Fix Rosetta x86 debugging through debugserver#25935
Open
0verflowme wants to merge 1 commit into
Open
Conversation
Collaborator
|
Lets split this pr because its currently affecting so many different parts and each change is isolated from the others its hard to review as a whole. Make a separate pr only wirh the code that affects the gdb protocol pls |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes the Apple Silicon Rosetta x86 debugging path by treating translated x86 processes as LLDB/debugserver remote targets instead of trying to drive them through the native XNU/smach debugger path.
The old architecture mixed three assumptions that do not hold for Rosetta:
dr/ds/breakpoint operationThis PR rewrites that boundary so Rosetta x86 debugging goes through Apple debugserver/OAH, then synchronizes r2's debug backend, asm arch/bits, register profile, and stop-register cache from the remote target.
What Changed
debugserver+ the gdb backend./Library/Apple/usr/libexec/oah/debugserverfor Rosetta when available, with fallback debugserver discovery.qProcessInfoCPU type to set the target architecture/bits.Tstop-packet registers and prefer those over per-registerpNreads, because OAH exposes the expected x86 architectural state in stop replies.asm.archchanges.asm.archupdating the active breakpoint plugin and default breakpoint size.Impact
For end users debugging x86_64 Mach-O binaries on Apple Silicon, initial register state, stepping, disassembly at PC, and software breakpoints now operate on the x86 view instead of the translated ARM state. This makes Rosetta debugging usable from r2 instead of landing at ARM trampoline bytes or missing breakpoint traps.
For maintainers, the key design change is that Rosetta is no longer treated as a special case inside native XNU debugging. It is a remote LLDB/debugserver target with explicit architecture/profile synchronization. That keeps the architecture boundary clearer and avoids leaking Rosetta-specific behavior into the native smach path.
Validation
make -C libr/io clean > /dev/null && make -C libr/core clean > /dev/null && make -C libr/debug clean > /dev/null && make -j > /dev/nullR2R_RADARE2=$PWD/binr/radare2/radare2 R2R_RASM2=$PWD/binr/rasm2/rasm2 ./binr/r2r/r2r test/db/cmd/cmd_bp test/db/cmd/cmd_dr test/db/cmd/cmd_dr_equal test/db/cmd/cmd_regs test/db/cmd/cmd_dh test/db/cmd/cmd_dsR2R_RADARE2=$PWD/binr/radare2/radare2 R2R_RASM2=$PWD/binr/rasm2/rasm2 ./binr/r2r/r2r test/db/io/write test/db/io/maps test/db/io/cacheR2R_RADARE2=$PWD/binr/radare2/radare2 R2R_RASM2=$PWD/binr/rasm2/rasm2 ./binr/r2r/r2r test/db/asm/x86_64 test/db/asm/arm_64 test/db/esil/x86_64asm.arch=x86,asm.bits=64,rippoints at x86 dyld code,pddecodes x86, anddsadvancesrip.rip+3stops at the expected x86 address.git diff --checkNotes from local validation: native arm64 smach attach is blocked on this machine by unsigned local r2/macOS ptrace restrictions, and LLDB itself fails to attach to an independently running Rosetta
/bin/sleephere withattach failed: lost connection. The spawned Rosetta flow, which is the bug path this PR targets, is validated end to end.