Debugging launchd on OS X 10.10.3

http://blog.wuntee.sexy/osx/kernel/debugging/2015/05/11/debugging-launchd/

by mmastrac • 11 years ago

19 5 11 years ago

blog.wuntee.sexy

pschastain• 11 years ago

So I don't know much at all about kernel debugging, but when the author mentioned not being able to attach a debugger to launchd since it's PID 1 I got to wondering if it would be possible to use a debugger by launching OS X in a VM instead.

feld• 11 years ago

Well at that point you have to sift through the noise of the hypervisor and understand an entire OS you can't really see. Sort of...

alphonse23• 11 years ago

Test

comex• 11 years ago

The author does end up using a VM, although via native kernel debugging over a virtual network rather than the VM's built-in debug stub. Neither one is going to isolate a single user process from other activity, though.

chris_wot• 11 years ago

I initially thought this was some anti-debug trick Apple introduced to prevent debugging of the service. However, I got to thinking - if launchd is PID 1, and everything is spawned off of it, then if lldb was able to break lauchd, then lldb should be halted as well - something like the “chicken or the egg” problem. It would be like if you spawned a thread, and then put a breakpoint in the parent, but the thread still was running. It is just not possible.

Hold on... So if you break on a parent process the children stop?

However, the error is that the connection is lost to the debug server. I don't think you are having the problem for the reason you are saying.

Debugging launchd on OS X 10.10.3

Related Stories