Can't debug binary on MacOS (r2 signed, SIP disabled)

[demute]

I'm on a Macbook Pro M1 Max with MacOS Monterey 12.3.1. I am trying to debug a simple binary but for some reason, r2 is unable to stop at my breakpoint.

I have verified I have no old installations of radare2 on my system, then installed it with:

$ git clone [email protected]:radareorg/radare2.git
$ sys/install.sh
$ make -C binr/radare2 macossign
$ make -C binr/radare2 macos-sign-libs

The signature looks like this:

$ codesign -dv binr/radare2/radare2
radare2 $ codesign -dv binr/radare2/radare2
Executable=/Users/foobar/radare2/binr/radare2/radare2
Identifier=org.radare.radare2
Format=bundle with Mach-O thin (arm64)
CodeDirectory v=20400 size=619 flags=0x0(none) hashes=9+7 location=embedded
Signature size=1626
Signed Time=5 Jun 2023 at 11:01:39
Info.plist entries=6
TeamIdentifier=not set
Sealed Resources version=2 rules=10 files=9
Internal requirements count=1 size=96

I have rebooted in recovery mode and disabled SIP (I have tried both "csrutil disable" and "csrutil enable --without debug")

The source code to the binary I am trying to debug is

$ cat wonderful.c
#include <stdio.h>

int main (int argc, char **argv)
{
    for (int i=0; i<10; i++)
        printf ("Wonderful\n");
    return 0;
}

I am trying to set a breakpoint at the main function but it never stops:

$ gcc -o wonderful wonderful.c
$ r2 -d wonderful
WARN: run r2 with -e bin.cache=true to fix relocations in disassembly
[0x1028dce54]> aa
INFO: Analyze all flags starting with sym. and entry0 (aa)
INFO: Analyze all functions arguments/locals (afva@@@F)
[0x1028dce54]> afl~main
0x102533f40    6     96 main
[0x1028dce54]> db 0x102533f40
[0x1028dce54]> dc
hw breakpoints not yet supported
Wonderful
Wonderful
Wonderful
Wonderful
Wonderful
Wonderful
Wonderful
Wonderful
Wonderful
Wonderful
INFO: ==> Process finished

I have tried to start r2 with "-e bin.cache=true" but it makes no difference. I have also tried with sudo, no difference.

If I run the same binary in lldb, it works:

test $ lldb wonderful
(lldb) target create "wonderful"
Current executable set to '/Users/foobar/test/wonderful' (arm64).
(lldb) b main
Breakpoint 1: where = wonderful`main, address = 0x0000000100003f40
(lldb) run
Process 2951 launched: '/Users/foobar/test/wonderful' (arm64)
Process 2951 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
    frame #0: 0x0000000100003f40 wonderful`main
wonderful`main:
->  0x100003f40 <+0>:  sub    sp, sp, #0x30
    0x100003f44 <+4>:  stp    x29, x30, [sp, #0x20]
    0x100003f48 <+8>:  add    x29, sp, #0x20
    0x100003f4c <+12>: stur   wzr, [x29, #-0x4]
Target 0: (wonderful) stopped.
(lldb) 

Does anyone have any idea why r2 is not stopping at my breakpoint?

[trufae]

It seems like its trying to set a hardware breakpoint. You can try "dcu main" or dbg.hwbp=false

[demute]

That's awesome, you saved my day! Interestingly, both suggestions worked, e.g. "dcu main" worked even when I didn't set dbg.hwbp=false.

[trufae]

Maybe worth fixing that so it works with default settings, would you like to give it a try?