在Mac OS X上使用GDB中的strcmp()的条件断点与Objective-C运行时冲突

Question

我正在尝试调试我在Mac OS X上没有源代码的程序.我想知道它调用的参数gettattrlist(),并检查两个不同卷的返回值(为了比较和查看为什么它会让你使用一个卷而不是另一个).

我第一次尝试dtruss; 但那没用getattrlist(); 它只显示传入的指针getattrlist()(甚至不知道有多少参数getattrlist()).

  635/0x1dc5:  getattrlist("/Volumes/MyVolume\0", 0x113FA6380, 0x113FA5FD0)                 = 0 0
  635/0x1dc5:  getattrlist("/Volumes/MyVolume\0", 0x113FA4F00, 0x113FA4B30)                 = 0 0
  635/0x1dc5:  getattrlist("/Volumes/MyVolume\0", 0x113FA5870, 0x113FA54C0)                 = 0 0
  635/0x19c6:  getattrlist("/Volumes/MyVolume\0", 0x7FFF5FBF9140, 0x7FFF5FBF8D70)           = 0 0
  635/0x19c6:  getattrlist("/Volumes/MyVolume\0", 0x7FFF5FBFA8A0, 0x7FFF5FBFA4F0)           = 0 0

所以我尝试了GDB.我可以设置一个无条件断点getattrlist(),并查看它的第一个参数,但它经常被称为有用的方式.

(gdb) break getattrlist
Breakpoint 1 at 0x7fff8e90b6ac
(gdb) cont
Continuing.

Breakpoint 1, 0x00007fff8e90b6ac in getattrlist ()
(gdb) p (char *)$rdi
$1 = 0x7fff5fbfd67e "/some/random/path"

所以,我可能需要一个条件断点,只有当第一个参数匹配我感兴趣的路径时才会断开.这应该不会太难,对吧？

(gdb) delete
Delete all breakpoints? (y or n) y
(gdb) break getattrlist if ((int)strcmp((char *)$rdi, "/Volumes/My Volume")) == 0
Breakpoint 2 at 0x7fff8e90b6ac
(gdb) cont
Continuing.
Canceling call as the malloc lock is held so it isn't safe to call the runtime.
Issue the command:
    set objc-non-blocking-mode off 
to override this check if you are sure your call doesn't use the malloc libraries or the ObjC runtime.
Error in testing breakpoint condition:
Canceling call as the malloc lock is held so it isn't safe to call the runtime.
Issue the command:
    set objc-non-blocking-mode off 
to override this check if you are sure your call doesn't use the malloc libraries or the ObjC runtime.

Breakpoint 2, 0x00007fff8e90b6ac in getattrlist ()
(gdb) p (char *)$rdi
 $12 = 0x7fff5fbfd67e "/some/other/random/path"

这是什么？GDB忽略了我的条件,因为它怀疑它可能会调用malloc()还是ObjC运行时？好的,好吧,strcmp()不应该打电话malloc(); 它应该逐字节地比较字符串,直到它变为空字符.因此,设置消息建议覆盖检查的选项:

(gdb) set objc-non-blocking-mode off
(gdb) cont
Continuing.
Segmentation fault: 11

没有骰子.GDB和应用程序都死了.

有关如何在GDB中设置条件监视点而不遇到此问题的任何建议？或者其他捕获参数和返回值(通过输出参数存储)的方法getattrlist()比dtruss()哪个更好？

编辑

试过亚光的解决方案,但没有运气:

(gdb) set $vol = (char *) malloc((int)strlen("/Volumes/My Volume") + 1)
(gdb) call (int)strcpy($vol, "/Volumes/My Volume")
$1 = 236411760
(gdb) break getattrlist if ((int)strcmp((char *)$rdi, $vol)) == 0
Breakpoint 1 at 0x7fff8e90b6ac
(gdb) cont
Continuing.
Unsafe to run code: malloc zone lock is held for some zone..
Error in testing breakpoint condition:
Canceling call as the malloc lock is held so it isn't safe to call the runtime.
Issue the command:
    set objc-non-blocking-mode off 
to override this check if you are sure your call doesn't use the malloc libraries or the ObjC runtime.

Breakpoint 1, 0x00007fff8e90b6ac in getattrlist ()
(gdb) p (char *)$rdi
$4 = 0x11a715838 "/some/other/random/path"

我决定尝试memcmp()而不是strcmp(); 也没有运气:

(gdb) break getattrlist if ((int)memcmp((char *)$rdi, $vol, 18)) == 0
Breakpoint 1 at 0x7fff8e90b6ac
(gdb) cont
Continuing.
Unsafe to run code: malloc zone lock is held for some zone..
Error in testing breakpoint condition:
Canceling call as the malloc lock is held so it isn't safe to call the runtime.
Issue the command:
    set objc-non-blocking-mode off 
to override this check if you are sure your call doesn't use the malloc libraries or the ObjC runtime.

Breakpoint 1, 0x00007fff8e90b6ac in getattrlist ()
(gdb)

在这一点上,我想"好了,现在真的不应该有任何用处malloc()",所以我决定再试set objc-non-blocking-mode off一次.仍然没有运气:

(gdb) set objc-non-blocking-mode off
(gdb) cont
Continuing.
Reading symbols for shared libraries ... done
Reading symbols for shared libraries . done
Reading symbols for shared libraries ....... done
[Switching to process 5456 thread 0x2971b]
[Switching to process 5456 thread 0x29e2f]
warning: Unable to restore previously selected frame.

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000000
[Switching to process 5456 thread 0x29e2f]
0x0000000000000000 in ?? ()
Error in testing breakpoint condition:
The program being debugged was signaled while in a function called from GDB.
GDB remains in the frame where the signal was received.
To change this behavior use "set unwindonsignal on"
Evaluation of the expression containing the function (memcmp) will be abandoned.

Breakpoint 1, 0x0000000000000000 in ?? ()
Error in testing breakpoint condition:
The program being debugged was signaled while in a function called from GDB.
GDB remains in the frame where the signal was received.
To change this behavior use "set unwindonsignal on"
Evaluation of the expression containing the function (memcmp) will be abandoned.

Breakpoint 1, 0x0000000000000000 in ?? ()

嗯.我在哪个州？

(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x000000011e6ec070 in ?? ()

伊克.这看起来不太好.如果我继续在这里怎么办？

(gdb) cont
Continuing.
[Switching to process 5456 thread 0x2971b]
(gdb) bt
#0  0x00007fff8e90b6ac in getattrlist ()
#1  0x00007fff897c9c4b in GetPathVolFSAttributes ()
#2  0x00007fff897c9459 in PathGetObjectInfo ()
#3  0x00007fff897c9279 in FSPathMakeRefInternal ()
#4  0x00007fff8767b3ee in FSNodePrepareFSRef ()
... snip ...
(gdb) p (char *)$rdi
$2 = 0x10db1c2b0 "/System/Library/CoreServices/CoreTypes.bundle"

不.仍然没有打破正确的电话getattrlist(); 由于空指针取消引用,同时一切都已经死亡.

Answer 1

我相信像下面这样的东西应该有效。

(gdb) start
...
(gdb) set $x = malloc(strlen("foobar") + 1)
(gdb) call strcpy($x, "foobar")
(gdb) break a_leg if strcmp(foo, $x) == 0