>si >br s -f foo.c -l 12 show contents of variable bar lldb cheat sheet instruction level single step over set a breakpoint by regular expression on >frame variable bar Execution Commands >thread step-inst-over source file contents >fr v bar >ni >p bar start lld (prefix with xcrun on os x) >breakpoint set --source-pattern regular-expression --file SourceFile >lldb [program.app] step out of the currently selected frame show contents of var bar formatted as hex >br s -p regular-expression -f file >lldb -- program.app arg1 >thread step-out >frame variable --format x bar >finish >fr v -f x bar load program set conditional breakpoint >file program.app Return from currently frame, with return >breakpoint set --name foo -- show contents of global variable baz value condition '(int)strcmp(y,"hello") == >target variable baz run program 0' >thread return [RETURN EXPRESSION] >ta v baz >process launch [-- args] >br s -n foo -c >run [args] Backtrace and disassemble every time you '(int)strcmp(y,"hello") == 0' show global/static variables in current file >target variable stop set arguments list breakpoints >ta v >settings set target.run-args 1 >target stop-hook add >breakpoint list >bt >br l show argc and argv every time you stop launch process in new terminal >disassemble --pc >target stop-hook add --one-liner >process launch --tty -- >DONE delete a breakpoint "frame variable argc argv" >breakpoint delete 1 >ta st a -o "fr v argc argv" set env variables run until line 12 or end of frame >br del 1 >display argc >settings set target.env-vars DEBUG=1 >thread until 12 Watchpoint Commands >display argv remove env variables Breakpoint Commands >settings remove target.env-vars set watchpoint on variable when written to display argc and argv when stopping in main DEBUG set breakpoint at all functions named main >watchpoint set variable global_var >target stop-hook add --name main -- >breakpoint set --name main >wa s v global_var one-liner "frame variable argc argv" show program arguments >br s -n main >ta st a -n main -o "fr v argc argv" >settings show target.run-args >b main set watchpoint on memory of pointer size >watchpoint set expression -- display *this when in class MyClass set env variable and run set breakpoint in file test.c line 12 0x123456 >target stop-hook add --classname >process launch -v DEBUG=1 >breakpoint set --file test.c --line >wa s e -- 0x123456 MyClass --one-liner "frame variable attach to process by PID 12 *this" set watchpoint on memory of custom size >ta st a -c MyClass -o "fr v *this" >process attach --pid 123 >br s -f test.c -l 12 > watchpoint set expression –x >b test.c:12 Evaluating Expressions attach to process by name byte_size -- 0x123456 >process attach --name a.out [-- set breakpoint at all C++ methods with name > wa s e –x byte_size -- 0x123456 evaluate expression (print alias possible as waitfor] main well) >breakpoint set --method main set a condition on a watchpoint >expr (int) printf ("Print nine: attach to remote gdb on eorgadd >br s -M main >watch set var global >gdb-remote eorgadd:8000 >watchpoint modify -c '(global==5)' %d.", 4 + 5) set breakpoint at ObjC function >print (int) printf ("Print nine: attach to gdb server on localhost >breakpoint set --name "-[NSString list watchpoints %d.", 4 + 5) >gdb-remote 8000 >watchpoint list stringWithFormat:]" using a convenience variable >b -[NSString stringWithFormat:] >watch l attach to remote Darwin kernel in kdp mode >expr unsigned int $foo = 5 >kdp-remote eorgadd delete a watchpoint set breakpoint at all ObjC functions whose print the ObjC description of an object selector is count >watchpoint delete 1 source level single step >watch del 1 >expr -o -- [SomeClass >thread step-in >breakpoint set --selector count returnAnObject] >step >br s -S count Examining Variables >po [SomeClass returnAnObject] >s set breakpoint by regular expression function show arguments and local variables print dynamic type of expression result source level setop over name >frame variable >expr -d 1 -- [SomeClass >thread step-over >breakpoint set --func-regex print.* >fr v returnAnObject] >next ensure that breakpoints by file and line work show local variables >expr -d 1 – >n someCPPObjectPtrOrReference (c/cpp/objc) >frame variable --no-args instruction level single step >settings set target.inline- >fr v -a >thread step-inst breakpoint-strategy always set dynamic type printing as default show general purpose registers as signed get information about specific heap Executable and Shared Library Query >settings set target.prefer-dynamic decimal allocation and cast result to dynamic type Commands run-target >register read --format i that can be deduced (Mac OS X only) list the main executable and all dependent >re r -f i >command script import calling a function with a breakpoint shared libraries >expr -i 0 -- >register read/d lldb.macosx.heap >image list function_with_a_breakpoint() show all registers in all register threads >malloc_info --type 0x10010d680 look up information for a raw address in the calling a function that crashes >register read --all find all heap blocks that contain pointer expr -u 0 -- function_which_crashes() >re r -a specified by an expression EXPR (Mac OS X executable or any shared libraries >image lookup --address 0x1ec4 show registers rax, rsp, rbp only) Examining Thread State >im loo -a 0x1ec4 register read rax rsp rbp >command script import show backtrace (current thread) lldb.macosx.heap look up functions matching a regular show register rax with binary format >thread backtrace >ptr_refs EXPR expression in a binary >bt >register read --format binary rax find all heap blocks that contain a C string >image lookup -r -n read memory from 0xbffff3c0 and show 4 hex show backtrace for all threads anywhere in the block (Mac OS X only) (debug symbols) uint32_t values >image lookup -r -s >thread backtrace all >command script import >memory read --size 4 --format x -- (non-debug syms) >bt all lldb.macosx.heap count 4 0xbffff3c0 >cstr_refs CSTRING find full source line information backtrace the first 5 frames of current thread >me r -s4 -fx -c4 0xbffff3c0 >image lookup -v --address 0x1ec4 >thread backtrace -c 5 >x -s4 -fx -c4 0xbffff3c0 disassemble current function for current (look for entryline) >bt 5 (lldb-169 and later) >memory read/4xw 0xbffff3c0 frame >bt –c 5 (lldb-168 and later) >x/4xw 0xbffff3c0 >disassemble –frame look up information for an address in a.out select a different stack frame by index >memory read --gdb-format 4xw >di -f only 0xbffff3c0 >frame select 12 disassemble any functions named main >image lookup --address 0x1ec4 a.out >im loo -a 0x1ec4 a.out >fr s 12 read memory starting at the expression >disassemble --name main >f 12 "argv[0]" >di -n main look up information for a type Pointer by show frame information >memory read `argv[0]` disassemble address range name >frame info >memory read --size `sizeof(int)` >disassemble --start-address 0x1eb8 - >image lookup --type Point `argv[0]` select stack frame the called current frame -end-address 0x1ec3 >im loo -t Point >up read 512 bytes from address 0xbffff3c0 and >di -s 0x1eb8 -e 0x1ec3 dump all sections from the main executable >frame select --relative=1 save results to a local file disassemble 20 instructions from start and any shared libraries select stack frame that is called by current >memory read --outfile /tmp/mem.txt - address >image dump sections -count 512 0xbffff3c0 >disassemble --start-address 0x1eb8 - frame >me r -o/tmp/mem.txt -c512 0xbffff3c0 dump all sections in the a.out module -count 20 >down >x/512bx -o/tmp/mem.txt 0xbffff3c0 >image dump sections a.out >frame select --relative=-1 >di -s 0x1eb8 -c 20 save binary memory data starting at 0x1000 dump all symbols from the main executable >fr s -r-1 show mixed source and disassembly for the and ending at 0x2000 to file and any shared libraries select different frame using relative offset current function >memory read --outfile /tmp/mem.bin - >image dump symtab >frame select --relative 2 >disassemble --frame –mixed -binary 0x1000 0x2000 >fr s -r2 >di -f -m dump all symbols in a.out and liba.so >me r -o /tmp/mem.bin -b 0x1000 >frame select --relative -3 >image dump symtab a.out liba.so 0x2000 >fr s -r-3 disassemble the current function for the current frame and show the opcode bytes Miscellaneous show general purpose registers get information about specific heap allocation (Mac OS X only) >disassemble --frame –bytes echo text to the screen >register read >di -f -b >command script import >script print "Here is some text" write 123 to register rax lldb.macosx.heap disassemble the current source line for the remap source file pathnames for the debug >register write rax 123 >process launch --environment current frame session (e.g. if program was built on another skip 8 bytes using with program counter MallocStackLogging=1 -- [ARGS] >disassemble --line PC) >malloc_info --stack-history >register write pc `$pc+8` >di -l >settings set target.source-map 0x10010d680 /buildbot/path /my/path