Click “like” to see, wechat search [iOS growth refers to north] to guide the book. Welcome to share, please feel free to ask any questions

preface

IOS Crash Dump Analysis is now updated to version 2. The author brings his extensive experience as an Apple staff member to introduce readers to iOS Crash Analysis techniques. Four new chapters have been added to the book, including system diagnostics, Apple Silicon Mac (better known as M1), pointer validation mechanisms, and failed crashes that do not return crash reports. We study the new passage together in the order of the passage. As a novice translator, the author may not be clear and accurate in terms of words or sentences. We look forward to your feedback to make this book better.

So the body begins

System in the diagnosis of

Crash reports are only part of a larger system diagnostic report.

Generally speaking, as application developers, we don’t need to delve any further. However, if our problems may be caused by a series of unexplained events or more complex system interactions with hardware or apple-provided system services, then we need to look not only at crash reports, but also at system diagnostics.

Extract system diagnosis information

When we reproduce a crashed environment, we may need to install a mobile device management profile (to open some debugging subsystems) or create a virtual network interface (for network sniffing). Apple provides a web page that covers each scenario.

On iOS devices, the basic idea is that we install a profile that changes the device to produce more logging and then reproduces the crash (or lets the customer do so). We then press special sequences of keys on the device (for example, volume buttons and side buttons). The device vibrates briefly, indicating that it is running the program SysDiagnose, which extracts many log files. This can take 10 minutes to process and generate a large file (a compressed tar file).

Then, share the local SYSDiagnosis file with the Mac. Let’s go to Settings > Privacy > Analytics and Improvements > Analytics Data. Scroll down to find the file that starts with SYSDiagnose_year.month.day_ *.

This is an example sysDiagnose log file

After selecting this file, we’ll get a blank screen, but that’s not a problem. We click the Share icon in the top toolbar and select the appropriate Share target.

In this archive file, there are many system and subsystem logs, so we can see why crashes happen at any time.

The equivalent method can also be used on macOS.

Resource configuration file logs

In addition to the SysDiagnose log, we can see that there are many other files on our device. This information gives us an overview of the overall health of the system.

CPU Resource Logs

Subs.cpu_resource – year.month.day_ *.ips.synced Contains CPU Resource configuration file logs.

This is an example from apfs_defragd, the APFS file system defrag.

{" share_with_app_devs ": 1," app_version ":" ", "bug_type" : "202", "times tamp" : "the 2020-10-19 23:49:02. 00 + 0100 ", "os_version" : "the iPhone OS 14.2 (18 b5072f)", "slice_uuid" : "047 d42ed - E41C - 38 be ae - 81 - E4ABCF05A703", "is_first_party":1,"build_version":"","incident_id":"05D98B49-C8B 1-4F18-B494-491D76B2AA3C","app_name":"apfs_defragd","name":"apfs_ defragd"} Date/Time: 2020-10-19 23:46:29.268 +0100 End Time: 2020-10-19 23:48:59.680 +0100 OS Version: IPhone OS 14.2 (Build 18B5072f) Architecture: ARM64E Report Version: 32 Incident Identifier: 05D98B49-C8B1-4F18-B494-491D76B2AA3C Share With Devs: Yes Data Source: Microstackshots Shared Cache: D949F5BB-14F3-3223-9E0F-EB9B0E5D53E8 slid base address 0x191410000, slide 0x11410000 Command: apfs_defragd Path: /System/Library/Filesystems/apfs.fs/apfs_defragd Version: ??? (??????? Parent: UNKNOWN [1] PID: 7877 Event: cpu usage Action taken: none CPU: 90 seconds cpu time over 150 seconds (60% cpu average), exceeding limit of 50% cpu over 180 seconds CPU limit: 90S Limit duration: 180s CPU used: 90S CPU duration: 150s duration: 150.41s duration time delay: 119.32s Steps: 23 Hardware Model: iPhone12,1 Active cpus: 6 busiest stack for the target process: 18?? (libsystem_pthread.dylib + 14340) [0x1db258804] 18 ??? (libdispatch.dylib + 89464) [0x19146ad78] 18 ??? (libdispatch.dylib + 48220) [0x191460c5c] 18 ??? (libdispatch.dylib + 45324) [0x19146010c] 18 ??? (libdispatch.dylib + 15792) [0x191458db0] 18 ??? (libdispatch.dylib + 8780) [0x19145724c] 18 ??? (apfs_defragd + 18536) [0x104f30868] 18 ??? (apfs_defragd + 177336) [0x104f574b8] 18 ??? (apfs_defragd + 176680) [0x104f57228] 18 ??? (apfs_defragd + 19380) [0x104f30bb4] 16 ??? (apfs_defragd + 10128) [0x104f2e790] 16 ??? (AppleFSCompression + 18424) [0x1c8e0a7f8] 16 ??? (AppleFSCompression + 43828) [0x1c8e10b34] 6 ??? (AppleFSCompression + 44780) [0x1c8e10eec] 2 ??? (libz.1.dylib + 47196) [0x1dae8885c] Powerstats for: apfs_defragd [7877] UUID: 047D42ED-E41C-38AE-81BE-E4ABCF05A703 Path: /System/Library/Filesystems/apfs.fs/apfs_defragd Architecture: Arm64e Parent: UNKNOWN [1] UID: 0 Sudden Term: Tracked (allows idle exit) Footprint: 120.84 MB Start time: 334 +0100 End time: 2020-10-19 23:48:58.707 +0100 Num samples: 18 (78%) Primary state: 10 samples Non-Frontmost App, Non-Suppressed, Kernel mode, Effective Thread QoS Background, Requested Thread QoS Background, Override Thread QoS Unspecified User Activity: 18 samples Idle, 0 samples Active Power Source: 0 samples on Battery, 18 samples on AC 18 ??? (libsystem_pthread.dylib + 14340) [0x1db258804] 18 ??? (libdispatch.dylib + 89464) [0x19146ad78] . . Binary Images: 0x104f2c000 - ??? apfs_defragd <047D42ED-E41C-38AE-81BE-E4ABCF05A703> /System/Library/Filesystems/apfs.fs/apfs_defragd . . Powerstats for:  PerfPowerServicesExtended UUID: AC943755-DBF7-306D-8D54-5F1FA7D45C1A Path: The/usr/bin/PerfPowerServicesExtended Architecture: arm64e Start time: 2020-10-19 23:47:41. 119 + 0100 End time: 220-10-19 23:48:19.856 +0100 Num samples: 3 (13%) Primary state 2 samples Non-Frontmost App, Non-Suppressed, User mode, Effective Thread QoS Background, Requested Thread QoS Background, Override Thread QoS Unspecified User Activity: 3 samples Idle, 0 samples Active Power Source: 0 samples on Battery, 3 samples on AC 3 ??? (libsystem_pthread.dylib + 14340) [0x1db258804] 3 ??? (libdispatch.dylib + 89464) [0x19146ad78] . . Binary Images: 0x104e78000 - ??? PerfPowerServicesExtended <AC943755-DBF7-306D-8D54-5F1FA7D45C1A> /usr/bin/PerfPowerServicesExtended 0x191455000 - 0x191497fff libdispatch.dylib <187D8E52-371D-33F2-B0D4-C6D154917885> /usr/lib/system/libdispatch.dylib . .Copy the code

Disk usage Logs

Sub.diskwrites_resource – year.month.day_ *.ips. Synced Contains Disk Utilization configuration file logs.

This is an example from ASsetD, Asset Management software.

{" share_with_app_devs ": 1," app_version ":" ", "bug_type" : "145", "times tamp" : "the 2020-10-18 02:55:57. 00 + 0100 ", "os_version" : "the iPhone OS 14.2 (18 b5072f)", "slice_uuid" : "6192 da47 - C99E - 33 f4-8 fc5 - CF071E4EE26B", "is_first_party":1,"build_version":"","incident_id":"BB4403D7-A0C F-4c50-aea6-eff26facf690 ","app_name":" assetSD ","name":" assetSD "} Date/Time: 2020-10-17 23:26:36.891 +0100 End Time: 835 +0100 OS Version: iPhone OS 14.2 (Build 18B5072f) Architecture: ARM64e Report Version: 32 Incident Identifier: BB4403D7-A0CF-4C50-AEA6-EFF26FACF690 Share With Devs: Yes Data Source: Microstackshots Shared Cache: D949F5BB-14F3-3223-9E0F-EB9B0E5D53E8 slid base address 0x191410000, slide 0x11410000 Command: assetsd Path: /System/Library/Frameworks/AssetsLibrary.framework/Support/asset sd Version: ??? (???) Parent: launchd [1] PID: 124 Event: disk writes Action taken: none Writes: 1073.75 MB of File Backed Memory dirtied over 12560 seconds (85.49 KB per second average), Supernumero supernumero limit: 1073.74 MB limit duration: 86400s CAUSED: 1073.75MB Writes duration: 12560s duration: 12559.94s duration time tos: 12460.16s Steps: 81 ((10.49 MB/step)) Hardware Model: iPhone12,1 Active cpus: 6 busiest stack for the target process: 6 ??? (libsystem_pthread.dylib + 14340) [0x1db258804] 6 ??? (libdispatch.dylib + 89464) [0x19146ad78] 6 ??? (libdispatch.dylib + 48220) [0x191460c5c] 6 ??? (libdispatch.dylib + 45324) [0x19146010c] 6 ??? (libdispatch.dylib + 15792) [0x191458db0] 6 ??? (libdispatch.dylib + 8780) [0x19145724c] 6 ??? (AssetsLibraryServices + 240248) [0x1a3090a78]  6 ??? (PhotoLibraryServices + 5982616) [0x1a2eda998] 6 ??? (PhotoLibraryServices + 5903404) [0x1a2ec742c] 5 ??? (libsqlite3.dylib + 272472) [0x1ab453858] 5 ??? (libsqlite3.dylib + 335252) [0x1ab462d94] 5 ??? (libsqlite3.dylib + 147268) [0x1ab434f44] 5 ??? (libsqlite3.dylib + 365168) [0x1ab46a270] 5 ??? (libsqlite3.dylib + 450844) [0x1ab47f11c] 5 ??? (libsqlite3.dylib + 778840) [0x1ab4cf258] 5 ??? (libsqlite3.dylib + 452760) [0x1ab47f898] 5 ??? (libsystem_kernel.dylib + 172372) [0x1becf8154] Powerstats for: assetsd [124] UUID: 6192DA47-C99E-33F4-8FC5-CF071E4EE26B Path: /System/Library/Frameworks/AssetsLibrary.framework/Support/asset sd Architecture: arm64e Parent: launchd [1] UID: 505 Sudden Term: Tracked (allows idle exit) Footprint: 19.98 MB Start time: 2020-10-18 02:54:02.699 +0100 End time: 2020-10-18 02:55:24.063 +0100 Num samples: 6 (7%) Primary state: 6 samples Non-Frontmost App, Non-Suppressed, Kernel mode, Effective Thread QoS Background, Requested Thread QoS Utility, Override Thread QoS Unspecified User Activity: 6 samples Idle, 0 samples Active Power Source: 0 samples on Battery, 6 samples on AC 6 ??? (libsystem_pthread.dylib + 14340) [0x1db258804] . . Binary Images: 0x104bf4000 - ??? assetsd <6192DA47-C99E-33F4-8FC5-CF071E4EE26B> /System/Library/Frameworks/AssetsLibrary.framework/Support/asset sd 0x191455000 - 0x191497fff libdispatch.dylib <187D8E52-371D-33F2-B0D4-C6D154917885> /usr/lib/system/libdispatch.dylib . .Copy the code

Jetsam report

The term Jetsam was originally a nautical term for ships that threw unwanted objects into the sea to lighten their weight. In iOS, Jetsam is a system that pops current applications out of memory to meet the most important application needs of the moment.

Aggressive (aggressive) memory management is a feature of iOS compared to macOS, which has very loose limits on memory usage. In layman’s terms, mobile devices are memory-constrained devices. However, as mobile devices become more powerful, especially iPad devices, the difference has become smaller. Now, the Apple Watch is considered a memory-constrained device. However, Jetsam’s strict memory management system served us well, guaranteeing the best user experience for a given amount of RAM.

It’s best to think of Jetsam as normal behavior, and popping out of memory isn’t necessarily a mistake in our application design. We could have run it in the background and the memory usage would have increased when the user did a lot of photography and image effects using the camera function.

If we pop out of memory a lot, we have to consider whether we are using too much memory in the background; Our goal should be no more than 50 MB or less. We should also write programmatic methods to save the context, destroy the cache, and save the state for recovery from the saved state. Then we should Hook in this function, when we get a memory warning message from the system, such as in the AppDelegate applicationDidReceiveMemoryWarning: callback, execute the method.

Apple documents the various reasons Jetsam events can occur and memory management techniques to avoid them.

There is no actual documentation of this limitation, but generally applications have more background memory usage than application extensions. There are various types of application extensions, each with its own limitations. For example, a photo editing application extension can be very limited because it is usually a heavyweight image processor.

The first thing to look for in the Jetsam report is the Reason field.

Jetsam Reason Meaning
per-process-limit Resident memory limit has been reached. This limitation varies depending on the type of application or extender.
vm-pageshortage The kernel wanted to provide clean pages for another process, but it ran out and killed our process.
vnode-limit The kernel has run out of VNodes (a generalization of UNIX files) and is terminating our process of releasing more VNodes.
highwater The process uses too much physical memory.
fc-thrashing Too many random accesses to memory-mapped files cause file cache fragmentation/jitter.
jettisoned Other reasons for Jetsam.

We haven’t actually seen anything like fC-thrashing or Jettisoned, but they’re still possible.

The Jetsam report is named JetSamEvent-year.month.day_ *.ips.synced.

Here is an example report illustrating the Highwater event’s WifianalyticSD:

{"bug_type":"298","timestamp":"2020-10-15 17:29:58.79 +0100"," OS_version ":"iPhone OS 14.2 (18B5061e)","incident_id":"B04A36B1-19EC-4895-B203-6AE21BE52B02" } { "crashReporterKey" : "D3e622273dd1296e8599964c99f70e07d25c8ddc", "the kernel", "Darwin kernel Version 20.1.0: Mon Sep 21 00:09:01 PDT 2020; Root: xnu-7195.40.113.0.2-22 \/RELEASE_ARM64_T8030", "product" : "iPhone12,1", "incident" : B04a36b1-19ec-4895-b203-6ae21be52b02 ", "date" : "2020-10-15 17:29:58.79 +0100", "build" : "IPhone OS 14.1 (18B5061e)", "timeDelta" : 7, "memoryStatus" : {"compressorSize" : 96635, "compressions" : 3009015, "decompressions" : 2533158, "zoneMapCap" : 1472872448, "largestZone" : "APFS_4K_OBJS", "largestZoneSize" : 41271296, "pageSize" : 16384, "uncompressed" : 257255, "zoneMapSize" : 193200128, "memoryPages" : { "active" : 45459, "throttled" : 0, "fileBacked" : 34023, "wired" : 49236, "anonymous" : 55900, "purgeable" : 12, "inactive" : 40671, "free" : 5142, "speculative" : 3793 } }, "largestProcess" : "AppStore", "genCounter" : 1, "processes" : [ { "uuid" : "7607487f-d2b1-3251-a2a6-562c8c4be18c", "states" : [ "daemon", "idle" ], "age" : 3724485992920, "purgeable" : 0, "fds" : 25, "coalition" : 68, "rpages" : 229, "priority" : 0, "physicalPages" : {"internal" : [6, 183]}, "pid" : 350, "cpuTime" : 0.066796999999999995, "name" : "SBRendererService", "lifetimeMax" : 976 }, . . { "uuid" : "f71f1e2b-a7ca-332d-bf87-42193c153ef8", "states" : [ "daemon", "idle" ], "lifetimeMax" : 385, "killDelta" : 13595, "age" : 94337735133, "purgeable" : 0, "fds" : 50, "genCount" : 0, "coalition" : 320, "rpages" : 382, "priority" : 1, "reason" : "highwater", "physicalPages" : { "internal" : [ 327, 41 ] }, "pid" : 2527, "idleDelta" : 41601646, "name" : "wifianalyticsd", "cpuTime" : 0.634077}.Copy the code

communication

The article continues to update every week, you can search “iOS growth refers to north” on wechat to read and urge more. Learn together and grow