1

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all breakpoints are wokring fine. Let's have a look on example:

First case (trying to attach to exising process):

MacBook-Pro-Michal:Damn m1entus$ ps aux | grep -i calculator
m1entus         28940   0,0  0,0  2432772    676 s001  S+    1:21     0:00.00 grep -i calculator
m1entus         28863   0,0  0,2  2762000  36000   ??  U     1:19     0:00.73 /Applications/Calculator.app/Contents/MacOS/Calculator

next

(lldb) attach -p 28863

next

(lldb) b *0x00000001000093dd
Breakpoint 1: address = 0x00000001000093dd
(lldb) c
Process 28863 resuming

And nothing is happening when open showAbout... (i took address from Hopper)

Second case (run app with lldb command):

MacBook-Pro-Michal:Damn m1entus$ lldb /Applications/Calculator.app/Contents/MacOS/Calculator 
(lldb) target create "/Applications/Calculator.app/Contents/MacOS/Calculator"
Current executable set to '/Applications/Calculator.app/Contents/MacOS/Calculator' (x86_64).
(lldb) b *0x00000001000093dd
Breakpoint 1: address = 0x00000001000093dd
(lldb) run
Process 28972 launched: '/Applications/Calculator.app/Contents/MacOS/Calculator' (x86_64)

when i open showAbout: in Calculator my breakpoint is reached:

Process 28972 stopped
* thread #1: tid = 0x8f823, 0x00000001000093dd Calculator`___lldb_unnamed_function161$$Calculator, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
 frame #0: 0x00000001000093dd Calculator`___lldb_unnamed_function161$$Calculator
Calculator`___lldb_unnamed_function161$$Calculator:
->  0x1000093dd <+0>:  pushq  %rbp
0x1000093de <+1>:  movq   %rsp, %rbp
0x1000093e1 <+4>:  movq   0x12b98(%rip), %rdi       ; (void *)0x00007fff7374e488: NSDictionary
0x1000093e8 <+11>: movq   0x12301(%rip), %rsi       ; "dictionaryWithObject:forKey:"

Could someone could explain me why it is happening and how to attach to exising process and hit breakpoint ?

2

The reason is due to address space layout randomization (ASLR). The dynamic loader will employ some randomization in the starting address (the slide) which you must account for. When you start the application in lldb, no slide is applied so the addresses are the same.

Here is an example of it in action from two different Calculator apps running

  1. 0x00000200 container [0x00000001040c6000-0x00000001040db000) 0x00000000 0x00015000 0x00000000 Calculator.__TEXT
  2. 0x00000200 container [0x0000000105e21000-0x0000000105e36000) 0x00000000 0x00015000 0x00000000 Calculator.__TEXT

The default starting address for the TEXT segment is 0x0100000000 so the first one is applying a slide of 0x40c6000 and the second has a slide of 0x5e21000.

Let's say I wanted to set a breakpoint on -[LCDController showValue]. For my particular version of Calculator, this has an address of 0x0100001610. If I start Calculator in lldb, I can simply put a breakpoint on that address but if I attach to one already loaded I must account for the slide. In the first example, I would need to put a breakpoint on:

0x0100001610 + 0x40c6000 = 0x1040c7610

and the second that would be:

0x0100001610 + 0x5e21000 = 0x105e22610.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.