Using debuggers in everyday life

One of the things that I teach students that I mentor is that an understanding of how computers work, at least on the lower level, gives you an unexplainable edge. Its like being a doctor, or a lawyer or a mechanic, where your field of specialty (which is really something that you interact with in everyday life) stops becoming a black box of magic and starts becoming something you are empowered to interact with in a meaningful way.

Recently I was drafting up some important documents for someone close to me and we had spent hours and hours working on. Every detail was critical. Unfortunately, our intense concentration meant that we forgot to save the document and this happened after attempting to insert a new paragraph:


The application had hung completely and looked like its was stuck in an infinite loop. We’d have to throw away the three or four hours of work as there was no way we were going to get the contents of that (now multipage) document.

Or was there?

It turns out that having been a hobbyist programmer for years, I knew a thing or two about debugging. I also knew that when you type something into a document, the contents of that document are usually somewhere in memory – and most simple text editors would probably just store the document’s contents in memory as plain or marked up text. That’s what I’d do if I wrote a simple text editor.

If we could just search the program’s memory for the contents that we can still see on-screen, then we might be able to retrieve a fair bit of the document.

It turns out that debuggers are well suited to that task.

LLDB Start


The debugger I’m using is called LLDB and it come with Xcode. It’s part of the LLVM suite of tools.

LLDB like most debuggers has a scripting capability and there’s a script shipped by default that lets you search heap memory for a matching string called cstr_refs.



Just by searching for the very first string, we found an allocation of 320 bytes.

If its just a simple nul-terminated string all the way to the end, we can just cast the pointer to a string and print out the rest of it.

Printing out string


There’s our recovered contents!

Sometimes we’re not so lucky and we don’t get a null-terminated string. Or the memory ends up being fragmented across a few different pools.

When that happens we can just read memory, so long as its within the program’s mapped range, with the memory command.

memory read

You can use debuggers for all kinds of cool stuff, including momentarily getting back those few hours of lost work.

2 thoughts on “Using debuggers in everyday life

  1. Nice to hear from you again! I hope you are well!
    This blog post could really make people interested in programming.
    Though you are lucky the program you used was open source 😉
    I do not want to start any unnecessary discussion, but out of personal interest: Have you completely switched to osx? what were your reasons for the switch?

    1. Oops, I didn’t see this for some time!

      Yes – I bought a Macbook Pro last year and I’ve been using OS X most of the time now. The reason is that the MBP was probably the best hardware you could get in a laptop (the display was quite a high priority for me) and it has quite good battery life too which I need when I’m at university.

      In order to take advantage of that battery life and display, you really need to be running OS X. You can run Ubuntu or another distro on it natively but you won’t get anywhere near the same kind of power efficiency.

      That said – I still boot up my Ubuntu virtual machine almost every day and I do quite a lot of development in it. Most of the stuff I’m developing (and planning on launching later) runs over all three major platforms and having access to all three to test on is quite a boon.

      There’s a lot of stuff that I miss from using Ubuntu day-to-day, but I actually found that my workflow was pretty easily adaptable to OS X. For instance in Ubuntu I used the terminal as a de-facto kind of application launcher and for a while doing the same thing in OS X was a huge pain. I’ve now set up aliases to all the applications that I use (so I can just fire up a terminal and do something like $ qtc ~/Source/myapp or $ st2 ~/Source/myfile.txt .

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s