Question

I am trying to debug a library whose source I don’t have, so I’m using LLDB disassembly a lot. I was wondering if there was a way to automatically run disassemble after every call to ‘thread step-in.’ Currently, when I do ‘thread step-in,’ LLDB executes the instruction, and then returns with a blank prompt. To see, where the EIP moved to, I need to type disassemble after every thread step-in, which is extremely distracting and annoying (also, LLDB doesn’t seem to end expressions with ‘;’ so putting multiple commands on one line doesn’t work.)

More generally, I was wondering if there is a way to create an alias for multiple LLDB commands in succession: For example a single alias that could print the contents of %rdi, then disassemble 10 lines around EIP. (Yes, I could write python script for it, but I don’t have that much time on my hand 🙁

Answer 1

Yes, the correct way to do this is via the Python scripting interface. There was a deliberate decision to avoid gdb’s approach of cramming enough flow-control and execution logic in the debugger’s command language to make this possible (or rather — to make it possible… poorly). Instead of that approach, there is a low barrier where you need to use Python to accomplish a task — but the full power of the debugger is available through some pretty easy-to-use interfaces in Python. lldb leaves the scripting language to Python and concentrates on providing a clean and powerful API that is easy to use from Python.

But to address your goal here, why won’t the stop-disassembly-count setting do what you need? In fact, it should already be doing what you want unless you’ve disabled disassembly display in your ~/.lldbinit file by changing the default setting of stop-disassembly-display.

(lldb) settings show stop-disassembly-count
stop-disassembly-count (int) = 4
(lldb) settings show stop-disassembly-display
stop-disassembly-display (enum) = no-source
(lldb) 

lldb’s default behavior is to show some kind of context when you are stepping through a program. If source code is available, it will show the source you’re stepping through. If no source, it will show the assembly instructions that are about to be executed. There is a little bug when you have debug information (so the debugger knows file and line numbers) but the source code is unavailable (or at a different path) — right now lldb will show you disassembly but that is not the correct behavior for this case. Users are still operating at a source level (using s and n to step, instead of si and ni for instruction-level stepping) and lldb should show no context in this instance, just displaying the source file name and line number.