Android tombstones are not always generated. How to enforce its generation?

Question

I'm trying to debug an unreal engine 4 native application (a game I made). Sometimes I see a "tombstone" is generated when the game crashes. But not always ...

Is there any way to enforce tombstones generation? why it isn't generated everytime my game crashes?

Thanks in advance

Answer 1

The dumps are created by debuggerd when a program crashes under Linux. When this happens, the kernel will send a signal to the dying program. This signal is caught by a special signal handler installed in every native Android application by the bionic C library (this is why tombstones aren't generated for Java-based Android apps). The signal handler contacts debuggerd (via a named pipe), which then connects back to the dying program using ptrace to read registers and memory to produce the tombstone and log entries.

./bionic/linker/debugger.cpp installs the debuggerd_signal_handler() signal handler for several signals that when invoked will try to use the pipe to communicate to debuggerd to create the tombstone file. I suppose that if the pipe communication fails or the ptrace back to the crashing process fails then the tombstone won't be generated. But those failures should still be logged (in the tombstone file or logcat or maybe both - I'm not sure). There may be other problems that result in a tombstone file not being generated.

See the following for how the signal handling is set up by the bionic linker (all function names and files mentioned here are from Android 4.4, but should be similar in other versions):

• __linker_init_post_relocation() in ./bionic/linker/linker.cpp
• debuggerd_init() in ./bionic/linker/debugger.cpp
• debuggerd_signal_handler() in ./bionic/linker/debugger.cpp

And see the following for how debuggerd responds to the request to deal with a crashing process:

• do_server() in ./system/core/debuggerd/debuggerd.c // opens the pipe to receive requests
• handle_request() in ./system/core/debuggerd/debuggerd.c // handles the request to deal with a crashing process

Answer 2

Keep in mind that in most of cases tombstone could be generated on rooted devices.

First Identify PID for your app:

adb shell ps | grep <your app>

Sample:

adb shell ps | grep br
root      257   2     0      0     rescuer_th 0000000000 S k_gbridge
u0_a7     9404  537   2052020 45460 SyS_epoll_ 7f921a99d0 S com.android.cellbroadcastreceiver

Second Send SIGSEGV signal to your PID (9404 in our sample):

adb shell kill -11 <YOUR PID>

Example:

adb shell kill -11 9404

List of signals:

SIGHUP   1 Exit Hang up
SIGINT   2 Exit Interrupt
SIGQUIT  3 Core Quit
SIGILL   4 Core Illegal Instruction
SIGTRAP  5 Core Trace/Breakpoint Trap
SIGABRT  6 Core Abort
SIGEMT   7 Core Emulation Trap
SIGFPE   8 Core Arithmetic Exception
SIGKILL  9 Exit Killed
SIGBUS   10 Core Bus Error
SIGSEGV  11 Core Segmentation Fault
SIGSYS   12 Core Bad System Call
SIGPIPE  13 Exit Broken Pipe

Third Check generated file:

adb shell ls -la /data/tombstones/

Example:

adb shell cat /data/tombstones/tombstone_00
*** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
LineageOS Version: '14.1-20170512-NIGHTLY-zl1'
Build fingerprint: 'LeEco/le_zl1/LePro3:6.0.1/MMB29M/362280:user/release-keys'
Revision: '0'
ABI: 'arm64'
pid: 9404, tid: 9404, name: oadcastreceiver  >>> com.android.cellbroadcastreceiver <<<
signal 11 (SIGSEGV), code 0 (SI_USER), fault addr 0x3aab
    x0   fffffffffffffffc  x1   0000007fc3ad89a8  x2   0000000000000010  x3   00000000ffffffff
    x4   0000000000000000  x5   0000000000000008  x6   0000007f92808000  x7   0000000000000000
    x8   0000000000000016  x9   7fffffffffffffff  x10  0000000000000000  x11  0000007fc3ad8a98
    x12  0000000000000000  x13  ffffffffa26d50eb  x14  00010bc3b9000000  x15  003b9aca00000000
    x16  0000007f92200470  x17  0000007f9215c374  x18  0000000000000011  x19  3a3580d85807b977
    x20  0000007f8e8a3188  x21  00000000ffffffff  x22  00000000ffffffff  x23  0000007f8e8a30e0
    x24  0000000000000028  x25  0000000000000000  x26  00000000716d0b90  x27  000000007a258060
    x28  0000007f834e1680  x29  0000007fc3ad8950  x30  0000007f9215c3b8
    sp   0000007fc3ad8930  pc   0000007f921a99d0  pstate 0000000060000000

Note: If you have message about permission for command "adb shell ls -la /data/tombstones/" You need run following:

adb root
adb remount