Tag: lldb

笔记

lldb 断点自动执行命令

By @sskaje
Link: https://sskaje.me/2018/03/lldb-%e6%96%ad%e7%82%b9%e8%87%aa%e5%8a%a8%e6%89%a7%e8%a1%8c%e5%91%bd%e4%bb%a4/

调试某软件，需要取到断点时候的内存数据。

之前是每次到断点，一个地址一个地址地 p 或者 memory read，后来看到 breakpoint command 命令，于是有了：

添加断点

(lldb) breakpoint set -a 0x100110000
Breakpoint 1: where = someapp`___lldb_unnamed_symbol10122$$global, address = 0x0000000100110000

1 2	(lldb) breakpoint set -a 0x100110000 Breakpoint 1: where = someapp`___lldb_unnamed_symbol10122$$global, address = 0x0000000100110000

添加命令

(lldb) breakpoint command add 1.1
Enter your debugger command(s).  Type 'DONE' to end.

1 2	(lldb) breakpoint command add 1.1 Enter your debugger command(s). Type 'DONE' to end.

输入命令

> memory read -f Y -c 0x100 $x1 
> memory read -f Y -c 0x100 $x2
> DONE

> memory read -f Y -c 0x100 $x1

> memory read -f Y -c 0x100 $x2

> DONE

这样，每次运行到断点的时候，就会执行这两条命令。

lldb 断点自动执行命令 by @sskaje: https://sskaje.me/2018/03/lldb-%e6%96%ad%e7%82%b9%e8%87%aa%e5%8a%a8%e6%89%a7%e8%a1%8c%e5%91%bd%e4%bb%a4/

Tags lldb, lldb breakpoint, lldb breakpoint command

iOS 逆向

ARM __moddi3

By @sskaje
Link: https://sskaje.me/2016/01/arm-__moddi3/

When I was debugging an app on iPhone 4 (armv7), I found a function call:

    0x22ad42 <+238>: blx    0x40e6dc                  ; symbol stub for: __moddi3

1	0x22ad42 <+238>: blx 0x40e6dc ; symbol stub for: __moddi3

Since ARM does not have Division/Modulo operators, compilers use other ways making your code work on devices like iPhone.

I followed the __moddi3 on iPhone 4, the moddi3() is provided by llvm’s compiler-rt (lib/builtins/moddi3.c).

Parameters a and b are 64-bit long and returned value is also 64-bit.

But in ARMv7, registers are 32-bit long. I’m trying to find out which registers are used.

I wrote a simple C file and compile to armv7 and x86_64

#include <stdio.h>

int main()
{
        long long a = 365;
        long long b = 14;
        long long c = a % b;
        long long d = a / b;

        printf("%llu %% %llu = %llu\n%llu / %llu = %llu\n", a, b, c, a, b, d);
        return 0;
}

#include <stdio.h>

int main()

{

long long a = 365;

long long b = 14;

long long c = a % b;

long long d = a / b;

printf("%llu %% %llu = %llu\n%llu / %llu = %llu\n", a, b, c, a, b, d);

return 0;

}

Compile to x86_64

clang -g -o mod_x86_64 mod.c

1	clang -g -o mod_x86_64 mod.c

Disassembe x86_64

$ otool -tV mod_x86_64
mod_x86_64:
(__TEXT,__text) section
_main:
0000000100000ed0	pushq	%rbp
0000000100000ed1	movq	%rsp, %rbp
0000000100000ed4	subq	$0x40, %rsp
0000000100000ed8	leaq	0x8b(%rip), %rdi        ## literal pool for: "%llu %% %llu = %llu\n%llu / %llu = %llu\n"
0000000100000edf	movl	$0x0, -0x4(%rbp)
0000000100000ee6	movq	$0x16d, -0x10(%rbp)     ## imm = 0x16D
0000000100000eee	movq	$0xe, -0x18(%rbp)
0000000100000ef6	movq	-0x10(%rbp), %rax
0000000100000efa	cqto
0000000100000efc	idivq	-0x18(%rbp)
0000000100000f00	movq	%rdx, -0x20(%rbp)
0000000100000f04	movq	-0x10(%rbp), %rdx
0000000100000f08	movq	%rdx, %rax
0000000100000f0b	cqto
0000000100000f0d	idivq	-0x18(%rbp)
0000000100000f11	movq	%rax, -0x28(%rbp)
0000000100000f15	movq	-0x10(%rbp), %rsi
0000000100000f19	movq	-0x18(%rbp), %rax
0000000100000f1d	movq	-0x20(%rbp), %rcx
0000000100000f21	movq	-0x10(%rbp), %r8
0000000100000f25	movq	-0x18(%rbp), %r9
0000000100000f29	movq	-0x28(%rbp), %r10
0000000100000f2d	movq	%rax, %rdx
0000000100000f30	movq	%r10, (%rsp)
0000000100000f34	movb	$0x0, %al
0000000100000f36	callq	0x100000f4a             ## symbol stub for: _printf
0000000100000f3b	xorl	%r11d, %r11d
0000000100000f3e	movl	%eax, -0x2c(%rbp)
0000000100000f41	movl	%r11d, %eax
0000000100000f44	addq	$0x40, %rsp
0000000100000f48	popq	%rbp
0000000100000f49	retq

$ otool -tV mod_x86_64

mod_x86_64:

(__TEXT,__text) section

_main:

0000000100000ed0 pushq %rbp

0000000100000ed1 movq %rsp, %rbp

0000000100000ed4 subq $0x40, %rsp

0000000100000ed8 leaq 0x8b(%rip), %rdi ## literal pool for: "%llu %% %llu = %llu\n%llu / %llu = %llu\n"

0000000100000edf movl $0x0, -0x4(%rbp)

0000000100000ee6 movq $0x16d, -0x10(%rbp) ## imm = 0x16D

0000000100000eee movq $0xe, -0x18(%rbp)

0000000100000ef6 movq -0x10(%rbp), %rax

0000000100000efa cqto

0000000100000efc idivq -0x18(%rbp)

0000000100000f00 movq %rdx, -0x20(%rbp)

0000000100000f04 movq -0x10(%rbp), %rdx

0000000100000f08 movq %rdx, %rax

0000000100000f0b cqto

0000000100000f0d idivq -0x18(%rbp)

0000000100000f11 movq %rax, -0x28(%rbp)

0000000100000f15 movq -0x10(%rbp), %rsi

0000000100000f19 movq -0x18(%rbp), %rax

0000000100000f1d movq -0x20(%rbp), %rcx

0000000100000f21 movq -0x10(%rbp), %r8

0000000100000f25 movq -0x18(%rbp), %r9

0000000100000f29 movq -0x28(%rbp), %r10

0000000100000f2d movq %rax, %rdx

0000000100000f30 movq %r10, (%rsp)

0000000100000f34 movb $0x0, %al

0000000100000f36 callq 0x100000f4a ## symbol stub for: _printf

0000000100000f3b xorl %r11d, %r11d

0000000100000f3e movl %eax, -0x2c(%rbp)

0000000100000f41 movl %r11d, %eax

0000000100000f44 addq $0x40, %rsp

0000000100000f48 popq %rbp

0000000100000f49 retq

x86_64 uses idivq, in this program:

dividend:  $rax
divisor:   $rbp-0x18
quotient:  $rax
remainder: $rdx

dividend: $rax

divisor: $rbp-0x18

quotient: $rax

remainder: $rdx

Compile to armv7

# CC="$(xcrun --sdk iphoneos -f clang)"
# SDKROOT=$(xcrun --sdk iphoneos --show-sdk-path)
# $CC -isysroot $SDKROOT -arch armv7 -g -o mod_armv7 mod.c

# CC="$(xcrun --sdk iphoneos -f clang)"

# SDKROOT=$(xcrun --sdk iphoneos --show-sdk-path)

# $CC -isysroot $SDKROOT -arch armv7 -g -o mod_armv7 mod.c

Disassemble armv7

$ otool -tV mod_armv7
mod_armv7:
(__TEXT,__text) section
_main:
0000bec8	    b5f0	push	{r4, r5, r6, r7, lr}
0000beca	    af03	add	r7, sp, #0xc
0000becc	e92d0d00	push.w	{r8, r10, r11}
0000bed0	    b096	sub	sp, #0x58
0000bed2	    466c	mov	r4, sp
0000bed4	f36f0402	bfc	r4, #0, #3
0000bed8	    46a5	mov	sp, r4
0000beda	f24000e6	movw	r0, #0xe6
0000bede	f2c00000	movt	r0, #0x0
0000bee2	    4478	add	r0, pc
0000bee4	    2100	movs	r1, #0x0
0000bee6	    9115	str	r1, [sp, #0x54]
0000bee8	    9113	str	r1, [sp, #0x4c]
0000beea	f240126d	movw	r2, #0x16d
0000beee	    9212	str	r2, [sp, #0x48]
0000bef0	    9111	str	r1, [sp, #0x44]
0000bef2	    220e	movs	r2, #0xe
0000bef4	    9210	str	r2, [sp, #0x40]
0000bef6	    9b12	ldr	r3, [sp, #0x48]
0000bef8	f8dd904c	ldr.w	r9, [sp, #0x4c]
0000befc	    900b	str	r0, [sp, #0x2c]
0000befe	    4618	mov	r0, r3
0000bf00	    910a	str	r1, [sp, #0x28]
0000bf02	    4649	mov	r1, r9
0000bf04	    9b0a	ldr	r3, [sp, #0x28]
0000bf06	f000e878	blx	0xbff8 @ symbol stub for: ___moddi3
0000bf0a	    910f	str	r1, [sp, #0x3c]
0000bf0c	    900e	str	r0, [sp, #0x38]
0000bf0e	    9812	ldr	r0, [sp, #0x48]
0000bf10	    9913	ldr	r1, [sp, #0x4c]
0000bf12	    9a10	ldr	r2, [sp, #0x40]
0000bf14	    9b11	ldr	r3, [sp, #0x44]
0000bf16	f000e86e	blx	0xbff4 @ symbol stub for: ___divdi3
0000bf1a	    910d	str	r1, [sp, #0x34]
0000bf1c	    900c	str	r0, [sp, #0x30]
0000bf1e	    9a12	ldr	r2, [sp, #0x48]
0000bf20	    9b13	ldr	r3, [sp, #0x4c]
0000bf22	f8dd9040	ldr.w	r9, [sp, #0x40]
0000bf26	f8ddc044	ldr.w	r12, [sp, #0x44]
0000bf2a	f8dde038	ldr.w	lr, [sp, #0x38]
0000bf2e	    9c0f	ldr	r4, [sp, #0x3c]
0000bf30	    461d	mov	r5, r3
0000bf32	    4616	mov	r6, r2
0000bf34	    46e0	mov	r8, r12
0000bf36	    46ca	mov	r10, r9
0000bf38	    46eb	mov	r11, sp
0000bf3a	f8cb1020	str.w	r1, [r11, #0x20]
0000bf3e	f8cb001c	str.w	r0, [r11, #0x1c]
0000bf42	f8cb8018	str.w	r8, [r11, #0x18]
0000bf46	f8cba014	str.w	r10, [r11, #0x14]
0000bf4a	f8cb5010	str.w	r5, [r11, #0x10]
0000bf4e	f8cb600c	str.w	r6, [r11, #0xc]
0000bf52	f8cb4008	str.w	r4, [r11, #0x8]
0000bf56	f8cbe004	str.w	lr, [r11, #0x4]
0000bf5a	f8cbc000	str.w	r12, [r11]
0000bf5e	f2400062	movw	r0, #0x62
0000bf62	f2c00000	movt	r0, #0x0
0000bf66	    4478	add	r0, pc
0000bf68	    4611	mov	r1, r2
0000bf6a	    461a	mov	r2, r3
0000bf6c	    464b	mov	r3, r9
0000bf6e	f000e846	blx	0xbffc @ symbol stub for: _printf
0000bf72	    2100	movs	r1, #0x0
0000bf74	    9009	str	r0, [sp, #0x24]
0000bf76	    4608	mov	r0, r1
0000bf78	f1a70418	sub.w	r4, r7, #0x18
0000bf7c	    46a5	mov	sp, r4
0000bf7e	e8bd0d00	pop.w	{r8, r10, r11}
0000bf82	    bdf0	pop	{r4, r5, r6, r7, pc}

$ otool -tV mod_armv7

mod_armv7:

(__TEXT,__text) section

_main:

0000bec8 b5f0 push {r4, r5, r6, r7, lr}

0000beca af03 add r7, sp, #0xc

0000becc e92d0d00 push.w {r8, r10, r11}

0000bed0 b096 sub sp, #0x58

0000bed2 466c mov r4, sp

0000bed4 f36f0402 bfc r4, #0, #3

0000bed8 46a5 mov sp, r4

0000beda f24000e6 movw r0, #0xe6

0000bede f2c00000 movt r0, #0x0

0000bee2 4478 add r0, pc

0000bee4 2100 movs r1, #0x0

0000bee6 9115 str r1, [sp, #0x54]

0000bee8 9113 str r1, [sp, #0x4c]

0000beea f240126d movw r2, #0x16d

0000beee 9212 str r2, [sp, #0x48]

0000bef0 9111 str r1, [sp, #0x44]

0000bef2 220e movs r2, #0xe

0000bef4 9210 str r2, [sp, #0x40]

0000bef6 9b12 ldr r3, [sp, #0x48]

0000bef8 f8dd904c ldr.w r9, [sp, #0x4c]

0000befc 900b str r0, [sp, #0x2c]

0000befe 4618 mov r0, r3

0000bf00 910a str r1, [sp, #0x28]

0000bf02 4649 mov r1, r9

0000bf04 9b0a ldr r3, [sp, #0x28]

0000bf06 f000e878 blx 0xbff8 @ symbol stub for: ___moddi3

0000bf0a 910f str r1, [sp, #0x3c]

0000bf0c 900e str r0, [sp, #0x38]

0000bf0e 9812 ldr r0, [sp, #0x48]

0000bf10 9913 ldr r1, [sp, #0x4c]

0000bf12 9a10 ldr r2, [sp, #0x40]

0000bf14 9b11 ldr r3, [sp, #0x44]

0000bf16 f000e86e blx 0xbff4 @ symbol stub for: ___divdi3

0000bf1a 910d str r1, [sp, #0x34]

0000bf1c 900c str r0, [sp, #0x30]

0000bf1e 9a12 ldr r2, [sp, #0x48]

0000bf20 9b13 ldr r3, [sp, #0x4c]

0000bf22 f8dd9040 ldr.w r9, [sp, #0x40]

0000bf26 f8ddc044 ldr.w r12, [sp, #0x44]

0000bf2a f8dde038 ldr.w lr, [sp, #0x38]

0000bf2e 9c0f ldr r4, [sp, #0x3c]

0000bf30 461d mov r5, r3

0000bf32 4616 mov r6, r2

0000bf34 46e0 mov r8, r12

0000bf36 46ca mov r10, r9

0000bf38 46eb mov r11, sp

0000bf3a f8cb1020 str.w r1, [r11, #0x20]

0000bf3e f8cb001c str.w r0, [r11, #0x1c]

0000bf42 f8cb8018 str.w r8, [r11, #0x18]

0000bf46 f8cba014 str.w r10, [r11, #0x14]

0000bf4a f8cb5010 str.w r5, [r11, #0x10]

0000bf4e f8cb600c str.w r6, [r11, #0xc]

0000bf52 f8cb4008 str.w r4, [r11, #0x8]

0000bf56 f8cbe004 str.w lr, [r11, #0x4]

0000bf5a f8cbc000 str.w r12, [r11]

0000bf5e f2400062 movw r0, #0x62

0000bf62 f2c00000 movt r0, #0x0

0000bf66 4478 add r0, pc

0000bf68 4611 mov r1, r2

0000bf6a 461a mov r2, r3

0000bf6c 464b mov r3, r9

0000bf6e f000e846 blx 0xbffc @ symbol stub for: _printf

0000bf72 2100 movs r1, #0x0

0000bf74 9009 str r0, [sp, #0x24]

0000bf76 4608 mov r0, r1

0000bf78 f1a70418 sub.w r4, r7, #0x18

0000bf7c 46a5 mov sp, r4

0000bf7e e8bd0d00 pop.w {r8, r10, r11}

0000bf82 bdf0 pop {r4, r5, r6, r7, pc}

In armv7:

dividend:  $r0 | ($r1 << 32)
divisor:   $r2 | ($r3 << 32)
quotient:  N/A
remainder: $r0 | ($r1 << 32)

dividend: $r0 | ($r1 << 32)

divisor: $r2 | ($r3 << 32)

quotient: N/A

remainder: $r0 | ($r1 << 32)

If both dividend and divisor are less than 0x100000000.

$r2 may be negative, like 0xfffffff3. ($r3 == 0).

(lldb) p $r0 - $r2
(int) $0 = 14

1 2	(lldb) p $r0 - $r2 (int) $0 = 14

means $r0 – $r2 == divisor

If signed integer $r2 is smaller than 0x80000000,
((long long) $r1 << 32 | $r0) - ((long long ) $r3 << 32 | $r2) == divisor.

ARM __moddi3 by @sskaje: https://sskaje.me/2016/01/arm-__moddi3/

Incoming search terms:

Tags arm, armv7, debug, lldb

iOS 逆向

error: failed to launch process debugserver: Security

Post author By sskaje
Post date January 8, 2016
No Comments on error: failed to launch process debugserver: Security

By @sskaje
Link: https://sskaje.me/2016/01/failed-launch-process-debugserver-security/

I jailbroken my iPhone 4s with iOS 8.2 and tried to ran debugserver, then I met this error:

# debugserver *:9988 /var/mobile/Containers/Bundle/Application/P-A-T-H/to.app/Binary
debugserver-@(#)PROGRAM:debugserver  PROJECT:debugserver-320.2.89
 for armv7.
error: failed to launch process debugserver: Security
Exiting.

# debugserver *:9988 /var/mobile/Containers/Bundle/Application/P-A-T-H/to.app/Binary

debugserver-@(#)PROGRAM:debugserver PROJECT:debugserver-320.2.89

for armv7.

error: failed to launch process debugserver: Security

Exiting.

Google doesn’t help.

Just because, the App I’m trying to crack is an In-House app, not from AppStore, I have to ran it after installation and choose to trust the developer.

error: failed to launch process debugserver: Security by @sskaje: https://sskaje.me/2016/01/failed-launch-process-debugserver-security/

Incoming search terms:

NOUNDEFS DYLDLINK TWOLEVEL WEAK_DEFINES BINDS_TO_WEAK PIE

Tags debugserver, ios, lldb

iOS OS X 逆向

Set up DebugServer on iOS 7

Post author By sskaje
Post date January 4, 2016
No Comments on Set up DebugServer on iOS 7

By @sskaje
Link: https://sskaje.me/2016/01/set-up-debugserver-ios-7/

I had my iPhone 4 jailbroken, so I can debug/crack apps on iPhone.

Server: iPhone 4 + debugserver
Client: Mac OS X + lldb

Server

DebugServer

Debugserver can be found on iOS: /Developer/usr/bin/debugserver
Just follow instructions: debugserver on iPhone Wiki

# lipo -info /Developer/usr/bin/debugserver 
Architectures in the fat file: /Developer/usr/bin/debugserver are: armv7 armv7s arm64 
# lipo -thin armv7 /Developer/usr/bin/debugserver -output ~/debugserver

# lipo -info /Developer/usr/bin/debugserver

Architectures in the fat file: /Developer/usr/bin/debugserver are: armv7 armv7s arm64

# lipo -thin armv7 /Developer/usr/bin/debugserver -output ~/debugserver

Save following content as a plist like dbg.plist

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.springboard.debugapplications</key>
	<true/>
	<key>get-task-allow</key>
	<true/>
	<key>task_for_pid-allow</key>
	<true/>
	<key>run-unsigned-code</key>
	<true/>
</dict>
</plist>

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

<dict>

<key>com.apple.springboard.debugapplications</key>

<true/>

<key>get-task-allow</key>

<true/>

<key>task_for_pid-allow</key>

<true/>

<key>run-unsigned-code</key>

<true/>

</dict>

</plist>

Apply the entitlement

ldid -Sdbg.plist debugserver

1	ldid -Sdbg.plist debugserver

If entitlement above is not applied, debugserver won’t be able to listen to a TCP port.

Remove FairPlay

FairPlay is Apple’s DRM applied to apps on AppStore.
If you see cryptid 1 like below, try Clutch!

otool -l /var/mobile/Applications/0732D587-2530-4517-A101-C46602B32628/CheMiYouHao.app/CheMiYouHao |grep LC_ENCRYPTION_INFO -A 5 cmd LC_ENCRYPTION_INFO cmdsize 20 cryptoff 16384 cryptsize 5652480 cryptid 1 Load command 13

1
2
3
4
5
6
7

otool -l /var/mobile/Applications/0732D587-2530-4517-A101-C46602B32628/CheMiYouHao.app/CheMiYouHao  |grep LC_ENCRYPTION_INFO -A 5
          cmd LC_ENCRYPTION_INFO
      cmdsize 20
    cryptoff  16384
    cryptsize 5652480
    cryptid   1
Load command 13

Disable ASLR

Try otool -hv to your App, if you see PIE flags, you have to disable ASLR.

mede-iPhone:~ root# otool -hv /var/mobile/Applications/0732D587-2530-4517-A101-C46602B32628/CheMiYouHao.app/CheMiYouHao 
/var/mobile/Applications/0732D587-2530-4517-A101-C46602B32628/CheMiYouHao.app/CheMiYouHao:
Mach header
      magic cputype cpusubtype  caps    filetype ncmds sizeofcmds      flags
   MH_MAGIC     ARM         V7  0x00     EXECUTE    48       5084   NOUNDEFS DYLDLINK TWOLEVEL WEAK_DEFINES BINDS_TO_WEAK PIE

mede-iPhone:~ root# otool -hv /var/mobile/Applications/0732D587-2530-4517-A101-C46602B32628/CheMiYouHao.app/CheMiYouHao

/var/mobile/Applications/0732D587-2530-4517-A101-C46602B32628/CheMiYouHao.app/CheMiYouHao:

Mach header

magic cputype cpusubtype caps filetype ncmds sizeofcmds flags

MH_MAGIC ARM V7 0x00 EXECUTE 48 5084 NOUNDEFS DYLDLINK TWOLEVEL WEAK_DEFINES BINDS_TO_WEAK PIE

See: Mach-O Disable ASLR/PIE

Make sure you have python installed on your iPhone.

Find your target app.

Client

Copy a decrypted and de-aslr-ed app binary to your OS X and:

$ lldb /path/to/app/binary
(lldb) target create "/path/to/app/binary"
Current executable set to '/path/to/app/binary' (arm64).
(lldb) platform select remote-ios 
  Platform: remote-ios
 Connected: no
  SDK Path: "/Users/sskaje/Library/Developer/Xcode/iOS DeviceSupport/9.2 (13C75)"
 SDK Roots: [ 0] "/Users/sskaje/Library/Developer/Xcode/iOS DeviceSupport/7.1.2 (11D257)"
 SDK Roots: [ 1] "/Users/sskaje/Library/Developer/Xcode/iOS DeviceSupport/8.3 (12F70)"
 SDK Roots: [ 2] "/Users/sskaje/Library/Developer/Xcode/iOS DeviceSupport/8.4.1 (12H321)"
 SDK Roots: [ 3] "/Users/sskaje/Library/Developer/Xcode/iOS DeviceSupport/9.2 (13C75)"
(lldb) process connect connect://172.18.1.66:9988

$ lldb /path/to/app/binary

(lldb) target create "/path/to/app/binary"

Current executable set to '/path/to/app/binary' (arm64).

(lldb) platform select remote-ios

Platform: remote-ios

Connected: no

SDK Path: "/Users/sskaje/Library/Developer/Xcode/iOS DeviceSupport/9.2 (13C75)"

SDK Roots: [ 0] "/Users/sskaje/Library/Developer/Xcode/iOS DeviceSupport/7.1.2 (11D257)"

SDK Roots: [ 1] "/Users/sskaje/Library/Developer/Xcode/iOS DeviceSupport/8.3 (12F70)"

SDK Roots: [ 2] "/Users/sskaje/Library/Developer/Xcode/iOS DeviceSupport/8.4.1 (12H321)"

SDK Roots: [ 3] "/Users/sskaje/Library/Developer/Xcode/iOS DeviceSupport/9.2 (13C75)"

(lldb) process connect connect://172.18.1.66:9988

Set up DebugServer on iOS 7 by @sskaje: https://sskaje.me/2016/01/set-up-debugserver-ios-7/

Tags aslr, debugserver, fairplay, lldb

OS X 学习研究操作系统相关笔记逆向

Note: LLDB Debug OS X Application

Post author By sskaje
Post date January 11, 2014
No Comments on Note: LLDB Debug OS X Application

By @sskaje
Link: https://sskaje.me/2014/01/note-lldb-debug-os-application/

The LLDB Debugger, as it’s said on http://lldb.llvm.org/:

LLDB is a next generation, high-performance debugger. It is built as a set of reusable components which highly leverage existing libraries in the larger LLVM Project, such as the Clang expression parser and LLVM disassembler.

I was trying to find an OllyDBG-like debugger on OS X, gdb & lldb are the two choices.
Affinic.com has GUI for these two debuggers, not so good.
Hopper Disassembler provides it’s own GDB Server app, still bad.

Only commands here:

Stop at entry:

(lldb) process launch --stop-at-entry

1	(lldb) process launch --stop-at-entry

Launch with args:

(lldb) process launch --  -a -b -c

1	(lldb) process launch -- -a -b -c

Read memory(stack like):

(lldb)  memory read -f A -c 0x4 $esp-4
0xbfffe49c: 0x00002d76 
0xbfffe4a0: 0x03f13790 -> 0xa11d2b70 Foundation`NSConcreteMutableData
0xbfffe4a4: 0x00003aff "ascii26String"
0xbfffe4a8: 0x00000007

(lldb) memory read -f A -c 0x4 $esp-4

0xbfffe49c: 0x00002d76

0xbfffe4a0: 0x03f13790 -> 0xa11d2b70 Foundation`NSConcreteMutableData

0xbfffe4a4: 0x00003aff "ascii26String"

0xbfffe4a8: 0x00000007

Note: LLDB Debug OS X Application by @sskaje: https://sskaje.me/2014/01/note-lldb-debug-os-application/

Tags affinic, affinic debugger, affinic debugger lldb, debugger, hopper, hopper debugger, hopper disassembler, hopper lldb, hopperapp, lldb, obj-c