How I debug closed source software

Slides from my talk “How I debug closed source software” at CocoaKucha 2 – London in January 2013.

Transcript

1. How I debug closed source software Damien DeVille ! @damiendeville http://ddeville.me
2. Who am I? • I am Damien DeVille. • I work at Realmac Software in Brighton. • I make Ember for Mac and iOS. • I spend way too much time in the debugger.
3. Not all bugs are yours! • As software developers, we write a lot of bugs • But, we also rely on a lot of third party closed sourced code • Apple frameworks have bugs too! • Sometimes even though the bug is in your code, it only manifest itself inside a framework…
4. So, how can we find these bugs? This is what we are going to talk about now!
5. opensource.apple.com • Many Apple frameworks are open source! • dispatch, objc, darwin, CoreFoundation, CFNetwork, Security, etc… • A ton of closed source Apple frameworks are built on top of open source ones
6. Class Dump Lets you examine the objc runtime information stored in Mach-O files: i.e. dump objc headers https://github.com/nygard/class-dump
7. Class Dump It can also help us finding out that UIKit engineers have a good sense of humor…
8. LLDB • LLDB is extremely powerful • We spend most of our time in the debugger so it’s important to master it • I’m going to share one special case where it can be tricky to find your way in the debugger…
9. Inspecting blocks
10. Inspecting blocks
11. Inspecting blocks • A block is just a function pointer • With some captured variables • Luckily the signature is easily available http://ddeville.me/2013/02/block-debugging/
12. Disassembling a block So, we have the address of a block, what can we do?
13. Disassembling a block Keeping the block layout in mind, we can read the memory at this address
14. Disassembling a block It’s then easy to find the function pointer and disassemble
15. Getting a block signature Similarly, we can read the memory at the descriptor address
16. Getting a block signature Assuming we know the position of the signature, we can print it
17. Getting a block signature Finally, we can use NSMethodSignature to get a nicer output
18. LLDB Python Scripting Since this is tedious, we can have LLDB do it for us! https://github.com/ddeville/block-lldb-script
19. LLDB Python Scripting Since this is tedious, we can have LLDB do it for us! https://github.com/ddeville/block-lldb-script
20. LLDB Process Attach • Suppose that you have an application on your machine • You would like to figure out how they implemented a given feature • You would like to debug it, i.e. inspect it in the debugger • Now, how can we do this?
21. Process Attach Attach to the Pages process, waiting for it to launch
22. Launch Pages Process Attach
23. We set a breakpoint on an NSFileManager method Process Attach
24. Note that the breakpoint location is not resolved yet Process Attach
25. Process Attach We continue. Pages launches.
26. The breakpoint is hit and the program is paused Process Attach