Update ProcessMachCore::DoLoadCore to handle binary hints with and without addresses

[jasonmolenda]

Summary

ProcessMachCore::DoLoadCore was implemented to handle the two LC_NOTEs "kern ver str" and "main bin spec" with only certain combinations of UUID and address and type present. Other groups are starting to adopt these corefile hints and there are combinations that lldb wouldn't handle correctly.

This patch cleans up the handling of these hints in DoLoadCore a lot -- I've been wanting to clean this up for over a year now -- and adds tests for all of the combinations.

I did make one change to DynamicLoaderStatic to only set load addresses of Sections to their file addresses (slide==0) if an address hasn't already been set. This gives me the ability to set the load address in ProcessMachCore and have it not get re-set back to the original file address later by the dynamic loader plugin.

The rest of this patch is is code that's my little playground of ProcessMachCore, so I don't know if others will have any comments, but I wanted to open it to the floor if anyone has suggestions or questions.

[shafik]

lldb/source/Plugins/Process/mach-core/ProcessMachCore.cpp

214

We can use make_shared here instead.

lldb/test/API/macosx/lc-note/firmware-corefile/TestFirmwareCorefiles.py

148

0x70000000000 feels like it should be a variable with a name since we are using in multiple places.

lldb/test/API/macosx/lc-note/firmware-corefile/create-empty-corefile.cpp

91

snprintf we should also collect the return value and assert on the result.

[jasonmolenda]

Thanks for the feedback Shafik, updated the patch and landing in a sec.

lldb/source/Plugins/Process/mach-core/ProcessMachCore.cpp

214

Sounds good.

lldb/test/API/macosx/lc-note/firmware-corefile/TestFirmwareCorefiles.py

148

Good suggestion, done.

lldb/test/API/macosx/lc-note/firmware-corefile/create-empty-corefile.cpp

91

Thanks, I switched to using a PRIx64 formatter to make it explicit how large the formatter's output will be.

lldb/source/Plugins/DynamicLoader/Static/DynamicLoaderStatic.cpp

 //===-- DynamicLoaderStatic.cpp -------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "lldb/Core/Module.h"
 #include "lldb/Core/PluginManager.h"
 #include "lldb/Core/Section.h"
 #include "lldb/Symbol/ObjectFile.h"
+#include "lldb/Target/SectionLoadList.h"
 #include "lldb/Target/Target.h"
 
 #include "DynamicLoaderStatic.h"
 
 using namespace lldb;
 using namespace lldb_private;
 
 LLDB_PLUGIN_DEFINE(DynamicLoaderStatic)
if (module_sp) {
           const size_t num_sections = section_list->GetSize();
           size_t sect_idx = 0;
           for (sect_idx = 0; sect_idx < num_sections; ++sect_idx) {
             // Iterate through the object file sections to find the first
             // section that starts of file offset zero and that has bytes in
             // the file...
             SectionSP section_sp(section_list->GetSectionAtIndex(sect_idx));
             if (section_sp) {
+              // If this section already has a load address set in the target,
+              // don't re-set it to the file address.  Something may have
+              // set it to a more correct value already.
+              if (m_process->GetTarget()
+                      .GetSectionLoadList()
+                      .GetSectionLoadAddress(section_sp) !=
+                  LLDB_INVALID_ADDRESS) {
+                continue;
+              }
               if (m_process->GetTarget().SetSectionLoadAddress(
                       section_sp, section_sp->GetFileAddress()))
                 changed = true;
             }
           }
         }
       }
 

lldb/source/Plugins/Process/mach-core/ProcessMachCore.cpp

 #include "lldb/Core/Module.h"
 #include "lldb/Core/ModuleSpec.h"
 #include "lldb/Core/PluginManager.h"
 #include "lldb/Core/Section.h"
 #include "lldb/Host/Host.h"
 #include "lldb/Symbol/LocateSymbolFile.h"
 #include "lldb/Symbol/ObjectFile.h"
 #include "lldb/Target/MemoryRegionInfo.h"
+#include "lldb/Target/SectionLoadList.h"
 #include "lldb/Target/Target.h"
 #include "lldb/Target/Thread.h"
 #include "lldb/Utility/DataBuffer.h"
 #include "lldb/Utility/Log.h"
 #include "lldb/Utility/State.h"
 
 #include "ProcessMachCore.h"
 #include "Plugins/Process/Utility/StopInfoMachException.h"
 #include "ThreadMachCore.h"
 
 // Needed for the plug-in names for the dynamic loaders.
 #include "lldb/Host/SafeMachO.h"
 
 #include "Plugins/DynamicLoader/Darwin-Kernel/DynamicLoaderDarwinKernel.h"
 #include "Plugins/DynamicLoader/MacOSX-DYLD/DynamicLoaderMacOSXDYLD.h"
+#include "Plugins/DynamicLoader/Static/DynamicLoaderStatic.h"
 #include "Plugins/ObjectFile/Mach-O/ObjectFileMachO.h"
 
 #include <memory>
 #include <mutex>
 
 using namespace lldb;
 using namespace lldb_private;
 
case llvm::MachO::MH_EXECUTE:
         return true;
       }
       break;
     }
   }
   return false;
 }
 
+// We have a hint about a binary -- a UUID, possibly a load address.
+// Try to load a file with that UUID into lldb, and if we have a load
+// address, set it correctly.  Else assume that the binary was loaded
+// with no slide.
+static bool load_standalone_binary(UUID uuid, addr_t addr, Target &target) {
+  if (uuid.IsValid()) {
+    ModuleSpec module_spec;
+    module_spec.GetUUID() = uuid;
+
+    // Look up UUID in global module cache before attempting
+    // dsymForUUID-like action.
+    ModuleSP module_sp;
+    Status error = ModuleList::GetSharedModule(module_spec, module_sp, nullptr,
+                                               nullptr, nullptr);
+
+    if (!module_sp.get()) {
+      // Force a a dsymForUUID lookup, if that tool is available.
+      if (!module_spec.GetSymbolFileSpec())
+        Symbols::DownloadObjectAndSymbolFile(module_spec, true);
+
+      if (FileSystem::Instance().Exists(module_spec.GetFileSpec())) {
+        module_sp = std::make_shared<Module>(module_spec);
+      }
+    }
+
+    if (module_sp.get() && module_sp->GetObjectFile()) {
+      target.SetArchitecture(module_sp->GetObjectFile()->GetArchitecture());
+      target.GetImages().AppendIfNeeded(module_sp, false);
+
+      Address base_addr = module_sp->GetObjectFile()->GetBaseAddress();
+      addr_t slide = 0;
+      if (addr != LLDB_INVALID_ADDRESS && base_addr.IsValid()) {
+        addr_t file_load_addr = base_addr.GetFileAddress();
+        slide = addr - file_load_addr;
+      }
+      bool changed = false;
+      module_sp->SetLoadAddress(target, slide, true, changed);
+
+      ModuleList added_module;
+      added_module.Append(module_sp, false);
+      target.ModulesDidLoad(added_module);
+
+      // Flush info in the process (stack frames, etc).
+      ProcessSP process_sp(target.GetProcessSP());
+      if (process_sp)
+        process_sp->Flush();
+
+      return true;
+    }
+  }
+  return false;
+}
+
 // Process Control
 Status ProcessMachCore::DoLoadCore() {
   Log *log(lldb_private::GetLogIfAnyCategoriesSet(LIBLLDB_LOG_DYNAMIC_LOADER |
                                                   LIBLLDB_LOG_PROCESS));
   Status error;
   if (!m_core_module_sp) {
     error.SetErrorString("invalid core module");
     return error;
Status ProcessMachCore::DoLoadCore() {
 
   bool found_main_binary_definitively = false;
 
   addr_t objfile_binary_addr;
   UUID objfile_binary_uuid;
   ObjectFile::BinaryType type;
   if (core_objfile->GetCorefileMainBinaryInfo(objfile_binary_addr,
                                               objfile_binary_uuid, type)) {
+    if (log) {
+      log->Printf(
+          "ProcessMachCore::DoLoadCore: using binary hint from 'main bin spec' "
+          "LC_NOTE with UUID %s address 0x%" PRIx64 " and type %d",
+          objfile_binary_uuid.GetAsString().c_str(), objfile_binary_addr, type);
+    }
     if (objfile_binary_addr != LLDB_INVALID_ADDRESS) {
-      if (type == ObjectFile::eBinaryTypeUser)
+      if (type == ObjectFile::eBinaryTypeUser) {
         m_dyld_addr = objfile_binary_addr;
-      else
+        m_dyld_plugin_name = DynamicLoaderMacOSXDYLD::GetPluginNameStatic();
+        found_main_binary_definitively = true;
+      }
+      if (type == ObjectFile::eBinaryTypeKernel) {
         m_mach_kernel_addr = objfile_binary_addr;
+        m_dyld_plugin_name = DynamicLoaderDarwinKernel::GetPluginNameStatic();
         found_main_binary_definitively = true;
-      LLDB_LOGF(log,
-                "ProcessMachCore::DoLoadCore: using kernel address 0x%" PRIx64
-                " from LC_NOTE 'main bin spec' load command.",
-                m_mach_kernel_addr);
+      }
+    }
+    if (!found_main_binary_definitively) {
+      // ObjectFile::eBinaryTypeStandalone, undeclared types
+      if (load_standalone_binary(objfile_binary_uuid, objfile_binary_addr,
+                                 GetTarget())) {
+        found_main_binary_definitively = true;
+        m_dyld_plugin_name = DynamicLoaderStatic::GetPluginNameStatic();
+      }
     }
   }
 
   // This checks for the presence of an LC_IDENT string in a core file;
   // LC_IDENT is very obsolete and should not be used in new code, but if the
   // load command is present, let's use the contents.
+  UUID ident_uuid;
+  addr_t ident_binary_addr = LLDB_INVALID_ADDRESS;
+  if (!found_main_binary_definitively) {
     std::string corefile_identifier = core_objfile->GetIdentifierString();
-  if (!found_main_binary_definitively &&
-      corefile_identifier.find("Darwin Kernel") != std::string::npos) {
-    UUID uuid;
-    addr_t addr = LLDB_INVALID_ADDRESS;
+
+    // Search for UUID= and stext= strings in the identifier str.
     if (corefile_identifier.find("UUID=") != std::string::npos) {
       size_t p = corefile_identifier.find("UUID=") + strlen("UUID=");
       std::string uuid_str = corefile_identifier.substr(p, 36);
-      uuid.SetFromStringRef(uuid_str);
+      ident_uuid.SetFromStringRef(uuid_str);
+      if (log)
+        log->Printf("Got a UUID from LC_IDENT/kern ver str LC_NOTE: %s",
+                    ident_uuid.GetAsString().c_str());
     }
     if (corefile_identifier.find("stext=") != std::string::npos) {
       size_t p = corefile_identifier.find("stext=") + strlen("stext=");
       if (corefile_identifier[p] == '0' && corefile_identifier[p + 1] == 'x') {
-        errno = 0;
-        addr = ::strtoul(corefile_identifier.c_str() + p, nullptr, 16);
-        if (errno != 0 || addr == 0)
-          addr = LLDB_INVALID_ADDRESS;
-      }
-    }
-    if (uuid.IsValid() && addr != LLDB_INVALID_ADDRESS) {
-      m_mach_kernel_addr = addr;
-      found_main_binary_definitively = true;
-      LLDB_LOGF(
-          log,
-          "ProcessMachCore::DoLoadCore: Using the kernel address 0x%" PRIx64
-          " from LC_IDENT/LC_NOTE 'kern ver str' string: '%s'",
-          addr, corefile_identifier.c_str());
-    }
-  }
-
-  // In the case where we have an LC_NOTE specifying a standalone
-  // binary with only a UUID (and no load address) (iBoot, EFI, etc),
-  // then let's try to force a load of the binary and set its
-  // load address to 0-offset.
-  //
-  // The two forms this can come in is either a
-  //   'kern ver str' LC_NOTE with "EFI UUID=...."
-  //   'main bin spec' LC_NOTE with UUID and no load address.
-
-  if (found_main_binary_definitively == false &&
-      (corefile_identifier.find("EFI ") != std::string::npos ||
-       (objfile_binary_uuid.IsValid() &&
-        objfile_binary_addr == LLDB_INVALID_ADDRESS))) {
-    UUID uuid;
-    if (objfile_binary_uuid.IsValid()) {
-      uuid = objfile_binary_uuid;
-      LLDB_LOGF(log,
-                "ProcessMachCore::DoLoadCore: Using the main bin spec "
-                "LC_NOTE with UUID %s and no load address",
-                uuid.GetAsString().c_str());
-    } else {
-      if (corefile_identifier.find("UUID=") != std::string::npos) {
-        size_t p = corefile_identifier.find("UUID=") + strlen("UUID=");
-        std::string uuid_str = corefile_identifier.substr(p, 36);
-        uuid.SetFromStringRef(uuid_str);
-        if (uuid.IsValid()) {
-          LLDB_LOGF(log,
-                    "ProcessMachCore::DoLoadCore: Using the EFI "
-                    "from LC_IDENT/LC_NOTE 'kern ver str' string: '%s'",
-                    corefile_identifier.c_str());
-        }
-      }
-    }
-
-    if (uuid.IsValid()) {
-      ModuleSpec module_spec;
-      module_spec.GetUUID() = uuid;
-      module_spec.GetArchitecture() = GetTarget().GetArchitecture();
-
-      // Lookup UUID locally, before attempting dsymForUUID-like action
-      FileSpecList search_paths = Target::GetDefaultDebugFileSearchPaths();
-      module_spec.GetSymbolFileSpec() =
-          Symbols::LocateExecutableSymbolFile(module_spec, search_paths);
-      if (module_spec.GetSymbolFileSpec()) {
-        ModuleSpec executable_module_spec =
-            Symbols::LocateExecutableObjectFile(module_spec);
-        if (FileSystem::Instance().Exists(
-                executable_module_spec.GetFileSpec())) {
-          module_spec.GetFileSpec() = executable_module_spec.GetFileSpec();
-        }
-      }
-
-      // Force a a dsymForUUID lookup, if that tool is available.
-      if (!module_spec.GetSymbolFileSpec())
-        Symbols::DownloadObjectAndSymbolFile(module_spec, true);
+        ident_binary_addr =
+            ::strtoul(corefile_identifier.c_str() + p, nullptr, 16);
+        if (log)
+          log->Printf("Got a load address from LC_IDENT/kern ver str "
+                      "LC_NOTE: 0x%" PRIx64,
+                      ident_binary_addr);
 
-      // If we found a binary, load it at offset 0 and set our
-      // dyld_plugin to be the static plugin.
-      if (FileSystem::Instance().Exists(module_spec.GetFileSpec())) {
-        ModuleSP module_sp(new Module(module_spec));
-        if (module_sp.get() && module_sp->GetObjectFile()) {
-          GetTarget().GetImages().AppendIfNeeded(module_sp, true);
-          GetTarget().SetExecutableModule(module_sp, eLoadDependentsNo);
-          found_main_binary_definitively = true;
-          bool changed = true;
-          module_sp->SetLoadAddress(GetTarget(), 0, true, changed);
-          ModuleList added_module;
-          added_module.Append(module_sp, false);
-          GetTarget().ModulesDidLoad(added_module);
-          m_dyld_plugin_name = DynamicLoaderDarwinKernel::GetPluginNameStatic();
-          found_main_binary_definitively = true;
-        }
+    // Search for a "Darwin Kernel" str indicating kernel; else treat as
+    // standalone
+    if (corefile_identifier.find("Darwin Kernel") != std::string::npos &&
+        ident_uuid.IsValid() && ident_binary_addr != LLDB_INVALID_ADDRESS) {
+      if (log)
+        log->Printf("ProcessMachCore::DoLoadCore: Found kernel binary via "
+                    "LC_IDENT/kern ver str LC_NOTE");
+      m_mach_kernel_addr = ident_binary_addr;
+    } else if (ident_uuid.IsValid()) {
+      if (load_standalone_binary(ident_uuid, ident_binary_addr, GetTarget())) {
+        m_dyld_plugin_name = DynamicLoaderStatic::GetPluginNameStatic();
       }
     }
   }
 
   if (!found_main_binary_definitively &&
       (m_dyld_addr == LLDB_INVALID_ADDRESS ||
        m_mach_kernel_addr == LLDB_INVALID_ADDRESS)) {
     // We need to locate the main executable in the memory ranges we have in

lldb/test/API/macosx/lc-note/firmware-corefile/TestFirmwareCorefiles.py

class TestFirmwareCorefiles(TestBase):
     @skipUnlessDarwin
     def test_lc_note(self):
         self.build()
         self.aout_exe = self.getBuildArtifact("a.out")
         self.bout_exe = self.getBuildArtifact("b.out")
         self.create_corefile = self.getBuildArtifact("create-empty-corefile")
         self.dsym_for_uuid = self.getBuildArtifact("dsym-for-uuid.sh")
         self.aout_corefile = self.getBuildArtifact("aout.core")
+        self.aout_corefile_addr = self.getBuildArtifact("aout.core_addr")
         self.bout_corefile = self.getBuildArtifact("bout.core")
+        self.bout_corefile_addr = self.getBuildArtifact("bout.core_addr")
 
         ## We can hook in our dsym-for-uuid shell script to lldb with this env
         ## var instead of requiring a defaults write.
         os.environ['LLDB_APPLE_DSYMFORUUID_EXECUTABLE'] = self.dsym_for_uuid
         self.addTearDownHook(lambda: os.environ.pop('LLDB_APPLE_DSYMFORUUID_EXECUTABLE', None))
 
         dwarfdump_uuid_regex = re.compile(
             'UUID: ([-0-9a-fA-F]+) \(([^\(]+)\) .*')
def test_lc_note(self):
                 ]
 
         with open(self.dsym_for_uuid, "w") as writer:
             for l in shell_cmds:
                 writer.write(l + '\n')
 
         os.chmod(self.dsym_for_uuid, 0o755)
 
+        self.slide = 0x70000000000
+
         ### Create our corefile
-        retcode = call(self.create_corefile + " version-string " + self.aout_corefile + " " + self.aout_exe, shell=True)
-        retcode = call(self.create_corefile + " main-bin-spec " + self.bout_corefile + " " + self.bout_exe, shell=True)
+        retcode = call(self.create_corefile + " version-string " + self.aout_corefile + " " + self.aout_exe + " 0xffffffffffffffff", shell=True)
+        retcode = call(self.create_corefile + " main-bin-spec " + self.bout_corefile + " " + self.bout_exe + " 0xffffffffffffffff", shell=True)
+        retcode = call(self.create_corefile + " version-string " + self.aout_corefile_addr + " " + self.aout_exe + (" 0x%x" % self.slide), shell=True)
+        retcode = call(self.create_corefile + " main-bin-spec " + self.bout_corefile_addr + " " + self.bout_exe + (" 0x%x" % self.slide), shell=True)
 
         ### Now run lldb on the corefile
         ### which will give us a UUID
         ### which we call dsym-for-uuid.sh with
         ### which gives us a binary and dSYM
         ### which lldb should load!
 
         # First, try the "kern ver str" corefile
         self.target = self.dbg.CreateTarget('')
         err = lldb.SBError()
+        if self.TraceOn():
+            self.runCmd("log enable lldb dyld")
+            self.addTearDownHook(lambda: self.runCmd("log disable lldb dyld"))
+
         self.process = self.target.LoadCore(self.aout_corefile)
         self.assertEqual(self.process.IsValid(), True)
         if self.TraceOn():
             self.runCmd("image list")
+            self.runCmd("target mod dump sections")
         self.assertEqual(self.target.GetNumModules(), 1)
         fspec = self.target.GetModuleAtIndex(0).GetFileSpec()
         filepath = fspec.GetDirectory() + "/" + fspec.GetFilename()
         self.assertEqual(filepath, self.aout_exe)
 
+        # Second, try the "kern ver str" corefile where it loads at an address
+        self.target = self.dbg.CreateTarget('')
+        err = lldb.SBError()
+        self.process = self.target.LoadCore(self.aout_corefile_addr)
+        self.assertEqual(self.process.IsValid(), True)
+        if self.TraceOn():
+            self.runCmd("image list")
+            self.runCmd("target mod dump sections")
+        self.assertEqual(self.target.GetNumModules(), 1)
+        fspec = self.target.GetModuleAtIndex(0).GetFileSpec()
+        filepath = fspec.GetDirectory() + "/" + fspec.GetFilename()
+        self.assertEqual(filepath, self.aout_exe)
+        main_sym = self.target.GetModuleAtIndex(0).FindSymbol("main", lldb.eSymbolTypeAny)
+        main_addr = main_sym.GetStartAddress()
+        self.assertGreater(main_addr.GetLoadAddress(self.target), self.slide)
+        self.assertNotEqual(main_addr.GetLoadAddress(self.target), lldb.LLDB_INVALID_ADDRESS)
 
-        # Second, try the "main bin spec" corefile
+        # Third, try the "main bin spec" corefile
         self.target = self.dbg.CreateTarget('')
         self.process = self.target.LoadCore(self.bout_corefile)
         self.assertEqual(self.process.IsValid(), True)
         if self.TraceOn():
             self.runCmd("image list")
+            self.runCmd("target mod dump sections")
+        self.assertEqual(self.target.GetNumModules(), 1)
+        fspec = self.target.GetModuleAtIndex(0).GetFileSpec()
+        filepath = fspec.GetDirectory() + "/" + fspec.GetFilename()
+        self.assertEqual(filepath, self.bout_exe)
+
+        # Fourth, try the "main bin spec" corefile where it loads at an address
+        self.target = self.dbg.CreateTarget('')
+        self.process = self.target.LoadCore(self.bout_corefile_addr)
+        self.assertEqual(self.process.IsValid(), True)
+        if self.TraceOn():
+            self.runCmd("image list")
+            self.runCmd("target mod dump sections")
         self.assertEqual(self.target.GetNumModules(), 1)
         fspec = self.target.GetModuleAtIndex(0).GetFileSpec()
         filepath = fspec.GetDirectory() + "/" + fspec.GetFilename()
         self.assertEqual(filepath, self.bout_exe)
+        main_sym = self.target.GetModuleAtIndex(0).FindSymbol("main", lldb.eSymbolTypeAny)
+        main_addr = main_sym.GetStartAddress()
+        self.assertGreater(main_addr.GetLoadAddress(self.target), self.slide)
+        self.assertNotEqual(main_addr.GetLoadAddress(self.target), lldb.LLDB_INVALID_ADDRESS)

lldb/test/API/macosx/lc-note/firmware-corefile/create-empty-corefile.cpp

+#include <inttypes.h>
 #include <mach-o/loader.h>
 #include <mach/thread_status.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <string>
+#include <sys/errno.h>
 #include <uuid/uuid.h>
 #include <vector>
 
 // Create an empty corefile with a "kern ver str" LC_NOTE
 // or a "main bin spec" LC_NOTE..
 // If an existing binary is given as a 3rd argument on the cmd line,
 // the UUID from that binary will be encoded in the corefile.
 // Otherwise a pre-set UUID will be put in the corefile that
std::vector<uint8_t> x86_lc_thread_load_command() {
   add_uint64(data, 0x0000000000022222);       // cs
   add_uint64(data, 0x0000000000033333);       // fs
   add_uint64(data, 0x0000000000044444);       // gs
   return data;
 }
 
 void add_lc_note_kern_ver_str_load_command(
     std::vector<std::vector<uint8_t>> &loadcmds, std::vector<uint8_t> &payload,
-    int payload_file_offset, std::string uuid) {
+    int payload_file_offset, std::string uuid, uint64_t address) {
   std::string ident = "EFI UUID=";
   ident += uuid;
+
+  if (address != 0xffffffffffffffff) {
+    ident += "; stext=";
+    char buf[24];
+    sprintf(buf, "0x%" PRIx64, address);
+    ident += buf;
+  }
+
   std::vector<uint8_t> loadcmd_data;
 
   add_uint32(loadcmd_data, LC_NOTE); // note_command.cmd
   add_uint32(loadcmd_data, 40);      // note_command.cmdsize
   char lc_note_name[16];
   memset(lc_note_name, 0, 16);
   strcpy(lc_note_name, "kern ver str");
 
void add_lc_note_kern_ver_str_load_command(
   add_uint32(payload, 1); // kerneL_version_string.version
   for (int i = 0; i < ident.size() + 1; i++) {
     payload.push_back(ident[i]);
   }
 }
 
 void add_lc_note_main_bin_spec_load_command(
     std::vector<std::vector<uint8_t>> &loadcmds, std::vector<uint8_t> &payload,
-    int payload_file_offset, std::string uuidstr) {
+    int payload_file_offset, std::string uuidstr, uint64_t address) {
   std::vector<uint8_t> loadcmd_data;
 
   add_uint32(loadcmd_data, LC_NOTE); // note_command.cmd
   add_uint32(loadcmd_data, 40);      // note_command.cmdsize
   char lc_note_name[16];
   memset(lc_note_name, 0, 16);
   strcpy(lc_note_name, "main bin spec");
 
   // lc_note.data_owner
   for (int i = 0; i < 16; i++)
     loadcmd_data.push_back(lc_note_name[i]);
 
   // we start writing the payload at payload_file_offset to leave
   // room at the start for the header & the load commands.
   uint64_t current_payload_offset = payload.size() + payload_file_offset;
 
   add_uint64(loadcmd_data, current_payload_offset); // note_command.offset
   add_uint64(loadcmd_data,
              sizeof(struct main_bin_spec_payload)); // note_command.size
 
   loadcmds.push_back(loadcmd_data);
 
   // Now write the "main bin spec" payload.
   add_uint32(payload, 1);          // version
-  add_uint32(payload, 3);          // type == 3 [ firmware, standalone,e tc ]
-  add_uint64(payload, UINT64_MAX); // load address unknown/unspecified
+  add_uint32(payload, 3);          // type == 3 [ firmware, standalone, etc ]
+  add_uint64(payload, address);    // load address
   uuid_t uuid;
   uuid_parse(uuidstr.c_str(), uuid);
   for (int i = 0; i < sizeof(uuid_t); i++)
     payload.push_back(uuid[i]);
   add_uint32(payload, 0); // log2_pagesize unspecified
   add_uint32(payload, 0); // unused
 }
 
if (cmd == LC_UUID) {
       break;
     }
     file_offset += cmdsize;
   }
   return uuid;
 }
 
 int main(int argc, char **argv) {
-  if (argc != 4) {
-    fprintf(stderr, "usage: create-empty-corefile version-string|main-bin-spec "
-                    "<output-core-name> <binary-to-copy-uuid-from>\n");
+  if (argc != 5) {
+    fprintf(stderr,
+            "usage: create-empty-corefile version-string|main-bin-spec "
+            "<output-core-name> <binary-to-copy-uuid-from> <address>\n");
+    fprintf(stderr,
+            "     <address> is base 16, 0xffffffffffffffff means unknown\n");
     fprintf(
         stderr,
         "Create a Mach-O corefile with an either LC_NOTE 'kern ver str' or \n");
     fprintf(stderr, "an LC_NOTE 'main bin spec' load command without an "
                     "address specified, depending on\n");
     fprintf(stderr, "whether the 1st arg is version-string or main-bin-spec\n");
     exit(1);
   }
   if (strcmp(argv[1], "version-string") != 0 &&
       strcmp(argv[1], "main-bin-spec") != 0) {
     fprintf(stderr, "arg1 was not version-string or main-bin-spec\n");
     exit(1);
   }
 
   std::string uuid = get_uuid_from_binary(argv[3]);
 
   // An array of load commands (in the form of byte arrays)
   std::vector<std::vector<uint8_t>> load_commands;
 
   // An array of corefile contents (page data, lc_note data, etc)
   std::vector<uint8_t> payload;
 
+  errno = 0;
+  uint64_t address = strtoull(argv[4], NULL, 16);
+  if (errno != 0) {
+    fprintf(stderr, "Unable to parse address %s as base 16", argv[4]);
+    exit(1);
+  }
+
   // First add all the load commands / payload so we can figure out how large
   // the load commands will actually be.
   load_commands.push_back(x86_lc_thread_load_command());
   if (strcmp(argv[1], "version-string") == 0)
-    add_lc_note_kern_ver_str_load_command(load_commands, payload, 0, uuid);
+    add_lc_note_kern_ver_str_load_command(load_commands, payload, 0, uuid,
+                                          address);
   else
-    add_lc_note_main_bin_spec_load_command(load_commands, payload, 0, uuid);
+    add_lc_note_main_bin_spec_load_command(load_commands, payload, 0, uuid,
+                                           address);
   add_lc_segment(load_commands, payload, 0);
 
   int size_of_load_commands = 0;
   for (const auto &lc : load_commands)
     size_of_load_commands += lc.size();
 
   int header_and_load_cmd_room =
       sizeof(struct mach_header_64) + size_of_load_commands;
 
   // Erase the load commands / payload now that we know how much space is
   // needed, redo it.
   load_commands.clear();
   payload.clear();
 
   load_commands.push_back(x86_lc_thread_load_command());
 
   if (strcmp(argv[1], "version-string") == 0)
-    add_lc_note_kern_ver_str_load_command(load_commands, payload,
-                                          header_and_load_cmd_room, uuid);
+    add_lc_note_kern_ver_str_load_command(
+        load_commands, payload, header_and_load_cmd_room, uuid, address);
   else
-    add_lc_note_main_bin_spec_load_command(load_commands, payload,
-                                           header_and_load_cmd_room, uuid);
+    add_lc_note_main_bin_spec_load_command(
+        load_commands, payload, header_and_load_cmd_room, uuid, address);
 
   add_lc_segment(load_commands, payload, header_and_load_cmd_room);
 
   struct mach_header_64 mh;
   mh.magic = MH_MAGIC_64;
   mh.cputype = CPU_TYPE_X86_64;
 
   mh.cpusubtype = CPU_SUBTYPE_X86_64_ALL;