The LLDB Debugger, as it’s said on http://lldb.llvm.org/:
LLDB is a next generation, high-performance debugger. It is built as a set of reusable components which highly leverage existing libraries in the larger LLVM Project, such as the Clang expression parser and LLVM disassembler.
I was trying to find an OllyDBG-like debugger on OS X, gdb & lldb are the two choices.
Affinic.com has GUI for these two debuggers, not so good.
Hopper Disassembler provides it’s own GDB Server app, still bad.
Only commands here:
Stop at entry:
1 |
(lldb) process launch --stop-at-entry |
Launch with args:
1 |
(lldb) process launch -- -a -b -c |
Read memory(stack like):
1 2 3 4 5 |
(lldb) memory read -f A -c 0x4 $esp-4 0xbfffe49c: 0x00002d76 0xbfffe4a0: 0x03f13790 -> 0xa11d2b70 Foundation`NSConcreteMutableData 0xbfffe4a4: 0x00003aff "ascii26String" 0xbfffe4a8: 0x00000007 |
Read memory(hex dump like):
1 2 3 |
(lldb) memory read -f Y -c 0x20 $esp-4 0xbfffe49c: 76 2d 00 00 90 37 f1 03 ff 3a 00 00 07 00 00 00 v-...7?.?:...... 0xbfffe4ac: 08 00 00 00 01 00 00 00 e0 a9 33 00 00 00 00 00 ........?3..... |
Read variable:
1 2 3 4 5 6 |
(lldb) p $eax (unsigned int) $516 = 70420592 (lldb) p/x 12345 (int) $108 = 0x00003039 (lldb) po $eax KUTBSIYEGHZSYICYUNBYJEL |
Add breakpoint at an address:
1 |
(lldb) breakpoint set -a 0x2a80 |
Add breakpoint at a name:
1 |
(lldb) breakpoint set --name ExtractFromCMSEnvelope |
List all breakpoints:
1 |
(lldb) breakpoint list |
Enable/Disable a breakpoint:
1 2 3 4 |
(lldb) breakpoint enable 1 1 breakpoints enabled. (lldb) breakpoint disable 2 1 breakpoints disabled. |
Delete a breakpoint:
1 2 |
(lldb) breakpoint delete 6 1 breakpoints deleted; 0 breakpoint locations disabled. |
Disassemble at current address(20 lines):
1 |
(lldb) dis -c 20 |
Continue:
1 |
(lldb) c |
Step-in
1 |
(lldb) s |
Step-over
1 |
(lldb) n |
Finish executing in current frame
1 |
(lldb) fin |
Read All Registers:
1 |
(lldb) register read |
Modify A Register:
1 |
(lldb) register write rax 0 |
List loaded modules
1 |
image list |
Useful links:
https://github.com/snarez/voltron <= this one is quite useful
in LLDB:
1 |
voltron start |
1 |
sskajetekiMacBook-Pro:~ sskaje$ voltron view cmd 'memory read -f Y -c 0x20 0x03f0cc90 ' |