初识rust

---

调试下rust 的执行流程

参考：

认识 Cargo - Rust语言圣经(Rust Course)

新建一个hello world 程序：

fn main() {println!("Hello, world!");
}

用IDA 打开exe，并加载符号：

根据字符串找到主程序入口：

双击该符号，然后按x，快捷键，查看所有的符号引用：

之后跳转到对应的程序位置：

PE 起始地址为140000000

读取"hello,world"字符的指令地址：140001040：

使用windbg ，加载该程序，并在lea 指令的位置下断点：

0:000> kp# Child-SP          RetAddr               Call Site
00 000000e6`c38ff9a8 00007ff7`b2571006     hello_world!__ImageBase
01 000000e6`c38ff9b0 00007ff7`b257101c     hello_world!__ImageBase
02 000000e6`c38ff9e0 00007ff7`b25736a8     hello_world!__ImageBase
03 (Inline Function) --------`--------     hello_world!std::rt::lang_start_internal::closure$2(void)+0xb [/rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\rt.rs @ 148] 
04 (Inline Function) --------`--------     hello_world!std::panicking::try::do_call(void)+0xb [/rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs @ 502] 
05 (Inline Function) --------`--------     hello_world!std::panicking::try(void)+0xb [/rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs @ 466] 
06 (Inline Function) --------`--------     hello_world!std::panic::catch_unwind(void)+0xb [/rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panic.rs @ 142] 
07 000000e6`c38ffa10 00007ff7`b25710ac     hello_world!std::rt::lang_start_internal(void)+0xb8 [/rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\rt.rs @ 148] 
08 000000e6`c38ffb10 00007ff7`b258a510     hello_world!main+0x2c
09 (Inline Function) --------`--------     hello_world!invoke_main(void)+0x22 [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 78] 
0a 000000e6`c38ffb50 00007ffc`c2a0257d     hello_world!__scrt_common_main_seh(void)+0x10c [D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl @ 288] 
0b 000000e6`c38ffb90 00007ffc`c39caa78     KERNEL32!BaseThreadInitThunk+0x1d
0c 000000e6`c38ffbc0 00000000`00000000     ntdll!RtlUserThreadStart+0x28

//! Runtime services
//!
//! The `rt` module provides a narrow set of runtime services,
//! including the global heap (exported in `heap`) and unwinding and
//! backtrace support. The APIs in this module are highly unstable,
//! and should be considered as private implementation details for the
//! time being.#![unstable(feature = "rt",reason = "this public module should not exist and is highly likely \to disappear",issue = "none"
)]
#![doc(hidden)]
#![deny(unsafe_op_in_unsafe_fn)]
#![allow(unused_macros)]use crate::ffi::CString;// Re-export some of our utilities which are expected by other crates.
pub use crate::panicking::{begin_panic, panic_count};
pub use core::panicking::{panic_display, panic_fmt};use crate::sync::Once;
use crate::sys;
use crate::sys_common::thread_info;
use crate::thread::Thread;// Prints to the "panic output", depending on the platform this may be:
// - the standard error output
// - some dedicated platform specific output
// - nothing (so this macro is a no-op)
macro_rules! rtprintpanic {($($t:tt)*) => {if let Some(mut out) = crate::sys::stdio::panic_output() {let _ = crate::io::Write::write_fmt(&mut out, format_args!($($t)*));}}
}macro_rules! rtabort {($($t:tt)*) => {{rtprintpanic!("fatal runtime error: {}\n", format_args!($($t)*));crate::sys::abort_internal();}}
}macro_rules! rtassert {($e:expr) => {if !$e {rtabort!(concat!("assertion failed: ", stringify!($e)));}};
}macro_rules! rtunwrap {($ok:ident, $e:expr) => {match $e {$ok(v) => v,ref err => {let err = err.as_ref().map(drop); // map Ok/Some which might not be Debugrtabort!(concat!("unwrap failed: ", stringify!($e), " = {:?}"), err)}}};
}// One-time runtime initialization.
// Runs before `main`.
// SAFETY: must be called only once during runtime initialization.
// NOTE: this is not guaranteed to run, for example when Rust code is called externally.
//
// # The `sigpipe` parameter
//
// Since 2014, the Rust runtime on Unix has set the `SIGPIPE` handler to
// `SIG_IGN`. Applications have good reasons to want a different behavior
// though, so there is a `#[unix_sigpipe = "..."]` attribute on `fn main()` that
// can be used to select how `SIGPIPE` shall be setup (if changed at all) before
// `fn main()` is called. See <https://github.com/rust-lang/rust/issues/97889>
// for more info.
//
// The `sigpipe` parameter to this function gets its value via the code that
// rustc generates to invoke `fn lang_start()`. The reason we have `sigpipe` for
// all platforms and not only Unix, is because std is not allowed to have `cfg`
// directives as this high level. See the module docs in
// `src/tools/tidy/src/pal.rs` for more info. On all other platforms, `sigpipe`
// has a value, but its value is ignored.
//
// Even though it is an `u8`, it only ever has 4 values. These are documented in
// `compiler/rustc_session/src/config/sigpipe.rs`.
#[cfg_attr(test, allow(dead_code))]
unsafe fn init(argc: isize, argv: *const *const u8, sigpipe: u8) {unsafe {sys::init(argc, argv, sigpipe);let main_guard = sys::thread::guard::init();// Next, set up the current Thread with the guard information we just// created. Note that this isn't necessary in general for new threads,// but we just do this to name the main thread and to give it correct// info about the stack bounds.let thread = Thread::new(Some(rtunwrap!(Ok, CString::new("main"))));thread_info::set(main_guard, thread);}
}// One-time runtime cleanup.
// Runs after `main` or at program exit.
// NOTE: this is not guaranteed to run, for example when the program aborts.
pub(crate) fn cleanup() {static CLEANUP: Once = Once::new();CLEANUP.call_once(|| unsafe {// Flush stdout and disable buffering.crate::io::cleanup();// SAFETY: Only called once during runtime cleanup.sys::cleanup();});
}// To reduce the generated code of the new `lang_start`, this function is doing
// the real work.
#[cfg(not(test))]
fn lang_start_internal(main: &(dyn Fn() -> i32 + Sync + crate::panic::RefUnwindSafe),argc: isize,argv: *const *const u8,sigpipe: u8,
) -> Result<isize, !> {use crate::{mem, panic};let rt_abort = move |e| {mem::forget(e);rtabort!("initialization or cleanup bug");};// Guard against the code called by this function from unwinding outside of the Rust-controlled// code, which is UB. This is a requirement imposed by a combination of how the// `#[lang="start"]` attribute is implemented as well as by the implementation of the panicking// mechanism itself.//// There are a couple of instances where unwinding can begin. First is inside of the// `rt::init`, `rt::cleanup` and similar functions controlled by bstd. In those instances a// panic is a std implementation bug. A quite likely one too, as there isn't any way to// prevent std from accidentally introducing a panic to these functions. Another is from// user code from `main` or, more nefariously, as described in e.g. issue #86030.// SAFETY: Only called once during runtime initialization.panic::catch_unwind(move || unsafe { init(argc, argv, sigpipe) }).map_err(rt_abort)?;let ret_code = panic::catch_unwind(move || panic::catch_unwind(main).unwrap_or(101) as isize).map_err(move |e| {mem::forget(e);rtabort!("drop of the panic payload panicked");});panic::catch_unwind(cleanup).map_err(rt_abort)?;ret_code
}#[cfg(not(test))]
#[lang = "start"]
fn lang_start<T: crate::process::Termination + 'static>(main: fn() -> T,argc: isize,argv: *const *const u8,sigpipe: u8,
) -> isize {let Ok(v) = lang_start_internal(&move || crate::sys_common::backtrace::__rust_begin_short_backtrace(main).report().to_i32(),argc,argv,sigpipe,);v
}

其核心运行时如上

panic

看起来是利用panic 库进行一些基本的异常捕获与异常处理。

panic! 深入剖析 - Rust语言圣经(Rust Course)

实验：

主动 异常

fn main() {panic!("crash and burn");
}

PS E:\learn\rust\panic_test> $env:RUST_BACKTRACE="full" ; cargo run releaseCompiling panic_test v0.1.0 (E:\learn\rust\panic_test)Finished dev [unoptimized + debuginfo] target(s) in 0.18sRunning `target\debug\panic_test.exe release`
thread 'main' panicked at src\main.rs:2:5:
crash and burn
stack backtrace:0:     0x7ff7a439709a - std::sys_common::backtrace::_print::impl$0::fmtat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\sys_common\backtrace.rs:441:     0x7ff7a43a52db - core::fmt::rt::Argument::fmtat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\core\src\fmt\rt.rs:1382:     0x7ff7a43a52db - core::fmt::writeat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\core\src\fmt\mod.rs:10943:     0x7ff7a43953d1 - std::io::Write::write_fmt<std::sys::windows::stdio::Stderr>at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\io\mod.rs:17144:     0x7ff7a4396e1a - std::sys_common::backtrace::_printat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\sys_common\backtrace.rs:475:     0x7ff7a4396e1a - std::sys_common::backtrace::printat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\sys_common\backtrace.rs:346:     0x7ff7a4398e4a - std::panicking::default_hook::closure$1at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:2707:     0x7ff7a4398ab8 - std::panicking::default_hookat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:2908:     0x7ff7a43994fe - std::panicking::rust_panic_with_hookat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:7079:     0x7ff7a43993aa - std::panicking::begin_panic_handler::closure$0at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:59710:     0x7ff7a4397a89 - std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$>at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\sys_common\backtrace.rs:170    11:     0x7ff7a43990f0 - std::panicking::begin_panic_handlerat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:59512:     0x7ff7a43aa235 - core::panicking::panic_fmtat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\core\src\panicking.rs:6713:     0x7ff7a43910a1 - panic_test::mainat E:\learn\rust\panic_test\src\main.rs:214:     0x7ff7a439123b - core::ops::function::FnOnce::call_once<void (*)(),tuple$<> >at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\core\src\ops\function.rs:25015:     0x7ff7a439119e - std::sys_common::backtrace::__rust_begin_short_backtrace<void (*)(),tuple$<> >at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\std\src\sys_common\backtrace.rs:154    16:     0x7ff7a439119e - std::sys_common::backtrace::__rust_begin_short_backtrace<void (*)(),tuple$<> >at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\std\src\sys_common\backtrace.rs:154    17:     0x7ff7a4391061 - std::rt::lang_start::closure$0<tuple$<> >at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\std\src\rt.rs:16618:     0x7ff7a4393558 - std::rt::lang_start_internal::closure$2at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\rt.rs:14819:     0x7ff7a4393558 - std::panicking::try::do_callat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:50220:     0x7ff7a4393558 - std::panicking::tryat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:46621:     0x7ff7a4393558 - std::panic::catch_unwindat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panic.rs:14222:     0x7ff7a4393558 - std::rt::lang_start_internalat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\rt.rs:14823:     0x7ff7a439103a - std::rt::lang_start<tuple$<> >at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\std\src\rt.rs:16524:     0x7ff7a43910c9 - main25:     0x7ff7a43a8c80 - invoke_mainat D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:7826:     0x7ff7a43a8c80 - __scrt_common_main_sehat D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:28827:     0x7ffcc2a0257d - BaseThreadInitThunk28:     0x7ffcc39caa78 - RtlUserThreadStart
error: process didn't exit successfully: `target\debug\panic_test.exe release` (exit code: 101)

被动 异常

fn main() {let v = vec![1, 2, 3];v[99];
}

PS E:\learn\rust\panic_test> $env:RUST_BACKTRACE="full" ; cargo run releaseFinished dev [unoptimized + debuginfo] target(s) in 0.00sRunning `target\debug\panic_test.exe release`
thread 'main' panicked at src\main.rs:4:6:
index out of bounds: the len is 3 but the index is 99
stack backtrace:0:     0x7ff75aca794a - std::sys_common::backtrace::_print::impl$0::fmtat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\sys_common\backtrace.rs:441:     0x7ff75acb5c1b - core::fmt::rt::Argument::fmtat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\core\src\fmt\rt.rs:1382:     0x7ff75acb5c1b - core::fmt::writeat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\core\src\fmt\mod.rs:10943:     0x7ff75aca5c81 - std::io::Write::write_fmt<std::sys::windows::stdio::Stderr>at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\io\mod.rs:17144:     0x7ff75aca76ca - std::sys_common::backtrace::_printat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\sys_common\backtrace.rs:475:     0x7ff75aca76ca - std::sys_common::backtrace::printat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\sys_common\backtrace.rs:346:     0x7ff75aca978a - std::panicking::default_hook::closure$1at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:2707:     0x7ff75aca93f8 - std::panicking::default_hookat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:2908:     0x7ff75aca9e3e - std::panicking::rust_panic_with_hookat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:7079:     0x7ff75aca9d2d - std::panicking::begin_panic_handler::closure$0at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:59910:     0x7ff75aca8339 - std::sys_common::backtrace::__rust_end_short_backtrace<std::panicking::begin_panic_handler::closure_env$0,never$>at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\sys_common\backtrace.rs:170    11:     0x7ff75aca9a30 - std::panicking::begin_panic_handlerat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:59512:     0x7ff75acbab75 - core::panicking::panic_fmtat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\core\src\panicking.rs:6713:     0x7ff75acbacee - core::panicking::panic_bounds_checkat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\core\src\panicking.rs:16214:     0x7ff75aca1afd - core::slice::index::impl$2::index<i32>at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\core\src\slice\index.rs:26115:     0x7ff75aca1076 - alloc::vec::impl$12::index<i32,usize,alloc::alloc::Global>at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\alloc\src\vec\mod.rs:267516:     0x7ff75aca1366 - panic_test::mainat E:\learn\rust\panic_test\src\main.rs:417:     0x7ff75aca14ab - core::ops::function::FnOnce::call_once<void (*)(),tuple$<> >at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\core\src\ops\function.rs:25018:     0x7ff75aca13de - std::sys_common::backtrace::__rust_begin_short_backtrace<void (*)(),tuple$<> >at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\std\src\sys_common\backtrace.rs:154    19:     0x7ff75aca13de - std::sys_common::backtrace::__rust_begin_short_backtrace<void (*)(),tuple$<> >at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\std\src\sys_common\backtrace.rs:154    20:     0x7ff75aca12e1 - std::rt::lang_start::closure$0<tuple$<> >at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\std\src\rt.rs:16621:     0x7ff75aca3e08 - std::rt::lang_start_internal::closure$2at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\rt.rs:14822:     0x7ff75aca3e08 - std::panicking::try::do_callat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:50223:     0x7ff75aca3e08 - std::panicking::tryat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panicking.rs:46624:     0x7ff75aca3e08 - std::panic::catch_unwindat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\panic.rs:14225:     0x7ff75aca3e08 - std::rt::lang_start_internalat /rustc/cc66ad468955717ab92600c770da8c1601a4ff33/library\std\src\rt.rs:14826:     0x7ff75aca12ba - std::rt::lang_start<tuple$<> >at /rustc/cc66ad468955717ab92600c770da8c1601a4ff33\library\std\src\rt.rs:16527:     0x7ff75aca13c9 - main28:     0x7ff75acb95c0 - invoke_mainat D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:7829:     0x7ff75acb95c0 - __scrt_common_main_sehat D:\a\_work\1\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:28830:     0x7ffcc2a0257d - BaseThreadInitThunk31:     0x7ffcc39caa78 - RtlUserThreadStart
error: process didn't exit successfully: `target\debug\panic_test.exe release` (exit code: 101)

可以看到，包括我们用windbg 看到的，比较完整的js 运行时的入口都看到了

 rust 程序main 入口前，就已经安装了一个默认的panic handler ，用来打印一些全局的错误信息，和堆栈列表。

rt.rs 详解

int __cdecl main(int argc, const char **argv, const char **envp)
{char v4; // [rsp+20h] [rbp-18h]__int64 (__fastcall *v5)(); // [rsp+30h] [rbp-8h] BYREFv5 = sub_140001040;v4 = 0;return std::rt::lang_start_internal::h8a2184178aa988dc(&v5, &off_14001D360, argc, argv, v4);
}

其中，sub_140001040 即为main 函数：

 

__int64 sub_140001040()
{__int64 v1[3]; // [rsp+28h] [rbp-30h] BYREF__int128 v2; // [rsp+40h] [rbp-18h]v1[0] = (__int64)&off_14001D3A0;v1[1] = 1i64;v1[2] = (__int64)"called `Option::unwrap()` on a `None` value";v2 = 0i64;return std::io::stdio::_print::h445fdab5382e0576(v1);
}