LEGEND: STACK | HEAP | CODE | DATA | RWX | RODATA
─────────────────────────────────────────────────────────────────[ REGISTERS ]──────────────────────────────────────────────────────────────────
 RAX  0xfffffffffffffdfe
 RBX  0x7ffdb0445f48 ◂— 0xfffffffe7ffffbff
 RCX  0x7f0853f7b2e6 (sigsuspend+70) ◂— cmp    rax, -0x1000 /* 'H=' */
 RDX  0x0
 RDI  0x7ffdb0445f48 ◂— 0xfffffffe7ffffbff
 RSI  0x8
 R8   0x0
 R9   0xb
 R10  0x8
 R11  0x293
 R12  0x7ffdb0445f40 ◂— 0x0
 R13  0x5581b1e9c210 ◂— 0xefc9
 R14  0xb
 R15  0x0
 RBP  0xb
 RSP  0x7ffdb0445f10 ◂— 0xb /* '\x0b' */
 RIP  0x7f0853f7b2e6 (sigsuspend+70) ◂— cmp    rax, -0x1000 /* 'H=' */
───────────────────────────────────────────────────────────────────[ DISASM ]───────────────────────────────────────────────────────────────────
 ► 0x7f0853f7b2e6 <sigsuspend+70>     cmp    rax, -0x1000
   0x7f0853f7b2ec <sigsuspend+76>     ja     sigsuspend+122 <0x7f0853f7b31a>
    ↓
   0x7f0853f7b31a <sigsuspend+122>    mov    rcx, qword ptr [rip + 0x3abb47]
   0x7f0853f7b321 <sigsuspend+129>    neg    eax
   0x7f0853f7b323 <sigsuspend+131>    mov    dword ptr fs:[rcx], eax
   0x7f0853f7b326 <sigsuspend+134>    mov    eax, 0xffffffff
   0x7f0853f7b32b <sigsuspend+139>    jmp    sigsuspend+78 <0x7f0853f7b2ee>
    ↓
   0x7f0853f7b2ee <sigsuspend+78>     mov    edi, edx
   0x7f0853f7b2f0 <sigsuspend+80>     mov    dword ptr [rsp + 0xc], eax
   0x7f0853f7b2f4 <sigsuspend+84>     call   __libc_disable_asynccancel <0x7f085406c8f0>
 
   0x7f0853f7b2f9 <sigsuspend+89>     mov    eax, dword ptr [rsp + 0xc]
───────────────────────────────────────────────────────────────────[ STACK ]────────────────────────────────────────────────────────────────────
00:0000│ rsp      0x7ffdb0445f10 ◂— 0xb /* '\x0b' */
01:0008│          0x7ffdb0445f18 ◂— 0xdb8b156e6a07500
02:0010│          0x7ffdb0445f20 —▸ 0x7ffdb0445f48 ◂— 0xfffffffe7ffffbff
03:0018│          0x7ffdb0445f28 —▸ 0x5581ae7bbb14 ◂— call   0x5581ae770710
04:0020│          0x7ffdb0445f30 ◂— 0x0
05:0028│          0x7ffdb0445f38 ◂— 0xffffffffffffffff
06:0030│ r12      0x7ffdb0445f40 ◂— 0x0
07:0038│ rbx rdi  0x7ffdb0445f48 ◂— 0xfffffffe7ffffbff
─────────────────────────────────────────────────────────────────[ BACKTRACE ]──────────────────────────────────────────────────────────────────
 ► f 0     7f0853f7b2e6 sigsuspend+70
   f 1     5581ae7bbb14
   f 2     5581ae7bc6b8
   f 3     5581ae7bd4db process_pending_signals+363
   f 4     5581ae7a06e8 cpu_loop+504
   f 5     5581ae773504 main+1860
   f 6     7f0853f5db97 __libc_start_main+231
我为 aarch64 构建和模拟了相同的行为，并使用了未打包的 Galaxy S9 映像中的库。

【问题讨论】：

    标签： android segmentation-fault emulation qemu


    【解决方案1】：

    可能 Android 二进制文件正在尝试使用 QEMU 未实现的内核功能，或者它正在做一些意想不到的事情 - 大多数 QEMU 的用户仿真模式是在普通 Linux 用户空间二进制文件上测试的，而不是 Android 的。例如，您可以在 strace() 中看到许多失败的 prctl() 调用：调试它的一个好的开始是弄清楚它们正在尝试做什么并检查 QEMU 是否实现了它们。

    您可能还会发现使用 QEMU 的内置调试存根并将 x86 感知 gdb 附加到它很有用：然后您可以逐步执行来宾代码并查看它在出错时正在做什么。

    最后，您不要提及您使用的是哪个 QEMU 版本——如果它不是最新版本，那么总是值得尝试最新版本来检查它是否已经修复。 （特别是 4.0 之前的任何 QEMU 版本都存在一些与多线程和用户模式仿真中的信号有关的非常糟糕的错误。）

    【讨论】：

      猜你喜欢
      • 1970-01-01
      • 1970-01-01
      • 2021-07-09
      • 2012-07-19
      • 1970-01-01
      • 2011-01-17
      • 2020-08-01
      • 1970-01-01
      • 2013-04-13
      相关资源
      最近更新 更多
      热门标签
      Java Python linux javascript Mysql C# Docker 算法 前端 SpringBoot Redis Vue spring 设计模式 .net core .net kubernetes c++ 数据库 数据结构 大数据 js 机器学习 微服务 Android Go 程序员 面试 JVM ASP.net core 云原生 人工智能 后端 PHP git CSS golang k8s Nginx Django mybatis 深度学习 多线程 React 架构 devops 爬虫 云计算 Spring Boot LeetCode