将类转储信息导入GDB

Question

有没有办法将输出class-dump导入GDB？

示例代码:

$ cat > test.m
#include <stdio.h>
#import <Foundation/Foundation.h>

@interface TestClass : NSObject

+ (int)randomNum;

@end

@implementation TestClass

+ (int)randomNum {
    return 4; // chosen by fair dice roll.
              // guaranteed to be random.
}

@end

int main(void) {
    printf("num: %d\n", [TestClass randomNum]);
    return 0;
}
^D

$ gcc test.m -lobjc -o test
$ ./test
num: 4
$ gdb test
...
(gdb) b +[TestClass randomNum]
Breakpoint 1 at 0x100000e5c
(gdb) ^D
$ strip test
$ gdb test
...
(gdb) b +[TestClass randomNum]
Function "+[TestClass randomNum]" not defined.
(gdb) ^D

$ class-dump -A test
...
@interface TestClass : NSObject
{
}

+ (int)randomNum;   // IMP=0x0000000100000e50

@end

我知道我现在可以使用b *0x0000000100000e50的gdb,但有修改GDB的符号表,使之接受的一种方式b +[TestClass randomNum]？

编辑:如果它适用于GDB v6而不仅仅是GDB v7,那将是最好的,因为GDB v6是Apple的补丁的最新版本.

Answer 1

可以使用该add-symbol-file命令在gdb中加载符号文件.最难的部分是生成这个符号文件.

在libMachObjC(它是类转储的一部分)的帮助下,转储所有地址及其相应的Objective-C方法非常容易.我写了一个小工具,objc-symbols就是这样做的.

我们以Calendar.app为例.如果您尝试使用该nm工具列出符号,您会注意到日历应用已被剥离:

$ nm -U /Applications/Calendar.app/Contents/MacOS/Calendar 
0000000100000000 T __mh_execute_header
0000000005614542 - 00 0000   OPT radr://5614542

但是objc-symbols您可以轻松检索所有缺少的Objective-C方法的地址:

$ objc-symbols /Applications/Calendar.app
00000001000c774c +[CALCanvasAttributedText textWithPosition:size:text:]
00000001000c8936 -[CALCanvasAttributedText createTextureIfNeeded]
00000001000c8886 -[CALCanvasAttributedText bounds]
00000001000c883b -[CALCanvasAttributedText updateBezierRepresentation]
...
00000001000309eb -[CALApplication applicationDidFinishLaunching:]
...

然后,使用SymTabCreator,您可以创建一个符号文件,它实际上是一个包含所有符号的空dylib.

使用objc-symbols和SymTabCreator在一起很简单:

$ objc-symbols /Applications/Calendar.app | SymTabCreator -o Calendar.stabs

您可以检查Calendar.stabs包含所有符号:

$ nm Calendar.stabs 
000000010014a58b T +[APLCALSource printingCachedTextSize]
000000010013e7c5 T +[APLColorSource alternateGenerator]
000000010013e780 T +[APLColorSource defaultColorSource]
000000010013e7bd T +[APLColorSource defaultGenerator]
000000010011eb12 T +[APLConstraint constraintOfClass:withProperties:]
...
00000001000309eb T -[CALApplication applicationDidFinishLaunching:]
...

现在让我们看看gdb中发生了什么:

$ gdb --silent /Applications/Calendar.app
Reading symbols for shared libraries ................................. done

没有符号文件:

(gdb) b -[CALApplication applicationDidFinishLaunching:]
Function "-[CALApplication applicationDidFinishLaunching:]" not defined.
Make breakpoint pending on future shared library load? (y or [n]) n

加载符号文件后:

(gdb) add-symbol-file Calendar.stabs 
add symbol table from file "Calendar.stabs"? (y or n) y
Reading symbols from /Users/0xced/Calendar.stabs...done.
(gdb) b -[CALApplication applicationDidFinishLaunching:]
Breakpoint 1 at 0x1000309f2

您会注意到断点地址与符号地址不完全匹配(0x1000309f2与0x1000309eb,差异为7个字节),这是因为gdb会自动识别函数序言并在之后设置断点.

GDB脚本

鉴于剥离的可执行文件是当前目标,您可以使用此GDB脚本自动执行此操作.

从下面添加脚本到您的.gdbinit目标,剥离可执行文件并objc_symbols在gdb中运行命令:

$ gdb test
...
(gdb) b +[TestClass randomNum]
Function "+[TestClass randomNum]" not defined.
(gdb) objc_symbols
(gdb) b +[TestClass randomNum]
Breakpoint 1 at 0x100000ee1
(gdb) ^D

define objc_symbols
    shell rm -f /tmp/gdb-objc_symbols

    set logging redirect on
    set logging file /tmp/gdb-objc_symbols
    set logging on

    info target

    set logging off

    shell target="$(head -1 /tmp/gdb-objc_symbols | head -1 | awk -F '"' '{ print $2 }')"; objc-symbols "$target" | SymTabCreator -o /tmp/gdb-symtab

    set logging on
    add-symbol-file /tmp/gdb-symtab
    set logging off
end