android-ndk开发工具下有一个asan_device_setup脚本:
~/Android/android-ndk-r21/toolchains/llvm/prebuilt/linux-x86_64/lib64/clang/9.0.8/bin/asan_device_setup
执行了脚本之后app就能支持asan检查了
具体原理为:
1.app_process被替换为了一个脚本:
#!/system/bin/sh-from-zygote
ASAN_OPTIONS=start_deactivated=1,allow_user_segv_handler=1 \
ASAN_ACTIVATION_OPTIONS=include_if_exists=/data/local/tmp/asan.options.%b \
LD_PRELOAD=symlink-to-libclang_rt.asan \
exec /system/bin/app_process32 [email protected]
真正的app_process名字改成了app_process32或者app_process64
http://aosp.opersys.com/xref/android-11.0.0_r39/xref/system/core/rootdir/init.zygote32.rc#1
service zygote /system/bin/app_process -Xzygote /system/bin --zygote --start-system-server
class main
priority -20
user root
group root readproc reserved_disk
socket zygote stream 660 root system
socket usap_pool_primary stream 660 root system
onrestart write /sys/android_power/request_state wake
onrestart write /sys/power/state on
onrestart restart audioserver
onrestart restart cameraserver
onrestart restart media
onrestart restart netd
onrestart restart wificond
writepid /dev/cpuset/foreground/tasks
zygote启动时候会用到更改后的脚本,脚本里指定了一些启动参数,LD_PRELOAD
ab30a5:/system/lib # ls -al symlink-to-libclang_rt.asan
lrwxrwxrwx 1 root root 31 2021-09-10 14:35 symlink-to-libclang_rt.asan -> libclang_rt.asan-arm-android.so
这样zygote在启动的时候会预加载libclang_rt.asan-arm-android.so这个库
检查是否修改生效,随便找一个android进程,查看maps里是否加载了libclang_rt.asan-arm-android.so这个库,例如:
system 10091 9019 0 14:39:03 ? 00:00:08 com.android.settings
ab30a5:/system/lib # cat /proc/10091/maps | grep asan
ac34f000-ac37c000 r--p 00000000 b3:12 1309 /system/lib/libclang_rt.asan-arm-android.so
ac37c000-ac3ff000 r-xp 0002d000 b3:12 1309 /system/lib/libclang_rt.asan-arm-android.so
ac3ff000-ac401000 r--p 000b0000 b3:12 1309 /system/lib/libclang_rt.asan-arm-android.so
ac401000-ac404000 rw-p 000b2000 b3:12 1309 /system/lib/libclang_rt.asan-arm-android.so
ad43c000-ad43f000 r--s 00000000 b3:12 329 /system/fonts/NotoSansElbasan-Regular.otf
备注:手机需要root