Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Is it possible to debug x64 assembly on Mac OS?

I would like to be able to write and debug x64 assembly on my Mac with Sierra 10.12.4. One would think this would not be a particularly difficult or obscure desire, but despite many hours of effort and a lot of searching online I have not succeeded and I haven't found anyone else who has either.

I would prefer to use the NASM assembler, but will use GAS or anything with Intel syntax if I have to. (By the way, note that both gdb and lldb work fine with C files compiled with gcc.)

Here's my situation and what I've tried:

NASM doesn't work

I can assemble and link a file and verify it works.

$ nasm -f macho64 -g -F dwarf hello2.s -o hello2.o
$ gcc hello2.o -o hello2
$ ./hello2
Hello, world!

But I can't debug it with gdb (note that I did do all the necessary codesigning nonsense):

$ gdb hello2
GNU gdb (GDB) 8.0
<snip>
Reading symbols from hello2...done.
(gdb) list
1   section .data
2
3   msg: db "Hello, world!", 0
4
5   section .text
6       global _main
7       extern _puts
8
9   _main:
10      push    rbp
(gdb) break 10
Breakpoint 1 at 0x0: file hello2.s, line 10.
(gdb) run
Starting program: /Users/mike/GoogleDrive/Projects/Sort/hello2
[New Thread 0x1403 of process 38022]
warning: unhandled dyld version (15)
Warning:
Cannot insert breakpoint 1.
Cannot access memory at address 0x0

Command aborted.

And I can't debug it with lldb:

$ lldb hello2
(lldb) target create "hello2"
Current executable set to 'hello2' (x86_64).
(lldb) b hello2.s:10
Breakpoint 1: no locations (pending).
WARNING:  Unable to resolve breakpoint to any actual locations.

GAS doesn't work

I can assemble, link, and run:

$ gcc -g hello.s -o hello
$ ./hello
Hello, world!

But I can't debug with gdb:

$ gdb hello
GNU gdb (GDB) 8.0
<snip>
Reading symbols from hello...Reading symbols from /Users/mike/GoogleDrive/Projects/Sort/hello.dSYM/Contents/Resources/DWARF/hello...done.
done.
(gdb) list
1   .intel_syntax
2   .text
3       .globl _main
4
5   _main:
6       push    rbp
7       mov rbp, rsp
8       lea rdi, [rip + _main.S_0]
9       call    _puts
10      mov rax, 0
(gdb) break 6
No line 6 in the current file.
Make breakpoint pending on future shared library load? (y or [n]) y
Breakpoint 1 (6) pending.
(gdb) run
Starting program: /Users/mike/GoogleDrive/Projects/Sort/hello
[New Thread 0x1403 of process 38063]
warning: unhandled dyld version (15)
Hello, world!
[Inferior 1 (process 38063) exited normally]

(So it just ran and ignored the breakpoint.)

And I can't debug it with lldb:

$ lldb hello
(lldb) target create "hello"
Current executable set to 'hello' (x86_64).
(lldb) b hello.s:6
Breakpoint 1: no locations (pending).
WARNING:  Unable to resolve breakpoint to any actual locations.

Things I've found online

Here is a blog post about gdb not working on new versions of Mac OS.

There are a couple old related StackOverflow questions, neither of which provide an adequate answer.

There's also this way to use Xcode, which miraculously seems to work... but it doesn't actually do what I want. The debugger is not actually aware of my source file; it's just stepping through the instructions and displaying disassembled code or something. Also I don't want to use XCode.

I asked about this on the NASM mailing list a couple months ago and nobody ever responded.

So...

So is it currently impossible to do one of the most basic things a person might want to do with a computer using a Mac?

If someone has a way to do this, please show me exactly the necessary commands.

like image 341
Michael Benfield Avatar asked Jun 12 '17 07:06

Michael Benfield


1 Answers

Miracle of miracles, it seems I can do this with clang:

$ clang -g -c -x assembler hello.s
$ clang hello.o -o hello
$ ./hello
Hello, world!
$ lldb hello
(lldb) target create "hello"
Current executable set to 'hello' (x86_64).
(lldb) b hello.s:10
Breakpoint 1: where = hello`main + 16, address = 0x0000000100000f7c
(lldb) run
Process 40460 launched: '/Users/mike/GoogleDrive/Projects/Sort/hello' (x86_64)
Hello, world!
Process 40460 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
    frame #0: 0x0000000100000f7c hello`main at hello.s:10
   7        mov rbp, rsp
   8        lea rdi, [rip + _main.S_0]
   9        call    _puts
-> 10       mov rax, 0
   11       mov rsp, rbp
   12       pop rbp
   13       ret

Unfortunately as far as I can tell clang's x64 assembly support is completely undocumented, and I figured out the correct incantations to do this only by experimenting. But it's something, I guess.

like image 168
Michael Benfield Avatar answered Nov 16 '22 16:11

Michael Benfield