Vault7: CIA Hacking Tools Revealed
Navigation: » Directory » iOS » iOS » How-to articles
iOS Debugging
Set Up
- GDB does not work on device, so use debugserver
- El_ssh will install an appropriate version of debugserver and cdhash it. Find it in /private/var/root/bin (note that this is also on PATH).
- Run the debugserver on target (can leave process to debug out)
- debugserver *:8888 <executable to run>
- From your host computer, run tcprelay (part of the usbmuxd project under the python-client directory)
- python tcprelay.py -t 8888
- Get debug symbols and shared cache using XCode. (without this, you will see "<redacted>" in LLDB where it attempts to print the names of functions in shared cache)
- Have device plugged in.
- Start XCode.
- Go to "Window->Devices".
- Select the device from the screen that appears.
- Run lldb in another window and in it run the command.
- gdb-remote localhost:8888
LLDB Commands
-
process attach —name <procname> —waitfor
- pro at -n a.out -w
- image dump sections - shows sections
- image lookup --address <addr> - info on what library and section this address is in (prints nothing if not loaded)
- target module dump sections <module name> - show sections for a loaded module
- target module dump symtab <module name> - show symbols for a module
-
Breaking
- b <func name>
- b <file>:<linenum>
-
b -a <address>
- remember that the addres
-
List breakpoints
- br l
-
Disable breakpoint
- br dis 3
-
Backtrace
- bt
-
Registers
- register read
-
Data Viewing
-
Same as GDB:
- x/16gx <addr> - view 16 units of data at <addr> as 64-bit words (g) in hex (x)
-
Same as GDB:
-
Continue
- c
-
Stepping
- si - assembly level step
- ni - assembly level next
-
Switch frames
- f <frame number>
- frame info
- up
- down
-
Commands
-
command history
- co h
-
command history
-
Disassembly
- disassemble -s <address> -c <num instructions>
-
Setting Values
- register write rax 123
ARM Tricks
- If get garbage disassembly, maybe the code is Thumb mode and LLDB can't tell. Try disassembling one byte later or try passing "-A thumb" to specify thumb.
-
Tell if in ARMProcessor manufacturer mode or Thumb mode:
- print $cpsr & 0x20 (prints 32 if in Thumb mode)