Writing a Linux Debugger (2017) | Hacker News Reader

Writing a Linux Debugger (2017)

blog.tartanllama.xyz

108 pointslrsjng13 comments

Nice, I really like that it describes the DWARF format instead of just handwaving around it. I've been considering adding DWARF support to my compiler so that I can use mainstream debuggers with it and this article has just destroyed my last excuse to procrastinate.

I must admit, the title got me very excited (it's still a cool article regardless) - something I've always wanted is a system-wide debugger for Linux. Something that can put breakpoints in arbitrary executables or shell scripts (via custom /bin/sh wrapper?) system wide, not just within a debugging session. I'd love to be able to put conditional breakpoints on, say, any process that opens a named pipe matching some regex. I find that when dealing with complex systems involving systemd services, cron jobs, udev and 30 different daemons running in background, gdb and strace simply aren't enough.

SystemTap or ebpf might be the way to go for visibility at that level. Not quite a debugger, but they can be very helpful.

I had heard of SystemTap, but had no idea it was that powerful. In particular, the user space marker feature sounds like what I need. Although it sounds like it may require manual instrumentation.

Not sure about Linux specifically, but it sounds like you’re looking for a kernel debugger that can communicate with a user mode debugger (or debuggers).

Edit: actually SystemTap mentioned in a sibling comment sounds simpler if you just need instrumentation.

As someone who does debugger development as part of their day job, I can attest that this is a very good introduction to the details of basic debugger operation and implementation. If you are unfamiliar with the topic, I recommend you give it a try as it immediately starts giving useful nuggets of knowledge that are applicable in other circumstances if you are ever interested in doing low level or embedded development.

However, note that the libelfin library that the author uses is pretty much unmaintained.

I am not sure what would be the right way to parse ELF and DWARF? libelf/libdwarf, libdw, or something else?

Also, since you are probably in the know, is liblldb "extensible", in the sense that can liblldb can be used as a foundation of a new debugger with experimental features added on top of it?

libbfd is apparently what the GNU debugger uses:

https://ftp.gnu.org/old-gnu/Manuals/bfd-2.9.1/html_chapter/b...

https://en.wikipedia.org/wiki/Binary_File_Descriptor_library

gdb uses BFD for object file access but has its own DWARF reader.

The Rust goblin and gimli crates are very good, I've used them for ELF symbol resolution things before and they're a dream compared to libelf.

gimli works well enough for actually parsing the DWARF format, but it abstracts over somewhat less than what you would hope (in particular, you get to do all the fun stuff of figuring out where debugging information is yourself--which gets tedious when you want to support things like split-dwarf or debug index).

libdwarf is the most complete C library, Rust options are also quite good. We already support both DWARF and PDB in Rizin[1] but working hard on improving that support[2]

[1] https://github.com/rizinorg/rizin/tree/dev/librz/bin

[2] https://rizin.re/posts/gsoc-2023-announcement/#billow-debug-...

Appreciated the How is Babby Formed reference in chapter two:)

How does one debug the Linux kernel ? I want to step through some portions.

Even with UML it sounds arduous

Reply on news.ycombinator.com