IRP_HANDLER
IRP_HANDLER

Reputation: 308

LLDB - how do I import a symbol so I can access a struct definition?

I'm using lldb to debug an application and I have this breakpoint right before a call SCNetworkReachability

imp___stubs__SCNetworkReachabilityCreateWithAddress:
 jmp        qword [_SCNetworkReachabilityCreateWithAddress_10000c0c8] 

right here the RDI register contains a sockaddr structure that I want to inspect, so I'm trying to somehow cast the address to this type to get further information,I've tried the following commands:

expr *((sockaddr *)$rsi) 
expr *((sockaddr_in *)$rsi) 
p *((sockaddr *)$rsi) 
p *((sockaddr_in *)$rsi) 

the problem is that lldb does not recognize this structure, I need to somehow import this symbol but how do I go about this?

I also tried to manually import the structure:

expr struct $sockaddr { unsigned char sa_len; unsigned char sa_family; char sa_data[14]; }

and then cast it:

expr ($sockaddr)$rdi

but now LLDB gives a different error:

candidate constructor (the implicit copy constructor) not viable: 

no known conversion from 'unsigned long' to 'const $sockaddr' for 1st argument

 candidate constructor (the implicit move constructor) not viable: no known conversion from 'unsigned long' to '$sockaddr' for 1st argument

andidate constructor (the implicit default constructor) not viable: requires 0 arguments, but 1 was provided

Upvotes: 0

Views: 19

Answers (1)

Jim Ingham
Jim Ingham

Reputation: 27203

The sockaddr structure most likely doesn't fit in a single register, so $rdi holds a pointer to the structure, and you have to cast it as such:

(lldb) expr *($sockaddr *)$rdi

Upvotes: 1

Related Questions