title: lldb finding exit point of app
body: <p>I am debugging an app that presumably has anti debugging measures, setting up breakpoints and signals stops for quitting the app doesn't stop the app from exiting, </p>
  
  <pre><code>$ lldb App 
  (lldb) target create "App"
  error: Invalid fde/cie next entry offset of 0x43029a18 found in cie/fde at 0x1404
  Current executable set to 'App' (x86_64).
  (lldb) br s -n exit
  Breakpoint 1: 3 locations.
  (lldb) br s -n _exit
  Breakpoint 2: where = libsystem_kernel.dylib`__exit, address = 0x00000000000167a8
  (lldb) br s -n _Exit
  Breakpoint 3: where = libsystem_c.dylib`_Exit, address = 0x000000000005ed8b
  (lldb) process launch -stop-at-entry
  Process 17849 stopped
  * thread #1: tid = 0xb9ebc, 0x00007fff5fc01000 dyld`_dyld_start, stop reason = signal SIGSTOP
      frame #0: 0x00007fff5fc01000 dyld`_dyld_start
  dyld`_dyld_start:
  -&gt;  0x7fff5fc01000 &lt;+0&gt;: popq   %rdi
      0x7fff5fc01001 &lt;+1&gt;: pushq  $0x0
      0x7fff5fc01003 &lt;+3&gt;: movq   %rsp, %rbp
      0x7fff5fc01006 &lt;+6&gt;: andq   $-0x10, %rsp
  Process 17849 launched: '/Users/admin/Downloads/App.app/Contents/MacOS/App' (x86_64)
  (lldb) process handle -p false -s true
  Do you really want to update all the signals?: [y/N] y
  NAME         PASS   STOP   NOTIFY
  ===========  =====  =====  ======
  SIGHUP       false  true   true 
  ... [removed for brevity]
  (lldb) c
  Process 17849 resuming
  Process 17849 exited with status = 45 (0x0000002d) 
  (lldb)
  </code></pre>
  
  <p>How is the app able to exit without triggering any signal, exit, _exit, or _Exit?</p>
  
  <p>Is there a way in lldb to run the process, and upon exit then 'backtrack' to see where it exited?</p>
  
  <p>Is there a way for lldb to log each assembly instruction etc (like when it breaks) so you can trace it back upon exit?</p>