1.splint
splint是一个开源的静态代码检查工具，使用方法如下：
待检测的程序程序如下：
#include <stdio.h>
static void display(int i)
{
printf("i = %d\n",i);
}
int main(void)
{
int i,j;
i = 1;
i = i + 1;
display(i);
return 0;
}
调试如下：
$ splint main.c
Splint 3.1.2 --- 03 May 2009
main.c: (in function main)
main.c:10:8: Variable j declared but not used
A variable is declared but never used. Use /*@[email protected]*/ in front of
declaration to suppress message. (Use -varuse to inhibit warning)
Finished checking --- 1 code warning
提示定义了一个变量j但是从来没有使用过。
将j定义去掉后，再进行检测：
$ splint main.c
Splint 3.1.2 --- 03 May 2009
Finished checking --- no warnings
splint有一大推flag可以使用，使用时标志前加’+‘或’-’，‘+‘标志开启这个标志，‘-‘表示关闭此标志。
下列语句用于检查程序中数据的越界问题。
splint +bounds main.c
2.strace
strace常用来跟踪进程执行时的系统调用和所接收的信号。
对上面的程序进行追踪测试：
$ strace ./a.out
execve("./a.out", ["./a.out"], [/* 50 vars */]) = 0
brk(0) = 0x1033000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f64fa550000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=77020, ...}) = 0
mmap(NULL, 77020, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f64fa53d000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200\30\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1815224, ...}) = 0
mmap(NULL, 3929304, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f64f9f70000
mprotect(0x7f64fa125000, 2097152, PROT_NONE) = 0
mmap(0x7f64fa325000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b5000) = 0x7f64fa325000
mmap(0x7f64fa32b000, 17624, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f64fa32b000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f64fa53c000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f64fa53b000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f64fa53a000
arch_prctl(ARCH_SET_FS, 0x7f64fa53b700) = 0
mprotect(0x7f64fa325000, 16384, PROT_READ) = 0
mprotect(0x600000, 4096, PROT_READ) = 0
mprotect(0x7f64fa552000, 4096, PROT_READ) = 0
munmap(0x7f64fa53d000, 77020) = 0
fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f64fa54f000
write(1, "i = 2\n", 6i = 2
) = 6
exit_group(0) = ?
3.ltrace
ltrace用来跟踪进程调用库函数的情况。
对上面的程序进行追踪测试：
$ ltrace ./a.out
__libc_start_main(0x400518, 1, 0x7ffff364a1a8, 0x400550, 0x4005e0 <unfinished ...>
printf("i = %d\n", 2i = 2
) = 6
+++ exited (status 0) +++
《软件调试的艺术》笔记--使用其他调试工具