Using gdb debugger on macOS is no longer straightforward since Xcode stopped using it and replaced it with lldb. Starting from Mavericks (macOS 10.9), there are several steps to follow to make it work.

In this guide:

  • Install gdb
    • Install gdb 8.3 (recommended)
    • Install gdb 8.0.1
  • Generate a certificate
    • Troubleshooting the certificate generation
  • Sign the certificate for gdb
  • Create a gdb command file
  • Set Eclipse for using gdb
    • Troubleshooting the Eclipse configuration

Install gdb

The easiest way to install gdb is by using Homebrew: "the missing package manager for macOS". If you don't have it installed, open your Terminal prompt and write this command:

/usr/bin/ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"

Once you have Homebrew, you can install gdb. If you're using High Sierra (macOS  10.13) or later, be aware that gdb 8.1 and 8.2 are not compatible. You can either use gdb 8.0.1 or one of the latest versions, starting from 8.3. In this tutorial, I'm going to use gdb 8.3.

To install the latest version of gdb, run this command:

brew install gdb

Verify that the operation was successfull by running:

gdb --version

Take note of the version: you'll need it later. In my case, it is 8.3.

Install gdb 8.0.1

Should you decide to do so, you can install gdb version 8.0.1 in this way.

brew install https://raw.githubusercontent.com/Homebrew/homebrew-core/9ec9fb27a33698fc7636afce5c1c16787e9ce3f3/Formula/gdb.rb

brew pin gdb

The pinning operation makes sure that brew doesn't upgrade gdb to newer versions.

In case you have already a newer version of gdb, you first need to unlink the other version before installing the old one.

brew unlink gdb

brew install https://raw.githubusercontent.com/Homebrew/homebrew-core/9ec9fb27a33698fc7636afce5c1c16787e9ce3f3/Formula/gdb.rb

brew pin gdb

To check out your gdb version, run:

gdb --version

Take note of the version: you'll need it later. In my case, it is 8.3.

Generate a certificate

Installing gdb is not enough. If you try debugging a file, you'll get an error since the Darwin kernel doesn't allow gdb to control another process without having special rights. For security reasons, this is the default behaviour.

To give gdb those permissions, you need to generate a self-signed certificate.

  1. Launch Keychain Access application: Applications > Utilities > Keychain Access.
  2. From the Keychains list on the left, right-click on the System item and select Unlock Keychain "System".
  3. From the toolbar, go to Keychain Access > Certificate Assistant > Create a Certificate.
  4. Choose a name (e.g. gdb-cert).
  5. Set Identity Type to Self Signed Root.
  6. Set Certificate Type to Code Signing.
  7. Check the Let me override defaults checkbox.
  8. At this point, you can go on with the installation process until you get the Specify a Location For The Certificate dialogue box. Here you need to set Keychain to System. Finally, you can click on the Create button.
  9. After these steps, you can see the new certificate under System keychains. From the contextual menu of the newly created certificate (right-click on it) select the Get info option. In the dialogue box, expand the Trust item and set Code signing to Always Trust.
  10. Then, from the Keychains list on the left, right-click on the System item and select Lock Keychain "System".
  11. Finally, reboot your system.

Troubleshooting the certificate generation

At the end of the procedure to generate a certificate, you might get the following error message:

Unknown error: -2,147,414,007

This kind of error has bothered a lot of macOS users over the past years, I don't know why Apple has not replaced it with a more meaningful message yet. It seems that the error is related to the creation of the certificate in the System keychain. Here there are a few things you can try to solve the problem.

  • Be sure that your System keychain is unlocked. If it is and you're still getting the same error, than you can use a workaround. Create the certificate in the login keychain and then drag and drop the newly created certificate, the public key and the private key from the login keychain to the System keychain.
  • If the drag-and-drop option doesn't work for you, then find your certificate in the login keychain, select it, then choose File -> Export items from the toolbar and save the certificate somewhere on your disk. Then, go in the System folder, choose File -> Import items from the toolbar and select your certificate. Finally, delete the certificate originally created in the login folder (it's not done automatically).

Notice that once you have created the certificate using one of the previous workarounds, you still need to go through steps 9 to 11 of the prior section.

I hope that one of the solutions worked well for you. Please leave a comment if you are encountering any other error during the procedure.

Sign the certificate for gdb

It's time to sign the certificate. If you're using maOS Mojave (10.14) or later, create a gdb-entitlement.xml file. This will tell the operating system which operations the gdb process has to be trusted. In this case, just for debugging.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
"http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
    <key>com.apple.security.cs.debugger</key>
    <true/>
    <key>com.apple.security.get-task-allow</key>
    <true/>
</dict>
</plist>

Then, open your Terminal prompt, go to the directory where you saved the xml file and run:

codesign --entitlements gdb-entitlement.xml -fs gdb-cert gdbPath

If you're using macOS High Sierra (10.13) or previous, you don't need an entitlement configuration. Instead, you need to run this command:

codesign -fs gdb-cert gdbPath

where gdb-cert is the name of your certificate and gdbPath is the full path to your gdb binary file. If you have installed gdb as explained before (using Homebrew), the path should be: /usr/local/Cellar/gdb/version/bin/gdb (replace version with the actual version of your gdb installation, e.g. /usr/local/Cellar/gdb/8.3/bin/gdb).

Create a gdb command file

If you are on macOS Sierra (10.12) or later, you need to do this extra step.

In the home directory, create a new file called .gdbinit and write the following command in it:

set startup-with-shell off

Alternatively, from the Terminal, you can do that by running this:

echo "set startup-with-shell off" >> ~/.gdbinit

Now you can use gdb for debugging files on your Mac. If you use Eclipse, follow the next step.

Set Eclipse for using gdb

If you want to configure gdb for a specific project in Eclipse, you need to set some options:

  1. Go to Run > Debug Configurations...
  2. Select a launch configuration from the list on the left (e.g. C/C++ Application)
  3. Open the Debugger tab from the menu on the right
  4. Set GDB debugger to the full path of your gdb binary file (the same used for signing the certificate)
  5. Set GDB command file to the full path of your .gdbinit file: ~/.gdbinit (or the extended form /Users/yourname/.gdbinit, where yourname is your username)
  6. Click on the Apply button.
Eclipse window for debug configurations
Debug Configuration - Project-specific

In case you want to define a default configuration for gdb to be used in any Eclipse project, these are the steps to follow:

  1. Go to Eclipse > Preferences
  2. From the left menu select C/C++ > Debug > GDB
  3. Set GDB debugger to the full path of your gdb binary file (the same used for signing the certificate)
  4. Set GDB command file to the full path of your .gdbinit file: ~/.gdbinit (or the extended form /Users/yourname/.gdbinit, where yourname is your username)
  5. Click on the Apply button.
GDB Configuration - Eclipse Preferences

Now, you can debug files from inside Eclipse using gdb.

Troubleshooting the Eclipse configuration

If there is no GDB option in Eclipse > Preferences > C/C++ > Debug, then you need first to debug any C/C++ project. So, open any project and start a debugging session either by clicking the Debug icon on the toolbar. The operation will fail since you haven't configured gdb yet, but in this way, you will be able to see the gdb option in the main Preferences window.

Conclusion

In this tutorial, I've shown you how to install gdb and use it to debug a C/C++ application on macOS.

Special thanks to those people who helped me improve this article by commenting with suggestions and tips.

Resources

Last Update: 29 September 2019