Using atos to determine crashed method name with dSYM

Question

I have a Console stack (not a crash report) from a user, and I'm trying to determine which method call in my application was the last man standing.

I know which version of the application they were using, and I have a copy of that release/debug build, along with the dSYM file for the archived copy.

But, when I try to use atos to spit out the memory address, it doesn't seem to help. (I'm using 0x000000010e703bc0 from the stack below.)

craig-mbp:Desktop Craig$ atos -o MyApp.app_1.0.0.dSYM/Contents/Resources/DWARF/MyApp -arch x86_64
0x000000010e703bc0 (<- entered by me)
0x000000010e703bc0 (<- console output)

Do I need to enter an offset of some sort? Or some kind of memory address math to determine the actual location inside my program's memory block, based on the address provided to me by the user?

This is the totality of the stack trace I received:

28/11/12 10:48:56.220 AM    MyApp[411]  (
    0   CoreFoundation                      0x00007fff8fee90a6 __exceptionPreprocess + 198
    1   libobjc.A.dylib                     0x00007fff8e94a3f0 objc_exception_throw + 43
    2   CoreFoundation                      0x00007fff8fee8e7c +[NSException raise:format:] + 204
    3   Foundation                          0x00007fff92b1ce5c -[NSPlaceholderString initWithString:] + 93
    4   Foundation                          0x00007fff92b1cde4 +[NSString stringWithString:] + 43
    5   MyApp                               0x000000010e703bc0 MyApp + 23488
    6   MyApp                               0x000000010e70a038 MyApp + 49208
    7   MyApp                               0x000000010e70b41a MyApp + 54298
    8   MyApp                               0x000000010e70bb92 MyApp + 56210
    9   Foundation                          0x00007fff92b22db5 __NSFireDelayedPerform + 358
    10  CoreFoundation                      0x00007fff8fea5da4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
    11  CoreFoundation                      0x00007fff8fea58bd __CFRunLoopDoTimer + 557
    12  CoreFoundation                      0x00007fff8fe8b099 __CFRunLoopRun + 1513
    13  CoreFoundation                      0x00007fff8fe8a6b2 CFRunLoopRunSpecific + 290
    14  HIToolbox                           0x00007fff8b31c0a4 RunCurrentEventLoopInMode + 209
    15  HIToolbox                           0x00007fff8b31be42 ReceiveNextEventCommon + 356
    16  HIToolbox                           0x00007fff8b31bcd3 BlockUntilNextEventMatchingListInMode + 62
    17  AppKit                              0x00007fff948e7613 _DPSNextEvent + 685
    18  AppKit                              0x00007fff948e6ed2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
    19  AppKit                              0x00007fff948de283 -[NSApplication run] + 517
    20  AppKit                              0x00007fff94882cb6 NSApplicationMain + 869
    21  MyApp                               0x000000010e6ffab4 MyApp + 6836

Answer 1

it's expecting a load address. have you tried:

atos -o MyApp.app_1.0.0.dSYM/Contents/Resources/DWARF/MyApp -arch x86_64 -l 0x000000010E6FE000

i get 0x000000010E6FE000 from your example by subtracting 6836 (base10) from 0x000000010e6ffab4 ... or you could use any of the other math items shown there for MyApp .

here's an example from one of my recent crashes, where the 0x2d000 was evident from the crash log. first line is what i entered on the command line. every other line after that is program output (artificially indenting my input with $ or $> ... there is no such prompt on the screen).

$ atos -o /x/xcode/DerivedData/Xxxx/Build/Products/Debug-iphoneos/Xxxx.app.dSYM/Contents/Resources/DWARF/Xxxx -l 0x2d000
got symbolicator for /x/xcode/DerivedData/Xxxx/Build/Products/Debug-iphoneos/Xxxx.app.dSYM/Contents/Resources/DWARF/Xxxx, base address 1000
$> 0x0002f9a6
0x000039a6 (in Xxxx)
$> 0x0002f940
0x00003940 (in Xxxx)
$> 0x000c70f6
-[TFHTTPOperation connection:didReceiveData:] (in Xxxx) + 754