Gleaning Information from Stackshots

Question

Created May ’16

Replies 3

Boosts 0

Participants 2

Anyone have any idea how to glean some information from a stackshot collected in production? Specifically, whether it's possible and how to identify the main thread and figure out what code is being executed by it?

Boost

Answer 1

DTS Engineer OP

Apple

May ’16

On what platform?

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0

Answer 2

jleishman OP

May ’16

iOS

0

Answer 3

DTS Engineer OP

Apple

May ’16

Anyone have any idea how to glean some information from a stackshot collected in production?

Apple does not publish any tools for this. However, the format is (relatively) plain text so if you’re feeling adventurous you should be able to make progress.

Note I didn’t use any Apple internal info to craft this response; I just opened the file and poked around.

IMPORTANT As this format is not documented, don’t hard-code knowledge about it into your product.

Here’s what I did:

Finding your process is easy: get the
```
processByPid
```
dictionary and search for an entry whose
```
procname
```
matches.
Within that, that’s a
```
threadById
```
dictionary that lists all of the threads.
Within each of those, there’s a
```
userFrames
```
array that lists the frame in the backtrace. Each entry looks like it contains an offset and a base address.
At the end of the stackshot you’ll find a
```
binaryImages
```
key that lists the UUID and load address of each image. There’s also some mysterious flags (
```
K
```
,
```
C
```
,
```
A
```
,
```
P
```
) that I don’t fully grok but I think that
```
P
```
refers to images that are unique to a process and
```
C
```
stands for stuff that’s in the dyld shared segment.

The above should be enough to allow you to do manual symbolication. You can use

binaryImages

to create an map from address to UUID, run the base address through that map to get the UUID and slide, look up the UUID to find the symbols in the iOS SDK, and then run the whole thing through

atos

.

Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"

0