《iOS 逆向》006-LLDB(Low Lever Debug

断点

• 设置断点
  $breakpoint set -n XXX
  set 是子命令
  -n 是选项 是--name 的缩写!

• 查看断点列表
  $breakpoint list

• 删除
  $breakpoint delete 组号

• 禁用/启用
  $breakpoint disable 禁用
  $breakpoint enable 启用

所有文件的touchesBegan:withEvent:方法都hook:
breakpoint set --selector touchesBegan:withEvent:
当前文件中touchesBegan:withEvent:方法的hook:
breakpoint set --file ViewController.m --selector touchesBegan:withEvent:

• 遍历整个项目中满足Game:这个字符的所有方法
  $breakpoint set -r Game:

流程控制

• 继续执行
  $continue c
• 单步运行,将子函数当做整体一步执行
  $n next
• 单步运行,遇到子函数会进去
  $s

stop-hook

让你在每次stop的时候去执行一些命令,只对breadpoint,watchpoint

target stop-hook add -o "code"

常用命令

• image list
• p
• b -[xxx xxx]
• x : memory read的缩写
• register read
• po

内存断点

watchpoint set variable p1->_name

(lldb) frame variable
(ViewController *) self = 0x0000000101204e10
(SEL) _cmd = "viewDidLoad"
(Person *) p1 = 0x00000001c4225720
(Person *) p2 = 0x0000000000000010
(Person *) p3 = 0x000000016f219638
(lldb) p &p1->_name
(NSString **) $0 = 0x00000001c4225730
(lldb) watchPoint set expression 0x00000001c4225730
error: 'watchPoint' is not a valid command.
error: Unrecognized command 'watchPoint'.
(lldb) watchpoint set expression 0x00000001c4225730
Watchpoint created: Watchpoint 1: addr = 0x1c4225730 size = 8 state = enabled type = w
new value: 4307468384
(lldb) n
(lldb) n

Watchpoint 1 hit:
old value: 4307468384
new value: 4307468480

(lldb) po 4307468384
zhanglei

(lldb) po 4307468480
dadada