lldb指令 · 開發小記錄

# 1.打印 ~~~bash print / p 打印內存地址 po 打印對象 ~~~ 例如： ~~~objectivec Printing description of obj: <NSObject: 0x1004b44d0> (lldb) print obj (NSObject *) $1 = 0x00000001004b44d0 (lldb) p obj (NSObject *) $2 = 0x00000001004b44d0 (lldb) po obj <NSObject: 0x1004b44d0> ~~~ # 2.讀取內存 ~~~bash memory read（簡寫x）/數量.格式.字節數內存地址格式：x(十六進制)，f(浮點)，d(十進制) 字節數： b(byte)一個字節 h(half word)兩個字節 w(word)四個字節 g(giant word)八個字節 ~~~ ~~~cpp (lldb) memory read/4xw 0x1004b44d0 //4串十六進制，每串4個字節 0x1004b44d0: 0x95367119 0x001dffff 0x00000000 0x00000000 (lldb) x/4xw 0x1004b44d0 //簡寫 0x1004b44d0: 0x95367119 0x001dffff 0x00000000 0x00000000 (lldb) x/16xb 0x1004b44d0 //16串十六進制，每串1個字節 0x1004b44d0: 0x19 0x71 0x36 0x95 0xff 0xff 0x1d 0x00 0x1004b44d8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 (lldb) ~~~ # 3.修改內存 ~~~undefined memory write 地址數值 ~~~ ~~~cpp (lldb) x/16xb 0x1004b44d0 //16串十六進制，每串1個字節 0x1004b44d0: 0x19 0x71 0x36 0x95 0xff 0xff 0x1d 0x00 0x1004b44d8: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 (lldb) memory write 0x1004b44d8 17 //將0x1004b44d8位置內存改寫為0x17 (lldb) x/16xb 0x1004b44d0 0x1004b44d0: 0x19 0x71 0x36 0x95 0xff 0xff 0x1d 0x00 0x1004b44d8: 0x17 0x00 0x00 0x00 0x00 0x00 0x00 0x00 (lldb) ~~~ # 4.more [https://www.cnblogs.com/hjltonyios/p/8878959.html](https://links.jianshu.com/go?to=https%3A%2F%2Fwww.cnblogs.com%2Fhjltonyios%2Fp%2F8878959.html) [https://www.jianshu.com/p/4250e4805bb3](https://www.jianshu.com/p/4250e4805bb3) LLDB是個開源的內置于XCode的調試工具，這里來理一理常用用法。 lldb對于命令的簡稱，是頭部匹配方式，只要不混淆，你可以隨意簡稱某個命令。結果為在xcode下驗證所得，可能與其它平臺有所誤差。 1 打印值、修改值、調用方法 1.1 p、po 打印值打印相關的命令有：p、po。 p 和 po 的區別在于使用 po 只會輸出對應的值，而 p 則會返回值的類型以及命令結果的引用名。 (lldb) p width (CGFloat)![10 = 70 (lldb) po width 70 (lldb) p endTime (__NSCFString *)](https://math.jianshu.com/math?formula=10%20%3D%2070%20(lldb)%20po%20width%2070%20(lldb)%20p%20endTime%20(__NSCFString%20*))14 = 0x0000608000437660 @"08-11 11:43" (lldb) po endTime 08-11 11:43 對比結果: po：輸出值 p：輸出值+值類型+引用名+內存地址(xcode中有內存地址，其它平臺不確定) 除此之外，p還隱藏了一個有意思的功能，常量的進制轉換: //默認打印為10進制 (lldb) p 100 (int)![8 = 100 //轉16進制 (lldb) p/x 100 (int)](https://math.jianshu.com/math?formula=8%20%3D%20100%20%2F%2F%E8%BD%AC16%E8%BF%9B%E5%88%B6%20(lldb)%20p%2Fx%20100%20(int))9 = 0x00000064 //轉8進制 (lldb) p/o 100 (int)![10 = 0144 //轉二進制 (lldb) p/t 100 (int)](https://math.jianshu.com/math?formula=10%20%3D%200144%20%2F%2F%E8%BD%AC%E4%BA%8C%E8%BF%9B%E5%88%B6%20(lldb)%20p%2Ft%20100%20(int))2 = 0b00000000000000000000000001100100 //字符轉10進制數字 (lldb) p/d 'A' (char)![7 = 65 //10進制數字轉字符 (lldb) p/c 66 (int)](https://math.jianshu.com/math?formula=7%20%3D%2065%20%2F%2F10%E8%BF%9B%E5%88%B6%E6%95%B0%E5%AD%97%E8%BD%AC%E5%AD%97%E7%AC%A6%20(lldb)%20p%2Fc%2066%20(int))10 = B\\0\\0\\0 1.2 expression 修改參數值感覺exp命令是調試過程中最有價值有命令了，它可以打印值、修改值。 //expression打印值 (lldb) expression width (CGFloat)![5 = 67 //expression修改值 (lldb) expression width = 80 (CGFloat)](https://math.jianshu.com/math?formula=5%20%3D%2067%20%2F%2Fexpression%E4%BF%AE%E6%94%B9%E5%80%BC%20(lldb)%20expression%20width%20%3D%2080%20(CGFloat))6 = 80 //打印修改后結果 (lldb) p width (CGFloat) $7 = 80 (lldb) expression：同樣可以輸出值+值類型+引用名，但其一般用于修改。 1.3 call 方法調用在斷點調用某個方法，并輸出此方法的返回值。 (lldb) call width (CGFloat)![12 = 70 (lldb) call endTime (__NSCFString *)](https://math.jianshu.com/math?formula=12%20%3D%2070%20(lldb)%20call%20endTime%20(__NSCFString%20*))16 = 0x0000608000437660 @"08-11 11:43" call：同樣為輸出值+值類型+引用名 2 Thread 2.1 堆棧打印 thread backtrace 如果嫌堆棧打印太長，可以加一個值限制，如bt 10，只打印 (lldb) bt 10 * thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 * frame #0: 0x00000001005e4906 DiDi`-[FW_HomeCell_HotBill setDataSource:](self=0x00007fd3938a7800, _cmd="setDataSource:", dataSource=0x00006080001c8bb0) at FW_HomeCell.m:357 frame #1: 0x00000001009a9fd7 DiDi`\-\[FW\_MyHomeTableView tableView:cellForRowAtIndexPath:\](self=0x00007fd3921fec00, \_cmd="tableView:cellForRowAtIndexPath:", tableView=0x00007fd3921fec00, indexPath=0xc000000000000316) at FW\_MyHomeTableView.m:247 frame #2: 0x00000001055a2ab2 UIKit`-[UITableView _createPreparedCellForGlobalRow:withIndexPath:willDisplay:] + 750 frame #3: 0x00000001055a2cf8 UIKit`\-\[UITableView \_createPreparedCellForGlobalRow:willDisplay:\] + 74 frame #4: 0x0000000105577639 UIKit`-[UITableView _updateVisibleCellsNow:isRecursive:] + 2845 frame #5: 0x00000001055abccc UIKit`\-\[UITableView \_performWithCachedTraitCollection:\] + 111 frame #6: 0x0000000105592e7a UIKit`-[UITableView layoutSubviews] + 233 frame #7: 0x00000001054f955b UIKit`\-\[UIView(CALayerDelegate) layoutSublayersOfLayer:\] + 1268 frame #8: 0x0000000105114904 QuartzCore`-[CALayer layoutSublayers] + 146 frame #9: 0x0000000105108526 QuartzCore`CA::Layer::layout\_if\_needed(CA::Transaction\*) + 370 2.2 thread return 跳出當前方法的執行 Debug的時候，也許會因為各種原因，我們不想讓代碼執行某個方法，或者要直接返回一個想要的值。這時候就該thread return上場了。有返回值的方法里，如：numberOfSectionsInTableView:，直接thread return 10，就可以直接跳過方法執行，返回10. //跳出方法 (lldb) thread return //讓帶有返回int值的方法直接跳出，并返回值10 (lldb) thread return 10 2.3 流程控制實際上使用xcode自帶的可視化工具來控制“繼續”“暫停”“下一步”“進入”“跳出”更簡單繼續：continue, c 下一步：next, n 進入：step, s 跳出：finish, f 2.4 跳幀 frame select N 2.1中打印有10幀，如果我想跳轉到第1幀：frame select 1 (lldb) frame select 1 frame #1: 0x0000000105e91c3c DiDi`-\[FW\_HomeViewController tableView:cellForRowAtIndexPath:\](self=0x00007fbf9f73b410, \_cmd="tableView:cellForRowAtIndexPath:", tableView=0x00007fbfa11dc400, indexPath=0xc000000000a00316) at FW\_HomeViewController.m:597 594 break; 595 596 case 3: { \-> 597 cell.\[4md\[0mataSource = \_hotBills\[indexPath.row\]; 598 cell.textSelect = ^(UITextField \*text) { 599 weakSelf.curruntText = text; 600 }; 2.5 查看幀變量 frame variable (lldb) frame variable (FW\_HomeViewController \*) self = 0x00007faccbf587d0 (SEL) \_cmd = "tableView:cellForRowAtIndexPath:" (UITableView \*) tableView = 0x00007faccd09b400 (NSIndexPath \*) indexPath = 0xc000000000000316 (FW\_HomeViewController \*) weakSelf = 0x00007faccbf587d0 (FW\_HomeCell\_HotBill \*) cell = 0x00007faccc101a00 (UIView \*) model = 0x00007fff52c13d90 (FW\_HomeCell\_HotBill \*) billCell = 0x00000001124e99f6 3 Image 3.1 image lookup -address 查找崩潰位置當你遇見數組崩潰，你又沒有找到崩潰的位置，只扔給你一堆報錯信息，這時候image lookup來幫助你。如下 0 CoreFoundation 0x0000000103209b0b \_\_exceptionPreprocess + 171 1 libobjc.A.dylib 0x00000001079db141 objc\_exception\_throw + 48 2 CoreFoundation 0x000000010313effb -\[\_\_NSArrayM objectAtIndex:\] + 203 3 DiDi 0x00000001009a9f3a -\[FW\_MyHomeTableView tableView:cellForRowAtIndexPath:\] + 1322 4 UIKit 0x00000001055a2ab2 -\[UITableView \_createPreparedCellForGlobalRow:withIndexPath:willDisplay:\] + 750 5 UIKit 0x00000001055a2cf8 -\[UITableView \_createPreparedCellForGlobalRow:willDisplay:\] + 74 6 UIKit 0x0000000105577639 -\[UITableView \_updateVisibleCellsNow:isRecursive:\] + 2845 7 UIKit 0x00000001055abccc -\[UITableView \_performWithCachedTraitCollection:\] + 111 8 UIKit 0x0000000105592e7a -\[UITableView layoutSubviews\] + 233 9 UIKit 0x00000001054f955b -\[UIView(CALayerDelegate) layoutSublayersOfLayer:\] + 1268 10 QuartzCore 0x0000000105114904 -\[CALayer layoutSublayers\] + 146 尋找自己項目的標識，看到frame3位置，你只需這樣查找位置： image lookup -a 0x00000001009a9f3a Address: DiDi\[0x0000000100609f3a\] (DiDi.\_\_TEXT.\_\_text + 6323194) Summary: DiDi`-\[FW\_MyHomeTableView tableView:cellForRowAtIndexPath:\] + 1322 at FW\_MyHomeTableView.m:243 項目中FW\_MyHomeTableView.m:243，perfect! 3.2 image lookup -name 查找方法來源此命令可以用來查找方法的來源。包括在第三方SDK中的方法，也能被查到。例：查找transformOtherModelToSuit: (lldb) image lookup -n transformOtherModelToSuit: 1 match found in /Users/xxx/Library/Developer/Xcode/DerivedData/DiDi-cwpbvvyvqmeijmcjnneothzuthsy/Build/Products/Debug-iphonesimulator/DiDi.app/DiDi: Address: DiDi\[0x0000000100293d60\] (DiDi.\_\_TEXT.\_\_text + 2693664) Summary: DiDi`+\[FW\_BetFunction transformOtherModelToSuit:\] at FW\_BetFunction.m:107 3.3 image lookup –type 查看成員查看某個class的所有屬性和成員變量。不過貌似frameWork庫中文件不能查看。 (lldb) image lookup -t MatchEvent 1 match found in /Users/xxxx/Library/Developer/Xcode/DerivedData/DiDi-cwpbvvyvqmeijmcjnneothzuthsy/Build/Products/Debug-iphonesimulator/DiDi.app/DiDi: id = {0x00433d32}, name = "MatchEvent", byte-size = 48, decl = MatchEvent.h:11, compiler\_type = "@interface MatchEvent : NSObject{ BOOL \_isHome; NSString \* \_playerName; NSString \* \_timePoint; NSString \* \_eventType; NSString \* \_eventDesc; } @property ( getter = isHome,setter = setIsHome:,assign,readwrite,nonatomic ) BOOL isHome; @property ( getter = playerName,setter = setPlayerName:,readwrite,copy,nonatomic ) NSString \* playerName; @property ( getter = timePoint,setter = setTimePoint:,readwrite,copy,nonatomic ) NSString \* timePoint; @property ( getter = eventType,setter = setEventType:,readwrite,copy,nonatomic ) NSString \* eventType; @property ( getter = eventDesc,setter = setEventDesc:,readwrite,copy,nonatomic ) NSString \* eventDesc; @end" 4 breakpoint 4.1 文件名+行號 breakpoint set -f xxx -l xxx 我們平時操作xcode，在某一行點下斷點，其實操作的就是這個命令。 (lldb) breakpoint set -f FW\_ProfilesDetailModel.m -l 95 Breakpoint 3: where = DiDi`-\[FW\_ProfilesDetailModel incomeRate\] + 27 at FW\_ProfilesDetailModel.m:96, address = 0x0000000105b404bb 4.2 函數名斷點 4.2.1 方法名斷點 breakpoint set -n 方法名 (lldb) breakpoint set -n viewDidLoad Breakpoint 4: 414 locations. Tips:這里要說一下，xcode其實也有函數名斷點，不過用breakpoint set -n實現，比xcode下斷點快N倍，不過xcode下的斷點還給提示所有斷到的位置。 4.2.2 類中方法斷點 breakpoint set -n “-\[類名方法名\]” (lldb) breakpoint set -n "-\[FW\_MyHomeViewController viewDidLoad\]" Breakpoint 8: where = DiDi`-[FW_MyHomeViewController viewDidLoad] + 20 at FW_MyHomeViewController.m:58, address = 0x0000000105aec944 注意：-[FW_MyHomeViewController viewDidLoad]，外面一定要加雙引號，不然會誤識別為-[FW_MyHomeViewController` 4.3 條件斷點 breakpoint set -c “xxxx” 和xcode中symbolic Breakpoint功能相同，我在FW\_HomeCell.m 362行下斷點，但又想過濾僅width>68的狀態，操作如下： breakpoint set -f FW\_HomeCell.m -l 362 -c "width > 68" Breakpoint 5: where = DiDi`-[FW_HomeCell_HotBill setDataSource:] + 2006 at FW_HomeCell.m:363, address = 0x000000010d22e0a6 4.4 查看斷點列表 breakpoint list (lldb) breakpoint list Current breakpoints: 8: name = '-[FW_MyHomeViewController viewDidLoad]', locations = 1, resolved = 1, hit count = 2 8.1: where = DiDi`\-\[FW\_MyHomeViewController viewDidLoad\] + 20 at FW\_MyHomeViewController.m:58, address = 0x0000000105aec944, resolved, hit count = 2 9: file = '/Users/xxxx/didi-ios/DiDi/FollowWinner/Model/FW\_HomeModel.m', line = 24, exact\_match = 0, locations = 1, resolved = 1, hit count = 0 9.1: where = DiDi`+[FW_HomeModel_Rank parasWithDict:limitNickLength:] + 89 at FW_HomeModel.m:24, address = 0x00000001061bc169, resolved, hit count = 0 4.5 禁用/啟用斷點 breakpoint disable/enable //禁用斷點 (lldb) breakpoint disable 9 1 breakpoints disabled. (lldb) breakpoint list Current breakpoints: 9: file = '/Users/zmz/didi-ios/DiDi/FollowWinner/Model/FW_HomeModel.m', line = 24, exact_match = 0, locations = 1 Options: disabled 9.1: where = DiDi`+\[FW\_HomeModel\_Rank parasWithDict:limitNickLength:\] + 89 at FW\_HomeModel.m:24, address = 0x00000001061bc169, unresolved, hit count = 0 //啟用斷點 (lldb) breakpoint enable 9 1 breakpoints enabled. (lldb) breakpoint list Current breakpoints: 9: file = '/Users/zmz/didi-ios/DiDi/FollowWinner/Model/FW\_HomeModel.m', line = 24, exact\_match = 0, locations = 1, resolved = 1, hit count = 0 9.1: where = DiDi`+[FW_HomeModel_Rank parasWithDict:limitNickLength:] + 89 at FW_HomeModel.m:24, address = 0x00000001061bc169, resolved, hit count = 0 4.6 移除斷點 breakpoint delete (lldb) breakpoint delete 8 1 breakpoints deleted; 0 breakpoint locations disabled. (lldb) breakpoint list Current breakpoints: 9: file = '/Users/xxxx/didi-ios/DiDi/FollowWinner/Model/FW_HomeModel.m', line = 24, exact_match = 0, locations = 1, resolved = 1, hit count = 0 9.1: where = DiDi`+\[FW\_HomeModel\_Rank parasWithDict:limitNickLength:\] + 89 at FW\_HomeModel.m:24, address = 0x00000001061bc169, resolved, hit count = 0 結語：有了這些命令，調試起來肯定就得心應手了。總結下常用的，供多看幾遍加深回憶：堆棧相關：bt查看堆棧、frame select跳幀、frame variable查看幀參數、thread return跳出當前執行、【step/finish/next/continue】進入/跳出/下一步/跳出本斷點斷點相關：breakpoint set -f -l -c條件斷點、breakpoint set -n方法斷點、breakpoint delete斷點移除、breakpoint list斷點列表 image命令：image lookup -address崩潰定位、image lookup -name方法來源、 image lookup –type 查看成員 LLDB支持簡寫