1*795d594fSAndroid Build Coastguard WorkerDex File Poisoning Access 2*795d594fSAndroid Build Coastguard Worker========================= 3*795d594fSAndroid Build Coastguard Worker 4*795d594fSAndroid Build Coastguard WorkerThese set of executables are useful for condensing large amounts of memory reads 5*795d594fSAndroid Build Coastguard Workerof Dex Files into smaller, split pieces of information. Two kinds of information 6*795d594fSAndroid Build Coastguard Workerare provided: 7*795d594fSAndroid Build Coastguard Worker 1. Visualizing what part of a Dex File is being accessed at what time 8*795d594fSAndroid Build Coastguard Worker as a graph 9*795d594fSAndroid Build Coastguard Worker 2. Ordering stack traces by most commonly occurring 10*795d594fSAndroid Build Coastguard WorkerBoth of these kinds of information can be split up further by providing category 11*795d594fSAndroid Build Coastguard Workernames as arguments. A trace is put into a category if the category name is a 12*795d594fSAndroid Build Coastguard Workersubstring of the symbolized trace. 13*795d594fSAndroid Build Coastguard Worker 14*795d594fSAndroid Build Coastguard WorkerHow: 15*795d594fSAndroid Build Coastguard Worker====== 16*795d594fSAndroid Build Coastguard WorkerThese set of tools work in conjunction with the class 17*795d594fSAndroid Build Coastguard WorkerDexFileTrackingRegistrar, which marks sections of Dex Files as poisoned. As Dex 18*795d594fSAndroid Build Coastguard WorkerFiles are marked for poisoning, their starting addresses are logged in logcat. 19*795d594fSAndroid Build Coastguard WorkerIn addition, when poisoned sections of memory are accesses, their stack trace is 20*795d594fSAndroid Build Coastguard Workeralso outputted to logcat. 21*795d594fSAndroid Build Coastguard Worker 22*795d594fSAndroid Build Coastguard Workersanitizer_logcat_analysis.sh is the main executable that will use the other two 23*795d594fSAndroid Build Coastguard Workerin order to give both types of information. The other two are used in some of 24*795d594fSAndroid Build Coastguard Workerthe intermediary steps which are described in sanitizer_logcat_analysis.sh, 25*795d594fSAndroid Build Coastguard Workerthough they can also be executed individually if provided the necessary input. 26*795d594fSAndroid Build Coastguard Worker 27*795d594fSAndroid Build Coastguard WorkerWhy: 28*795d594fSAndroid Build Coastguard Worker====== 29*795d594fSAndroid Build Coastguard Worker 30*795d594fSAndroid Build Coastguard WorkerThe main reason for splitting the functionality across multiple files is because 31*795d594fSAndroid Build Coastguard Workersanitizer_logcat_analysis.sh uses external executable development/scripts/stack. 32*795d594fSAndroid Build Coastguard WorkerThis is necessary in order to get symbolized traces from the output given by 33*795d594fSAndroid Build Coastguard WorkerAddress Sanitizer. 34*795d594fSAndroid Build Coastguard Worker 35*795d594fSAndroid Build Coastguard WorkerHow to Use: 36*795d594fSAndroid Build Coastguard Worker 37*795d594fSAndroid Build Coastguard Workersanitizer_logcat_analysis.sh at minimum requires all logcat output in the form 38*795d594fSAndroid Build Coastguard Workerof a file. Additional options specified below are useful for removing 39*795d594fSAndroid Build Coastguard Workerunnecessary trace information. 40*795d594fSAndroid Build Coastguard Worker 41*795d594fSAndroid Build Coastguard Worker=========================================================================== 42*795d594fSAndroid Build Coastguard WorkerUsage: sanitizer_logcat_analysis.sh [options] [LOGCAT_FILE] [CATEGORIES...] 43*795d594fSAndroid Build Coastguard Worker -a 44*795d594fSAndroid Build Coastguard Worker Forces all pids associated with registered dex 45*795d594fSAndroid Build Coastguard Worker files in the logcat to be processed. 46*795d594fSAndroid Build Coastguard Worker default: only the last pid is processed 47*795d594fSAndroid Build Coastguard Worker 48*795d594fSAndroid Build Coastguard Worker -b [DEX_FILE_NUMBER] 49*795d594fSAndroid Build Coastguard Worker Outputs data for the specified baksmali 50*795d594fSAndroid Build Coastguard Worker dump if -p is provided. 51*795d594fSAndroid Build Coastguard Worker default: first baksmali dump in order of dex 52*795d594fSAndroid Build Coastguard Worker file registration 53*795d594fSAndroid Build Coastguard Worker 54*795d594fSAndroid Build Coastguard Worker -d OUT_DIRECTORY 55*795d594fSAndroid Build Coastguard Worker Puts all output in specified directory. 56*795d594fSAndroid Build Coastguard Worker If not given, output will be put in a local 57*795d594fSAndroid Build Coastguard Worker temp folder which will be deleted after 58*795d594fSAndroid Build Coastguard Worker execution. 59*795d594fSAndroid Build Coastguard Worker 60*795d594fSAndroid Build Coastguard Worker -e 61*795d594fSAndroid Build Coastguard Worker All traces will have exactly the same number 62*795d594fSAndroid Build Coastguard Worker of categories which is specified by either 63*795d594fSAndroid Build Coastguard Worker the -m argument or by prune_sanitizer_output.py 64*795d594fSAndroid Build Coastguard Worker 65*795d594fSAndroid Build Coastguard Worker -f 66*795d594fSAndroid Build Coastguard Worker Forces redo of all commands even if output 67*795d594fSAndroid Build Coastguard Worker files exist. Steps are skipped if their output 68*795d594fSAndroid Build Coastguard Worker exist already and this is not enabled. 69*795d594fSAndroid Build Coastguard Worker 70*795d594fSAndroid Build Coastguard Worker -m [MINIMUM_CALLS_PER_TRACE] 71*795d594fSAndroid Build Coastguard Worker Filters out all traces that do not have 72*795d594fSAndroid Build Coastguard Worker at least MINIMUM_CALLS_PER_TRACE lines. 73*795d594fSAndroid Build Coastguard Worker default: specified by prune_sanitizer_output.py 74*795d594fSAndroid Build Coastguard Worker 75*795d594fSAndroid Build Coastguard Worker -o [OFFSET],[OFFSET] 76*795d594fSAndroid Build Coastguard Worker Filters out all Dex File offsets outside the 77*795d594fSAndroid Build Coastguard Worker range between provided offsets. 'inf' can be 78*795d594fSAndroid Build Coastguard Worker provided for infinity. 79*795d594fSAndroid Build Coastguard Worker default: 0,inf 80*795d594fSAndroid Build Coastguard Worker 81*795d594fSAndroid Build Coastguard Worker -p [PACKAGE_NAME] 82*795d594fSAndroid Build Coastguard Worker Using the package name, uses baksmali to get 83*795d594fSAndroid Build Coastguard Worker a dump of the Dex File format for the package. 84*795d594fSAndroid Build Coastguard Worker 85*795d594fSAndroid Build Coastguard Worker -t [TIME_OFFSET],[TIME_OFFSET] 86*795d594fSAndroid Build Coastguard Worker Filters out all time offsets outside the 87*795d594fSAndroid Build Coastguard Worker range between provided offsets. 'inf' can be 88*795d594fSAndroid Build Coastguard Worker provided for infinity. 89*795d594fSAndroid Build Coastguard Worker default: 0,inf 90*795d594fSAndroid Build Coastguard Worker 91*795d594fSAndroid Build Coastguard Worker CATEGORIES are words that are expected to show in 92*795d594fSAndroid Build Coastguard Worker a large subset of symbolized traces. Splits 93*795d594fSAndroid Build Coastguard Worker output based on each word. 94*795d594fSAndroid Build Coastguard Worker 95*795d594fSAndroid Build Coastguard Worker LOGCAT_FILE is the piped output from adb logcat. 96*795d594fSAndroid Build Coastguard Worker=========================================================================== 97*795d594fSAndroid Build Coastguard Worker 98*795d594fSAndroid Build Coastguard Worker 99*795d594fSAndroid Build Coastguard Worker 100*795d594fSAndroid Build Coastguard Worker 101