How to debug binary which doesn't have executable flags?

Question

I'm trying to debug the binary which is not executable.

As sample I'm using /bin/true with 644 permission:

install -m 644 /bin/true .

and I'm trying to run it as:

$ lldb true
(lldb) target create "true"
Current executable set to 'true' (x86_64).
(lldb) process launch

But I've got the following error:

error: error: ::posix_spawnp ( pid => 29052, path = '/Foo/Bar/true', file_actions = 0x7fff5d015e98, attr = 0x7fff5d015ed8, argv = 0x7fd6396507f0, envp = 0x7fd6396512d0 ) err = Permission denied (0x0000000d)

Is it something possible using lldb without giving the executable flag to the binary?

Answer 1

No. lldb wants to run the program using a combination of fork and exec, then control the progam with ptrace. But the kernel will refuse to exec the program unless it has the correct x bit (your user/group ids define which one is the correct one) set. You can set the x bit for yourself, the owner, only (if you want to prevent others from executing the binary); or you can set the x bit, start the process, and remove the x bit again (if you want to prevent yourself from running it accidentially). But to start a process that runs the binary, you need the x bit.

If you really really want to execute the binary's code without setting it executable, you could probably write a program to read its header, mmap the sections you need, read the binary into those sections, possibly fix up relocations, and jump to the entry point. But you'll have a long, arduous way in front of you to get this right, and it probably won't be possible to get llvm recognize any symbols in the binary. So while doing this might be a theoretical possibility, there's really no point in trying.

Answer 2

As for workaround (per this post), on Linux the non-executable binary can be invoked by dynamic linker/loader as below:

lldb -- /lib64/ld-linux-x86-64.so.2 foo_binary

and for 32-bit version use ld-linux.so found in /lib instead.