derekselander/lldb

A collection of LLDB aliases/regexes and Python scripts to aid in your debugging sessions

lldb's Issues

Lookup not printing anything..

Hi Derek,

Is something broken in lookup or is this a base class / subclass thing?
I am debugging a largely ObjC release app that stripped but it set to debuggable (get-task-allow).

(lldb) lookup MYBaseView
(lldb) lookup MYBaseView -s
(lldb) lookup -x MYBaseView
// nothing printed to stdout

Search...

(lldb) search MYBaseView
// works perfect. prints the pointer references to the Heap objects. 

Strangely, even this fails [ despite the fact I can po the information:

image lookup -n "-[MyClass foobar]"
// nothing printed to stdout

I was using your scripts from the latest Master ( Jan 27, 2020 ) commit. Also:

(lldb) version
lldb-1100.0.30.6
Apple Swift version 5.1.2 (swiftlang-1100.0.278 clang-1100.0.33.9)

CFStringCreateWithBytes needed!

sbt-script-output.txt
Keep getting this when I run a variety of commands:

Error [IRForTarget]: Rewriting an Objective-C constant string requires CFStringCreateWithBytes

(this particular one comes from using sbt)

Wouldn't expect it to be a python 3-ism.

Sorry, was on a browser that didn't allow me to attach the text file. The file attached contains the obj-c code that's trying to run and the context of the sbt use.

ivars not working.

error: use of undeclared identifier

(lldb) overlaydbg
error: use of undeclared identifier 'UIDebuggingInformationOverlay'

IOS 11.4.1
i don't understand this error ?

msl not working in Xcode 12.4

Hi, I've enabled malloc stack logging in the scheme editor for my current target (Simulator x86_64), and when I take an ObjC object address and pass to msl, I'm not getting any output.

Is there something I might be missing, or otherwise how can I provide more information here for effective debugging?
I am using the latest version of this repo, as of this morning.

(lldb) p inObject
(ClassNameRedactedHere *) $5 = 0x00007f8beaab8e40
(lldb) msl 0x00007f8beaab8e40

Any suggestion on integrate theos into XCode

I've just watched your lldb workshop video, it's awesome, I love it.

Now I'm interested in jailbreak development. I've written serval tweaks using theos with sublime text. I'm wondering is there any way to integrate theos into Xcode, so that I can benefit from it's syntax highlighted and code completion.

I don't like IOSOpenDev, it's outdated and need many fixes.

Thanks.

Xcode 11 / iOS 13 support

Upon launching a project in Xcode 11 with iOS 13, a bunch of warnings related to this project are dumped:

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print(data.sint64[0])? (ds.py, line 229)
  File "temp.py", line 1, in <module>
  File "/Users/ash/iOS/source/LLDB/lldb_commands/xref.py", line 4, in <module>
    import ds

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print(data.sint64[0])? (ds.py, line 229)
  File "temp.py", line 1, in <module>
  File "/Users/ash/iOS/source/LLDB/lldb_commands/lookup.py", line 25, in <module>
    import ds

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print(data.sint64[0])? (ds.py, line 229)
  File "temp.py", line 1, in <module>
  File "/Users/ash/iOS/source/LLDB/lldb_commands/section.py", line 7, in <module>
    import ds

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print(data.sint64[0])? (ds.py, line 229)
  File "temp.py", line 1, in <module>
  File "/Users/ash/iOS/source/LLDB/lldb_commands/disassemble.py", line 7, in <module>
    import ds

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print(data.sint64[0])? (ds.py, line 229)
  File "temp.py", line 1, in <module>
  File "/Users/ash/iOS/source/LLDB/lldb_commands/msl.py", line 5, in <module>
    import ds

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print(data.sint64[0])? (ds.py, line 229)
  File "temp.py", line 1, in <module>
  File "/Users/ash/iOS/source/LLDB/lldb_commands/dclass.py", line 24, in <module>
    import ds

error: module importing failed: inconsistent use of tabs and spaces in indentation (search.py, line 383)
  File "temp.py", line 1, in <module>

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print(data.sint64[0])? (ds.py, line 229)
  File "temp.py", line 1, in <module>

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print(frame)? (breakifonfunc.py, line 84)
  File "temp.py", line 1, in <module>

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print(data.sint64[0])? (ds.py, line 229)
  File "temp.py", line 1, in <module>
  File "/Users/ash/iOS/source/LLDB/lldb_commands/sbt.py", line 26, in <module>
    import ds

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print('Whoops! You are missing the <' + arg.argName + '> argument.')? (fblldb.py, line 96)
  File "temp.py", line 1, in <module>

It looks like the commands are generally broken as well (dclass specifically, for example).
This is an awesome project, would love to see iOS 13 support. Thank you for all the work you've contributed on this project already!

error when `ex -l swift -- import Foundation`

Hey,

I've just started this book and got an error while trying to import Foundation into lldb.

(lldb) ex -l swift -- import Foundation

Cannot create Swift scratch context (couldn't load the Swift stdlib)Cannot create Swift scratch context (couldn't load the Swift stdlib)Shared Swift state for Xcode could not be initialized.
The REPL and expressions are unavailable.

What is going on here?

Command line tools are set in Xcode preferences:

Regards,
Tom

command alias p/x

hi,i see the command alias like
command alias reload_lldbinit command source ~/.lldbinit.

now I'd like to
command alias 1 p/x $x1
.....

but it note:
error: invalid command given to 'command alias'. 'p/x $x1' does not begin with a valid command. No alias created.

can you help me?

dd command issue

dd isn't working for me on Version 8.3.3 (8E3004b) of Xcode

@DerekSelander Thanks for all your hard work and enjoying your book!

(lldb) dd
Traceback (most recent call last):
File "/usr/local/bin/lldb_commands/disassemble.py", line 37, in handle_command
output += generateAssemblyFromSymbol(sym, options)
File "/usr/local/bin/lldb_commands/disassemble.py", line 66, in generateAssemblyFromSymbol
mnemonic = ds.attrStr(inst.mnemonic.ljust(5), 'red')
File "/Applications/Xcode8.app/Contents/SharedFrameworks/LLDB.framework/Resources/Python/lldb/init.py", line 5220, in mnemonic_property
return self.GetMnemonic (target)
File "/Applications/Xcode8.app/Contents/SharedFrameworks/LLDB.framework/Resources/Python/lldb/init.py", line 5173, in GetMnemonic
return _lldb.SBInstruction_GetMnemonic(self, *args)
ValueError: invalid null reference in method 'SBInstruction_GetMnemonic', argument 2 of type 'lldb::SBTarget'
(lldb)

sbt command not working

Thank you for providing wondering python scripts. However, I cannot get sbt command to work!
I followed the installation instruction to the tee, but I get following error:
___lldb_unnamed_symbol33766$$... unresolved womp womp

Please help!

SwiftUI Debugging Reverse Engineering

Hi
Is there any information about SwiftUI debugging/ reverse Engineering?
Thanks

Any way to implement mshookfunction use lldb python api or dynamic load a dylib?

This project implement many awesome commands to inspect the process, I just curious how to alter the program execution. Breakpoint with expression seems can do this, but seems not a effective way, do you have any suggestions?

Can I use this to debug macOS Apps?

I'd like to debug some macOS Apps, what part I should change to make it work?

dd command failed

Env:
Symulator iOS 11.2 iPhone X

Usage:
(lldb) dd 0x10af2df62

Result:
Traceback (most recent call last):
File "/some/path/lldb/lldb_commands/disassemble.py", line 42, in handle_command
output += generateAssemblyFromSymbol(sym, options, exe_ctx)
File "/some/path/lldb/lldb_commands/disassemble.py", line 74, in generateAssemblyFromSymbol
pc = ds.attrStr('-> ', 'red') if frame.addr == inst.addr else ' '
NameError: global name 'frame' is not defined

methods command

I just updated to the latest scripts (from first week of May 2019).

When connected to a real or simulator iOS device, if I run...

(lldb) methods UIView
error: expression value didn't result in a scalar value for the expression 'UIView'

If I find a pointer to the Class, it works..

(lldb) search UIView
<UIImageView: 0x7fd81bd08450; frame = (0 0; 0 0); userInteractionEnabled = NO; layer = <CALayer: 0x60000290f020>>

(lldb) methods 0x7fd81bd08450
...happily lists class and instance methods here....

(lldb) help methods
     Dumps all methods implemented by the NSObject subclass (iOS, NSObject
     subclass only)  Expects 'raw' input (see 'help raw-input'.)

Syntax: methods UIView

Running sys echo "$(dclass -t swift)" outputs "command not found"

I just started reading Advanced Apple Debugging & Reverse Engineering, and I am in chapter 1 where it says to execute:

(lldb) sys echo "$(dclass -t swift)" | grep -v _ | grep "\." | cut -d. -f1 | uniq | wc -l

When attached to Xcode 10.2, upon running this command, I receive over 1000 lines of output ending with this:

/bin/sh: line 1422: _TtGCs23_ContiguousArrayStorageGVs5RangeSi__$: command not found
/bin/sh: line 1423: _TtGCs23_ContiguousArrayStorageGSaGVs5RangeSi___$: command not found
/bin/sh: line 1424: _TtGCs23_ContiguousArrayStorageV12SourceEditor26SourceEditorLineIdentifier_$: command not found
/bin/sh: line 1425: _TtGCs23_ContiguousArrayStorageCSo18NSAttributedString_$: command not found
/bin/sh: line 1426: _TtGCs23_ContiguousArrayStorageCSo9NSTextTab_$: command not found
/bin/sh: line 1427: _TtGCs23_ContiguousArrayStorageTSSP___$: command not found
/bin/sh: line 1428: _TtGCs23_ContiguousArrayStorageGSqP12SourceEditor30SourceEditorDataSourceObserver___$: command not found
/bin/sh: line 1429: _TtGCs23_ContiguousArrayStorageTVs11AnyHashableP___$: command not found
/bin/sh: line 1430: _TtGCs23_ContiguousArrayStorageTaSo21NSAttributedStringKeyP___$: command not found
/bin/sh: line 1431: _TtGCs23_ContiguousArrayStorageP12SourceEditor29SourceEditorFeatureController__$: command not found
/bin/sh: line 1432: _TtGCs23_ContiguousArrayStorageVs9Character_$: command not found
/bin/sh: line 1433: _TtGCs23_ContiguousArrayStorageP12SourceEditor33EditAssistantPostProcessOperation__$: command not found
/bin/sh: line 1434: _TtGCs23_ContiguousArrayStorageP12SourceEditor32EditAssistantPreProcessOperation__$: command not found
/bin/sh: line 1435: _TtGCs23_ContiguousArrayStorageaSo16NSPasteboardType_$: command not found
/bin/sh: line 1436: _TtGCs23_ContiguousArrayStorageVSo21NSTrackingAreaOptions_$: command not found
/bin/sh: line 1437: _TtGCs23_ContiguousArrayStorageP12SourceEditor30LineLayerRangeOverrideProvider__$: command not found
/bin/sh: line 1438: _TtGCs23_ContiguousArrayStorageP12SourceEditor27ColumnShiftOverrideProvider__$: command not found
/bin/sh: line 1439: _TtGCs23_ContiguousArrayStorageGSaVC12SourceEditor25SourceEditorDelimiterDataP1020db24a09Delimiter__$: command not found
/bin/sh: line 1440: _TtGCs23_ContiguousArrayStorageP12SourceEditor35HiddenGutterContentOverrideProvider__$: command not found
/bin/sh: line 1441: _TtGCs23_ContiguousArrayStorageP12SourceEditor29LineHighlightOverrideProvider__$: command not found
/bin/sh: line 1442: _TtGCs23_ContiguousArrayStorageP12SourceEditor27SourceEditorMarginAccessory__$: command not found
/bin/sh: line 1443: _TtGCs23_ContiguousArrayStorageP12SourceEditor28LineNumberAttributesProvider__$: command not found
/bin/sh: line 1444: _TtGCs23_ContiguousArrayStorageP12SourceEditor29SourceEditorViewEventConsumer__$: command not found
/bin/sh: line 1445: _TtGCs23_ContiguousArrayStorageP12SourceEditor29TextAttributeOverrideProvider__$: command not found
/bin/sh: line 1446: _TtGCs23_ContiguousArrayStorageP12SourceEditor22LayoutOverrideProvider__$: command not found
/bin/sh: line 1447: _TtGCs23_ContiguousArrayStorageP12SourceEditor19LayoutVisualization__$: command not found
/bin/sh: line 1448: _TtGCs23_ContiguousArrayStorageCSo18NSLayoutConstraint_$: command not found
/bin/sh: line 1449: _TtGCs23_ContiguousArrayStorageV12SourceEditorP1020db875035SourceEditorDataSourceObserverToken_$: command not found
/bin/sh: line 1450: _TtGCs23_ContiguousArrayStorageVSo8_NSRange_$: command not found
/bin/sh: line 1451: _TtGCs23_ContiguousArrayStorageC12SourceEditor20SourceEditorLineData_$: command not found
/bin/sh: line 1452: _TtGCs23_ContiguousArrayStorageVSo26NSStringEnumerationOptions_$: command not found
/bin/sh: line 1453: _TtGCs23_ContiguousArrayStorageVSo18CAAutoresizingMask_$: command not found
/bin/sh: line 1454: _TtGCs23_ContiguousArrayStorageV12SourceEditor30SourceEditorFontRenderingStyle_$: command not found
/bin/sh: line 1455: _TtGCs23_ContiguousArrayStoragePMP12SourceEditor29SourceEditorFeatureController__$: command not found
/bin/sh: line 1456: _TtGCs23_ContiguousArrayStorageCSo13IDEAlertEvent_$: command not found
/bin/sh: line 1457: _TtGCs23_ContiguousArrayStorageSi_$: command not found
/bin/sh: line 1458: _TtGCs23_ContiguousArrayStorageVs5UInt8_$: command not found
/bin/sh: line 1459: _TtGCs23_ContiguousArrayStorageGSaVs5UInt8__$: command not found
/bin/sh: line 1460: _TtGCs23_ContiguousArrayStorageO21DNTDocumentationModel14SourceLanguage_$: command not found
/bin/sh: line 1461: _TtGCs23_ContiguousArrayStorageV21DNTDocumentationModel24AllCollectionsIdentifier_$: command not found
/bin/sh: line 1462: _TtGCs23_ContiguousArrayStoragePs9CodingKey__$: command not found
/bin/sh: line 1463: _TtGCs23_ContiguousArrayStorageP23DNTDocumentationSupport8SQLValue__$: command not found
/bin/sh: line 1464: _TtGCs23_ContiguousArrayStorageGVs10DictionarySSP23DNTDocumentationSupport8SQLValue___$: command not found
/bin/sh: line 1465: _TtGCs23_ContiguousArrayStorageCSo32DVTSourceControlRemoteRepository_$: command not found
/bin/sh: line 1466: _TtGCs23_ContiguousArrayStorageP__$: command not found
/bin/sh: line 1467: _TtGCs23_ContiguousArrayStorageCSo9NSControl_$: command not found
/bin/sh: line 1468: _TtGCs23_ContiguousArrayStorageGSqCSo9NSControl__$: command not found
/bin/sh: line 1469: _TtGCs23_ContiguousArrayStorageSS_$: command not found
/bin/sh: line 1470: _TtGCs23_ContiguousArrayStorageVs4Int8_$: command not found
/bin/sh: line 1471: Swift.__EmptyArrayStorage: command not found
Dumping classes
       0

I attempted to break it down to find the problem, but quickly realized that even if I use (lldb) sys echo "$(dclass -t swift)", I get the same output (minus the "0" at the end).

If I just run dclass -t swift, I get the desired output.
If I just run sys echo "hello world". I also get the desired output.

I would like to be able to follow along with this part of the book, but I can not seem to get this command to work as desired. Any help would be appreciated.

ios 14.2 xcode 12.2 keychain error

(lldb) keychain
error: warning: <user expression 31>:15:5: collection expression type 'NSArray *' may not respond to 'countByEnumeratingWithState:objects:count:'
for (id secItemClass in secItemClasses) {
^ ~~~~~~~~~~~~~~
error: <user expression 31>:18:9: unknown type name 'CFTypeRef'
CFTypeRef result = NULL;
^
error: <user expression 31>:19:39: use of undeclared identifier 'CFDictionaryRef'
SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
^
warning: <user expression 31>:60:13: collection expression type 'NSArray *' may not respond to 'countByEnumeratingWithState:objects:count:'
for (id dsitem in keychainArray) {
^ ~~~~~~~~~~~~~

Chapter 1: No LLDB prompt after Xcode launch

Hi, perhaps I am missing something but following the book Ch 1,
after launching Xcode there is no longer lldb prompt which would allow
entering subsequent commands. It just prints out Xcode has been launched
and never getting back to prompt: (lldb). Where I might be wrong?

Scanning over lldb docs didn't yield too much.

symbol import in lldb

I would like to ask you how to solve the problem of symbol import in lldb, when I use it, I get an error like this "use of undeclared identifier 'Method'", and it seems to be very time consuming to import the required system headers one by one, because one system header file may depend on another system header file.

Advanced Apple Debugging Chapter 1: Getting Started script not working

Thanks

(lldb) sys echo "$(dclass -t swift)" | grep -v _ | grep "\." | cut -d. - f1 | uniq | wc -l
error: error: error: use of undeclared identifier 'objc_copyClassList'
error: while importing modules:
error: Header search couldn't locate module ObjectiveC

New feature

Adding in the option to have all the registers print on each step/breakpoint would be great. Is this something that could be added in future revisions?

xcode13 search command not work

(lldb) search WCAccountLoginControlLogic
error:

---

error: error: error: error: Multiple internal symbols found for 'count'
id = {0x000019f8}, range = [0x00000001f6ad6798-0x00000001f6ad67a0), name="count"
id = {0x00000faf}, range = [0x00000001f5f309b0-0x00000001f5f309b8), name="count"

Change command names

Would you be opposed to changing some of the command names? I have some name collisions I'd like to avoid. I can make the change and submit a pull request if you're cool with it.

dclass is broken in Xcode 11.4 (11E146)/lldb-1103.0.22.4/Swift v5.2/swiftlang-1103.0.32.1/clang-1103.0.32.29)

Output of "dclass UNUserNotificationCenter":

(lldb) dclass UNUserNotificationCenter error: error: warning: <user expression 5>:406:92: format specifies type 'int' but the argument has type 'unsigned long' [returnString appendString:(NSString*)[[NSString alloc] initWithFormat:@"\t\t%d\t%p\n", bprot ? bprot->count : 0, bprot ? &bprot->first : 0]]; ~~ ^~~~~~~~~~~~~~~~~~~~~~~~ %lu error: <user expression 5>:558:110: no known method '-UTF8String'; cast the message send to the method's return type [returnString appendString:(NSString*)[[NSString alloc] initWithFormat:@" %s%40s %p\n", [methodType UTF8String], mt[i].name, mt[i].imp]]; ~~~~~~~~~~~~^~~~~~~~~~~ error: <user expression 5>:568:114: no known method '-UTF8String'; cast the message send to the method's return type [returnString appendString:(NSString*)[[NSString alloc] initWithFormat:@" %s%40s %p\n", [methodType UTF8String], mt[i].name, mt[i].imp]]; ~~~~~~~~~~~~^~~~~~~~~~~ warning: <user expression 5>:596:93: format specifies type 'void *' but the argument has type 'uintptr_t' (aka 'unsigned long') [returnString appendString:(NSString*)[[NSString alloc] initWithFormat:@"(%p) %s\n", ptr[i], dsinfo.dli_sname]]; ~~ ^~~~~~ %lu

Enumerating NoneType

So there's a bug that seems pretty endemic with respect to enumerating a NoneType. You can see it in search at line 110 (I think i may be a python3 issue?):

Currently in search.py:110: if 'nil' in res.GetOutput():

Fixed with?
ro = res.GetOutput()
if ro is None or 'nil' in res.GetOutput():

Not sure if this is correct though.

Python3 support

Could you confirm or consider to add support of python3 with lldb?

Couldn't load top-level module Foundation

A lot of the methods in the plugin don't seem to be working for me. They all seem to revolve around giving me this "Couldn't load top-level module Foundation". Sorry if this is a dumb question, I'm very new to reverse engineering binaries.

(lldb) dclass
Dumping classes
error: error: while importing modules:
error: Couldn't load top-level module Foundation


(lldb) search UIView
error: 
**************************************
error: error: error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableArrayRef'
error: unknown type name 'CFMutableSetRef'
error: use of undeclared identifier 'CFMutableSetRef'
error: use of undeclared identifier 'CFMutableSetRef'
error: use of undeclared identifier 'CFMutableArrayRef'
error: 'NSClassFromString' has unknown return type; cast the call to its declared return type
error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableArrayRef'
error: use of undeclared identifier 'CFIndex'
error: assigning to 'uint32_t' (aka 'unsigned int') from incompatible type 'char *(const char *, int)'
error: while importing modules:
error: Couldn't load top-level module Foundation

I tried following along with your "Reverse Engineering the iOS Simulator’s SpringBoard" but dumping the SpringBoard classes returned zero results. Any ideas what could be wrong?

(lldb) dclass -m SpringBoard
Dumping classes
error: error: while importing modules:
error: Couldn't load top-level module Foundation