Blob


1 .TH DB 1
2 .SH NAME
3 db \- debugger
4 .SH SYNOPSIS
5 .B db
6 [
7 .I option ...
8 ]
9 [
10 .I textfile
11 ]
12 [
13 .I pid
14 |
15 .I corefile
16 ]
17 .SH DESCRIPTION
18 .I Db
19 is a general purpose debugging program.
20 It may be used to examine files and to provide
21 a controlled environment for the execution
22 of programs.
23 .PP
24 A
25 .I textfile
26 is a file containing the text and initialized
27 data of an executable program.
28 A
29 .I pid
30 or
31 .I corefile
32 specifies the memory image of a process.
33 A
34 .I pid
35 gives the id of an executing process to be accessed via
36 .IR ptrace (2)
37 or
38 .IR proc (5).
39 A
40 .I corefile
41 specifies the name of a core dump (see
42 .IR core (5)
43 on your system of choice) containing the
44 memory image of a terminated process.
45 This manual refers to the memory image specified by
46 .I pid
47 or
48 .I corefile
49 as a
50 .IR memfile .
51 .PP
52 A
53 .I map
54 associated with each
55 .I textfile
56 or
57 .I memfile
58 supports accesses to instructions and data in the file;
59 see `Addresses'.
60 .PP
61 An argument consisting entirely of digits is assumed
62 to be a process id; otherwise, it is the name of a
63 .I textfile
64 or
65 .IR corefile .
66 When a
67 .I textfile
68 is given, the textfile map
69 is associated with it.
70 If only a
71 .I memfile
72 is given, the textfile map is
73 derived from the corresponding
74 .IR textfile ,
75 if it can be determined
76 (this varies from system to system).
77 When a
78 .I memfile
79 is given, the memfile map is associated with it;
80 otherwise the map is undefined and accesses to it
81 are not permitted.
82 .PP
83 Commands to
84 .I db
85 are read from the standard input and
86 responses are to the standard output.
87 The options are
88 .TP
89 .B -w
90 Open
91 .I textfile
92 and
93 .I memfile
94 for writing as well as reading.
95 .TP
96 .BI -I path
97 Directory in which to look for relative path names in
98 .B $<
99 and
100 .B $<<
101 commands.
102 .TP
103 .BI -m machine
104 Assume instructions are for the given CPU type
105 (possible names include
106 .B 386
107 and
108 .BR powerpc ;
109 adding
110 the suffix
111 .B -co
112 as in
113 .B 386-co
114 and
115 .B powerpc-co
116 selects disassembly in the manufacturer's syntax, if
117 available,
118 rather than the default Plan 9 syntax).
119 .PP
120 Most
121 .I db
122 commands have the following form:
123 .IP
124 .RI [ address ]
125 .RB [ ,
126 .IR count ]
127 .RI [ command ]
128 .PP
129 If
130 .I address
131 is present then the current position, called `dot',
132 is set to
133 .IR address .
134 Initially dot
135 is set to 0.
136 Most commands are repeated
137 .I count
138 times with
139 dot advancing between repetitions.
140 The default
141 .I count
142 is 1.
143 .I Address
144 and
145 .I count
146 are expressions.
147 Multiple commands on one line must be separated by
148 .LR ; .
149 .SS Expressions
150 Expressions are evaluated as long
151 .IR ints .
152 .TP 7.2n
153 .B .
154 The value of dot.
155 .TP 7.2n
156 .B +
157 The value of dot
158 incremented by the current increment.
159 .TP 7.2n
160 .B ^
161 The value of dot
162 decremented by the current increment.
163 .TP 7.2n
164 .B \&"
165 The last
166 .I address
167 typed.
168 .TP 7.2n
169 .I integer
170 A number, in decimal radix by default.
171 The prefixes
172 .L 0
173 and
174 .L 0o
175 and
176 .L 0O
177 (zero oh) force interpretation
178 in octal radix; the prefixes
179 .L 0t
180 and
181 .L 0T
182 force interpretation in
183 decimal radix; the prefixes
184 .LR 0x ,
185 .LR 0X ,
186 and
187 .L #
188 force interpretation in
189 hexadecimal radix.
190 Thus
191 .LR 020 ,
192 .LR 0o20 ,
193 .LR 0t16 ,
194 and
195 .L #10
196 all represent sixteen.
197 .TP 7.2n
198 .IB integer . fraction
199 A single-precision floating point number.
200 .TP 7.2n
201 .BI \' c\| \'
202 The
203 16-bit
204 value of a character.
205 .L \e
206 may be used to escape a
207 .LR \' .
208 .TP 7.2n
209 .BI < name
210 The value of
211 .IR name ,
212 which is a register name.
213 The register names are
214 those printed by the
215 .B $r
216 command.
217 .TP 7.2n
218 .I symbol
220 .I symbol
221 is a sequence
222 of upper or lower case letters, underscores or
223 digits, not starting with a digit.
224 .L \e
225 may be used to escape other characters.
226 The location of the
227 .I symbol
228 is calculated from the symbol table
229 in
230 .IR textfile .
231 .TP 7.2n
232 .IB routine . name
233 The address of the variable
234 .I name
235 in the specified
236 C routine.
237 Both
238 .I routine
239 and
240 .I name
241 are
242 .IR symbols .
243 If
244 .I name
245 is omitted the value is the address of the
246 most recently activated stack frame
247 corresponding to
248 .IR routine ;
249 if
250 .I routine
251 is omitted,
252 the active procedure
253 is assumed.
254 .TP 7.2n
255 .IB file : integer
256 The address of the instruction corresponding
257 to the source statement at the indicated
258 line number of the file. If the source line contains
259 no executable statement, the address of the
260 instruction associated with the nearest
261 executable source line is returned. Files
262 begin at line 1. If multiple files of the same
263 name are loaded, an expression of this form resolves
264 to the first file encountered in the symbol table.
265 .TP 7.2n
266 .BI ( exp )
267 The value of the expression
268 .IR exp .
269 .LP
270 .I Monadic operators
271 .RS
272 .TP 7.2n
273 .BI * exp
274 The contents of the location addressed
275 by
276 .I exp
277 in
278 .IR memfile .
279 .TP 7.2n
280 .BI @ exp
281 The contents of the location addressed by
282 .I exp
283 in
284 .IR textfile .
285 .TP 7.2n
286 .BI - exp
287 Integer negation.
288 .TP 7.2n
289 .BI ~ exp
290 Bitwise complement.
291 .TP 7.2n
292 .BI % exp
293 When used as an
294 .IR address ,
295 .I exp
296 is an offset into the segment named
297 .IR ublock ;
298 see `Addresses'.
299 .RE
300 .LP
301 .I "Dyadic\ operators"
302 are left-associative
303 and are less binding than monadic operators.
304 .RS
305 .TP 7.2n
306 .IB e1 + e2
307 Integer addition.
308 .TP 7.2n
309 .IB e1 - e2
310 Integer subtraction.
311 .TP 7.2n
312 .IB e1 * e2
313 Integer multiplication.
314 .TP 7.2n
315 .IB e1 % e2
316 Integer division.
317 .TP 7.2n
318 .IB e1 & e2
319 Bitwise conjunction.
320 .TP 7.2n
321 .IB e1 | e2
322 Bitwise disjunction.
323 .TP 7.2n
324 .IB e1 # e2
325 .I E1
326 rounded up to the next multiple of
327 .IR e2 .
328 .RE
329 .DT
330 .SS Commands
331 Most commands have the following syntax:
332 .TP .5i
333 .BI ? f
334 Locations starting at
335 .I address
336 in
337 .I textfile
338 are printed according to the format
339 .IR f .
340 .TP
341 .BI / f
342 Locations starting at
343 .I address
344 in
345 .I memfile
346 are printed according to the format
347 .IR f .
348 .TP
349 .BI = f
350 The value of
351 .I address
352 itself is printed according to the format
353 .IR f .
354 .PP
356 .I format
357 consists of one or more characters that specify a style
358 of printing.
359 Each format character may be preceded by a decimal integer
360 that is a repeat count for the format character.
361 If no format is given then the last format is used.
362 .PP
363 Most format letters fetch some data,
364 print it,
365 and advance (a local copy of) dot
366 by the number of bytes fetched.
367 The total number of bytes in a format becomes the
368 .IR current increment .
369 .ta 2.5n .5i
370 .RS
371 .TP
372 .PD 0
373 .B o
374 Print two-byte integer in octal.
375 .TP
376 .B O
377 Print four-byte integer in octal.
378 .TP
379 .B q
380 Print two-byte integer in signed octal.
381 .TP
382 .B Q
383 Print four-byte integer in signed octal.
384 .TP
385 .B d
386 Print two-byte integer in decimal.
387 .TP
388 .B D
389 Print four-byte integer in decimal.
390 .TP
391 .B V
392 Print eight-byte integer in decimal.
393 .TP
394 .B Z
395 Print eight-byte integer in unsigned decimal.
396 .TP
397 .B x
398 Print two-byte integer in hexadecimal.
399 .TP
400 .B X
401 Print four-byte integer in hexadecimal.
402 .TP
403 .B Y
404 Print eight-byte integer in hexadecimal.
405 .TP
406 .B u
407 Print two-byte integer in unsigned decimal.
408 .TP
409 .B U
410 Print four-byte integer in unsigned decimal.
411 .TP
412 .B f
413 Print
414 as a single-precision floating point number.
415 .TP
416 .B F
417 Print double-precision floating point.
418 .TP
419 .B b
420 Print the addressed byte in hexadecimal.
421 .TP
422 .B c
423 Print the addressed byte as an
424 .SM ASCII
425 character.
426 .TP
427 .B C
428 Print the addressed byte as a character.
429 Printable
430 .SM ASCII
431 characters
432 are represented normally; others
433 are printed in the form
434 .BR \exnn .
435 .TP
436 .B s
437 Print the addressed characters, as a
438 .SM UTF
439 string, until a zero byte
440 is reached.
441 Advance dot
442 by the length of the string,
443 including the zero terminator.
444 .TP
445 .B S
446 Print a string using
447 the escape convention (see
448 .B C
449 above).
450 .TP
451 .B r
452 Print as
453 .SM UTF
454 the addressed two-byte integer (rune).
455 .TP
456 .B R
457 Print as
458 .SM UTF
459 the addressed two-byte integers as runes
460 until a zero rune is reached.
461 Advance dot
462 by the length of the string,
463 including the zero terminator.
464 .TP
465 .B i
466 Print as machine instructions. Dot is
467 incremented by the size of the instruction.
468 .TP
469 .B I
470 As
471 .B i
472 above, but print the machine instructions in
473 an alternate form if possible.
474 .TP
475 .B M
476 Print the addressed machine instruction in a
477 machine-dependent hexadecimal form.
478 .TP
479 .B a
480 Print the value of dot
481 in symbolic form.
482 Dot is unaffected.
483 .TP
484 .B A
485 Print the value of dot
486 in hexadecimal.
487 Dot is unaffected.
488 .TP
489 .B z
490 Print the function name, source file, and line number
491 corresponding to dot (textfile only). Dot is unaffected.
492 .TP
493 .B p
494 Print the addressed value in symbolic form.
495 Dot is advanced by the size of a machine address.
496 .TP
497 .B t
498 When preceded by an integer, tabs to the next
499 appropriate tab stop.
500 For example,
501 .B 8t
502 moves to the next 8-space tab stop.
503 Dot is unaffected.
504 .TP
505 .B n
506 Print a newline.
507 Dot is unaffected.
508 .tr '"
509 .TP
510 .BR ' ... '
511 Print the enclosed string.
512 Dot is unaffected.
513 .br
514 .tr ''
515 .TP
516 .B ^
517 Dot is decremented by the current increment.
518 Nothing is printed.
519 .TP
520 .B +
521 Dot is incremented by 1.
522 Nothing is printed.
523 .TP
524 .B -
525 Dot is decremented by 1.
526 Nothing is printed.
527 .RE
528 .PD
529 .LP
530 Other commands include:
531 .TP
532 newline
533 Update dot by the current increment.
534 Repeat the previous command with a
535 .I count
536 of 1.
537 .TP
538 .RB [ ?/ ] l "\fI value mask\fR"
539 Words starting at dot
540 are masked with
541 .I mask
542 and compared with
543 .I value
544 until
545 a match is found.
546 If
547 .B l
548 is used,
549 the match is for a two-byte integer;
550 .B L
551 matches four bytes.
552 If no match is found then dot
553 is unchanged; otherwise dot
554 is set to the matched location.
555 If
556 .I mask
557 is omitted then ~0 is used.
558 .TP
559 .RB [ ?/ ] w "\fI value ...\fR"
560 Write the two-byte
561 .I value
562 into the addressed
563 location.
564 If the command is
565 .BR W ,
566 write four bytes.
567 .TP
568 .RB [ ?/ ] "m\fI s b e f \fP" [ ?\fR]
569 .br
570 New values for
571 .RI ( b,\ e,\ f )
572 in the segment named
573 .I s
574 are recorded. Valid segment names are
575 .IR text ,
576 .IR data ,
577 or
578 .IR ublock .
579 If less than three address expressions are given,
580 the remaining parameters are left unchanged.
581 If the list is terminated by
582 .L ?
583 or
584 .L /
585 then the file
586 .RI ( textfile
587 or
588 .I memfile
589 respectively) is used
590 for subsequent requests.
591 For example,
592 .L /m?
593 causes
594 .L /
595 to refer to
596 .IR textfile .
597 .TP
598 .BI > name
599 Dot is assigned to the variable or register named.
600 .TP
601 .B !
602 The rest of the line is passed to
603 .IR rc (1)
604 for execution.
605 .TP
606 .BI $ modifier
607 Miscellaneous commands.
608 The available
609 .I modifiers
610 are:
611 .RS
612 .TP
613 .PD 0
614 .BI < f
615 Read commands from the file
616 .IR f .
617 If this command is executed in a file, further commands
618 in the file are not seen.
619 If
620 .I f
621 is omitted, the current input stream is terminated.
622 If a
623 .I count
624 is given, and is zero, the command is ignored.
625 .TP
626 .BI << f
627 Similar to
628 .B <
629 except it can be used in a file of commands without
630 causing the file to be closed.
631 There is a (small) limit to the number of
632 .B <<
633 files that can be open at once.
634 .br
635 .ns
636 .TP
637 .BI > f
638 Append output to the file
639 .IR f ,
640 which is created if it does not exist.
641 If
642 .I f
643 is omitted, output is returned to the terminal.
644 .TP
645 .B ?
646 Print process id, the condition which caused stopping or termination,
647 the registers and the instruction addressed by
648 .BR pc .
649 This is the default if
650 .I modifier
651 is omitted.
652 .TP
653 .B r
654 Print the general registers and
655 the instruction addressed by
656 .BR pc .
657 Dot is set to
658 .BR pc .
659 .TP
660 .B R
661 Like
662 .BR $r ,
663 but include miscellaneous processor control registers
664 and floating point registers.
665 .TP
666 .B f
667 Print floating-point register values as
668 single-precision floating point numbers.
669 .TP
670 .B F
671 Print floating-point register values as
672 double-precision floating point numbers.
673 .TP
674 .B b
675 Print all breakpoints
676 and their associated counts and commands. `B' produces the same results.
677 .TP
678 .B c
679 Stack backtrace.
680 If
681 .I address
682 is given, it specifies the address of a pair of 32-bit
683 values containing the
684 .B sp
685 and
686 .B pc
687 of an active process. This allows selecting
688 among various contexts of a multi-threaded
689 process.
690 If
691 .B C
692 is used, the names and (long) values of all
693 parameters,
694 automatic
695 and static variables are printed for each active function.
696 If
697 .I count
698 is given, only the first
699 .I count
700 frames are printed.
701 .TP
702 .B a
703 Attach to the running process whose pid
704 is contained in
705 .IR address .
706 .TP
707 .B e
708 The names and values of all
709 external variables are printed.
710 .TP
711 .B w
712 Set the page width for output to
713 .I address
714 (default 80).
715 .TP
716 .B q
717 Exit from
718 .IR db .
719 .TP
720 .B m
721 Print the address maps.
722 .TP
723 .B k
724 Simulate kernel memory management.
725 .TP
726 .BI M machine
727 Set the
728 .I machine
729 type used for disassembling instructions.
730 .PD
731 .RE
732 .TP
733 .BI : modifier
734 Manage a subprocess.
735 Available modifiers are:
736 .RS
737 .TP
738 .PD 0
739 .BI h
740 Halt
741 an asynchronously running process to allow breakpointing.
742 Unnecessary for processes created under
743 .IR db ,
744 e.g. by
745 .BR :r .
746 .TP
747 .BI b c
748 Set breakpoint at
749 .IR address .
750 The breakpoint is executed
751 .IR count \-1
752 times before
753 causing a stop.
754 Also, if a command
755 .I c
756 is given it is executed at each
757 breakpoint and if it sets dot to zero
758 the breakpoint causes a stop.
759 .TP
760 .B d
761 Delete breakpoint at
762 .IR address .
763 .TP
764 .B r
765 Run
766 .I textfile
767 as a subprocess.
768 If
769 .I address
770 is given the
771 program is entered at that point; otherwise
772 the standard entry point is used.
773 .I Count
774 specifies how many breakpoints are to be
775 ignored before stopping.
776 Arguments to the subprocess may be supplied on the
777 same line as the command.
778 An argument starting with < or > causes the standard
779 input or output to be established for the command.
780 .TP
781 .BI c s
782 The subprocess is continued.
783 If
784 .I s
785 is omitted
786 or nonzero,
787 the subprocess
788 is sent the note that caused it to stop.
789 If 0
790 is specified,
791 no note is sent.
792 (If the stop was due to a breakpoint or single-step,
793 the corresponding note is elided before continuing.)
794 Breakpoint skipping is the same
795 as for
796 .BR r .
797 .TP
798 .BI s s
799 As for
800 .B c
801 except that
802 the subprocess is single stepped for
803 .I count
804 machine instructions.
805 If a note is pending,
806 it is received
807 before the first instruction is executed.
808 If there is no current subprocess then
809 .I textfile
810 is run
811 as a subprocess as for
812 .BR r .
813 In this case no note can be sent; the remainder of the line
814 is treated as arguments to the subprocess.
815 .TP
816 .BI S s
817 Identical to
818 .B s
819 except the subprocess is single stepped for
820 .I count
821 lines of C source. In optimized code, the correspondence
822 between C source and the machine instructions is
823 approximate at best.
824 .TP
825 .BI x
826 The current subprocess, if any, is released by
827 .I db
828 and allowed to continue executing normally.
829 .TP
830 .B k
831 The current subprocess, if any, is terminated.
832 .TP
833 .BI n c
834 Display the pending notes for the process.
835 If
836 .I c
837 is specified, first delete
838 .I c'th
839 pending note.
840 .PD
841 .RE
842 .SS Addresses
843 The location in a file or memory image associated with
844 an address is calculated from a map
845 associated with the file.
846 Each map contains one or more quadruples
847 .RI ( "t, f, b, e, o" ),
848 defining a segment named
849 .I t
850 (usually,
851 .IR text ,
852 .IR data ,
853 or
854 .IR core )
855 in file
856 .I f
857 mapping addresses in the range
858 .I b
859 through
860 .IR e
861 to the part of the file
862 beginning at
863 offset
864 .IR o .
865 If segments overlap, later segments obscure earlier ones.
866 An address
867 .I a
868 is translated
869 to a file address
870 by finding the last segment in the list
871 for which
872 .IR b ≤ a < e ;
873 the location in the file
874 is then
875 .IR address + f \- b .
876 .PP
877 Usually,
878 the text and initialized data of a program
879 are mapped by segments called
880 .IR text ,
881 .IR data ,
882 and
883 .IR bss .
884 Since a program file does not contain stack data,
885 this data is
886 not mapped.
887 The text segment is mapped similarly in
888 a normal (i.e., non-kernel)
889 .IR memfile .
890 However, one or more segments called
891 .I data
892 provide access to process memory.
893 This region contains the program's static data, the bss, the
894 heap and the stack.
895 .PP
896 Sometimes it is useful to define a map with a single segment
897 mapping the region from 0 to 0xFFFFFFFF; a map of this type
898 allows an entire file to be examined
899 without address translation.
900 .PP
901 The
902 .B $m
903 command dumps the currently active maps. The
904 .B ?m
905 and
906 .B /m
907 commands modify the segment parameters in the
908 .I textfile
909 and
910 .I memfile
911 maps, respectively.
912 .SH EXAMPLES
913 To set a breakpoint at the beginning of
914 .B write()
915 in extant process 27:
916 .IP
917 .de EX
918 .RS
919 .ft B
920 .nf
921 ..
922 .de EE
923 .RE
924 ..
925 .EX
926 % db 27
927 :h
928 write:b
929 :c
930 .EE
931 .PP
932 To set a breakpoint at the entry of function
933 .B parse
934 when the local variable
935 .B argc
936 in
937 .B main
938 is equal to 1:
939 .IP
940 .EX
941 parse:b *main.argc-1=X
942 .EE
943 .PP
944 This prints the value of
945 .B argc-1
946 which as a side effect sets dot; when
947 .B argc
948 is one the breakpoint will fire.
949 Beware that local variables may be stored in registers; see the
950 BUGS section.
951 .SH "SEE ALSO"
952 .IR 9nm (1),
953 .IR acid (1)
954 .SH SOURCE
955 .B /usr/local/plan9/src/cmd/db
956 .SH DIAGNOSTICS
957 Exit status is 0, unless the last command failed or
958 returned non-zero status.
959 .SH BUGS
960 Examining a local variable with
961 .I routine.name
962 returns the contents of the memory allocated for the variable, but
963 with optimization, variables often reside in registers.
964 Also, on some architectures, the first argument is always
965 passed in a register.
966 .PP
967 Variables and parameters that have been
968 optimized away do not appear in the
969 symbol table, returning the error
970 .IR "bad local variable"
971 when accessed by
972 .IR db .
973 .PP
974 Breakpoints should not be set on instructions scheduled
975 in delay slots. When a program stops on such a breakpoint,
976 it is usually impossible to continue its execution.