lldb

cheat sheet >si

instruction level single step over
>br s -f foo.c -l 12
set a breakpoint by regular expression on
show contents of variable bar
>frame variable bar
Execution Commands >thread step-inst-over source file contents >fr v bar
>ni >breakpoint set --source-pattern >p bar
start lld (prefix with xcrun on os x)
>lldb [program.app] step out of the currently selected frame regular-expression --file SourceFile show contents of var bar formatted as hex
>thread step-out >br s -p regular-expression -f file >frame variable --format x bar
>lldb -- program.app arg1
>finish set conditional breakpoint >fr v -f x bar
load program
>file program.app Return from currently frame, with return >breakpoint set --name foo -- show contents of global variable baz
condition '(int)strcmp(y,"hello") == >target variable baz
run program value
0' >ta v baz
>thread return [RETURN EXPRESSION]
>process launch [-- args] >br s -n foo -c
>run [args] Backtrace and disassemble every time you '(int)strcmp(y,"hello") == 0' show global/static variables in current file
>target variable
set arguments stop list breakpoints >ta v
>settings set target.run-args 1 >target stop-hook add >breakpoint list
>bt >br l show argc and argv every time you stop
launch process in new terminal >disassemble --pc >target stop-hook add --one-liner
>process launch --tty -- <args> >DONE delete a breakpoint "frame variable argc argv"
>breakpoint delete 1 >ta st a -o "fr v argc argv"
set env variables run until line 12 or end of frame >br del 1 >display argc
>settings set target.env-vars DEBUG=1 >thread until 12
Watchpoint Commands >display argv
remove env variables Breakpoint Commands
>settings remove target.env-vars set watchpoint on variable when written to display argc and argv when stopping in main
DEBUG set breakpoint at all functions named main >watchpoint set variable global_var >target stop-hook add --name main --
>breakpoint set --name main >wa s v global_var one-liner "frame variable argc argv"
show program arguments >br s -n main >ta st a -n main -o "fr v argc argv"
>settings show target.run-args >b main set watchpoint on memory of pointer size
>watchpoint set expression -- display *this when in class MyClass
set env variable and run set breakpoint in file test.c line 12 >target stop-hook add --classname
0x123456
>process launch -v DEBUG=1 >breakpoint set --file test.c --line MyClass --one-liner "frame variable
>wa s e -- 0x123456
attach to process by PID 12 *this"
>br s -f test.c -l 12 set watchpoint on memory of custom size >ta st a -c MyClass -o "fr v *this"
>process attach --pid 123
>b test.c:12 > watchpoint set expression –x
attach to process by name byte_size -- 0x123456
Evaluating Expressions
>process attach --name a.out [-- set breakpoint at all C++ methods with name > wa s e –x byte_size -- 0x123456 evaluate expression (print alias possible as
waitfor] main well)
>breakpoint set --method main set a condition on a watchpoint
attach to remote gdb on eorgadd >watch set var global >expr (int) printf ("Print nine:
>br s -M main
>gdb-remote eorgadd:8000 >watchpoint modify -c '(global==5)' %d.", 4 + 5)
set breakpoint at ObjC function >print (int) printf ("Print nine:
attach to gdb server on localhost >breakpoint set --name "-[NSString list watchpoints %d.", 4 + 5)
>gdb-remote 8000 stringWithFormat:]" >watchpoint list
>watch l using a convenience variable
attach to remote Darwin kernel in kdp mode >b -[NSString stringWithFormat:]
>expr unsigned int $foo = 5
>kdp-remote eorgadd set breakpoint at all ObjC functions whose delete a watchpoint
>watchpoint delete 1 print the ObjC description of an object
source level single step selector is count >expr -o -- [SomeClass
>watch del 1
>thread step-in >breakpoint set --selector count returnAnObject]
>step >br s -S count Examining Variables >po [SomeClass returnAnObject]
>s set breakpoint by regular expression function show arguments and local variables print dynamic type of expression result
source level setop over name >frame variable >expr -d 1 -- [SomeClass
>thread step-over >breakpoint set --func-regex print.* >fr v returnAnObject]
>next show local variables >expr -d 1 –
>n
ensure that breakpoints by file and line work
>frame variable --no-args someCPPObjectPtrOrReference
(c/cpp/objc)
instruction level single step >settings set target.inline- >fr v -a
>thread step-inst breakpoint-strategy always
set dynamic type printing as default show general purpose registers as signed get information about specific heap Executable and Shared Library Query
>settings set target.prefer-dynamic decimal allocation and cast result to dynamic type Commands
run-target >register read --format i that can be deduced (Mac OS X only)
>re r -f i list the main executable and all dependent
calling a function with a breakpoint >command script import
shared libraries
>expr -i 0 -- >register read/d lldb.macosx.heap
>malloc_info --type 0x10010d680 >image list
function_with_a_breakpoint() show all registers in all register threads
>register read --all find all heap blocks that contain pointer look up information for a raw address in the
calling a function that crashes
expr -u 0 -- function_which_crashes() >re r -a specified by an expression EXPR (Mac OS X executable or any shared libraries
>image lookup --address 0x1ec4
Examining Thread State show registers rax, rsp, rbp only)
>im loo -a 0x1ec4
register read rax rsp rbp >command script import
show backtrace (current thread) lldb.macosx.heap look up functions matching a regular
show register rax with binary format
>thread backtrace
>register read --format binary rax
>ptr_refs EXPR expression in a binary
>bt >image lookup -r -n <FUNC_REGEX>
find all heap blocks that contain a C string
show backtrace for all threads read memory from 0xbffff3c0 and show 4 hex (debug symbols)
anywhere in the block (Mac OS X only)
>thread backtrace all uint32_t values >image lookup -r -s <FUNC_REGEX>
>command script import
>bt all >memory read --size 4 --format x -- (non-debug syms)
lldb.macosx.heap
count 4 0xbffff3c0 find full source line information
backtrace the first 5 frames of current thread >me r -s4 -fx -c4 0xbffff3c0
>cstr_refs CSTRING
>image lookup -v --address 0x1ec4
>thread backtrace -c 5 >x -s4 -fx -c4 0xbffff3c0 disassemble current function for current
>bt 5 (lldb-169 and later) (look for entryline)
>memory read/4xw 0xbffff3c0 frame
>bt –c 5 (lldb-168 and later) >x/4xw 0xbffff3c0 >disassemble –frame look up information for an address in a.out
select a different stack frame by index >memory read --gdb-format 4xw >di -f only
>frame select 12 0xbffff3c0 >image lookup --address 0x1ec4 a.out
disassemble any functions named main
>fr s 12 read memory starting at the expression >im loo -a 0x1ec4 a.out
>disassemble --name main
>f 12 "argv[0]" >di -n main look up information for a type Pointer by
show frame information >memory read `argv[0]`
disassemble address range name
>frame info >memory read --size `sizeof(int)` >image lookup --type Point
>disassemble --start-address 0x1eb8 -
`argv[0]` >im loo -t Point
select stack frame the called current frame -end-address 0x1ec3
>up read 512 bytes from address 0xbffff3c0 and >di -s 0x1eb8 -e 0x1ec3 dump all sections from the main executable
>frame select --relative=1 save results to a local file disassemble 20 instructions from start and any shared libraries
>memory read --outfile /tmp/mem.txt - >image dump sections
select stack frame that is called by current address
-count 512 0xbffff3c0
frame >me r -o/tmp/mem.txt -c512 0xbffff3c0
>disassemble --start-address 0x1eb8 - dump all sections in the a.out module
>down -count 20 >image dump sections a.out
>x/512bx -o/tmp/mem.txt 0xbffff3c0
>frame select --relative=-1 >di -s 0x1eb8 -c 20
>fr s -r-1 save binary memory data starting at 0x1000 dump all symbols from the main executable
show mixed source and disassembly for the and any shared libraries
and ending at 0x2000 to file
select different frame using relative offset current function >image dump symtab
>memory read --outfile /tmp/mem.bin -
>frame select --relative 2 >disassemble --frame –mixed
>fr s -r2
-binary 0x1000 0x2000
>di -f -m dump all symbols in a.out and liba.so
>me r -o /tmp/mem.bin -b 0x1000 >image dump symtab a.out liba.so
>frame select --relative -3
0x2000 disassemble the current function for the
>fr s -r-3
current frame and show the opcode bytes
Miscellaneous
show general purpose registers get information about specific heap
allocation (Mac OS X only) >disassemble --frame –bytes echo text to the screen
>register read >di -f -b >script print "Here is some text"
>command script import
write 123 to register rax lldb.macosx.heap disassemble the current source line for the remap source file pathnames for the debug
>register write rax 123 >process launch --environment current frame session (e.g. if program was built on another
skip 8 bytes using with program counter MallocStackLogging=1 -- [ARGS] >disassemble --line PC)
>register write pc `$pc+8` >malloc_info --stack-history >di -l >settings set target.source-map
0x10010d680
/buildbot/path /my/path