2

I'm trying to hit a breakpoint that I set in LLDB (CLI), but for whatever reason I'm not hitting my breakpoint. I am messing around with the stock Calculator.app on OS X, and am trying to call / hit my breakpoint when I open the About dialog box of the Calculator.app.

I launch the Calculator.app, then I start lldb from a Terminal window. I find the process of the Calculator.app using ps and grep. I attach to the running process using LLDB. I then issue the continue command in LLDB to allow the Calculator.app to continue running.

Then I set a breakpoint in LLDB when the following method is called, showAbout

I type the following command into LLDB, (lldb) breakpoint set --method showAbout

However when I click About Calculator from the menu bar it doesn't halt the program, but rather shows the About dialog box for the Calculator.

4

The Calculator app is stripped as can be seen by running nm. You will need to find the address of the method using class-dump:

$ class-dump -A /Applications/Calculator.app | grep showAbout
- (void)showAbout:(id)arg1; // IMP=0x0000000100009939

However as the Calculator application is already running, the address has been slided because of ASLR. To find the ASLR slide you can use my tool called get_aslr, like so:

$ sudo get_aslr $(pgrep Calculator)
ASLR slide: 0x9508000

You then add the two numbers together:

0x0000000100009939 + 0x9508000 = 0x109511939

That is the current address of the showAbout: method. Now you just need to set the breakpoint in lldb:

b *0x109511939

And it works!

  • 1
    You don't need get_aslr; you can also find the address the binary is loaded at by running image list from within lldb. – Brennan Vincent Nov 30 '15 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.