babeltrace与CTF相关学习笔记-1

写在前面

背景是了解完大概的Nanolog之后，还需要准备实现将nanolog转为ctf。
最开始的方向，的确是按之前的计划，采用lttng usr lib。
写了一个工程，后面可能用上。
但lttng lib相对难用，有时间我们详述。简言之，过多地与C语言的宏绑定。我是不喜欢这种编码方式的，不灵活。
所以，因为前面虽然GPT强调应该基于lttng，但查看文章也发现，babeltrace不仅有读和转换，还有写入的ctf的能力。
所以，抽时间，还是临时调研一下。故有本文。

代码下载

代码

https://github.com/efficios/babeltrace
git clone下来即可。

代码编译

babeltrace的编译并不是特别简单。有两方面困难，一是选择多，另一个是依赖多。

相关的依赖

apt install autoconfsudo apt-get install libglib2.0-dev sudo apt-get install dh-autoreconf bison libdw-dev libelf-dev flex uuid-dev libpopt-dev

bootstrap

 ./bootstrap

configure过程

如下三选一，我选的最后下，因为需要调试

 ./configure./configure --enable-debug-info BABELTRACE_DEBUG_MODE=1 BABELTRACE_DEV_MODE=1 BABELTRACE_MINIMAL_LOG_LEVEL=TRACE ./configure   --enable-debug-info

编译和安装

  makemake install

注

我目前遇到点问题，主lib目前不能跟踪，可能是configure时，忘了加：BABELTRACE_DEBUG_MODE=1
如果也遇到这样的情况，将下面的几个O2，改为O0

编译完成后，初步的审视

找到与ctf相关的工程

vscode加载后，大至看了一下，
看到两个ctf-writer目录：
./src/ctf-writer
./tests/ctf-writer
事后证明，这两个目录都有用。

tests

毕竟我在风河呆过，算是半个科班出身，对tests或者ptest，是相当熟悉的。自吹一下。
所以，先锁定tests目下录的内容。

/data/babeltrace/babeltrace/tests/ctf-writer# find . -type f -executable
./test-ctf-writer.sh
./.libs/ctf-writer
./ctf-writer

根所上面的信息，我们知道，这里有三个文件需要关注。
/data/babeltrace/babeltrace/tests/ctf-writer/test-ctf-writer.sh
解释一下：

./test-ctf-writer.sh

先运行./test-ctf-writer.sh

看到大部分测试例都通过了。

ok 275 - Create an event class
ok 276 - Reject addition of a field with an empty name to an event
ok 277 - Reject addition of a field with a NULL type to an event
ok 278 - Reject addition of a type with an illegal name to an event
ok 279 - Add field of type unsigned integer to an event
ok 280 - Add field of type signed integer to an event
ok 281 - Add composite structure to an event
ok 282 - bt_ctf_event_class_get_name returns a correct name
ok 283 - bt_ctf_event_class_get_id returns a negative value when not set
ok 284 - bt_ctf_event_class_set_id handles NULL correctly
ok 285 - Set an event class' id
ok 286 - bt_ctf_event_class_get_id returns the correct value
ok 287 - event class has the expected initial log level
ok 288 - as expected, event class has no initial EMF URI
ok 289 - bt_ctf_event_class_set_log_level handles a NULL event class correctly
ok 290 - bt_ctf_event_class_set_log_level handles an unknown log level correctly
ok 291 - bt_ctf_event_class_set_log_level succeeds with a valid log level
ok 292 - bt_ctf_event_class_get_log_level returns the expected log level
ok 293 - bt_ctf_event_class_set_emf_uri handles a NULL event class correctly
ok 294 - bt_ctf_event_class_set_emf_uri succeeds with a valid EMF URI
ok 295 - bt_ctf_event_class_get_emf_uri returns the expected EMF URI
ok 296 - bt_ctf_event_class_set_emf_uri succeeds with NULL (to reset)
ok 297 - as expected, event class has no EMF URI after reset
ok 298 - Reject addition of NULL event class to a stream class
ok 299 - Add an event class to stream class
ok 300 - bt_ctf_event_class_get_stream_class returns the correct stream class
ok 301 - bt_ctf_event_class_get_field_by_name handles an invalid field name correctly
ok 302 - Instantiate a complex event
ok 303 - bt_ctf_event_get_class returns the correct event class
ok 304 - Use bt_ctf_event_get_payload to get a field instance
ok 305 - bt_ctf_field_integer_unsigned_get_value succeeds after setting a value
ok 306 - bt_ctf_field_integer_unsigned_get_value returns the correct value
ok 307 - bt_ctf_field_integer_signed_get_value succeeds after setting a value
ok 308 - bt_ctf_field_integer_signed_get_value returns the correct value
ok 309 - bt_ctf_field_string_append succeeds
ok 310 - bt_ctf_field_string_append_len succeeds (append 5 characters)
ok 311 - bt_ctf_field_string_append_len succeeds (append 0 characters)
ok 312 - bt_ctf_field_string_append_len succeeds (append 0 characters)
ok 313 - bt_ctf_field_string_get_value returns a string
ok 314 - bt_ctf_field_string_get_value returns a correct value
ok 315 - bt_ctf_field_type_variant_get_field_type_from_tag returns the correct field type
ok 316 - Set a sequence field's length
ok 317 - Append a complex event to a stream
ok 318 - Flush a stream containing a complex event
ok 319 - two event classes with the same name may cohabit within the same stream class
ok 320 - two event classes with the same ID cannot cohabit within the same stream class
ok 321 - bt_ctf_stream_class_get_trace returns NULL when stream class is orphaned
ok 322 - bt_ctf_stream_class_get_trace returns the correct trace after a stream has been created
ok 323 - Created a stream class with default attributes and an empty stream
ok 324 - Get metadata string
12-12 01:52:28.276 414616 414616 W PLUGIN/CTF/META/WARN-MEANINGLESS-HEADER-FIELDS warn_meaningless_field@plugins/ctf/common/src/metadata/tsdl/ctf-meta-warn-meaningless-header-fields.cpp:18 User field found in packet header: ignoring: name="custom_trace_packet_header_field"
12-12 01:52:28.276 414616 414616 W PLUGIN/CTF/META/WARN-MEANINGLESS-HEADER-FIELDS warn_meaningless_field@plugins/ctf/common/src/metadata/tsdl/ctf-meta-warn-meaningless-header-fields.cpp:18 User field found in event header: ignoring: name="seq_len"
12-12 01:52:28.276 414616 414616 W PLUGIN/CTF/META/WARN-MEANINGLESS-HEADER-FIELDS warn_meaningless_field@plugins/ctf/common/src/metadata/tsdl/ctf-meta-warn-meaningless-header-fields.cpp:18 User field found in packet header: ignoring: name="custom_trace_packet_header_field"
12-12 01:52:28.276 414616 414616 W PLUGIN/CTF/META/WARN-MEANINGLESS-HEADER-FIELDS warn_meaningless_field@plugins/ctf/common/src/metadata/tsdl/ctf-meta-warn-meaningless-header-fiel

结尾处似乎有点问题

## 跟踪 ./test-ctf-writer.sh
#!/bin/bash
if [ -n "${BT_TESTS_SRCDIR:-}" ]; thenUTILSSH="$BT_TESTS_SRCDIR/utils/utils.sh"
elseUTILSSH="$(dirname "$0")/../utils/utils.sh"
fi
# shellcheck source=../utils/utils.sh
source "$UTILSSH"
echo $BT_TESTS_BT2_BIN
"${BT_TESTS_BUILDDIR}/ctf-writer/ctf-writer" "$BT_TESTS_BT2_BIN"

运行后，发现
$BT_TESTS_BT2_BIN的值为：
/data/babeltrace/babeltrace/tests/…/src/cli/babeltrace2
也就是，将可执行文件作为输入
这里目前我还没有完全理解，
file /data/babeltrace/babeltrace/tests/…/src/cli/babeltrace2
/data/babeltrace/babeltrace/tests/…/src/cli/babeltrace2: Bourne-Again shell script, ASCII text executable
可以看到，我们只知道，这是一个脚本。内部指向了一些.a
这个放一下。
我们目前只是想得到参数。

ctf-writer脚本

${BT_TESTS_BUILDDIR}/ctf-writer/ctf-writer
还是一个脚本。
虽然这个脚本很长，但在这里下断，
原来是指向可执行文件：./.libs/ctf-writer 和 上面的参数：
/data/babeltrace/babeltrace/tests/…/src/cli/babeltrace2
有了这些信息，我们就可以构建vscode跟踪工程了

vscode跟踪ctf-writer.c

如上所述，
可执行文件是：./.libs/ctf-writer
main()在这个文件中。
/data/babeltrace/babeltrace/tests/ctf-writer/ctf-writer.c

.vscode/launch.json

{// Use IntelliSense to learn about possible attributes.// Hover to view descriptions of existing attributes.// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387"version": "0.2.0","configurations": [{"type": "bashdb","request": "launch","name": "Bash-Debug (ctf-writer)","cwd": "${workspaceFolder}","program": "${workspaceFolder}/tests/ctf-writer/ctf-writer","args": ["/data/babeltrace/babeltrace/tests/../src/cli/babeltrace2"]},{"type": "bashdb","request": "launch","name": "Bash-Debug (test-ctf-writer.sh)","cwd": "${workspaceFolder}","program": "${workspaceFolder}/tests/ctf-writer/test-ctf-writer.sh","args": []},{"name": "C++ Launch ctf_write_test","type": "cppdbg","request": "launch","program": "${workspaceFolder}/tests/ctf-writer/.libs/ctf-writer","args": ["${workspaceFolder}/tests/../src/cli/babeltrace2"],//"args": ["decompress","/tmp/logFile"],//"environment": [{ "name": "config", "value": "Debug" }],"cwd": "${workspaceFolder}/tests/ctf-writer","setupCommands": [{"description": "Enable pretty-printing for gdb","text": "-enable-pretty-printing","ignoreFailures": true}]}]
}

然后开始跟踪工程：
上面的代码，现在我稍微有点熟悉了。
暂时到这里。

后记：

不能跟入babeltrace core的问题，在改变makefile后，没有解决。原因已经清楚了，小伙伴位自己解决吧：

root@xylxperf:/data/babeltrace/babeltrace/tests/ctf-writer/.libs# ls
ctf-writer
root@xylxperf:/data/babeltrace/babeltrace/tests/ctf-writer/.libs# ldd ctf-writerlinux-vdso.so.1 (0x00007ffc8ec6c000)libbabeltrace2-ctf-writer.so.0 => /lib/x86_64-linux-gnu/libbabeltrace2-ctf-writer.so.0 (0x00007fd850eca000)libglib-2.0.so.0 => /lib/x86_64-linux-gnu/libglib-2.0.so.0 (0x00007fd850d90000)libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007fd850b67000)/lib64/ld-linux-x86-64.so.2 (0x00007fd850f3e000)libpcre.so.3 => /lib/x86_64-linux-gnu/libpcre.so.3 (0x00007fd850af1000)libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6 (0x00007fd850a0a000)
root@xylxperf:/data/babeltrace/babeltrace/tests/ctf-writer/.libs# file ctf-writer
ctf-writer: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=b711a75943ce20beaa28b1b56113853c73ec1c76, for GNU/Linux 3.2.0, with debug_info, not stripped
root@xylxperf:/data/babeltrace/babeltrace/tests/ctf-writer/.libs# file libbabeltrace2-ctf-writer.so.0
libbabeltrace2-ctf-writer.so.0: cannot open `libbabeltrace2-ctf-writer.so.0' (No such file or directory)
root@xylxperf:/data/babeltrace/babeltrace/tests/ctf-writer/.libs# file libbabeltrace2-ctf-writer.so.0^C
root@xylxperf:/data/babeltrace/babeltrace/tests/ctf-writer/.libs# ls -l /lib/x86_64-linux-gnu/libbabeltrace2-ctf-writer.so.0
lrwxrwxrwx 1 root root 34 Mar 17  2022 /lib/x86_64-linux-gnu/libbabeltrace2-ctf-writer.so.0 -> libbabeltrace2-ctf-writer.so.0.0.0
root@xylxperf:/data/babeltrace/babeltrace/tests/ctf-writer/.libs# ls -l /lib/x86_64-linux-gnu/libbabeltrace2-ctf-writer.so.0.0.0
-rw-r--r-- 1 root root 261456 Mar 17  2022 /lib/x86_64-linux-gnu/libbabeltrace2-ctf-writer.so.0.0.0
root@xylxperf:/data/babeltrace/babeltrace/tests/ctf-writer/.libs# ls -lt
total 256
-rwxr-xr-x 1 root root 258512 Dec 12 02:16 ctf-writer
root@xylxperf:/data/babeltrace/babeltrace/tests/ctf-writer/.libs# file /lib/x86_64-linux-gnu/libbabeltrace2-ctf-writer.so.0.0.0
/lib/x86_64-linux-gnu/libbabeltrace2-ctf-writer.so.0.0.0: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=bbba9e66669c2cd836eadbd23fb7cae5015f904f, stripped
root@xylxperf:/data/babeltrace/babeltrace/tests/ctf-writer/.libs#

如下，现在链接的文件
libbabeltrace2-ctf-writer.so.0 => /lib/x86_64-linux-gnu/libbabeltrace2-ctf-writer.so.0 (0x00007fd850eca000)
是stripped的，而且，看样也不像是debug版，现在2024年12月12日，可是目前链到的库是2022年的。
应该是这个原因，大家自己处理吧。
我现在的处理方法是，将/usr/local/lib下的相关的内容，覆盖了/lib/x86_64-linux-gnu下的同名文件。
然后能够进入到核心库：