Debugging Dalvik VM Native Code with LLDB on Android

Background : The article introduces the need to understand the class loading process of the Dalvik VM at the native layer and outlines two scenarios – debugging with available app source code using Android Studio’s graphical debugger, and debugging without source code via remote LLDB.

Environment Requirements :

Android Studio version 2.2 or higher (supports native debugging).

Install the LLDB debugger plugin (http://lldb.llvm.org/).

A compiled Android system source (e.g., Android 4.4.4) containing libdvm.so .

3. Debugging When App Source Is Available

Create an Android project that will serve as the target process.

Replace the original /system/lib/libdvm.so on the device with a version that includes debugging symbols (found in the compiled symbols directory).

Configure the run configuration in Android Studio to use Native debugging mode and name it APP .

Run the app in debug mode; when the “Waiting for Debugger” screen appears, press the pause button in Android Studio.

Three LLDB windows appear: Frames , Variables , and LLDB for stack trace, variable inspection, and command interaction respectively.

Set breakpoints via LLDB commands, for example:

A. Breakpoint by function name

br s -n Dalvik system DexFile defineClassNative

B. Breakpoint by file and line number

br set --file dalvik system DexFile.cpp --line 387

Use F7/F8/F9 to step through the code. The article also notes that breakpoints must be set through LLDB commands rather than directly in the IDE.

4. Debugging Without App Source (Remote Debugging of libdvm.so)

The goal is to debug a custom‑built libdvm.so that crashes after modifications. Since Android Studio cannot provide a graphical view without source, LLDB is used for remote debugging.

Common LLDB Commands (presented in a table in the original article):

Command

Function

p *(Type *)addr

Print a structure at a given address

po object.property

Inspect an object's property

br s -n functionName

Set breakpoint by function name

b file.m:NUM

Set breakpoint by file and line number

br del breakpointID

Delete a breakpoint

ta v

Show global variables

fr v

Show local variables

s

Step into

n

Step over

c

Continue execution

wa s v b

Set a watchpoint on variable

b

watchpoint l

List watchpoints

watch del watchID

Delete a watchpoint

Prerequisites : The target app must be debuggable; the ROM should be a debug build to allow attaching to any app.

Step‑by‑step LLDB Remote Debugging Procedure :

Push lldb-server to the device’s /data/local/tmp directory (located in Android/Sdk/lldb/3.1/android/armeabi ).

Give the server executable permission: chmod 777 lldb-server

Run the server on the device: ./lldb-server platform --server --listen unix-abstract:///data/local/tmp/debug.sock

On the host PC, start lldb and select the Android remote platform: platform select remote-android

Connect to the server: platform connect unix-abstract-connect:///data/local/tmp/debug.sock

Attach to the target process (replace PID with the app’s process ID): process attach -p PID

Use LLDB commands (as listed above) to set breakpoints and debug libdvm.so .

The article concludes with a simple "END" marker and several illustrative images.