ADB(1)

NAME
adb - debugger

SYNOPSIS
adb [-w] [ -Idir ] [ objfil [ corfil ] ]

DESCRIPTION
Adb is a general purpose debugging program. It may be used to examine files and to provide a controlled environment for the execution of UNIX programs.

Objfil is normally an executable program file, preferably containing a symbol table; if not then the symbolic features of adb cannot be used although the file can still be examined. The default for objfil is a.out. Corfil is assumed to be a core image file produced after executing objfil; the default for corfil is core.

Requests to adb are read from the standard input and responses are to the standard output. The default prompt when adb is active is “adb> ”. Commands are accepted from the keyboard whenever this prompt is displayed. The prompt can be changed using the $P command as explained below. If the -w flag is present then both objfil and corfil are created if necessary and opened for reading and writing so that files can be modified using adb.

The -I option specifies a directory where files to be read with $< or $<< (see below) will be sought; the default is /usr/lib/adb.

Adb ignores QUIT; INTERRUPT causes return to the next adb command.

In general requests to adb are of the form

[address] [, count] [command] [;]

If address is present then dot is set to address. The value of address must be suitably aligned for the addressing mode used by the particular command. Initially dot is set to 0. For most commands count specifies how many times the command will be executed. The default count is 1. Address and count are expressions.

The interpretation of an address depends on the context it is used in. If a subprocess is being debugged then addresses are interpreted in the usual way in the address space of the subprocess. If the operating system is being debugged either post-mortem or using the special file /dev/kmem to interactively examine and/or modify memory the maps are set to refer to the kernel virtual addresses which start at 0x1000000 (on the ARM).

EXPRESSIONS

.   The value of dot.

+   The value of dot incremented by the current increment.

^   The value of dot decremented by the current increment.

"   The last address typed.

integer
    A number. The prefixes 0o and 0O (“zero oh”) force interpretation in octal radix; the prefixes 0t and 0T force interpretation in decimal radix; the prefixes 0x and 0X force interpretation in hexadecimal radix. Thus 0o20 = 0t16 = 0x10 = sixteen. If no prefix appears, then the default radix is used; see the $d command. The initial radix is hexadecimal. The hexadecimal digits are 0123456789abcdefABCDEF with the obvious values. Note that a hexadecimal number whose most significant digit would otherwise be an alphabetic character must have a 0x (or 0X) prefix (or a leading zero if the default radix is hexadecimal).

integer.fraction
    A 32 bit floating point number.

'cccc'
    The ASCII value of up to 4 characters. \ may be used to escape a '.

< name
    The value of name, which is either a variable name or a register name. Adb maintains a number of variables (see VARIABLES) named by single letters or digits. If name is a register name then the value of the register is obtained from the system header in corfil. The register names are those printed by the $r command.

symbol
    A symbol is a sequence of upper or lower case letters, underscores or digits, not starting with a digit. The backslash character \ may be used to escape other characters. The value of the symbol is taken from the symbol table in objfil. An initial _ will be prepended to symbol if needed.

_ symbol
    In C, the `true name' of an external symbol begins with _. It may be necessary to utter this name to distinguish it from internal or hidden variables of a program.

module.name
    The address of the static variable name in the specified C module. Both routine and name are symbols. In particular, module is the name of a module linked into the current object file and name is a static object found within that module. If module is omitted , then name is assumed to be in the last module referred to in this way. If the '.' is also ommited, name is assumed to be external. If no matching external symbol exists, the first matching static will be used. module on its own is illegal. (Note that local (ie automatic) variables can be examined only with dbx(1).)

(exp)
    The value of the expression exp.

Monadic operators

*exp
    The contents of the location addressed by exp in corfil.

@exp
    The contents of the location addressed by exp in objfil.

-exp
    Integer negation.

~exp
    Bitwise complement.

#exp
    Logical negation.

`exp
    exp & 0x3FFFFFC - for stripping condition codes from pc/lr values.

Dyadic operators are left associative and are less binding than monadic operators.

e1+e2
    Integer addition.

e1-e2
    Integer subtraction.

e1*e2
    Integer multiplication.

e1%e2
    Integer division.

e1&e2
    Bitwise conjunction.

e1|e2
    Bitwise disjunction.

e1#e2
    E1 rounded up to the next multiple of e2.

COMMANDS
Most commands consist of a verb followed by a modifier or list of modifiers. The following verbs are available. (The commands `?' and `/' may be followed by `*'; see ADDRESSES for further details.)

?f  Locations starting at address in objfil are printed according to the format f. dot is incremented by the sum of the increments for each format letter (q.v.).

/f  Locations starting at address in corfil are printed according to the format f and dot is incremented as for `?'.

=f  The value of address itself is printed in the styles indicated by the format f. (For i format PC-relative addressing is printed as an offset from HERE.)

A format consists of one or more characters that specify a style of printing. Each format character may be preceded by a decimal integer that is a repeat count for the format character. While stepping through a format dot is incremented by the amount given for each format letter. If no format is given then the last format is used. The format letters available are as follows.

    o	2 Print 2 bytes in octal. All octal numbers output by adb are preceded by 0.

    O	4 Print 4 bytes in octal.

    q	2 Print in signed octal.

    Q	4 Print long signed octal.

    d	2 Print in decimal.

    D	4 Print long decimal.

    x	2 Print 2 bytes in hexadecimal.

    X	4 Print 4 bytes in hexadecimal.

    u	2 Print as an unsigned decimal number.

    U	4 Print long unsigned decimal.

    f	4 Print the 32 bit value as a floating point number.

    F	8 Print double floating point.

    b	1 Print the addressed byte in octal.

    c	1 Print the addressed character.

    C	1 Print the addressed character using the standard escape convention where control characters are printed as ^X and the delete character is printed as ^?.

    s	n Print the addressed characters until a zero character is reached.

    S	n Print a string using the ^X escape convention (see C above). n is the length of the string including its zero terminator.

    Y	4 Print 4 bytes in date format (see ctime(3)).

    i	4 Print as machine instructions. This style of printing causes variable 1 to be set to any constant part of the instruction (branch or index offset or immediate constant).

    a	0 Print the value of dot in symbolic form. Symbols are checked to ensure that they have an appropriate type as indicated below.

        /    local or global data symbol
        ?    local or global text symbol
        =    local or global absolute symbol

    p	4 Print the addressed value in symbolic form using the same rules for symbol lookup as a.

    t	0 When preceded by an integer tabs to the next appropriate tab stop. For example, 8t moves to the next 8-space tab stop.

    r	0 Print a space.

    n	0 Print a newline.

    "..." 0
        Print the enclosed string.

    ^   Dot is decremented by the current increment. Nothing is printed.

    +   Dot is incremented by 1. Nothing is printed.

    -   Dot is decremented by 1. Nothing is printed.

newline
    Repeat the previous command with a count of 1.

[?/]l value mask
    Successive 2-byte words (on 2-byte boundaries) starting at dot are masked with mask and compared with value until a match is found. If L is used then the match is for 4 bytes at a time instead of 2. If no match is found then dot is unchanged; otherwise dot is set to the matched location. If mask is omitted then -1 is used.

[?/]w value ...
    Write the 2-byte value into the addressed location (which must be 2-byte aligned). If the command is W, write 4 bytes (4-byte aligned).

[?/]m b1 e1 f1[?/]
    New values for (b1, e1, f1) are recorded. If less than three expressions are given then the remaining map parameters are left unchanged. If the `?" or `/" is followed by `*" then the second segment (b2,e2,f2) of the mapping is changed. If the list is terminated by `?" or `/" then the file (objfil or corfil respectively) is used for subsequent requests. (So that, for example, `/m?" will cause `/" to refer to objfil.)

>name
    Dot is assigned to the variable or register named.

!   A shell (/bin/sh) is called to read the rest of the line following `!".

$modifier
    Miscellaneous commands (case is ignored unless both are listed).
    The available modifiers are:

    <f  Read commands from the file f. If this command is executed in a file, further commands in the file are not seen. If f is omitted, the current input stream is terminated. If a count is given, and is zero, the command will be ignored. The value of the count will be placed in variable 9 before the first command in f is executed.

    <<f Similar to < except it can be used in a file of commands without causing the file to be closed. Variable 9 is saved during the execution of this command, and restored when it completes. There is a (small) finite limit to the number of << files that can be open at once.

    >f  Append output to the file f, which is created if it does not exist. If f is omitted, output is returned to the terminal.

    ?   Print process id, the signal which caused stoppage or termination, as well as the registers as $R. This is the default if modifier is omitted.

    r   Print the general registers and the instruction addressed by pc. The registers are printed in two columns. Dot is set to pc.

    R   Same as r but only one column is produced.

    f   Print the floating point data, control, and status registers.

    F   Same as f but the extended representation is printed (as 3 words) as well.

    b   Print all breakpoints and their associated counts and commands.

    c   C stack backtrace. If address is given then it is taken as the address of the current frame instead of the contents of the frame-pointer register. If count is given then only the first count frames are printed.
        Note that since the C compiler is an optimising compiler the stack backtrace can have procedures apparently missing from the call chain. This will happen if a procedure contains a call to another procedure just before a return, when the calling procedure"s stack frame is removed before calling the next procedure.
        The C compiler will generate more understandable stack frames when "CC -g" is used.

    C   Same as $c but the FP/SP/LR/PC values of the frame are printed in hex.

    d   Set the default radix to address and report the new value. Note that address is interpreted in the (old) current radix. Thus “10$d” never changes the default radix. To make decimal the default radix, use “0t10$d”.

    e   The names and values of external variables are printed.

    E   Same as e but only those which are non-zero are printed.

    w   Set the page width for output to address (default 80).

    s   Set the distance limit for symbol matches to address (default 0x1000).

    S   Set the minimum value for symbol matches to address (default 0x1000).

    q   Exit from adb.

    v   Print all non zero adb variables.

    m   Print the address map.

    P   Change the prompt to all characters from the P to the end of the line. $P on its own results in no prompt. Leading and trailing spaces are included.

:modifier
    Manage a subprocess. Available modifiers are:

    bc  Set breakpoint at address. The breakpoint is executed count-1 times before causing a stop. Each time the breakpoint is encountered the command c is executed. If this command sets dot to zero then the breakpoint causes a stop.

    d   Delete breakpoint at address.

    r   Run objfil as a subprocess. If address is given explicitly then the program is entered at this point; otherwise the program is entered at its standard entry point. count specifies how many breakpoints are to be ignored before stopping. Arguments to the subprocess may be supplied on the same line as the command. An argument starting with < or > causes the standard input or output to be established for the command.

    cs  The subprocess is continued with signal s, see sigvec(2). If address is given then the subprocess is continued at this address. If no signal is specified then the signal that caused the subprocess to stop is sent. Breakpoint skipping is the same as for r.

    ss  As for c except that the subprocess is single stepped count times. If there is no current subprocess then objfil is run as a subprocess as for r. In this case no signal can be sent; the remainder of the line is treated as arguments to the subprocess.

    k   The current subprocess, if any, is terminated.

    p   Create a process, but do not load current registers. This can be used to examine text/data from an obfil which has been squeezed (the objfil file contents can not interpreted by adb, but once a process has been created the text/data of this process are accessable with ?). The registers are not affected so that this command can be used to investigate a core file from a squeezed program.

VARIABLES
Adb provides a number of variables. Named variables are set initially by adb but are not used subsequently. Numbered variables are reserved for communication as follows.

0   The last value printed.

1   The last constant part of an instruction source.

9   The count on the last $< or $<< command.

On entry the following are set from the system header in the corfil. If corfil does not appear to be a core file then these values are set from objfil.

b   The base address of the data segment.

d   The data segment size.

e   The entry point.

m   The `magic" number (see a.out.h(5) ).

s   The stack segment size.

t   The text segment size.

ADDRESSES
The address in a file associated with a written address is determined by a mapping associated with that file. Each mapping is represented by two triples (b1, e1, f1) and (b2, e2, f2) and the file address corresponding to a written address is calculated as follows.

b1≤address<e1 => file address=address+f1-b1, otherwise,

b2≤address<e2 => file address=address+f2-b2,

otherwise, the requested address is not legal. If a ? or / is followed by an * then only the second triple is used.

The initial setting of both mappings is suitable for normal a.out and core files. If either file is not of the kind expected then, for that file, b1 is set to 0, e1 is set to the maximum file size and f1 is set to 0; in this way the whole file can be examined with no address translation.

FILES
a.out
core

SEE ALSO
cc(1), dbx(1), ptrace(2), a.out(5), core(5)

DIAGNOSTICS
`Adb" when there is no current command or format. Comments about inaccessible files, syntax errors, abnormal termination of commands, etc. Exit status is 0, unless last command failed or returned nonzero status.

BUGS
Since no shell is invoked to interpret the arguments of the :r command, the customary wild-card and variable expansions cannot occur.

Since the arm is a 32-bit processor the default word size should be 32-bit not 16.

Local (ie automatic) variables cannot be examined or altered.

adb cannot examine image files that are squeezed (use :p so that ? examines the text/data of a process, rather than that of objfil).