AI guide
【One-Line Pitch】
A hands-on guide that turns debugger "magic" into engineering by walking you through building a native x64 Linux debugger in C++, from attaching to a process to unwinding stacks and evaluating expressions. Best for systems programmers, reverse engineers, and tool developers who want deep, practical insight into how debugging actually works.
【Book Arc】
- **Opening (~0%–13%)**: Sets up the project and mental model — directory structure, CMake, dependency management with vcpkg, and the compilation/architecture background (encoding, debug info, virtual memory, signals) needed before touching a live process.
- **Early (~13%–32%)**: Gets you attached to a running program — process launch/attach via ptrace, error handling, resuming and waiting on signals, then pipes, procfs, and automated testing to make the debugger testable.
- **Middle (~32%–55%)**: Core inspection and control — reading/writing x64 registers, validating them with assembly, software breakpoints, memory and disassembly, hardware breakpoints and watchpoints, and signal/syscall handling.
- **Late (~55%–80%)**: Connects machine code back to source — ELF object files, DWARF debug information, line tables, source-level breakpoints and stepping, call frame information, and stack unwinding.
- **Ending (~80%–100%)**: Advanced runtime features — shared libraries, multithreading, DWARF expressions, variables and types, expression evaluation, and a final advanced-topics chapter, plus appendix answers and a glossary.
【Key Takeaways】
- **A debugger is mostly an OS client** (Early): attaching, resuming, and waiting on signals all ride on ptrace and Linux process semantics, so the book teaches kernel behavior alongside tool code.
- **Registers are the first real interface to a process** (Early/Middle): reading and writing general-purpose, floating-point/vector, and debug registers, with x64 assembly tests to confirm your understanding.
- **Breakpoints come in two flavors with different trade-offs** (Middle): software breakpoints patch instructions and need site management, while hardware breakpoints/watchpoints use debug registers and watch memory access.
- **Disassembly and memory inspection make state legible** (Middle): turning raw bytes into instructions and readable memory is what makes the debugger usable rather than just a process controller.
- **Debug info is a bytecode problem, not a lookup table** (Late): ELF and DWARF — line tables, call frame information, DWARF expressions — must be parsed and interpreted to map machine code to source.
- **Stack unwinding is the payoff of CFI** (Late): backtraces depend on correctly interpreting call frame information, which is why it gets its own chapter before unwinding.
- **Real programs are shared and multithreaded** (Ending): shared library tracing and multithreading support are treated as advanced features layered on the core debugger.
- **Expression evaluation ties variables, types, and DWARF together** (Ending): locating and visualizing variables and calling functions in the debugged process is the culmination of the debug-info work.
【Reading Tips】
- Treat Chapters 1–4 as setup you must actually do, not skim — the testing infrastructure (pipes, procfs, automated tests) pays off for every later feature.
- Deep-read Chapters 5–9 if you care about breakpoints and registers; these are the most reusable mechanics for day-to-day debugging.
- Expect Chapters 11–16 (ELF, DWARF, CFI, unwinding) to be the hardest stretch — slow down and keep the glossary and "Check Your Knowledge" answers handy.
- Skim Chapter 22 on a first pass; return to it after the core debugger works.
- Keep a working build and run the tests as you go; this is a build-along book, not a read-only one.
【Coverage Limits】
This guide is based on stratified excerpts covering the front matter, table of contents, and early-to-middle chapter structure; later chapters are summarized from their titles and brief mentions, so specific implementation details beyond the excerpts are not covered.
Passage locations
Page 1
S Y B R A N D THE F INEST IN GEEK ENTERTA INMENT ™ nostarch.com ® ® B U IL D IN G A D E B U G G E R B R A N D F R O M B R E A K P O I N T S T O B A C K T R A...
View in text
Page 9
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 283 Chapter 13: Line Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....
View in text
Page 12
. . . . . . . . . . . . . 60 Testing Process Attaching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ....
View in text
Page 14
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 8 MEMORY AND DISASSEMBLY 165 Memory Operations...
View in text