Hacker News new | past | comments | ask | show | jobs | submit login
Debugging launchd on OS X 10.10.3 (wuntee.sexy)
19 points by mmastrac on May 14, 2015 | hide | past | favorite | 5 comments

I initially thought this was some anti-debug trick Apple introduced to prevent debugging of the service. However, I got to thinking - if launchd is PID 1, and everything is spawned off of it, then if lldb was able to break lauchd, then lldb should be halted as well - something like the “chicken or the egg” problem. It would be like if you spawned a thread, and then put a breakpoint in the parent, but the thread still was running. It is just not possible.

Hold on... So if you break on a parent process the children stop?

However, the error is that the connection is lost to the debug server. I don't think you are having the problem for the reason you are saying.

So I don't know much at all about kernel debugging, but when the author mentioned not being able to attach a debugger to launchd since it's PID 1 I got to wondering if it would be possible to use a debugger by launching OS X in a VM instead.

The author does end up using a VM, although via native kernel debugging over a virtual network rather than the VM's built-in debug stub. Neither one is going to isolate a single user process from other activity, though.

Well at that point you have to sift through the noise of the hypervisor and understand an entire OS you can't really see. Sort of...


Applications are open for YC Winter 2022

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact