Are Reverse Debuggers Impossible on OSX?

Question

I have been impressed with the reverse debugging (that is stepping back in time through a program) capabilities in GDB and tools like QIRA, but I am a little confused as to why no such program exists for the OSX platform (GDS does not support reverse debugging on OSX.) Is there a technical reason why a reverse debugger is not possible on OSX? I would imagine that under the same architectures the task of implementing a time oblivious debugger would be almost exactly the same. Why would porting to OSX be a impossible or difficult? I mostly assume there is a technical challenge here because no one has implemented such an obviously useful program.

Answer 1

Honestly, the stock reversible debugging support in gdb is not all that useful. It's really slow (because it records individual instructions), so you generally have to turn it on just for a critical piece of the program. I don't know of very many people that use it, which may explain why it hasn't been ported widely. I'm not familiar with QIRA's implementation so I don't know what the reasons would be there.

Something like Mozilla's rr can be a lot faster, because it records at the system call boundary. But that's much more tied to the specific OS, so it's a lot of work to reimplement for another platform.

One last possibility is something whole-system, that records hardware events and so would be OS-agnostic by default. But then you have to run a full OS to record/replay one program, so this may not be very attractive either. This is the route that PANDA and some experimental QEMU patches take (note that PANDA doesn't actually support the gdb reverse-step instructions yet, but it could be implemented).