美文网首页
iOS逆向006--LLDB(Low Lever Debug)

iOS逆向006--LLDB(Low Lever Debug)

作者: lukyy | 来源:发表于2018-05-10 22:59 被阅读85次
    Debug 命令 LLDB:Low Lever Debug( 轻量级Debug)
    • (lldb)//---------------------内存、寄存器 指令---------------------
    (lldb)help memory
    (lldb)help register
    (lldb)register read               :读取寄存器
    (lldb)register write    pc + 地址  :修改寄存器
    (lldb)memory read + 地址           :读取内存
    (lldb)x + 地址:(同上)              :读取内存
    (lldb)memory read list      ==  x list
    (lldb)x/100xb   list    : 查看100个字节,16进制显示
    (lldb)x/100xw   list    : 查看100个字,16进制显示
    
    (lldb)po/x $rip     :打印寄存器(rip 指令地址)
    (lldb)p/x $rip      :打印寄存器(rip 指令地址)
    (lldb)p/x $rflags   :打印寄存器(rflags 标记寄存器)
    (lldb)po  $edi 
    (lldb)po  $esi 
    (lldb)po  *Addr 
    (lldb)po  Addr 
    (lldb)ni                :汇编,单步往下走
    (lldb)s                 :进入函数
    (lldb)p/x 对象
    (lldb)p/x list
    (lldb)p/x list->value
    x/100xb  这个命令叫什么
    读取100个字节
    (lldb)help   :Debugger commands 查看命令指令
    command shfit m + address  =memory read 
    
    (lldb) x/100xb list 
    0x10062c640: 0x05 0x00 0x00 0x00 0x00 0x00 0x00 0x00    // 0x05 在左边高地址, 0x00 在右边低地 是小端模式
    0x10062c648: 0xf0 0xde 0x62 0x00 0x01 0x00 0x00 0x00    // 01 00 62 de f0 -> 0x010062def0
    (lldb) x/100xb 0x010062def0      // 打印指针地址
    
    (lldb) x/100xb list 
    0x10062c640: 0x00 0x00 0x00 0x05 0x00 0x00 0x00 0x00    // 0x00 在左边高地址, 0x05 在右边低地 是大端模式
    
    (小端模式倒序)f0 de 62 00 01 00 00 00 ->  00 00 00 01 00 62 de f0   -> 0x000000010062def0 == 0x010062def0
    //前面是00 就不需要管了,可以直接去掉,再打印地址
    
    高地址 存 高字节
    低地址 存 低字节
    
    • //-------------------------------基本使用指令---------------------------------
    // 查看所有指令
    help 
    // 查看指令详情:help + 指令
    help breakpoint
    // 继续往下走(c:continue)
    c
    // 显示当前线程的调用堆栈(bt:back stack)
    bt 
    // 线程回滚:不再往下走了,下面的代码不会再执行了
    thread return 
    // 单步运行(n:next,把子函数当做整体一步执行)
    n 
    // 单步运行(s:step in,遇到子函数会进去)
    s 
    // 回到上一个函数的调用者
    up 
    // 到下一个函数的调用者
    down 
    // 跳到对应的函数里
    frame select 7  
    // 所有的变量
    frame variable 
    /** 查看堆栈函数(一般奔溃使用:image lookup -a + 内存地址)
     *    image:Windows叫镜像或库
     */
    image lookup -a 0x18a6aafe0
    // 查看堆栈对象
    image lookup -t Person 
    // 查看库
    image list  
    

    指令的:添加、删除、查看(command)

    // 添加断点指令
    break command add 1
    Enter your debugger command(s).  Type 'DONE' to end.
    > po self
    > p self.view
    > DONE
    // 查看添加的指令
    breakpoint command list 1 
    // 删除添加的指令
    breakpoint command delete 1
    

    内存断点

    // 查看内存地址
    p &p1->_name  
    结果:(NSString **) $0 = 0x0000000170034f50
    // 设置内存断点 ( watchpoint set)
    watchpoint set variable p1->_name  
    // 设置内存断点 (同上)
    watchpoint set expression 0x0000000170034f50 
    // 
    watchpoint delete 1
    watchpoint list 
    

    断点:设置、查看、禁用、启用、删除

    // 设置断点 
    breakpoint set  
    breakpoint set -n test1      //给 test1函数 处 设置一个断点,进入此函数  (-n :--name 的缩写)
    
    // 设置一个断点
    breakpoint set -n test1 
    结果:Breakpoint 2: where = 001--LLDB`test1 + 11 at ViewController.m:81, address = 0x00000001070062fb
    breakpoint set -n "-[ViewController touchesBegan:withEvent:]" 
    结果:Breakpoint 1: where = 001--LLDB`-[ViewController touchesBegan:withEvent:] + 70 at ViewController.m:85, address = 0x000000010c536356
    // 同上:(简写)
    b -n "-[ViewController touchesBegan:withEvent:]" 
    
    // (简写)
    (lldb) b -[ViewController hankTest4:] 
    // (简写)同上
    (lldb) b hankTest4: 
    
    // 同时设置 多个断点(注意方法要有-[] 和分号:引号" )
    breakpoint set -n "-[ViewController save:]"  -n "-[ViewController pauseGame:]"  -n "-[ViewController continueGame:]"  
    结果:Breakpoint 6: 3 locations.
    
    // 设置指定文件 中的断点
    breakpoint set --file ViewController.m --selector touchesBegan:withEvent:  
    
    // 查看断点列表
    breakpoint list 
    
    // 禁用断点
    breakpoint disable 2.1 (对应断点组的子标号)
    breakpoint delete 2.1   (效果同上)
    breakpoint disable 2 (如果有此组有三个断点:2.1、2.2、2.3,则此指令 禁用此组所有断点)
    break dis 2 (简写:效果同上)
    
    // 启用断点
    breakpoint enable 2.1 (对应断点组的子标号)
    breakpoint enable 2 (如果有此组有三个断点:2.1、2.2、2.3,则此指令 启用此组所有断点)
    break en 2 (简写:效果同上)
    
    // 删除断点
    breakpoint delete 2   (如果有此组有三个断点:2.1、2.2、2.3,则此指令 删除此组所有断点)
    // 是否删除断点,Y
    (lldb) breakpoint delete 
    About to delete all breakpoints, do you want to do that?: [Y/n] Y
    
    // 找到使用过的指令
    breakpoint + ↑、↓、←、→ 
    // 设置 所有指定 字符的断点 (如下:暂停、继续  会设置成断点)
    (lldb) breakpoint set -r Game 
    

    断点:执行、打印

    // expression + 代码:(执行代码)
    (lldb) expression self.view.subviews 
    (__NSArrayM *) $0 = 0x000060400025c560 @"3 elements"
    // p: 简写 expression
    (lldb) p self.view.subviews  
    (__NSArrayM *) $1 = 0x000060400025c560 @"3 elements"
    // po + 代码:(打印代码)
    po self.view.subviews 
    
    (lldb) p self.models.lastObject 
    (Person *) $7 = 0x0000600000031920
    //------- 错误执行代码 ↓-------
    (lldb) p $7.name = @"zm"; 
    error: property 'name' not found on object of type 'id _Nullable'
    (lldb) p [$7 setValue:@"zm" forKey:@"name"]; 
    error: no known method '-setValue:forKey:''; cast the message send to the method's return type;
    //------- 错误执行代码 ↑-------
    
    // id 类型 必须指出其具体类型,才能正确执行代码
    (lldb) p (Person *)self.models.lastObject 
    (Person *) $8 = 0x0000600000031920
    // 赋值
    (lldb) p $8.name = @"zm"; 
    (NSTaggedPointerString *) $9 = 0xa00000000006d7a2 @"zm"
    // 赋值
    (lldb) p $8.age  = 18;
    (int) $10 = 18
    // id 类型,执行代码错误
    (lldb) po self.models.lastObject.name 
    error: property 'name' not found on object of type 'id _Nullable'
    // 调出值
    (lldb) p $8.name 
    (NSTaggedPointerString *) $11 = 0xa00000000006d7a2 @"zm"
    // 调出
    (lldb)  p $8.age 
    (int) $12 = 18
    
    // 执行多行代码
    (lldb) p Person *zm = [[Person alloc] init]; zm.name = @"ZM_v587";zm.age = 20; [self.models addObject:zm]; 
    // 同上:执行多行代码:command + return (换行)
    (lldb) p Person *zm = [[Person alloc] init];
    zm.name = @"ZM_v587";
    zm.age = 20;
    [self.models addObject:zm];  
    
    

    指令级别 如下图:

    指令级别

    普通指令级别

    1:显示、隐藏debug
    2:是否debug
    3:运行、停止debug
    4:n 单步运行
    5:s 单步运行
    6:step out 直接运行当前的函数,返回上一个函数

    汇编指令级别:按住control键

    1:显示、隐藏debug
    2:是否debug
    3:运行、停止debug
    4:si step over
    5:ni step into
    6:step out

    • 测试代码:如下

    ------ 测试:数组越界(要真机测试)------
    2018-05-13 14:01:59.444424+0800 001--LLDB[5410:2457279] *** Terminating app due to uncaught exception 'NSRangeException', reason: '*** -[__NSArrayM objectAtIndex:]: index 4 beyond bounds [0 .. 2]'
    *** First throw call stack:
    (0x18a6aafe0 0x18910c538 0x18a589200 0x1000c631c 0x19096c01c 0x19096beb8 0x19081017c 0x19080b728 0x1907dc33c 0x190fd6014 0x190fd0770 0x190fd0b9c 0x18a65942c 0x18a658d9c 0x18a6569a8 0x18a586da4 0x18bff0074 0x190841058 0x1000c6550 0x18959559c)
    libc++abi.dylib: terminating with uncaught exception of type NSException
    (lldb) image lookup -a 0x18a6aafe0 
          Address: CoreFoundation[0x0000000181646fe0] (CoreFoundation.__TEXT.__text + 1225360)
          Summary: CoreFoundation`__exceptionPreprocess + 124
    (lldb) image lookup -a 0x18910c538
          Address: libobjc.A.dylib[0x00000001800a8538] (libobjc.A.dylib.__TEXT.__text + 17720)
          Summary: libobjc.A.dylib`objc_exception_throw + 56
    (lldb) image lookup -a 0x18a589200 
          Address: CoreFoundation[0x0000000181525200] (CoreFoundation.__TEXT.__text + 38064)
          Summary: CoreFoundation`-[__NSArrayM removeObjectAtIndex:]
    (lldb) image lookup -a 0x1000c631c 
          Address: 001--LLDB[0x000000010000631c] (001--LLDB.__TEXT.__text + 1776)
          Summary: 001--LLDB`-[ViewController touchesBegan:withEvent:] + 140 at ViewController.m:89
    (lldb) 
    
    - (void)viewDidLoad {
        [super viewDidLoad];
        
        Person * p1 = [[Person alloc] init];
        p1.name = @"one";
        p1.age = 1;
        
        Person * p2 = [[Person alloc] init];
        p2.name = @"two";
        p2.age = 2;
        
        Person * p3 = [[Person alloc] init];
        p3.name = @"three";
        p3.age = 3;
        
        [self.models addObject:p1];
        [self.models addObject:p2];
        [self.models addObject:p3];
        
    }
    - (void)touchesBegan:(NSSet<UITouch *> *)touches withEvent:(UIEvent *)event{
        
        id p = self.models[4];    
    }
    
    ------ 测试:内存断点 wachpoint ------
    (lldb) frame variable
    (ViewController *) self = 0x000000010030bb70
    (SEL) _cmd = "viewDidLoad"
    (Person *) p1 = 0x0000000170034f40
    (Person *) p2 = 0x000000017402ea60
    (Person *) p3 = 0x000000016fd520b8
    (lldb) p &p1->_name 
    (NSString **) $0 = 0x0000000170034f50
    (lldb) watchpoint set expression 0x0000000170034f50
    Watchpoint created: Watchpoint 1: addr = 0x170034f50 size = 8 state = enabled type = w
        new value: 4295704824
    (lldb) c 
    Process 5218 resuming
    
    Watchpoint 1 hit:
    old value: 4295704824
    new value: 4295704952
    (lldb) po 4295704824
    one
    
    (lldb) po 4295704952 
    hello
    
    (lldb) watchpoint delete 1
    1 watchpoints deleted.
    (lldb) watchpoint list
    Number of supported hardware watchpoints: 4
    No watchpoints currently set.
    (lldb) 
    
    ------ 测试:bt、up、down------
    (lldb) b -[ViewController hankTest3:] 
    Breakpoint 2: where = 001--LLDB`-[ViewController hankTest3:] + 46 at ViewController.m:48, address = 0x000000010485af4e
    (lldb) bt 
    * thread #1, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1
      * frame #0: 0x0000000100061f48 001--LLDB`-[ViewController hankTest3:](self=0x000000010030f4f0, _cmd="hankTest3:", str=@"zm") at ViewController.m:48
        frame #1: 0x0000000100061efc 001--LLDB`-[ViewController hankTest2:](self=0x000000010030f4f0, _cmd="hankTest2:", str=@"zm") at ViewController.m:45
        frame #2: 0x0000000100061e7c 001--LLDB`-[ViewController hankTest1:](self=0x000000010030f4f0, _cmd="hankTest1:", str=@"zm") at ViewController.m:41
        frame #3: 0x0000000100062370 001--LLDB`-[ViewController touchesBegan:withEvent:](self=0x000000010030f4f0, _cmd="touchesBegan:withEvent:", touches=1 element, event=0x00000001742e1700) at ViewController.m:91
        frame #4: 0x000000019096c01c UIKit`forwardTouchMethod + 336
        frame #5: 0x000000019096beb8 UIKit`-[UIResponder touchesBegan:withEvent:] + 60
        frame #6: 0x000000019081017c UIKit`-[UIWindow _sendTouchesForEvent:] + 1948
        frame #7: 0x000000019080b728 UIKit`-[UIWindow sendEvent:] + 3192
        frame #8: 0x00000001907dc33c UIKit`-[UIApplication sendEvent:] + 340
        frame #9: 0x0000000190fd6014 UIKit`__dispatchPreprocessedEventFromEventQueue + 2400
        frame #10: 0x0000000190fd0770 UIKit`__handleEventQueue + 4268
        frame #11: 0x0000000190fd0b9c UIKit`__handleHIDEventFetcherDrain + 148
        frame #12: 0x000000018a65942c CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24
        frame #13: 0x000000018a658d9c CoreFoundation`__CFRunLoopDoSources0 + 540
        frame #14: 0x000000018a6569a8 CoreFoundation`__CFRunLoopRun + 744
        frame #15: 0x000000018a586da4 CoreFoundation`CFRunLoopRunSpecific + 424
        frame #16: 0x000000018bff0074 GraphicsServices`GSEventRunModal + 100
        frame #17: 0x0000000190841058 UIKit`UIApplicationMain + 208
        frame #18: 0x0000000100062560 001--LLDB`main(argc=1, argv=0x000000016fda3aa8) at main.m:14
        frame #19: 0x000000018959559c libdyld.dylib`start + 4
    (lldb) up 
    frame #1: 0x0000000100061efc 001--LLDB`-[ViewController hankTest2:](self=0x000000010030f4f0, _cmd="hankTest2:", str=@"zm") at ViewController.m:45
       42   }
       43   -(void)hankTest2:(NSString *)str{
       44       NSLog(@"%@",str);
    -> 45       �[4m[�[0mself hankTest3:str];
       46   } 
       47   -(void)hankTest3:(NSString *)str{
       48       NSLog(@"%@",str);
    (lldb) down 
    frame #0: 0x0000000100061f48 001--LLDB`-[ViewController hankTest3:](self=0x000000010030f4f0, _cmd="hankTest3:", str=@"zm") at ViewController.m:48
       45       [self hankTest3:str];
       46   }
       47   -(void)hankTest3:(NSString *)str{
    -> 48       NSLog(@"%@",�[4ms�[0mtr);
       49       [self hankTest4:str]; 
       50   }
       51   -(void)hankTest4:(NSString *)str{ 
    (lldb) 
    
    
    ------ 测试:源码------
    #import "ViewController.h"
    #import "Person.h"
    
    @interface ViewController ()
    @property(nonatomic,strong)NSMutableArray<Person *> * models;
    @end
    
    @implementation ViewController
    
    -(NSMutableArray<Person *> *)models
    {
        if (!_models) {
            _models = [NSMutableArray array];
        }
        return _models;
    }
    
    - (IBAction)save:(id)sender {
        NSLog(@"保存");
    }
    - (IBAction)pauseGame:(id)sender {
        NSLog(@"暂停");
    }
    - (IBAction)continueGame:(id)sender {
        NSLog(@"继续");
    }
    
    -(void)hankTest1:(NSString *)str{
        NSLog(@"%@",str);
        [self hankTest2:str];
    }
    -(void)hankTest2:(NSString *)str{
        NSLog(@"%@",str);
        [self hankTest3:str];
    }
    -(void)hankTest3:(NSString *)str{
        NSLog(@"%@",str);
        [self hankTest4:str];
    }
    -(void)hankTest4:(NSString *)str{
        NSLog(@"%@",str);
        
    }
    
    - (void)viewDidLoad {
        [super viewDidLoad];
        
        Person * p1 = [[Person alloc] init];
        p1.name = @"one";
        p1.age = 1;
        
        
        Person * p2 = [[Person alloc] init];
        p2.name = @"two";
        p2.age = 2;
        
        
        Person * p3 = [[Person alloc] init];
        p3.name = @"three";
        p3.age = 3;
        
        [self.models addObject:p1];
        [self.models addObject:p2];
        [self.models addObject:p3];
    }
    
    void test1(){
        NSLog(@"3");
    }
    
    - (void)touchesBegan:(NSSet<UITouch *> *)touches withEvent:(UIEvent *)event{
        
        Person * p1 = self.models.firstObject;
        p1.name = @"hello";
        NSLog(@"---1");
        NSLog(@"---2");
        test1();
    }
    
    • 断点总结:

    • 设置断点
      $breakpoint set -n XXX
      set 是子命令
      -n 是选项 是--name 的缩写!

    • 查看断点列表
      $breakpoint list

    • 删除
      $breakpoint delete 组号

    • 禁用/启用
      $breakpoint disable 禁用
      $breakpoint enable 启用

    • 遍历整个项目中满足Game:这个字符的所有方法
      $breakpoint set -r Game:

    流程控制

    • 继续执行
      $continue c
    • 单步运行,将子函数当做整体一步执行
      $n next
    • 单步运行,遇到子函数会进去
      $s

    stop-hook

    让你在每次stop的时候去执行一些命令,只对breadpoint,watchpoint

    常用命令

    • image list
    • p
    • b -[xxx xxx]
    • x
    • register read
    • po

    关于后期的安排(非越狱!)

    OC反汇编(MachO文件的东西)
    密码学(Base64,HASH,RSA)
    苹果签名技术
    重签名 Xcode签名 脚本自动签名
    动态库(动态库的注入)
    HOOK原理

    相关文章

      网友评论

          本文标题:iOS逆向006--LLDB(Low Lever Debug)

          本文链接:https://www.haomeiwen.com/subject/zzdorftx.html