atos(1)                      General Commands Manual                     atos(1)

     atos – convert numeric addresses to symbols of binary images or processes

     atos [-o <binary-image-file> | <dSYM>]
          [-p <pid> | <partial-executable-name>] [-arch architecture]
          [-l <load-address>] [-s <slide>] [-printHeader] [-fullPath] [-i]
          [-d <delimiter>] [-f <address-input-file>] [<address> ...]

     The atos command converts numeric addresses to their symbolic equivalents.
     If full debug symbol information is available, for example in a .app.dSYM
     sitting beside a .app, then the output of atos will include file name and
     source line number information.

     The input addresses may be given in one of three ways:

     1.   A list of addresses at the end of the argument list.

     2.   Using the -f <address-input-file> argument to specify the path of an
          input file containing whitespace-separated numeric addresses.

     3.   If no addresses were directly specified, atos enters an interactive
          mode, reading addresses from stdin.

     The symbols are found in either a binary image file or in a currently
     executing process, as specified by:

     -o <binary-image-file> | <dSYM>
             The path to a binary image file or dSYM in which to look up

     -p <pid> | <partial-executable-name>
             The process ID or the partial name of a currently executing process
             in which to look up symbols.

     Multiple process IDs or paths can be specified if necessary, and the two
     can be mixed in any order.  When working with a Mach-O binary image file,
     atos considers only addresses and symbols defined in that binary image
     file, at their default locations (unless the -l or -s option is given).
     When working with a running process, atos considers addresses and symbols
     defined in all binary images currently loaded by that process, at their
     loaded locations.

     The following additional options are available.

     -arch architecture
             The particular architecure of a binary image file in which to look
             up symbols.

     -l <load-address>
             The load address of the binary image.  This value is always assumed
             to be in hex, even without a "0x" prefix.  The input addresses are
             assumed to be in a binary image with that load address.  Load
             addresses for binary images can be found in the Binary Images:
             section at the bottom of crash, sample, leaks, and malloc_history

     -s <slide>
             The slide value of the binary image -- this is the difference
             between the load address of a binary image, and the address at
             which the binary image was built.  This slide value is subtracted
             from the input addresses.  It is usually easier to directly specify
             the load address with the -l argument than to manually calculate a
             slide value.

             If a process was specified, the first line of atos output should be
             a header of the form "Looking up symbols in process <pid> named:
             <process-name>".  This is primarily used when atos is invoked as
             part of a stackshot(1) run, for verification of the process ID and

             Print the full path of the source files.

     -i      Display inlined symbols.

     -d <delimiter>
             Delimiter when outputting inline frames. Defaults to newline.

     A stripped, optimized version of Sketch was built as an x86_64 position-
     independent executable (PIE) into /BuildProducts/Release.  Full debug
     symbol information is available in, which sits alongside  When was run, the Sketch binary (which was built at
     0x100000000) was loaded at 0x10acde000.  Running 'sample Sketch' showed 3
     addresses that we want to get symbol information for -- 0x10acea1d3,
     0x10ace4bea, and 0x10ace4b7a.

     First notice that the .dSYM is next to the .app:

     % ls -1 /BuildProducts/Release/

     Now, to symbolicate, we run atos with the -o flag specifying the path to
     the actual Sketch executable (not the .app wrapper), the -arch x86_64 flag,
     and the -l 0x10acde000 flag to specify the load address.

     % atos -o /BuildProducts/Release/ -arch x86_64 -l 0x10acde000  0x10acea1d3 0x10ace4bea 0x10ace4b7a
     -[SKTGraphicView drawRect:] (in Sketch) (SKTGraphicView.m:445)
     -[SKTGraphic drawHandlesInView:] (in Sketch) (NSGeometry.h:110)
     -[SKTGraphic drawHandleInView:atPoint:] (in Sketch) (SKTGraphic.m:490)

     The same goal can be achieved by running atos with the dSYM:

     % atos -o /BuildProducts/Release/ -arch x86_64 -l 0x10acde000  0x10acea1d3 0x10ace4bea 0x10ace4b7a
     -[SKTGraphicView drawRect:] (in Sketch) (SKTGraphicView.m:445)
     -[SKTGraphic drawHandlesInView:] (in Sketch) (NSGeometry.h:110)
     -[SKTGraphic drawHandleInView:atPoint:] (in Sketch) (SKTGraphic.m:490)

     It is possible to get symbols for addresses from a different machine
     architecture than the system on which atos is running.  For example, when
     running atos on an Intel-based system, one may wish to get the symbol for
     an address that came from a backtrace of a process running on an ARM
     device.  To do so, use the -arch flag to specify the desired architecture
     (such as i386 or arm) and pass in a corresponding symbol-rich Mach-O binary
     image file with a binary image of the corresponding architecture (such as a
     Universal Binary).

macOS 12.1                         May 9, 2017                        macOS 12.1