Microsoft Word - iOSAppReverseEngineering.docx

Compared to GDB, a significant improvement in LLDB is that you can enter commands while

the process is running. But be careful, some processes (such as SpringBoard) will automatically

relaunch because of timeout after stopping for a period of time. For this kind of processes, you

should try to keep it running to avoid unexpected automatic relaunching.

You can also use commands like “br dis”, “ br en” and “br del” to disable, enable and delete

breakpoints. The command to disable all breakpoints is as follows:

(lldb) br dis

All breakpoints disabled. (2 breakpoints)

The command to disable a specific breakpoint is as follows:

(lldb) br dis 6

1 breakpoints disabled.

The command to enable all breakpoints is as follows:

(lldb) br en

All breakpoints enabled. (2 breakpoints)

The command to enable a specific breakpoint is as follows:

(lldb) br en 6

1 breakpoints enabled.

The command to delete all breakpoints is as follows:

(lldb) br del

About to delete all breakpoints, do you want to do that?: [Y/n] Y

The command to delete a specific breakpoint is as follows:

(lldb) br del 8

1 breakpoints deleted; 0 breakpoint locations disabled.

Another useful command is that we can set a series of commands on a breakpoint to be

automatically executed when we hit the breakpoint. Suppose breakpoint 1 is set on a specific

objc_msgSend function, the commands to set a series of commands on breakpoint 1 are as

follows:

(lldb) br com add 1

After executing the above command, LLDB will ask for a series of commands, ending with

“DONE”.

Enter your debugger command(s). Type 'DONE' to end.

> po [$r0 class]

> p (char *)$r1

> c

> DONE

Here we’ve input 3 commands, once breakpoint 1 is hit, LLDB will execute them one by

one:

(lldb) c