3

I want lldb to break at the start of the actual code of an OS X application (which might be called main if symbols are existing).

I am currently looking this up by hand, but as I want to script some actions, it would be great if this could somehow be realized automatically

enter image description here

Do you have any idea if there is a way?

muffel
  • 165
  • 1
  • 4

2 Answers2

2

Try this:

(lldb) break set -n main
(lldb) r
(lldb) thread backtrace

frame #0: 0x0000000000405696 app`main(argc=1, argv=...) + 22 at app.cpp:11
frame #1: 0x00007ffff7216ec5 libc.so.6`__libc_start_main + 245
frame #2: 0x0000000000401f79 app

The frame below (before) main is the one you want, and it's showing the library and function name. You can set a breakpoint on it just like any other:

(lldb) break set -n __libc_start_main
Breakpoint 1: where = libc.so.6`__libc_start_main, address = 0x00007ffff7216dd0

or, to be more specific:

(lldb) break set -s libc.so.6 -n __libc_start_main
Breakpoint 2: where = libc.so.6`__libc_start_main, address = 0x00007ffff7216dd0

If you know the address, you could use it directly:

(lldb) break set -a 0x000000...

Then restart the process, and you should hit it immediately:

(lldb) r
There is a running process, kill it and restart?: [Y/n] y
...
* thread #1: ...__libc_start_main, name = 'app', stop reason = breakpoint
frame #0: 0x00007ffff7216dd0 libc.so.6`__libc_start_main
-> ...: pushq  %r14
(lldb)
Tim Sylvester
  • 136
  • 3
1

Try adding a breakpoint on a bad address. In GDB, the way I do this is: b *0xf00, or something similar. Here's what it looks like for me in GDB, and maybe you'll find a way to duplicate the same behavior:


$ gdb ./a.out
(gdb) b *0xf00
(gdb) r
Starting program: ./a.out 
Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0xf00

(gdb) x/2i $rip
=> 0x7ffff7ddb2d0 <_start>:   mov    rdi,rsp
   0x7ffff7ddb2d3 <_start+3>: call   0x7ffff7ddea70
Peter Goodman
  • 366
  • 2
  • 4
  • Oh hrm, I think I misunderstood the question. This is a convenient trick nonetheless :-P

    Perhaps you can find out if there's a known entrypoint before main, e.g. __libc_start_main. You might find that there's a semi-hackish way to add a breakpoint at an address that is at some fixed, predictable offset relative to the entrypoint.

     – Peter Goodman Nov 28 '14 at 00:32
  • thanks for your answer :) My problem is, that I would prefer a scriptable workflow for this. Of course I could look for some kind of a main, but that doesn't necessarily exist.. – muffel Nov 28 '14 at 10:06