crashtools.py

#!/usr/bin/env python3
from __future__ import print_function
"LLDB commands to get stuff from crash dumps"
import argparse, re, os, sys, time, subprocess, struct, ctypes, shlex

parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("DMPFILE", help="Path to core file", nargs="*")
parser.add_argument(
	"-b", "--base", help="Prefix to strip from paths")
parser.add_argument(
	"-r", "--storage", help="Path to binary archive")
parser.add_argument(
	"-m", "--modules", action="store_true", help="List binaries")
parser.add_argument(
	"--sections", action="store_true", help="List binaries with sections")
parser.add_argument(
	"-a", "--absent", action="store_true",
	help="List binaries not in storage")
parser.add_argument(
	"-s", "--stat", action="store_true",
	help="Print a line of numbers for every file")
parser.add_argument(
	"-d", "--download",
	help="Symbol server URL to download symbols from")
parser.add_argument(
	"-u", "--unchecked", action="store_true",
	help="Allow binaries not in archive")
parser.add_argument(
	"-n", "--attachname", help="Attach to a live process by name")
parser.add_argument(
	"-t", "--threadf", action="store_true",
	help="Print frames decoded by lldb (crashed thread)")
parser.add_argument(
		"--threads", action="store_true",
		help="Print frames decoded by lldb (each thread)")
parser.add_argument(
	"-T", "--telescope", action="store_true",
	help="Recursively resolve words from stack (crashed)")
parser.add_argument(
	"-B", "--bt", action="store_true",
	help="Print stack of crashed thread")
parser.add_argument(
		"--btu", action="store_true",
		help="Print unique stacks (deduplicated by backtrace)")
parser.add_argument(
	"-x", "--thread", action="store_true", 
	help="Unwind stack by counting PUSH/SUB *,SP instructions in code")
parser.add_argument(
	"-z", "--callsites", action="store_true", 
	help="""
Print all stack words from crashed thread pointing to code after
call instructions
""")
parser.add_argument(
	"-y", "--threadn", help="Print all words from stack N")
parser.add_argument(
	"-X", "--fa", action="store_true", 
	help=""""
Print all words from crashed thread using `memory read -fA` (aka x/a)
""")
parser.add_argument(
	"-H", "--hex", action="store_true", help="Hex dump stack of crashed thread")
parser.add_argument(
	"-Y", "--threadm",
	help="Print all words from stack N using `memory read -fA`")
parser.add_argument(
	"--smod",
	help="Module name to search the debuginfo for, rest of args see --search")
parser.add_argument(
	"--search", action="store_true",
	help="Search for debuginfo, arg1=CRASH rest=debuginfo or zip files")
parser.add_argument(
	"--slim", help="Same as --search but stop after NUM finds")
parser.add_argument(
	"-D", "--disassembly", action="store_true",
	help="Show disassembly of functions in the stack")
parser.add_argument(
	"-S", "--scan", help="Search memory for the contents of file")
parser.add_argument("-v", "--verbose", action="store_true")
parser.add_argument(
	"-w", "--dverbose", action="store_true",
	help="LLDB verbose output")
parser.add_argument(
	"-f", "--long", action="store_true", help="Not abbrev build ids")

def __lldb_init_module(debugger, internal_dict):
	"To load: command script import ~/stuff/crashtools.py"
	# Put them in global namespace so they're visible when
	# imported from another module
	name = "lldb.gv_crashtools"
	lldb.gv_crashtools = sys.modules[__name__]
	debugger.HandleCommand(
		"command script add -o -p -c %s.PrintUniqueStacks btu" % name)
	debugger.HandleCommand(
		"command script add --overwrite -f %s.printType dt" % name)
	debugger.HandleCommand(
		"command script add --overwrite -f %s.printTypeFromVbase dtv" % name)
	debugger.HandleCommand(
		"command script add --overwrite -f %s.printTypeOutside pto" % name)
	debugger.HandleCommand(
		"command script add --overwrite -f %s.printIcu icu" % name)
	debugger.HandleCommand(
		"command script add --overwrite -f %s.doScanForPtrsToType spt" %
		name)
	debugger.HandleCommand(
		"command script add --overwrite -f %s.scanHeapForPtr shp" %
		name)
	debugger.HandleCommand(
		"command script add --overwrite -f %s.startRefTracing tref" % name)
	debugger.HandleCommand(
		"command script add --overwrite -f %s.dumpRefTracing dref" % name)
	debugger.HandleCommand(
		"command script add --overwrite -f %s.telescope xt" % name)
	debugger.HandleCommand(
		"command script add --overwrite -f %s.printGtkTree pgt" % name)
	debugger.HandleCommand(
		"type summary add -F %s.summaryIcu icu_66::UnicodeString" % name)
	print("%s loaded" % __name__)

class ArgsForRepl:
	def __init__(self):
		self.storage = self.base = None
		self.download = self.long = False
		
class ReinterpretException(Exception): pass

def vecGetVals(dpc, vec, type):
	if isinstance(vec, lldb.SBValue):
		vec = vec.GetLoadAddress()
	ptrs = [dpc.readPtr(vec), dpc.readPtr(vec + ptrSize)]
	size = ptrs[1] - ptrs[0]
	if size % type.GetByteSize():
		raise ReinterpretException(
			"vector @ %s of size %d can't consist of type %s (%d)" % (
				xx(vec), size, type.GetName(), type.GetByteSize()))
	for ind in range(int(size/type.GetByteSize())):
		val = dpc.sbt.CreateValueFromAddress(
			"v.%d" % ind,
			lldb.SBAddress(ptrs[0] + ind * type.GetByteSize(), dpc.sbt),
			type)
		val.GetData()
		if val.error and val.error.Fail():
			raise ReinterpretException(
				"vector @ %s of size %d: unable to read [%d] '%s'" % (
					xx(vec), size, ind, val.error))
		yield val

def getNamedMember(val, name):
	cv = val.GetChildMemberWithName(name)
	if not cv.IsValid():
		raise Exception("Failed to get member '%s' from '%s' object" % (
			name, val.GetType().GetName()))
	return cv

def telescope(debugger, command, result, internal_dict):
	cmdl = re.split(r"\s+", command)
	if len(cmdl) > 2:
		print("USAGE: xt [START [END]]")
		return
	tg = Target(ArgsForRepl(), debugger, debugger.GetSelectedTarget())
	tg.process = tg.sbt.process
	th = tg.process.GetSelectedThread()
	start = cmdl[0] and unxx(cmdl[0]) or th.frames[0].sp
	stack = tg.printStackInfo(th)
	end = len(cmdl) > 1 and unxx(cmdl[1]) or stack.GetRegionEnd()
	tg.printPointers(start, end, stack)

def find1Type(sbt, name):
	if (nt := len(types := sbt.FindTypes(name))) != 1:
		raise DpcError("%d types '%s'" % (nt, name))
	return types.GetTypeAtIndex(0)

def find1stTypeImpl(sbt, name):
	executable = sbt.modules[0]
	for i in range(executable.GetNumCompileUnits()):
		u = executable.GetCompileUnitAtIndex(i)
		for t in u.GetTypes():
			print(t.GetName())
			if t.GetName().startswith(name + "<"):
				return t

class GtkTree:
	def __init__(self, sbt):
		self.sbt = sbt
		self.GtkRBTree = find1Type(sbt, "GtkRBTree")
		self.GtkRBNode = find1Type(sbt, "GtkRBNode")
		
	def doPrintTree(self, pt, prefix):
		print(" %s %s tree" % (xx(pt), prefix))
		vt = self.sbt.CreateValueFromAddress(
			"tree", lldb.SBAddress(pt, self.sbt), self.GtkRBTree)
		vnp = vt.GetChildMemberWithName("root")
		if vnp.GetValueAsUnsigned() == 0:
			print(" (null root)")
			return
		self.doPrintNode(vnp, prefix)

	def doPrintNode(self, vnp, prefix):
		if vnp.GetValueAsUnsigned() == 0:
			return
		# vn = vnp.GetChildAtIndex(0)
		print(" %s %s node" % (xx(vnp.GetValueAsUnsigned()), prefix))
		pt = vnp.GetChildMemberWithName("children").GetValueAsUnsigned()
		if pt:
			self.doPrintTree(pt, prefix + " ")
		left = vnp.GetChildMemberWithName("left")
		self.doPrintNode(left, prefix)
		self.doPrintNode(vnp.GetChildMemberWithName("right"), prefix)
	
def printGtkTree(debugger, command, result, internal_dict):
	cmdl = re.split(r"\s+", command)
	if len(cmdl) > 1:
		print("USAGE: pgt [GtkRBTree*]")
		return
	GtkTree(debugger.GetSelectedTarget()).doPrintTree(unxx(cmdl[0]), "")

try:
	import lldb
except ImportError:
	if sys.platform.startswith("linux"):
		sys.path.append(
			"/usr/lib/llvm-18/lib/python3.12/site-packages",
			"/usr/lib64/python3.6/site-packages")
#			"/usr/lib/python2.7/dist-packages/lldb-3.8")
	else:
		sys.path.append("\
/Library/Developer/CommandLineTools/Library/PrivateFrameworks/LLDB.framework/\
Resources/Python")
import lldb, lldb.plugins.parsed_cmd 

def check(error):
	if error.fail:
		raise Exception(str(error))

def cut(s, limit):
	return len(s) > (limit+3) and "%s..." % s[:limit] or s

def getIdFromModSpec(ms):
	uuid = ctypes.string_at(int(ms.GetUUIDBytes()), ms.GetUUIDLength())
	return uuid.hex().upper()
	
def getId(m, long=False):
	s = m.GetUUIDString()
	if not s:
		return s
	s = "".join(s.split("-")).upper() # + "0"
	if long:
		return s
	return s[0:8]

def justifyId(m, long=False):
	return (long and "%40s" or "%8s") % getId(m, long)

def nn(n):
	n = str(int(n))
	return ",".join(re.findall(r"\d{1,3}", n[::-1]))[::-1]

def xx(n):
	n = "%X" % n
	return ",".join(re.findall(r"[0-9a-fA-F]{1,4}", n[::-1]))[::-1]

def xr(start, end):
	sx = xx(start)
	ex = xx(end)
	prefix = ""
	if len(sx) == len(ex):
		for p in range(len(ex)):
			if sx[p] != ex[p]:
				break
			prefix += sx[p]
	return "%s[%s-%s]" % (prefix, sx[len(prefix):], ex[len(prefix):])

def splitPath(path):
	"Support all path separators"
	return re.split(r"[\\/]+", path)

def hexDumpMem(process, start, end, error):
	lsize = 16
	while start < end:
		if lsize > end - start:
			lsize = end - start
		st = process.ReadMemory(start, lsize, error)
		if error.fail:
			raise Exception(str(error))
		sys.stdout.write(" %X " % start)
		sys.stdout.write(
			("%02X " * lsize) % tuple(bytearray(st)))
		for c in st:
			if type(c) == int:
				sys.stdout.write(c < 32 and "." or chr(c))
				continue
			sys.stdout.write(ord(c) < 32 and "." or c)
		sys.stdout.write("\n")
		start += lsize

def printSize(count, name):
	print("%20s %s" % (nn(getattr(count, name.lower())), name))

def abbreviate_identifiers(code: str) -> str:
	"""
	Replaces repeated identifiers in a string with abbreviations.
	First occurrence stays intact, subsequent ones get replaced.
	Abbreviations are first letter + '.' (e.g., 'count' -> 'c.')
	"""
	identifier_pattern = re.compile(r'\b[a-zA-Z_][a-zA-Z0-9_]*\b')
		
	seen = {}

	def replacer(match):
		identifier = match.group(0)
		if identifier not in seen:
			seen[identifier] = identifier[0] + "."
			return identifier	 # keep the first occurrence
		else:
			return seen[identifier]

	return identifier_pattern.sub(replacer, code)

ptrSize = 8

class PrintUniqueStacks(lldb.plugins.parsed_cmd.ParsedCommand):
	def setup_command_definition(self):
		pass

	def get_short_help(self):
		return "Print unique stacks (deduplicated by backtrace)"

	def __call__(self, debugger, args, exe_ctx, result):
		tg = Target(ArgsForRepl(), debugger, debugger.GetSelectedTarget())
		tg.process = tg.sbt.process
		tg.printUniqueCallchains()
		print("")

class Count:
	def __init__(self):
		self.absent = 0
		self.modules = 0
		self.other = 0
		self.system = 0
		self.store = 0

class WorkCount:
	def __init__(self, todo=0):
		self.done = self.successful = 0
		self.total = todo

class DebuggerError(Exception):
	pass

class Util:
	def verb(self, message):
		if not self.args.verbose:
			return
		self.print(message)

	def print(self, message, count=None):
		count = count or hasattr(self, "count") and self.count
		if count:
			sys.stderr.write("\r[%s / %s] " % (
				nn(count.done), nn(count.total)))
		sys.stderr.write(message)
		sys.stderr.flush()

	def setVar(self, name, value):
		old = lldb.SBDebugger.GetInternalVariableValue(
			name, self.debugger.GetInstanceName())
		check(lldb.SBDebugger.SetInternalVariable(
			name, value, self.debugger.GetInstanceName()))
		self.verb("Variable '%s' was set to '%s' (was '%s')\n" % (
			name, value, " ".join(old)))

	def check(self, result):
		if self.error.fail:
			raise DebuggerError(str(self.error))
		return result

	def softCheck(self, result):
		return self.error.fail and self.error or result

	def describeAddr(self, addr):
		ptr = addr.GetLoadAddress(self.sbt)
		return CallSite(self).describePointer(ptr, addr)
	
	def getRegion(self, ptr):
		reg = lldb.SBMemoryRegionInfo()
		check(self.process.GetMemoryRegionInfo(ptr, reg))
		return reg.IsMapped() and reg or None

	def readPtr(self, ptr):
		return self.check(
			self.sbt.process.ReadPointerFromMemory(ptr, self.error))

	def getNamedIcu(self, val, name):
		return self.softCheck(icu(
			getNamedMember(val, name).GetLoadAddress(),
			self.sbt.process, self.error))


class SymbolNotOnServer(Exception):
	pass

class CallSite(Util):
	"""
	An object tracking a saved caller PC on stack. 
	TODO: Transform this class into more general pointer classifier
	"""
	def __init__(self, target):
		self.error = target.error
		self.sbt = target.sbt
		self.sbp = target.process
		self.args = target.args
		self.target = target
		self.reg = None
		class Count:
			def __init__(self):
				self.words = self.calls = self.destinations = 0
				self.pointers = self.readable = 0
		self.count = Count()
		self.stack = self.sp = self.pos = None

	def describePointer(self, ptr, addr=None):
		self.callerInstrs = []
		self.ra0 = ptr
		# TODO:
		# Move describeAddr here
		# Detect pointers to another threads stack bc it's probably
		# some kind of anomaly
		# Also, detect pointers that point down the stack - can't be
		# good too
		if not self.stack is None: 
			if ptr >= self.sp and ptr <= self.stack.GetRegionEnd():
				return "Same stack +%s" % (nn(ptr-self.pos))
		self.reg = self.target.getRegion(ptr)
		if not self.reg:
			return "Unmapped"
		if self.target.getThreadWithStackInRegion(self.reg):
			return "Other stack" if self.stack else "Stack"
		self.pa = addr or lldb.SBAddress(ptr, self.sbt)
		if not self.pa.section.IsValid():
			return "Heap or mmap"
		desc = "Indescribable"
		if self.pa.function.IsValid():
			off = self.pa.offset - self.pa.function.addr.offset
			desc = "%s+%d" % ( self.pa.function.name, off)
		elif self.pa.symbol.IsValid():
			off = self.pa.offset - self.pa.symbol.addr.offset
			desc = "%s+%d" % ( self.pa.symbol.name, off)
		elif self.pa.section.IsValid():
			desc = "%s%s+%s" % (
				self.pa.module.GetFileSpec().basename, self.pa.section.name,
				xx(self.pa.offset))
			if ".module_image" == self.pa.section.name:
				desc += " (buildId=%s)" % getId(self.pa.module, self.args.long)
		elif self.pa.module.IsValid():
			desc = self.pa.module.name
		# Try to load caller instructions regardles if it is code
		# section or not
		self.loadCallInstrFromAddress(ptr, self.pa)
		return desc

	def loadCallInstr(self, pretaddrl):
		ra0 = self.target.check(self.sbp.ReadPointerFromMemory(
			pretaddrl, self.sbt.error))
		msg = self.loadCallInstrGetMessage(ra0)
		if msg:
			print("%s: %s %s" % (xx(pretaddrl), xx(self.ra0), msg))
		else:
			return self.call

	def loadCallInstrGetMessage(self, ra0):
		self.ra0 = ra0
		self.ra = ra = lldb.SBAddress(ra0, self.sbt)
		if not ra.section.IsValid():
			return "no sec"
		self.count.pointers += 1
		return self.loadCallInstrFromAddress(ra0, ra)

	def loadCallInstrFromAddress(self, ra0, ra):
		self.callerInstrs = []
		if ra.section.file_size == 0:
			return "no image"
		self.count.readable += 1
		if ra.offset == 0:
			return
		ibufoff = max(ra.offset - 100, 0)
		# If that's a real return address, there must be call
		# instruction before that. It can be 5, 3 or 2 bytes.
		bytes = ra.section.GetSectionData().ReadRawData(
			self.error, ibufoff, ra.offset - ibufoff)
		ibuf = lldb.SBAddress(ra.section, ibufoff)
		if self.error.fail:
			raise Exception("%s @ %s %s %s section size = %s" % (
				self.error, self.target.getName(ra.module),
				xx(self.sbt.GetLoadAddress(ibuf)),
				self.describeAddr(ibuf), ra.section.file_size))
		self.call = call = self.getCall(bytes, ra0)
		if call:
			cia = lldb.SBAddress(ra0 - len(call.ibs), self.sbt)
			self.callerInstrs = self.sbt.GetInstructions(cia, call.ibs)
		
	def getCall(self, bytes, end, verbose=False):
		class Call:
			def __init__(self, ibs):
				self.ibs = ibs
		if len(bytes) >= 5 and bytes[-5] == 0xe8:
			call = Call(bytes[-5:])
			call.destination = struct.unpack("i", bytes[-4:])[0] + end
			return call
		if len(bytes) >= 3	and bytes[-3] == 0xff:
			call = Call(bytes[-3:])
			call.destination = None
			return call
		if verbose:
			print("	 Unknown instr %x %x %x %x %x" % bytes[-5:-1])
		return False


class UnwindFrame(CallSite):
	def loadTopOfStack(self, thread, stack):
		self.stack = stack
		self.pc = thread.frames[0].pc
		self.sp = thread.frames[0].sp
		self.source = "PC"
		return self
	
	def loadReturnAddress(self, loc, stack):
		# After call SP points at return address
		# We need SP before call
		self.stack = stack
		self.source = self.descStackPtr(loc)
		self.pc = self.target.check(
			self.sbp.ReadPointerFromMemory(loc, self.error))
		self.sp = loc + ptrSize
		return self

	def descStackPtr(self, ptr):
		return "S-%x" % (self.stack.GetRegionEnd() - ptr)

	def calculateFrameSize(self):
		self.pushCount = self.popCount = self.spDecrement = 0
		for ii in self.insns:
			mn = ii.GetMnemonic(self.sbt)
			if "pushq" == mn:
				self.pushCount += 1
			elif "popq" == mn:
				self.popCount += 1
			elif "subq" == mn:
				ops = ii.GetOperands(self.sbt).split(", %rsp")
				if len(ops) == 2:
					if self.spDecrement:
						sys.stdout.write(
							"Extra sub SP instruction (1st sub=%X): " % self.spDecrement)
						self.target.printInstruction(ii)
					elif not ops[0].startswith("$"):
						sys.stdout.write("Non-constant sub SP: ")
						self.target.printInstruction(ii)
						continue
					self.spDecrement += int(ops[0][1:], base=0)

	def findCaller(self):
		pc = lldb.SBAddress(self.pc, self.sbt)
		self.insns = pc.symbol.IsValid() and\
			self.target.getFuncInstructions(pc, self.pc)
		if self.insns:
			self.calculateFrameSize()
			self.returnAddrLocation = self.sp +\
				(ptrSize*(self.pushCount - self.popCount)) + self.spDecrement
			if self.returnAddrLocation >= self.sp:
				self.loadCallInstr(self.returnAddrLocation)
				return self
			else:
				print("	 popCount=%d pushCount=%d spDecrement=%d, start searching..." % (
					self.popCount, self.pushCount, self.spDecrement))
		else:
			print(
				"	 Instructions unreadable @ %s." % (self.describeAddr(pc))) 
			print(" Starting search for return address...")
		reg = self.target.getRegion(self.sp)
		# If nothing pushed, return address can be located @ sp
		for pretaddrl in range(self.sp, reg.GetRegionEnd(), ptrSize):
			self.count.words += 1
			call = self.loadCallInstr(pretaddrl)
			if not call:
				continue
			self.count.calls += 1
			if not call.destination:
				continue
			self.count.destinations += 1
			# We're looking for the call to an unloaded module
			# Therefore it must be call to .plt
			if call.destination:
				da = self.sbt.ResolveLoadAddress(call.destination)
				if da.section.name == ".text":
					if 0:
						print("Skip:")
						for inn in self.callerInstrs:
							self.target.printInstruction(inn, True)
					self.callerInstrs = None
					continue
			self.returnAddrLocation = pretaddrl
			break
		return self

	def getReturnAddrLoc(self):
		self.findCaller()
		if self.insns:
			if self.args.disassembly:
				for inn in self.insns:
					self.target.printInstruction(inn)
				print(" ==== end of disassembly")
			sys.stdout.write("	%d push, %d pop, %d sub, prev pc @ %s\n" % (
				self.pushCount, self.popCount, self.spDecrement,
				xx(self.returnAddrLocation)))
		else:
			sys.stdout.write(
				"	 Tried %d words, %d -> a section, %d readable, %d calls, %d destinations\n" % (
					self.count.words, self.count.pointers,
					self.count.readable, self.count.calls,
					self.count.destinations))
		for inn in self.callerInstrs:
			self.target.printInstruction(inn, True)
		return self.returnAddrLocation

	def print(self):
		pc = lldb.SBAddress(self.pc, self.sbt)
		# sys.stdout.write("\u2666 %s: %s %s %s\n" % (
		sys.stdout.write("%s: %s %s %s\n" % (
			self.source, xx(self.pc), self.target.getName(pc.module),
			self.target.describeAddr(pc)))
		sys.stdout.flush()

class MemTypeCount:
	def __init__(self):
		self.heap = self.stack = 0

class Target(Util):
	def __init__(self, args, debugger, sbt=None):
		self.args, self.debugger = args, debugger
		self.error = lldb.SBError()
		self.sbt = sbt or self.check(self.debugger.CreateTarget(
			"", "", "", True, self.error))
		# Hack: add mapping to nonexistent files so
		# ModuleList::GetSharedModule gets called first without a real
		# path and finds storage files in target.exec-search-paths
		if self.args.storage\
			and hasattr(self.sbt, "AppendImageSearchPath"):
			self.check(self.sbt.AppendImageSearchPath(
				"/Volumes", self.args.storage, self.error))
			self.check(self.sbt.AppendImageSearchPath(
				"/Applications", self.args.storage, self.error))
		if self.args.download:
			self.setVar("target.preload-symbols", "false")
		self.storagePath = None
			
	def load(self, path):
		self.path = path
		if self.args.storage:
			self.storagePath = os.path.abspath(self.args.storage)
		else:
			self.storagePath = os.path.dirname(os.path.abspath(self.path))
		dirs = [self.storagePath] +\
				[os.path.join(self.storagePath, x) for
					x in os.listdir(self.storagePath) if
					not x.startswith(".")]
		# TODO Check spaces in paths
		self.setVar("target.exec-search-paths", " ".join(dirs))
		self.verb("Loading '%s'..." % self.path)
		if sys.version_info[0] < 3:
			self.process = self.sbt.LoadCore(path)
		else:
			self.process = self.check(
				self.sbt.LoadCore(path, self.error))
		for m in self.sbt.modules:
			self.verb("Looking for symbols for '%s'...\n" % (
				m.file.fullpath))
			pdb = m.file.fullpath + ".pdb"
			if not os.path.isfile(pdb):
				self.verb("No symbol file '%s'\n" % pdb)
				pdb = m.file.basename.replace(".exe", "").replace(".dll", "") +\
					".pdb"
				if not os.path.isfile(pdb):
					self.verb("No symbol file '%s'\n" % pdb)
					pdb = os.path.join(self.storagePath, pdb)
					if not os.path.isfile(pdb):
						self.verb("No symbol file '%s'\n" % pdb)
						continue
			if 0 and\
				 not m.file.fullpath.startswith(self.args.storage) and\
				 not m.file.fullpath.startswith(self.storagePath):
				continue
			self.addDebugInfoFile(m, pdb)
		self.verb("DONE\n")
		return self

	def addDebugInfoFile(self, mod, path):
		self.runDebuggerCommand("target symbols add %s" % path)
		if not mod:
			for m2 in self.sbt.modules:
				if os.path.realpath(m2.GetSymbolFileSpec().fullpath) ==\
					 os.path.realpath(path):
					mod = m2
					break
		if not mod:
			raise DebuggerError("Symbol file '%s' does not match to any module")
		if os.path.realpath(mod.GetSymbolFileSpec().fullpath) !=\
			 os.path.realpath(path):
			raise DebuggerError(
				"Symbol file path must be '%s' but is '%s'" % (
					path, mod.GetSymbolFileSpec().fullpath))
		self.verb("Module='%s' %d symbols in '%s' %d CUs\n" % (
			mod.GetFileSpec(),
			mod.GetNumSymbols(),
			mod.GetSymbolFileSpec(),
			mod.GetNumCompileUnits()))

	def matchDebugInfoFile(self, mod, path):
		if mod:
			raise Exception("TODO")
		specs = lldb.SBModuleSpecList.GetModuleSpecifications(path)
		for m2 in self.sbt.modules:
			if getId(m2, True) == getIdFromModSpec(specs.GetSpecAtIndex(0)):
				return True
		raise DebuggerError("Symbol file '%s' doesn't match %s" % (
			path, mod and ("module %s" % mod) or "any  module"))

	def search(self, paths):
		search = self.args.smod
		limit = self.args.slim and int(self.args.slim) or float("inf")
		if search:
			matchingModsWithoutOrWithSyms = [[],[]]
			for m in self.sbt.modules:
				bn = m.GetFileSpec().basename
				if search == bn or search.split(".")[0] == bn.split(".")[0]:
					hasSym = m.GetSymbolFileSpec().IsValid() and\
						m.GetSymbolFileSpec().fullpath != m.GetFileSpec().fullpath
					matchingModsWithoutOrWithSyms[hasSym].append(m)
			self.verb("Matching=%s\n" % (matchingModsWithoutOrWithSyms))
			if not matchingModsWithoutOrWithSyms[False]:
				if matchingModsWithoutOrWithSyms[True]:
					raise Exception(
						"Modules '%s' already has matching symbols" % (
							matchingModsWithoutOrWithSyms[True]))
				raise Exception("No module matching '%s'" % search)
		cnt = WorkCount(len(paths))
		savedPaths = []
		for i, path in enumerate(paths):
			cnt.done = i
			if path.endswith(".zip"):
				tmpDir = os.path.join(self.storagePath, "tmp")
				if not os.path.isdir(tmpDir):
					os.mkdir(tmpDir)
				self.print("Looking in file '%s'...\n" % path, cnt)
				import zipfile
				zf = zipfile.ZipFile(path, "r")
				dbin = None
				for name in zf.namelist():
					self.print("In '%s' found '%s'\n" % (path, name))
					bn = os.path.basename(name)
					if not (bn == search or bn.endswith(".pdb")):
						continue
					self.print("Extracting '%s'..." % bn, cnt)
					fp = os.path.join(tmpDir, bn)
					open(fp, "wb").write(zf.read(name))
					savedPaths += self.saveTmpIfMatch(fp, search, cnt)
				if len(savedPaths) >= limit:
					break
		if not savedPaths:
			print("No symbol files found")
			return 1
		print(shlex.join(["gdb", self.path] + sum(
			[["-ex","add-symbol-file " + x] for x in savedPaths], [])))

	def saveTmpIfMatch(self, fp, search, cnt):
		try:
			self.matchDebugInfoFile(
				search and matchingModsWithoutOrWithSyms[0][0], fp)
		except DebuggerError as e:
			self.print("%s. Removing '%s'..." % (e, fp), cnt)
			os.unlink(fp)
			return []
		# Good file
		np = os.path.join(self.storagePath, os.path.basename(fp))
		print("Moving '%s' to '%s'" % (fp, np))
		os.rename(fp, np)
		return [np]
	

	def runDebuggerCommand(self, cmd):
		self.verb("Running '%s'..." % cmd)
		self.debugger.HandleCommand(cmd)

	def attach(self, name):
		self.verb("Attaching '%s'..." % name)
		self.process = self.check(self.sbt.Attach(
			lldb.SBAttachInfo(name, False), self.error))
		self.verb("DONE\n")
		return self

	storageShort = u"\u25A0"
	def getName(self, m):
		if not m.IsValid():
			return "-"
		if self.args.storage and\
			 m.file.fullpath.startswith(self.args.storage):
			return self.storageShort + m.file.fullpath[len(self.args.storage):]
		if self.storagePath and\
			 m.file.fullpath.startswith(self.storagePath):
			return self.storageShort + m.file.fullpath[len(self.storagePath):]
		parts = splitPath(m.file.fullpath)
		if len(parts) <= 1:
			return m.file.fullpath
		return "/%s/.../%s" % (parts[1], parts[-1])

	def getSymbolFileName(self, m):
		sfs = m.GetSymbolFileSpec()
		if not sfs.fullpath:
			return sfs
		if sfs == m.file:
			return "-"
		if sfs.dirname and re.match(".+[.]dSYM/", sfs.dirname):
			return "dSYM"
		if sfs.fullpath.startswith(m.file.fullpath):
			return u"\u2026" + sfs.fullpath[len(m.file.fullpath):]
		if self.args.storage and sfs.fullpath.startswith(self.args.storage):
			return self.storageShort + sfs.fullpath[len(self.args.storage):]
		return sfs

	def getSourceLine(self, f):
		if not f.line_entry.IsValid():
			return " "
		cwd = os.getcwd().split(os.sep)[-1]
		parts = splitPath(f.line_entry.file.fullpath)
		try:
			path = os.sep.join(parts[parts.index(cwd) + 1:])
		except ValueError:
			path = f.line_entry.file.fullpath
		return "%s:%d" % (path, f.line_entry.line)

	def getPossibleSourceLines(self, addr, template):
		if not addr.line_entry.IsValid():
			return []
		return self.getPossibleSourceLines2(
			addr.line_entry.file, addr.line_entry.line, template)

	def getRelativePath(self, path):
		cwd = os.getcwd().split(os.sep)[-1]
		parts = splitPath(path)[::-1]
		bases = [cwd]
		if self.args.base:
			bases += self.args.base.split(",")
		from itertools import takewhile
		return os.sep.join(
			list(takewhile(lambda x: x not in bases, parts))[::-1])

	def getPossibleSourceLines2(self, filespec, lineNumber, template):
		path = self.getRelativePath(filespec.fullpath)
		if path == filespec.fullpath:
			found = 0
			if 0:
				for root, dirnames, filenames in os.walk("."):
					if not filespec.basename in filenames:
						continue
					yield template % (
						os.path.join(root, filespec.basename),
						lineNumber)
					found += 1
			if not found:
				yield template % (
					filespec.fullpath, lineNumber)
			return
		yield template % (path, lineNumber)

	def printStacks(self):
		for t in self.process.threads:
			self.printWordsFromStack(t)

	def printStackInfo(self, t):
		sp = t.frames[0].sp
		reg = lldb.SBMemoryRegionInfo()
		error = self.process.GetMemoryRegionInfo(sp, reg)
		if error.fail:
			print("Thread%3d: sp=%s '%s' no region = '%s'" % (
				t.idx, xx(t.frames[0].sp), t.GetStopDescription(80), error))
			return None
		print("Thread%3d: sp=%s in %s-%s (%s/%s words) '%s'" % (
			t.idx, xx(t.frames[0].sp),
			xx(reg.GetRegionBase()), xx(reg.GetRegionEnd()),
			nn((reg.GetRegionEnd() - t.frames[0].sp)/ptrSize),
			nn((reg.GetRegionEnd() - reg.GetRegionBase())/ptrSize),
			t.GetStopDescription(80)))
		return reg
		
	def printUniqueCallchains(self):
		from collections import defaultdict
		stacks = defaultdict(list)
		for th in self.process.threads:
			key = []
			for f in th.frames:
				fn = f.GetFunctionName()
				mod = f.addr.module.IsValid() and self.getName(f.addr.module) or "-"
				src = ""
				if f.line_entry.IsValid():
					src = " %s:%d" % (
						self.getRelativePath(f.line_entry.file.fullpath), f.line_entry.line)
				key.append("%s %s%s" % (fn, mod, src))
			stacks[tuple(key)].append(th)
		for stack, threads in sorted(stacks.items(), key=lambda x: -len(x[1])):
			print("--- %d thread(s) ---" % len(threads))
			for th in threads:
				desc = th.GetStopDescription(80)
				print("  Thread %d: %s" % (th.idx, desc))
			for frame in stack:
				print("  %s" % frame)
			print("")

	def printDecodedFrames(self, t):
		self.prevVals = {}
		reg = self.printStackInfo(t)
		for f in t.frames:
			print("---- %d" % f.idx)
			self.printFrame(f, reg)

	def printFrame(self, f, reg):
		if 1 or self.args.base:
			printed = 0
			for prefix in self.getPossibleSourceLines(f, "%s:%d: "):
				if printed:
					sys.stdout.write("...\n")
					sys.stdout.write(prefix)
					sys.stdout.flush()
				printed += 1
		print("%s=pc '%s' %s (%s)" % (
			xx(f.pc), f.GetFunctionName(),
			self.getName(f.addr.module),
			self.getSymbolFileName(f.addr.module)))
		if f.IsInlined():
			print("Real function = %s" % (
				f.addr.symbol.name))
		deltaMsg = skippedMsg = ""
		if f.sp != self.prevVals.get("sp"):
			if "sp" in self.prevVals:
				delta = f.sp - self.prevVals["sp"]
				deltaMsg = "prev+%X " % (delta)
				skippedMsg = ", skipped %s" % nn(delta/ptrSize-1)
			print("sp=%s %s(%s words%s)" % (
				xx(f.sp), deltaMsg,
				nn((reg.GetRegionEnd() - f.sp)/ptrSize), skippedMsg))
			self.prevVals["sp"] = f.sp
		if not self.args.disassembly: return
		self.printRegs(f, prevVals)
		print("")
		if f.IsInlined(): return
		insns = self.getFuncInstructions(f)
		if insns:
			for ii in insns:
				self.printInstruction(ii)
		return
		# arguments, locals, statics, in_scope_only
		for v in f.GetVariables(True, True, False, True):
			print("'%s' loc='%s' v='%s' t=%s(%d)" % (
				v.name, v.location, v.value,
				v.type.name, v.type.size))

	def printRegs(self, f, prevVals):
		for rs in f.GetRegisters():
			for v in rs:
				if v.name[0] == "r" and\
					 not v.name in ["rflags", "rip", "rsp"]:
					if prevVals.get(v.name) == v.value:
						continue
					if v.value is None:
						continue
					sys.stdout.write("%s=%s " % (
						v.name, xx(v.GetValueAsUnsigned())))
					prevVals[v.name] = v.value
		print("")

	def printInstruction(self, ii, needCode=False):
		ibs = ""
		data = ii.GetData(self.sbt)
		bytes = self.check(
			data.ReadRawData(self.error, 0, ii.GetByteSize()))
		if needCode:
			for bv in bytes:
				ibs += "%02X " % bv
		comment = ii.GetComment(self.sbt)
		if comment:
			comment = " ; " + comment
		name = ii.GetMnemonic(self.sbt)
		ptr = ii.addr.GetLoadAddress(self.sbt)
		print("	 %s %s%s %s%s" % (
			xx(ptr), ibs, name, ii.GetOperands(self.sbt), comment))
		if "callq" == name:
			call = UnwindFrame.getCall(self, bytes, ptr + len(bytes))
			if call and call.destination:
				da = self.sbt.ResolveLoadAddress(call.destination)
				print("	 => %s %s %s %s" % (
					xx(call.destination), self.getName(da.module),
					UnwindFrame.describeAddr(self, da), da.section.name))
			
	def getFuncInstructions(self, f, pc):
		# Doesn't work
		# insns = f.function.GetInstructions(self.sbt)
		# also: symbol.GetInstructions
		size = f.symbol.end_addr.GetOffset() - f.symbol.addr.GetOffset()
		secBase = pc - f.offset
		#fpos = f.symbol.IsValid() and\
		#	f.symbol.addr.GetLoadAddress(self.sbt)
		fpos = secBase + f.symbol.addr.offset
		if not f.symbol.addr.IsValid():
			print("Addr not valid on %s" % f.symbol)
		if not fpos or not size:
			return
		bytes = f.symbol.addr.section.GetSectionData().\
			ReadRawData(self.error, f.symbol.addr.offset, size)
		if self.error.fail:
			bytes = self.process.ReadMemory(fpos, size, self.error)
			if self.error.fail:
				print("Error reading memory %s size=%s (%s %s(=%s):%s) = '%s'" % (
					xx(fpos), xx(size),
					f.symbol, f.symbol.addr.section.name,
					f.symbol.addr.section.GetLoadAddress(self.sbt),
					xx(f.symbol.addr.offset), self.error))
				return
		return self.sbt.GetInstructions(f.symbol.addr, bytes)

	def printWordsFromStack(self, n):
		if type(n) is int:
			th = self.process.GetThreadByIndexID(n)
			if not th.IsValid():
				raise Exception("No thread %d" % n)
		else:
			th = n
		sp = th.frames[0].sp
		stack = self.printStackInfo(th)
		self.printRegs(th.frames[0], {})
		if self.args.threadm or self.args.fa:
			self.doCmd("memory read --force -fA 0x%X 0x%X" % (
				sp, stack.GetRegionEnd()))
			return
		if self.args.hex:
			self.check(hexDumpMem(
				self.process, sp, stack.GetRegionEnd(), self.error))
			return
		# -x = try to follow call chain
		# -z = trawl stack for everything that can be a caller PC
		if self.args.thread:
			uwf = UnwindFrame(self).loadTopOfStack(th, stack)
			while uwf:
				uwf.print()
				uwf = UnwindFrame(self).loadReturnAddress(
					uwf.getReturnAddrLoc(), stack)
			return
		self.printPointers(sp, stack.GetRegionEnd(), stack)

	def printPointers(self, sp, end, stack):
		"""
		TODO:
		Need more fundamental pointer classification to bins like
		"same stack" (done) "other stack" "heap" "not pointer"
		"code" (done) "code/caller PC" (done) "data" (resolve recursively, done) 
		"""
		cs = CallSite(self)
		cs.stack = stack
		cs.sp = sp
		for pretaddrl in range(sp, stack.GetRegionEnd(), ptrSize):
			# If it points to current stack then it can't be return address
			self.error.Clear()
			ra0 = self.check(self.process.ReadPointerFromMemory(
				pretaddrl, self.error))
			cs.pos = pretaddrl
			msg = cs.describePointer(ra0)
			print("%s: %s %s" % (xx(pretaddrl), xx(ra0), msg))
			for ii in cs.callerInstrs:
				self.printInstruction(ii)
			# Don't follow pointer if in the same region or code
			if cs.callerInstrs or (ra0 >= sp and ra0 <= end):
				continue
			for level in range(1, 32):
				if (cs.reg is None) or cs.pa.function.IsValid():
					break
				# TODO Detect loops
				self.error.Clear()
				ra0 = self.process.ReadPointerFromMemory(ra0, self.error)
				msg = self.error.Fail() and self.error or cs.describePointer(ra0)
				print("%s %s %s" % (" "*level, xx(ra0), msg))
				if self.error.Fail():
					break

	def getAscii(self, pos, size):
		# ReadCStringFromMemory can't specify the code page
		seq = self.process.ReadMemory(pos, size, self.error)
		if self.error.fail:
			return "error: %s" % self.error
		for b in seq:
			if b == 0:
				return ""
		return seq.decode("windows-1251")

	def doCmd(self, cmd):
		self.verb("cmd: '%s'\n" % cmd)
		self.debugger.HandleCommand(cmd)

	def describeName(self, path):
		bn = os.path.basename(path)
		return len(bn) < 32 and bn or bn[:32] + "..."

	def getThreadWithStackInRegion(self, r):
		for th in self.process.threads:
			sp = th.frames[0].sp
			if sp >= r.GetRegionBase() and sp < r.GetRegionEnd():
				return th

	def countMemoryByType(self):
		mc = MemTypeCount()
		regions = self.process.GetMemoryRegions()
		sbr = lldb.SBMemoryRegionInfo()
		for i in range(regions.GetSize()):
			if not regions.GetMemoryRegionAtIndex(i, sbr):
				raise Exception("TODO")
			# Nothing is marked writable no Windows
			if not sbr.IsReadable() or sbr.IsExecutable():
				continue
			size = sbr.GetRegionEnd() - sbr.GetRegionBase()
			if self.getThreadWithStackInRegion(sbr):
				mc.stack += size
			else:
				mc.heap += size
		return mc

	def scanForVtables(self):
		mc = self.countMemoryByType()
		raise Exception("TODO")

	def printRegions(self):
		class Count:
			def __init__(self):
				self.scanned = self.total = self.errors = self.readable = 0
		if self.args.scan:
			class Sample():
				def __init__(self, path):
					self.path = path
					self.bs = open(path, "rb").read()
					if 1:
						pp = self.bs.find(b"?")
						if pp >= 0:
							self.bs = self.bs[pp+1:]
			samples = []
			if os.path.isdir(self.args.scan):
				for name in os.listdir(self.args.scan):
					s = Sample(os.path.join(self.args.scan, name))
					if len(s.bs) > 0:
						samples += [s]
			else:
				samples = [Sample(self.args.scan)]
			count = Count()
		regions = self.process.GetMemoryRegions()
		r = lldb.SBMemoryRegionInfo()
		for i in range(regions.GetSize()):
			if not regions.GetMemoryRegionAtIndex(i, r):
				raise Exception("TODO")
			size = r.GetRegionEnd() - r.GetRegionBase()
			name = r.GetName()
			if name:
				name = os.path.basename(name)
			if self.args.scan and not r.IsReadable(): # or r.IsExecutable():
				continue
			th = self.getThreadWithStackInRegion(r)
			# r.GetNumDirtyPages() always returns 0
			print("%s %s%s%s%s %s %s%s" % (
				self.describeName(self.path),
				(r.IsReadable() and "r" or "."),
				(r.IsWritable() and "w" or "."),
				(r.IsExecutable() and "x" or "."),
				(r.IsMapped() and "m" or "."),
				xr(r.GetRegionBase(), r.GetRegionEnd()),
				name and (" '%s'" % name) or "",
				th and (" S%s" % th.GetIndexID()) or ""))
			if self.args.scan:
				count.readable += 1
				# self.error.Clear() doesn't work
				self.error = lldb.SBError()
				all = self.process.ReadMemory(r.GetRegionBase(), size, self.error)
				if self.error.fail or (all is None) or len(all) < size:
					print("Got %s reading %s bytes from %s" % (
						self.error.fail and self.error or (all and nn(len(all))),
						nn(size), xx(r.GetRegionBase())))
					count.errors += 1
				# Error is for sections that don't have PT_LOAD type
				if not self.error.fail:
					count.total += size
				if self.error.fail or all is None:
					continue
				count.scanned += len(all)
				for sample in samples:
					biggerSize = len(sample.bs) + 40
					p = -1
					while True:
						p = all.find(sample.bs, p + 1)
						if p < 0:
							break
						b = self.process.ReadMemory(
							r.GetRegionBase() + p, biggerSize, self.error)
						if self.error.fail:
							print("%s" % self.error)
							continue
						print("%s %s found='%s'" % (
							sample.path, xx(r.GetRegionBase() + p), b))
		if self.args.scan:
			print("Scanned %s/%s, %d errors of %d regions (%d readable)" %
						(nn(count.scanned), nn(count.total),
						 count.errors, regions.GetSize(), count.readable))
		mc = self.countMemoryByType()
		printSize(mc, "Heap")
		printSize(mc, "Stack")
			

	def replaceModuleFromStorage(self, m):
		"""
		Only need to call this if exec-search-paths doesn't pick up the
		image for some reason
		"""
		for ver in ["."] + os.listdir(self.args.storage):
			path = os.path.join(self.args.storage, ver, m.file.basename)
			if not os.path.isfile(path):
				continue
			# path, architecture, UUID, symfile
			new = self.sbt.AddModule(path, None, None, None)
			if not new:
				raise Exception("%s not added" % path)
			if new.uuid != m.uuid:
				self.verb("Skipping %s (%s) for '%s'\n" % (
					new.file.fullpath, new.uuid, m.file.basename))
				self.sbt.RemoveModule(new)
				continue
			if m.num_sections != new.num_sections:
				self.verb(
					"Module %s: num_sections differ,\n%d in %s\n%d in %s" % (
						m.uuid, m.num_sections, m.file.fullpath,
						new.num_sections, new.file.fullpath))
				self.sbt.RemoveModule(new)
				continue
			for i in range(m.num_sections):
				check(self.sbt.SetSectionLoadAddress(
					new.sections[i],
					m.sections[i].GetLoadAddress(self.sbt)))
			self.sbt.RemoveModule(m)
			return 
		msg = ("'%s' (%s) not in storage" % (
			m.file.fullpath, m.uuid))
		if self.args.unchecked:
			self.verb(msg)
		else:
			raise Exception(msg)

	def listModules(self, tool):
		count = Count()
		mtime = time.localtime(os.path.getmtime(self.path))
		if self.args.modules:
			print("\
nsect, all sections size on disk, id, load addr, name, symfile")
		for m in self.sbt.modules:
			path = m.file.fullpath;
			parts = path.split("/")
			if len(parts) > 1:
				if self.args.storage and\
					 m.file.fullpath.startswith(self.args.storage):
					count.store += 1
				elif parts[1] in ["Volumes", "Applications"]:
					count.other += 1
				else:
					count.system += 1
			else:
				count.other += 1
			name = self.getName(m)
			fsize = sum(s.file_size for s in m.sections)
			if fsize == 0:
				count.absent += 1
			if self.args.absent:
				if fsize != 0:
					continue
				print(time.strftime("%Y-%m-%d %H:%M| %%s %%s", mtime) % (
					(self.args.stat and m.uuid or self.path), name))
				continue
			elif self.args.modules or self.args.sections:
				self.printModule(m)
				if 0 and m.GetUUIDString():
					print(
						"curl -L https://debuginfod.debian.net/buildid/%s/debuginfo	 -o %s.pdb" % (
#						"curl -L https://debuginfod.ubuntu.com/buildid/%s/debuginfo -o %s.pdb" % (
							getId(m, True).lower(), m.file.basename))
				if self.args.sections and fsize:
					def printSec(prefix, sec):
						print("%s%s+%s %s" % (
							prefix, xx(sec.GetLoadAddress(self.sbt)),
							xx(sec.GetByteSize()),
							sec.name))
						for i in range(sec.GetNumSubSections()):
							printSec(prefix + " ", sec.GetSubSectionAtIndex(i))
					for sec in m.sections:
						printSec("	", sec)
		if 1:
			print("gdb -ex 'set sysroot %s' %s %s" % (
				os.path.dirname(self.sbt.executable.fullpath),
				self.sbt.executable, self.path))
		if self.args.stat:
			if not hasattr(tool, "statHeaderPrinted"):
				print(" modules: total, system, store, other, absent")
				tool.statHeaderPrinted = True
			print(
				self.getTime() + "%3d %3d %3d %3d %3d %11s %11s %s '%s'" % (
					self.sbt.GetNumModules(),
					count.system, count.store, count.other, 
					count.absent, cut(self.path, 8),
					cut(self.sbt.executable.basename, 8),
					self.process.selected_thread.frames[0].addr,
					self.process.selected_thread.GetStopDescription(80)))

	def printModule(self, m):
		fsize = sum(s.file_size for s in m.sections)
		print("%2d %08X %s %s '%s' %s" % (
			m.num_sections, fsize, justifyId(m, self.args.long),
			xx(self.getSomeLoadAddress(m)), self.getName(m),
			self.getSymbolFileName(m)))

	def getSomeLoadAddress(self, m):
		for s in m.sections:
			for i in range(s.GetNumSubSections()):
				ss = s.GetSubSectionAtIndex(i)
				if ss.GetLoadAddress(self.sbt) != 0xFFFFFFFFFFFFFFFF:
					return s.GetLoadAddress(self.sbt)
				print("Invalid load address for '%s'" % (ss.name))
			if s.GetLoadAddress(self.sbt) != 0xFFFFFFFFFFFFFFFF:
				break
			print("Invalid load address for	 '%s'" % (s.name))
		return s.GetLoadAddress(self.sbt)

	def getTime(self):
		mtime = time.localtime(os.path.getmtime(self.path))
		return time.strftime("%Y-%m-%d %H:%M| ", mtime)

	def queueDownloadSymbols(self, server):
		if not self.args.storage:
			raise Exception("Can't download without storage dir")
		work = []
		for m in self.sbt.modules:
			if not m.file.fullpath.startswith(self.args.storage):
				continue
			self.verb("Full=%s\n" % m.file.fullpath)
			work.append(DownloadTemplate(
				server, "%s/%s/%s.dSYM.tar.bz2", m))
			if 0: # found this in 1 file on gh, but it never worked
				work.append(DownloadTemplate(
					server, "%s/%s/%s.tar.bz2", m))
		return work


class DownloadTemplate:
	def __init__(self, server, tmpl, m):
		self.server = server
		self.template = tmpl
		self.module = m
		
	def run(self, tool):
		m = self.module
		url = self.server.getUrl(self.template % (
			m.file.basename, getId(m, self.args.long), m.file.basename))
		name = url.split("/")[-1].split(".tar.bz2")[0]
		expected = os.path.join(m.file.dirname, name)
		if os.path.isdir(expected):
			tool.verb("Already have %s\n" % expected)
			return
		# Better have private tmp for each version so nothing gets mixed
		tmp = os.path.join(m.file.dirname, "tmp")
		if not os.path.isdir(tmp):
			os.mkdir(tmp)
		try:
			self.server.download(url, tmp, tool, useCurl=True)
		except SymbolNotOnServer:
			print("%s not found" % url)
			return
		self.rename(os.path.join(tmp, name), expected, tool)

	def rename(self, src, dst, tool):
		tool.verb("Renaming %s -> %s" % (src, dst))
		os.rename(src, dst)
		

class Server:
	def __init__(self, args):
		self.args = args
		self.hasResumableDownloads = True
		
	def startCurlWithResumeEnabled(self, url, dir):
		name = url.split(os.sep)[-1]
		curl = subprocess.Popen(
			["curl", "-L", "-C", "-", url, "-o", name],	cwd=dir)
		return (curl, name)

	def shortenFile(self, path, amount):
		with open(path, "+b") as f:
			f.truncate(os.path.getsize(path) - amount)

	def getUrl(self, path):
		prefix = self.args.download
		if not prefix.endswith("/"):
			if not path.startswith("/"):
				prefix += "/"
		return prefix + path

	def download(self, url, dir, tool, useCurl=False, tarBz2=True):
		tool.print("Downloading %s -> %s..." % (url, dir))
		if not tarBz2:
			import bz2
			bz2dec = bz2.BZ2Decompressor()
		count = None
		if useCurl:
			if self.hasResumableDownloads:
				curl, name = self.startCurlWithResumeEnabled(url, dir)
				if curl.wait() == 33:
					# Some servers break if we have full content...
					self.shortenFile(os.path.join(dir, name), 1)
					curl, _ = self.startCurlWithResumeEnabled(url, dir)
				if curl.wait() == 33:
					self.hasResumableDownloads = False
				elif curl.wait() != 0:
					raise Exception("curl.wait() = %d", curl.wait())
				src = open(os.path.join(dir, name), "rb")
				count = WorkCount(os.path.getsize(os.path.join(dir, name)))
			if not self.hasResumableDownloads:
				curl = subprocess.Popen(
					["curl", "-L", url], stdout=subprocess.PIPE)
				src = curl.stdout
		else:
			import urllib.request
			src = urllib.request.urlopen(url)
			if src.getcode() == 404:
				raise SymbolNotOnServer(src.getcode())
			elif src.getcode() != 200:
				raise Exception("src.getcode() = %d" % src.getcode())
		tar = subprocess.Popen(
			["tar", "xv%s" % (tarBz2 and "j" or "")],
			stdin=subprocess.PIPE, cwd=dir)
		while True:
			p = src.read(16384)
			if not p:
				break
			try:
				message = p.decode("utf-8")
			except Exception:
				message = None
			if message == "Symbol Not Found":
				raise SymbolNotOnServer(message)
			if count:
				count.done += len(p)
			tool.print("unpacking...", count)
			if not tarBz2:
				p = bz2dec.decompress(p)
			try:
				tar.stdin.write(p)
			except EOFError:
				pass # tar exited?
		tar.stdin.close()
		if tar.wait() != 0:
			raise Exception("tar.wait() = %d", tar.wait())


class Tool(Util):
	def __init__(self, args, debugger):
		self.args, self.debugger = args, debugger
		self.work = []
		if self.debugger is None:
			self.verb("Starting debugger...")
			self.debugger = lldb.SBDebugger.Create()
			self.verb("DONE name=%s\n" % self.debugger.GetInstanceName())
		# This is faster than replacing modules in fixModulesNotInStorage
		if self.args.storage:
			self.args.storage = self.args.storage.rstrip("/")
		if self.args.dverbose:
			# doesn't check categories
			if not self.debugger.EnableLog("lldb", ["dyld"]):
				raise Exception("Bad log")
		
	def run(self):
		# self.verb("Press ENTER...")
		# sys.stdin.read(1)
		if self.args.attachname:
			self.handleTarget(Target(self.args, self.debugger).attach(
				self.args.attachname))
		if not self.args.DMPFILE:
			parser.print_help()
			print("LLDB version = '%s'" % lldb.SBDebugger.GetVersionString())
		if self.args.search or self.args.smod or self.args.slim:
			if len(self.args.DMPFILE) < 2:
				print("\
USAGE: (--search|--smod=MODNAME|--slim=NUM) CORE PDB1 [PDB2]...")
			tg = Target(self.args, self.debugger).load(self.args.DMPFILE[0])
			return tg.search(self.args.DMPFILE[1:])
		self.args.DMPFILE.sort(key=os.path.getmtime, reverse=True)
		for path in self.args.DMPFILE:
			try:
				t = Target(self.args, self.debugger).load(path)
				self.handleTarget(t)
			except Exception as e:
				if not self.args.stat: raise
				print("%s = %s" % (path, e))
		self.count = WorkCount(len(self.work))
		for task in self.work:
			task.run(self)
			self.count.done += 1

	def handleTarget(self, t):
		if not self.args.stat:
			print("\u2592\n\u2592 \u2770 Crash %s \u2771\n\u2592" % t.path)
			sys.stdout.flush()
			# TODO Storage here is only 1 level, different from
			# in the script above
			cmd = "lldb %s-o 'target create --core %s'" % (
				self.args.storage and (
					"-o 'settings set target.exec-search-paths %s'" %
					self.args.storage) or "", t.path)
			for mo in t.sbt.modules:
				if mo.GetSymbolFileSpec().IsValid():
					if mo.GetSymbolFileSpec() != mo.file:
						cmd += " -o 'target symbols add %s'" % (
							mo.GetSymbolFileSpec().fullpath)
			if self.args.bt:
				cmd += " -o bt -o quit"
			elif self.args.btu:
				cmd += " -o  'command script import %s' -o btu -o quit" % (
					__file__)
			print(cmd)
		if self.args.download:
			self.work += t.queueDownloadSymbols(Server(self.args))
		elif self.args.threadn or self.args.threadm:
			t.printWordsFromStack(
				int(self.args.threadn or self.args.threadm, 10))
		elif self.args.thread or self.args.fa or self.args.callsites or\
				 self.args.hex or self.args.telescope:
			t.printWordsFromStack(t.process.selected_thread)
		elif self.args.threads:
			t.printStacks()
		elif self.args.bt:
			t.doCmd("bt")
		elif self.args.btu:
			t.printUniqueCallchains()
		elif self.args.threadf:
			t.printDecodedFrames(t.process.selected_thread)
		elif self.args.modules or self.args.sections or self.args.absent:
			t.listModules(self)
		elif self.args.scan:
			t.printRegions()
		elif not self.args.stat:
			t.printRegions()
		if not (self.args.modules or self.args.absent):
			if self.args.stat:
					t.listModules(self)

def icu(ptr, sbp, err):
	"""
	size=64 name=icu_66::UnicodeString
	+0-8			icu_66::Replaceable
	+-0-8			 icu_66::UObject
	+--0-1			icu_66::UMemory
	+8-64			fUnion icu_66::UnicodeString::StackBufferOrFields
	+-8-64		 fStackFields icu_66::UnicodeString::StackBufferOrFields::unnamed
	+--8-10			fLengthAndFlags short
	+--10-64		fBuffer char16_t[27]
	+-8-32		 fFields icu_66::UnicodeString::StackBufferOrFields::unnamed
	+--8-10			fLengthAndFlags short
	+--12-16		fLength int
	+--16-20		fCapacity int
	+--24-32		fArray char16_t *
	"""
	buf = sbp.ReadMemory(ptr, 64, err)
	if err.fail:
		return
	flags, length2, capacity, start = struct.unpack("HxxiixxxxP", buf[8:32])
	if flags & 0x8000:
		length = length2
	else:
		length = flags>>5
	# print("length=%d"	 % length)
	# Length in 2byte chars
	if flags & 2:
		bb = bytes(buf[10:10+length*2])
	else:
		bb = sbp.ReadMemory(start, length*2, err)
	return err.success and bytes(bb).decode("utf-16", errors="replace")

def icuOrError(a0, sbp):
	err = lldb.SBError()
	us = icu(a0, sbp, err)
	return err.fail and err or repr(us)

class DpcError(Exception):
	pass

class DataPrintoutContext(Util):
	def __init__(self, sbt=None, outFile=None):
		self.error = lldb.SBError()
		self.valName = None
		self.filter = self.negFilter = None
		self.printed = set()
		self.sbt = sbt
		self.fp = open(outFile, "w") if outFile else None
	
	def out(self, s):
		print(s)
		if self.fp:
			self.fp.write(s + "\n")
	
	def closeFile(self):
		if self.fp:
			self.fp.close()
		
	def doDetectTypes(self, a0):
		# print("self.filter=%s" % self.filter)
		vtb0 = self.check(self.sbt.process.ReadPointerFromMemory(a0, self.error))
		vtbl = self.sbt.ResolveLoadAddress(vtb0)
		sc = self.sbt.ResolveSymbolContextForAddress(
			vtbl, 255 | lldb.eSymbolContextVariable)
		0 and print("vtb0=%x sc='%s' cu='%s' s.n='%s'" % (
			vtb0, sc, sc.GetCompileUnit(), sc.symbol.name))
		pp = str(sc.symbol.name).split("::`vftable'")
		if len(pp) > 1:
			name = pp[0].replace("const ", "")
			return self.findTypes1(name)
		pp = str(sc.symbol.name).split(" for ")
		if (len(pp) > 1):
			# Heuristic: if we find "vtable for X-in-Y" it's probably Y
			name = pp[1].split("-in-")[-1]
			return self.findTypes1(name)
		# Sometimes can't resolve vtable - check for desstructor
		dest0 = self.check(
			self.sbt.process.ReadPointerFromMemory(vtb0, self.error))
		destr = lldb.SBAddress(dest0, self.sbt)
		# "function" works with PDB debug info
		name = destr.function.name or destr.symbol.name
		0 and print("%s: %s" % (xx(a0), name))
		if not name:
			raise DpcError("Head not resolvable %s" % (xx(dest0)))
		if "~" in name:
			return self.findTypes1(name.split("~")[0][:-2])
		name = name1 = "::".join(name.split("::")[0:-1])
		types1 = self.findTypes(name)
		# Heuristics
		name = name.split("<")[-1].split(",")[0]
		name = name.replace("void * ", "")
		name = name.replace("const ", "")
		types = self.findTypes(name)
		if len(types) == 1:
			return types
		if len(types1) == 1:
			return types1
		raise DpcError(
			"%d types '%s' and %d types '%s'" % (
				len(types), name, len(types1), name1))

	def detectTypes(self, a0):
		try:
			return self.doDetectTypes(a0)
		except DpcError as e:
			raise DpcError("%s while detecting 0x%x" % (e, a0))
	
	def findTypes(self, typeName):
		# print("'%s' = %d types" % (typeName, sbt.FindTypes(typeName).GetSize()))
		return self.sbt.FindTypes(typeName)
		for im in sbt.modules:
			if len(types := im.FindTypes(typeName)):
				break
		return types

	def findTypes1(self, typeName):
		types = self.findTypes(typeName)
		if len(types) != 1:
			raise DpcError("%d types '%s'" % (len(types), typeName))
		return types

	def getValue(self, a0, typeName=None):
		if typeName:
			types = self.findTypes1(typeName)
		else:
			types = self.detectTypes(a0)
		typeName = types.GetTypeAtIndex(0).name
		addr = lldb.SBAddress(a0, self.sbt)
		return self.sbt.CreateValueFromAddress(
			self.valName or ("*"+typeName), addr, types.GetTypeAtIndex(0))
		
	def printValue(self, val, trail):
		indent=None
		if len(trail) > 40:
			self.out("%s%s level too big" % (len(trail), val.name))
			return
		type = val.GetType()
		key = "%s-%s" % (val.GetAddress(), type.name)
		if key in self.printed:
			return
		self.printed.add(key)
		if self.negFilter:
			if val.name and re.search(self.negFilter, val.name):
				return
			if type.name and re.search(self.negFilter, type.name):
				return
		if 1 or val.name != type.name:
			trail = trail + [str(val.name).replace("[", "").replace("]", "")]
		prefix = str(val.GetAddress()) + (indent or (" %s " % ".".join(trail)))
		# 'suppress' = no print but still iterate through the children
		suppress = self.filter and not re.search(self.filter, prefix) and\
			not re.search(self.filter, type.name)
		name = "%s" % (val.GetType().name)
		shortTrail = ".".join(trail)
		if len(shortTrail) > 60:
			shortTrail = "..." + shortTrail[-60:]
		# Hack: we don't follow pointers but will follow vector elements
		# if there is a filter just because I need that at the moment
		if self.filter and name.startswith("std::vector"):
			0 and self.out("vector %s nta=%d of %s" % (
				name, type.GetNumberOfTemplateArguments(),
				type.GetTemplateArgumentType(1)))
			# type.GetTemplateArgumentType() doesn't work on windows
			tan = name.split("<")[1].split(",")[0]
			taTypes = self.findTypes1(tan)
			for ch in self.getVectorElementValues(
					val.GetLoadAddress(), taTypes.GetTypeAtIndex(0)):
				self.printValue(ch, trail)
		summary = val.GetSummary() or val.GetValue()
		nc = 0 if type.IsPointerType() else val.GetNumChildren()
		if 0 == nc:
			if suppress: return
			if not summary:
				err = lldb.SBError()
				num = val.GetValueAsUnsigned(err)
				if type.IsPointerType():
					num = xx(num)
				summary = err.fail and ("error: %s" % err) or num
		if summary:
			self.out("\r%s%s%s = %s" % (
				xx(val.GetAddress().GetLoadAddress(self.sbt)),
				prefix, name, summary))
			# Can have summary AND children
		# char buffers has contents in the summary
		if nc and not type.name in summaryIsEnoughList and\
			 not type.name.startswith("char[") and\
			 not type.name.startswith("char16_t["):
			if not suppress:
				self.out("%s%s has %d children" % (prefix, name, nc))
			for ii in range(nc):
				nv = val.GetChildAtIndex(ii)
				self.printValue(nv, trail)

	def getVectorElementValues(self, vecPos, type):
		p0 = self.readPtr(vecPos)
		p1 = self.readPtr(vecPos + ptrSize)
		for num, pos in enumerate(range(p0, p1, type.GetByteSize())):
			yield self.sbt.CreateValueFromAddress(
				str(num), lldb.SBAddress(pos, self.sbt), type)

	def scanForPtrsToType(self, start, end, typeName):
		targetType = self.findTypes1(
			isinstance(typeName, list) and typeName[0] or typeName).\
			GetTypeAtIndex(0)
		past = set()
		for pos in range(start, end, ptrSize):
			self.error.Clear()
			a0 = self.check(self.process.ReadPointerFromMemory(
				pos, self.error))
			if a0 in past:
				continue
			past.add(a0)
			try:
				types = self.detectTypes(a0)
			except (DpcError, DebuggerError):
				continue
			tn = re.sub(r"\s+", "", types.GetTypeAtIndex(0).name)
			if tn == typeName or isinstance(typeName, list) and tn in typeName:
				yield self.sbt.CreateValueFromAddress(
					"_", lldb.SBAddress(a0, self.sbt), targetType)
			0 and print("%s: %s" % (xx(a0), types.GetTypeAtIndex(0).name))

	def scanStackForPtrsToType(self, thread, typeName):
		self.process = self.sbt.process
		sp  = self.process.GetSelectedThread().frames[0].sp
		reg = self.getRegion(sp)
		return self.scanForPtrsToType(sp, reg.GetRegionEnd(), typeName)

summaryIsEnoughList = ["UnicodeString", "KString", "RefCnt"]

def unxx(addrt):
	if "," in addrt:
		return int("".join(addrt.split(",")), 16)
	else:
		return int(addrt, 0)
	
def printType(debugger, command, result, internal_dict):
	"""
	Print TYPE object at ADDR. If TYPE not given or "*", detect it
	by vtable. 
	"""
	commandArguments = re.split(r"\s+", command)
	if len(commandArguments) < 1:
		print("usage: dt ADDR[-ADDR] [TYPE] [REGEXP] [REGEXP_NEGATIVE] [-f FILE]")
		return
	outFile = None
	args = []
	i = 0
	while i < len(commandArguments):
		arg = commandArguments[i]
		if arg == "-f":
			i += 1
			if i >= len(commandArguments):
				print("Missing filename for -f")
				return
			outFile = commandArguments[i]
		else:
			args.append(arg)
		i += 1
	if not (len(args) in range(1, 5)):
		print("usage: dt ADDR[-ADDR] [TYPE] [REGEXP] [REGEXP_NEGATIVE] [-f FILE]")
		return
	addrt = args[0]
	if "-" in addrt:
		a0, b0 = (unxx(s) for s in addrt.split("-"))
	else:
		a0, b0 = unxx(addrt), None
	dpc = DataPrintoutContext(debugger.GetSelectedTarget(), outFile)
	dpc.filter = (len(args) >= 3) and re.compile(args[2])
	dpc.negFilter = (len(args) >= 4) and\
		re.compile(args[3])
	if len(args) == 1:
		typeName = None
	else:
		typeName = args[1]
		if "*" == typeName:
			typeName = None
	val = dpc.getValue(a0, typeName)
	data = val.GetData()
	dpc.out("data=%s" % (data))
	dpc.printValue(val, [])
	if b0:
		tp = val.GetType()
		for p in range(a0 + tp.size, b0, tp.size):
			val = dpc.getValue(p, debugger.GetSelectedTarget(), tp.name)
			dpc.printValue(val, [])
	dpc.closeFile()

def printTypeOutside(debugger, command, result, internal_dict):
	"""
Receive an address inside the value and find type by scanning up for the vtable
	"""
	commandArguments = re.split(r"\s+", command)
	if len(commandArguments) != 1:
		print("USAGE: pto ADDR")
	a0 = getAddressArg(commandArguments[0])
	dpc = DataPrintoutContext(debugger.GetSelectedTarget())
	dpc.printValue(dpc.scanOut(a0), [])

def printTypeFromVbase(debugger, command, result, internal_dict):
	"""
Find object by the address of an embedded virtual base class object and 
print it
	"""
	commandArguments = re.split(r"\s+", command)
	if len(commandArguments) != 2:
		print("USAGE: dtv ADDR BNAME")
		return
	dpc = DataPrintoutContext(debugger.GetSelectedTarget())
	a0 = getAddressArg(commandArguments[0])
	v0 = dpc.getValueFromVbase(a0, commandArguments[1])
	dpc.printValue(v0, [])

def printIcu(debugger, command, result, internal_dict):
	commandArguments = re.split(r"\s+", command)
	for arg in commandArguments:
		err = lldb.SBError()
		a0 = unxx(arg)
		us = icu(a0, debugger.GetSelectedTarget().process, err)
		print(" %s %s" % (xx(a0), err.fail and err or repr(us)))

def doScanForPtrsToType(debugger, command, result, internal_dict):
	commandArguments = re.split(r"\s+", command)
	if not len(commandArguments) in [1,2] or not commandArguments[0]:
		print("USAGE: spt TYPE_NAME [FILTER_REGEXP]")
		return
	dpc = DataPrintoutContext(debugger.GetSelectedTarget())
	if len(commandArguments) >= 2:
		dpc.filter = commandArguments[1]
	for val in dpc.scanStackForPtrsToType(
			dpc.sbt.process.GetSelectedThread(), commandArguments[0]):
		dpc.printValue(val, [])

def scanHeapForPtr(debugger, command, result, internal_dict):
	commandArguments = re.split(r"\s+", command)
	args = []
	cmd = None
	i = 0
	while i < len(commandArguments):
		if commandArguments[i] == "-c" and i + 1 < len(commandArguments):
			i += 1
			cmd = commandArguments[i].replace(",", " ")
		else:
			args.append(commandArguments[i])
		i += 1
	if not args or not args[0]:
		print("USAGE: shp PTR_ADDR [-c CMD]")
		return
	target = unxx(args[0])
	sbt = debugger.GetSelectedTarget()
	process = sbt.process
	err = lldb.SBError()
	regs = process.GetMemoryRegions()
	
	# Collect stack regions to exclude
	stackRegions = []
	for th in process.threads:
		sp = th.frames[0].sp
		reg = lldb.SBMemoryRegionInfo()
		if process.GetMemoryRegionInfo(sp, reg).success and reg.IsMapped():
			stackRegions.append((reg.GetRegionBase(), reg.GetRegionEnd()))
	
	def isStack(addr):
		for base, end in stackRegions:
			if base <= addr < end:
				return True
		return False
	
	totalBytes = 0
	totalRegions = 0
	regions = []
	r = lldb.SBMemoryRegionInfo()
	for i in range(regs.GetSize()):
		if not regs.GetMemoryRegionAtIndex(i, r):
			continue
		if not r.IsMapped() or not r.IsReadable():
			continue
		if r.IsExecutable():
			continue
		base = r.GetRegionBase()
		if isStack(base):
			continue
		size = r.GetRegionEnd() - base
		regions.append((base, r.GetRegionEnd(), size, r.GetName()))
		totalBytes += size
		totalRegions += 1
	
	print("Heap regions: %d, total: %s bytes" % (totalRegions, nn(totalBytes)))
	
	chunkSize = 64 * 1024 * 1024  # 64MB chunks
	scanned = 0
	found = 0
	t0 = time.time()
	
	for base, end, size, name in regions:
		pos = base
		while pos < end:
			chunkEnd = min(pos + chunkSize, end)
			nread = chunkEnd - pos
			data = process.ReadMemory(pos, nread, err)
			if err.fail:
				pos = chunkEnd
				continue
			scanned += nread
			packed = struct.pack("Q", target)
			p = 0
			while True:
				p = data.find(packed, p)
				if p < 0:
					break
				absAddr = pos + p
				found += 1
				addrStr = "0x%x" % absAddr
				print("%s @ %s (region %s)" % (xx(target), addrStr, name or "."))
				if cmd:
					debugger.HandleCommand(cmd % addrStr)
				p += 1
			elapsed = time.time() - t0
			perc = 100.0 * scanned / totalBytes if totalBytes else 0
			speed = scanned / elapsed if elapsed > 0 else 0
			sys.stderr.write("\r  [%5.1f%%] %s/%s, %s found, %s MB/s   " % (
				perc, nn(scanned), nn(totalBytes), found,
				int(speed / (1024*1024))))
			sys.stderr.flush()
			pos = chunkEnd
	
	elapsed = time.time() - t0
	print("\nDone: %s bytes, %d found, %.1fs" % (nn(scanned), found, elapsed))
		
def summaryIcu(val, internal_dict):
	rs = icuOrError(val.GetLoadAddress(), val.GetProcess())
	if len(rs) > 1024:
		rs = "..." + rs[-1024:]
	return rs

class VmPos:
	def __init__(self, dpc, frame, vm0):
		if vm0:
			self.vm = vm = dpc.getValue(vm0, dpc.sbt, "VM")
		else:
			self.vm = vm = dpc.scanUp(frame.sp, "VM")
		if not vm:
			raise Exception("VM not found up from sp=0x%x" % (sp))
		self.prgID = prgID = vm.GetChildMemberWithName("prgID").GetValueAsUnsigned()
		if self.prgID < 1:
			raise Exception("Bad prgID %s" % (prgID))
		self.progs = progs = vm.GetChildMemberWithName("progs_")
		if prgID - 1 >= progs.GetNumChildren():
			raise Exception("Bad prgID %s" % (prgID))
		oScriptData = progs.GetChildAtIndex(prgID - 1)
		spbAddr = oScriptData.GetChildMemberWithName("prog").GetChildMemberWithName(
			"_ptr").GetValueAsUnsigned()
		spb = dpc.getValue(spbAddr)
		self.name = spb.GetChildMemberWithName("name")
		self.pos = vm.GetChildMemberWithName("ip").GetChildMemberWithName(
			"pos").GetValueAsUnsigned()

def createBpByNameCheck(sbt, name):
	bp = sbt.BreakpointCreateByName(name)
	if bp.num_locations == 0:
		raise Exception("No locations for '%s'" % name)
	return bp

def createBpByLocationCheck(sbt, fileName, line):
	bp = sbt.BreakpointCreateByLocation(lldb.SBFileSpec(fileName), line)
	if bp.num_locations == 0:
		raise Exception("No locations for '%s:%s'" % (fileName, line))
	return bp

class RefTrace(Util):
	__slots__ = ["count", "next", "index", "dpc", "lastVmAddrIndex", "error"]

	class Count():
		__slots__ = ["add", "Del", "value", "positions"]
		def __init__(self):
			self.add = self.Del = self.value = 0
			self.positions = {}
			
	def __init__(self, t2):
		self.count = t2 and t2.count or RefTrace.Count()
		self.next = RefTrace.Count()
		self.index = t2 and t2.index or {}
		self.acqFileName = t2 and t2.acqFileName
		self.acqLine = t2 and t2.acqLine
		self.varName = t2 and t2.varName
		self.lastVmAddrIndex = {}
		self.error = lldb.SBError()

	def traceAcquisition(self, frame):
		if not self.varName:
			return self.traceAddRef(frame, *getPtrAndCnt(frame))
		# Add value from user provided breakpoint
		v0 = frame.EvaluateExpression(self.varName).GetLoadAddress()
		self.traceAddRef(frame, v0, 1)

	def traceAddRef(self, frame, p0, cnt):
		self.count.add += 1
		if self.count.add > self.next.add:
			self.printCount()
			self.next.add += 20
		# Only trace new created
		if cnt != 1:
			return
		state = self.index.get(p0)
		if not state:
			state = self.index[p0] = RefTrace.Count()
		state.value = cnt + 1
		state.add += 1
		posc = self.getVmPosCount(frame, state)
		if posc:
			posc.add += 1

	def getVmPosCount(self, frame, state):
		dpc = DataPrintoutContext(frame.thread.process.target)
		lastVm0 = self.lastVmAddrIndex.get(frame.thread.id, 0)
		if lastVm0:
			if dpc.detectTypeGetName(lastVm0) != "VM":
				lastVm0 = 0
		try:
			vmp = VmPos(dpc, frame, lastVm0)
		except Exception as e:
			return
		self.lastVmAddrIndex[frame.thread.id] = vmp.vm.GetLoadAddress()
		pos = "%s:%s" % (vmp.name, vmp.pos)
		posc = state.positions.get(pos)
		if not posc:
			posc = state.positions[pos] = RefTrace.Count()
		return posc

	def traceDelRef(self, frame, p0, cnt):
		self.count.Del += 1
		if self.count.Del > self.next.Del:
			self.printCount()
			self.next.Del += 20
		if cnt == 1:
			del self.index[p0]
			return
		else:
			state = self.index.get(p0)
			if not state:
				return
			state.value = cnt - 1
			state.Del += 1
		posc = self.getVmPosCount(frame, state)
		if posc:
			posc.Del += 1

	def dump(self, sbt, filter):
		dpc = DataPrintoutContext(sbt)
		c0cnt = 0
		deletedByBpCnt = 0
		startLen = len(self.index)
		# Copy 'items' to allow deletion
		for p0, cnt in list(self.index.items()):
			if cnt.Del >= cnt.add:
				deletedByBpCnt += 1
				continue
			try:
				v = dpc.getValueFromVbase(p0-ptrSize, "RefCnt")
				p2 = "%s %s" % (v.GetType().GetName(), v.GetAddress())
			except Exception as e:
				p2 = str(e)
			if not (filter in p2):
				continue
			i = dpc.sbt.process.ReadUnsignedFromMemory(p0, 4, self.error)
			if self.error.fail:
				i = self.error
			if i == 0:
				del self.index[p0]
				c0cnt += 1
				continue
			print("p=0x%x actualCnt=%s savedCount=%s add=%s del=%s %s" % (
				p0, i, cnt.value, cnt.add, cnt.Del, p2))
			for pos, state in cnt.positions.items():
				if state.add == state.Del:
					del cnt.positions[pos]
			if filter:
				for pos, state in cnt.positions.items():
					print(" %s add=%s del=%s" % (pos, state.add, state.Del))
		self.printCount()
		print(", %s index length, %s deleted by BP count, %s zero counts" % (
			startLen, deletedByBpCnt, c0cnt))
			
	def printCount(self):
		sys.stdout.write("\r%s adds, %s dels" % (self.count.add, self.count.Del))

	def updateBreakpoints(self, sbt):
		bpc = RefTrace.Count()
		if hasattr(lldb, "vgRefTraceBpAdd"):
			sbt.BreakpointDelete(lldb.vgRefTraceBpAdd.GetID())
			bpc.Del += 1
		if lldb.vgRefTracer.acqFileName:
			lldb.vgRefTraceBpAdd = createBpByLocationCheck(
				sbt, self.acqFileName, self.acqLine)
		else:
			lldb.vgRefTraceBpAdd = createBpByNameCheck(sbt, "RefCnt::AddRef")
		lldb.vgRefTraceBpAdd.SetScriptCallbackFunction("%s.traceAddRef" % __name__)
		bpc.add += 1
		if 0 and not hasattr(lldb, "vgRefTraceBpDel"):
			lldb.vgRefTraceBpDel = createBpByNameCheck(sbt, "RefCnt::DelRef")
			lldb.vgRefTraceBpDel.SetScriptCallbackFunction("%s.traceDelRef" % __name__)
			bpc.add += 1
		print("%s breakpoints added, %s deleted" % (bpc.add, bpc.Del))


def getPtrAndCnt(frame):
	# Now: returns a pointer to _M_i and value of _M_i
	# RefCnt object is 1 word before
	this = frame.FindVariable("this")
	t0 = this.GetValueAsUnsigned()
	# cnt = this.GetValueForExpressionPath("->count_._M_i")
	# This works because when we set BP in AddRef/DelRef we actually
	# wake up in the beginning of the inlined atomic_base method
	cnt = this.GetChildAtIndex(0).GetValueAsUnsigned()
	# print("t0=0x%X i=%s" %(t0, cnt))
	return (t0, cnt)

def traceAddRef(frame, bp_loc, dict):
	lldb.vgRefTracer.traceAcquisition(frame)
	frame.GetThread().GetProcess().Continue()

def traceDelRef(frame, bp_loc, dict):
	lldb.vgRefTracer.traceDelRef(frame, *getPtrAndCnt(frame))
	frame.GetThread().GetProcess().Continue()

def startRefTracing(debugger, command, result, internal_dict):
	commandArguments = re.split(r"\s+", command) 
	if not commandArguments[0] in ["", "-a"]:
		print("USAGE: tref [-a BP_FILE:BP_LINE,VAR_NAME]")
		print("Example: tref -a soapsrv.cpp:124,scriptVars._ptr->count_")
		return
	lldb.vgRefTracer = RefTrace(None)
	if commandArguments[0] == "-a":
		p1, lldb.vgRefTracer.varName = commandArguments[1].split(",")
		lldb.vgRefTracer.acqFileName, lldb.vgRefTracer.acqLine = p1.split(":")
		lldb.vgRefTracer.acqLine = int(lldb.vgRefTracer.acqLine)
	lldb.vgRefTracer.updateBreakpoints(debugger.GetSelectedTarget())

def dumpRefTracing(debugger, command, result, internal_dict):
	commandArguments = re.split(r"\s+", command) 
	if len(commandArguments) != 1:
		print("USAGE: dref [TYPE_NAME_SUBSTR]")
		return
	if not hasattr(lldb, "vgRefTracer"):
		print("RefCnt tracing not started (command tref)")
		return
	lldb.vgRefTracer.dump(debugger.GetSelectedTarget(), commandArguments[0])

# Update the functions, keep the data
if hasattr(lldb, "vgRefTracer"):
	lldb.vgRefTracer = RefTrace(lldb.vgRefTracer)

if __name__ == "__main__":
	# This makes my Mac (standard LLDB package) segfault 
	if 0 and sys.version_info[0] < 3:
		import codecs
		sys.stdout = codecs.getwriter("utf-8")(sys.stdout)
	Tool(parser.parse_args(), None).run()