How to print the contents of a memory address using LLDB?

Question

I am using LLDB and wondering how to print the contents of a specific memory address, for example 0xb0987654.

I received the error, error: Couldn't dematerialize struct : (null) Errored out in Execute: Couldn't FinalizeJITExpression — Adam Lee, Nov 03 '13 at 01:29
Probably yes. Did you try? (and you could install `gdb`, perhaps by compilng it from source). — Basile Starynkevitch, Nov 03 '13 at 01:42
When you are just printing straight-up memory like this, that "couldn't dematerialize struct" usually means the memory is not readable. The error message is horrible, but getting it right turns out to be tricky. You can use "memory read" to tell whether that is really true. — Jim Ingham, Nov 05 '13 at 22:19

score 74 · Answer 1 · answered Nov 03 '13 at 03:43

To complement Michael's answer.

I tend to use:

memory read -s1 -fu -c10000 0xb0987654 --force

That will print in the debugger.

-s for bytes grouping so use 1 for uint8 for example and 4 for int
-f for format. I inherently forget the right symbol. Just put the statement with -f and it will snap back at you and give you the list of all the options
-c is for count of bytes
if you are printing more than 1024 bytes, append with --force

Hope this helps.

Eric · Answer 2 · 2020-04-06T11:07:09.367

72

Xcode has a very nice Memory Browser window, which will very nicely display the contents of memory addresses. It also lets you control byte grouping and number of bytes displayed, and move back or forward a memory page:

enter image description here

You can access it by pressing ⌘^⌥⇧M. After entering it, press enter to open the memory browser in the main editor.

or

Debug --> Debug Workflow --> View Memory

Notice the field on its bottom left corner where you can paste the memory address you want to inspect!

Documentation here: https://developer.apple.com/library/ios/recipes/xcode_help-debugger/articles/viewing_memory.html

Related answer here: How do I open the memory browser in Xcode 4?

edited Apr 06 '20 at 11:07

answered Feb 25 '14 at 11:43

Eric

16,003
15
87
139

Best shortcut ever: sometimes they're combinations of 2-3 special keys (⌘^⇧, ⌘⌥⇧, ^⌥⇧ or whatever). Apple is out of shortcuts and they went all in. – Dog Nov 21 '19 at 08:35
1

@drewster it does, but because of Xcode's new UX you have to decide where to open the memory browser (so just press enter after entering the shortcut) – Eric Apr 06 '20 at 11:07
1

xcode is xcode. The Q is about LLDB. They are not the same thing. – RichieHH Jun 23 '21 at 20:26

score 12 · Answer 3 · answered Nov 03 '13 at 02:21

12

"me" is the command you're looking for.

For example, this lldb command:

me -r -o /tmp/mem.txt -c512 0xb0987654

will copy 512 bytes from your memory address into a file at /tmp/mem.txt.

answered Nov 03 '13 at 02:21

Michael Dautermann

88,797
17
166
215

1

I'm using lldb on Apple macOS 11.3 version `lldb-1200.0.44.2` and I had to alter the command slightly: `me read -o /tmp/mem.txt -c512 0xb0987654` – neuralmer Sep 29 '21 at 15:29

score 12 · Answer 4 · answered Jul 31 '18 at 15:07

12

for example, print memory of length 16x4 bytes.

x/16  0xb0987654

answered Jul 31 '18 at 15:07

andrewchan2022

4,953
45
48

Patrick Beard · Answer 5 · 2017-09-01T16:28:49.983

Here's a simple trick for displaying typed arrays of fixed-length in lldb. If your program contains a long* variable that points to 9 elements, you can declare a struct type that contains a fixed array of 9 long values and cast the pointer to that type:

long *values = new long[9]{...};

(lldb) expr typedef struct { long values[9]; } l9; *(l9 *)values
(l9) $1 = {
  values = {
    [0] = 0
    [1] = 1
    [2] = 4
    [3] = 9
    [4] = 16
    [5] = 25
    [6] = 36
    [7] = 49
    [8] = 64
  }
}

I use the typedef when I'm coding in C, it's not needed in C++.

How to print the contents of a memory address using LLDB?

5 Answers5

Linked