OS X: Disassemble cmd not working

Hello,
I tried to disassemble a packed executable after hitting a (hardcoded) breakpoint and it cannot be done :frowning: I can view the memory. I presume this has something to do with the initial segment/section information in the Mach-O file header being changed by the packer?
I can provide the file if the need be. (It has less than 3KB)

"It cannot be done" is rather vague. Could you give more details about what you tried and what happened?

-- Caroline Tice
ctice@apple.com

Please do attach the executable.

If the instruction you care about is in a function you can try disassembling by function:

lldb foo.o
(lldb) disassembly -n main

My only guess here is that the disassembler thinks it needs more than one byte and is refusing to disassemble because it thinks it doesn't have enough bytes.

LLDB doesn't currently handle packed executables. I have filed in internal bug to track this.

After looking up "mpress" and finding it is really an aftermarket tool that strips the entire symbol table and adds code that compresses each function and decompresses it on the fly, we don't have any current plans to support this in lldb.

So if you want to debug, don't pack your app.

Greg Clayton