exeucte debugme will make Tiiktok crash

[4ch12dy]

exeucte debugme will make Tiiktok crash

[liuxuan30]

如果让程序完全跑起来以后，中断LLDB 然后跑debugme，似乎也oK,

但是给某个函数在svc 前后加了断点，再继续执行，就会遇到

error: memory read failed for 0xfffffffe18d90000

crash提示在

0x1033c0be8 <+276>: mov x1, x0

尝试打印$x1 和x0是这样的：

(lldb) po $x0
error: Couldn't materialize: couldn't read the value of register x0
error: errored out in DoExecute, couldn't PrepareToExecuteJITExpression
(lldb) po $x1
error: Couldn't materialize: couldn't read the value of register x1
error: errored out in DoExecute, couldn't PrepareToExecuteJITExpression
(lldb) reg read
General Purpose Registers:
       x19 = 0x0000000281b69530
       x20 = 0x0000000281b69530
       x21 = 0x0000000281b69540
       x22 = 0x00000002225717b8 
       x23 = 0x00000001070b9658 
       x24 = 0x000000028308d560
       x25 = 0x000000005f910b68
       x26 = 0x00000002226b4037 
       x27 = 0x0000000106804000  (void *)0x000000010689aec0
       x28 = 0x00000001067a4000 
        fp = 0x00000001704710f0
        lr = 0x00000001033c0be8  TikTok`___lldb_unnamed_symbol400914$$TikTok + 276
        sp = 0x0000000170471080
        pc = 0x00000001033c0be8  TikTok`___lldb_unnamed_symbol400914$$TikTok + 276
20 registers were unavailable.

[liuxuan30]

如果我尝试使用patcher
比如代码段

    0x105968c14 <+320>: b      0x105968bf4               ; <+288>
    0x105968c18 <+324>: svc    #0x80
    0x105968c1c <+328>: add    sp, sp, #0x50             ; =0x50 

我想把0x105968c18 改为nop,

(lldb) patcher -a 0x105968c18 -i nop -s 4
[*] start patch text at address:0x105968c18 size:4 to ins:"nop" and data:0x1f, 0x20, 0x03, 0xd5 
[*] make ins data:
{0x1f, 0x20, 0x03, 0xd5 ,0x1f, 0x20, 0x03, 0xd5 ,0x1f, 0x20, 0x03, 0xd5 ,0x1f, 0x20, 0x03, 0xd5 }
[+] patch done
[x] power by xia0@2019

然后再继续，也会遇到

error: memory read failed for 0x10765f6400

[4ch12dy]

douyin就别想一步搞定了

[liuxuan30]

@4ch12dy 能详细说说吗？你是说xia0LLDB 里面那些反反调试的没法用还是有bug？还是被针对了

[4ch12dy]

有对抗