llvm / llvm/llvm-project

[LLDB/Bug/Enhancement] on intel IBT(e.g. `endbr64`), LLDB fails to resolve symbol names for dynamic calls breaking on PLT/GOT stubs (e.g., `___lldb_unnamed_symbolXX`)

Open
#164,049 1 comment 0 reactions 0 assignees View on GitHub
lldb
Dominant language
LLVM
Stars
40.5k
Forks
18.7k
PR merge metrics
PR metrics pending

Description

## Component: Debugger Core / Symbolication
## Description

when $\text{Intel IBT}$ ($\text{Indirect Branch Tracking}$) is enabled, typically via compiler flags like -fcf-protection=full, `endbr64` will be inserted into PLT table. Instead of displaying the intended unresolved symbol name (e.g., `printf@plt`), LLDB falls back to a generic, unhelpful label. Here is a reproduce example.

## Steps to Reproduce
1. Create a minimal C program (test.cpp):
```cpp
#include

using namespace std;

int main(){
printf("1\n");
printf("2\n");
printf("3\n");
return 0;
}
```
2. compile with IBT or without IBT:
```
g++ ./src/test.cpp -fcf-protection=full -o test_with_ibt
g++ ./src/test.cpp -fcf-protection=none -o test_without_ibt
```
3. use lldb to disasm main function:
```
# with IBT, notice the ___lldb_unnamed_symbol39
test_with_ibt`main:
-> 0x555555555149 <+0>: endbr64
0x55555555514d <+4>: pushq %rbp
0x55555555514e <+5>: movq %rsp, %rbp
0x555555555151 <+8>: leaq 0xeac(%rip), %rax
0x555555555158 <+15>: movq %rax, %rdi
0x55555555515b <+18>: callq 0x555555555050 ; ___lldb_unnamed_symbol39
0x555555555160 <+23>: leaq 0xe9f(%rip), %rax
0x555555555167 <+30>: movq %rax, %rdi

# without IBT, notice the symbol stub for: puts
test_without_ibt`main:
-> 0x555555555139 <+0>: pushq %rbp
0x55555555513a <+1>: movq %rsp, %rbp
0x55555555513d <+4>: leaq 0xec0(%rip), %rax
0x555555555144 <+11>: movq %rax, %rdi
0x555555555147 <+14>: callq 0x555555555030 ; symbol stub for: puts
0x55555555514c <+19>: leaq 0xeb3(%rip), %rax
0x555555555153 <+26>: movq %rax, %rdi
```

## behavior in gdb
In gdb, when disasm with `layout asm` , `puts@plt` is recognized as the jump destination

Image

## Test env
lldb version 20.1.2
GNU gdb (Ubuntu 15.0.50.20240403-0ubuntu1) 15.0.50.20240403-git

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the behavior with the provided test.cpp program and the with-IBT and without-IBT compilation commands, then inspect LLDB's debugger-core symbolication and disassembly handling for the PLT/GOT call target. Done means the IBT case resolves the intended unresolved symbol name, such as puts@plt, instead of a ___lldb_unnamed_symbol label.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.