On Friday, Apr 4, 2003, at 15:42 Australia/Sydney, Brian Tabone wrote: List, I have heard of old school UNIX hacks attaching to live kernels with gdb, allowing them to see values of variables and changing those values on the fly. I am curious as to how one could do this on Darwin. I attempted to attach to /dev/kmem via gdb, as root. All I would get back was a complaint that /dev/kmem could not be found (I looked and its there all-right). What I can gather is that /dev/kmem is a character special file, and is not visible to gdb in a direct fashion. I used the following gdb -s /mach.sym /dev/kmem Now I know you can't attach directly to a running kernel as you would a program, since halting the kernel would halt you. But, from what I understand you can attach to the running image to examine the memory, without halting that image. Perhaps I am mistaken? I'm led to believe that this is not supported with the Mac OS X gdb. It would be nice - I find it handy on NetBSD, AIX and Tru-64. On NetBSD: ksh$ gdb GNU gdb 5.0nb1 Copyright 2000 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386--netbsdelf". (gdb) file /netbsd Reading symbols from /netbsd...(no debugging symbols found)...done. (gdb) symbol-file /netbsd.gdb Reading symbols from /netbsd.gdb...done. (gdb) target kcore /dev/mem #0 0xc03f7700 in lwp0 () On Darwin: ksh$ gdb GNU gdb 5.3-20021014 (Apple version gdb-250) (Sat Dec 7 02:14:27 GMT 2002) Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "powerpc-apple-macos10". (gdb) file /mach_kernel Reading symbols from /mach_kernel...done. (gdb) symbol-file /mach.sym Reading symbols from /mach.sym...done. (gdb) target kcore /dev/mem Undefined target command: "kcore /dev/mem". Try "help target". Cheers, -- Paul Ripke Unix/OpenVMS/TSM/DBA 101 reasons why you can't find your Sysadmin: 68: It's 9AM. He/She is not working that late. -- Koos van den Hout _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.