Microsoft Word - iOSAppReverseEngineering.docx

Process 103706 resuming

As you can see, we’ve used “po” command to print the Objective-C object, and “p (char *)”

to print the C object by casting. Quite simple, right? It’s worth mentioning that when the

process stops on a “BL” instruction, LLDB will automatically parse this instruction and display

the corresponding symbol:

• 
  

  
  

  0xcc8a2: blx 0x3e3798 ; symbol stub for: objc_msgSend

  
  

  
  

However, sometimes LLDB’s parsing is wrong, mistaking the symbol. In this case, please

refer to IDA’s static analysis of that symbol.

Finally, we can use “x” command to print the value stored in a specific address:

(lldb) p/x $sp

(unsigned int) $4 = 0x006e838c

(lldb) x/10 $sp

0x006e838c: 0x00000000 0x22f2c975 0x00000000 0x00000000

0x006e839c: 0x26c6bf8c 0x0000000c 0x17a753c0 0x17a753c8

0x006e83ac: 0x000001c8 0x17a75200

(lldb) x/10 0x006e838c

0x006e838c: 0x00000000 0x22f2c975 0x00000000 0x00000000

0x006e839c: 0x26c6bf8c 0x0000000c 0x17a753c0 0x17a753c8

0x006e83ac: 0x000001c8 0x17a75200

We’ve printed SP in hexadecimal with “p/x” command. SP is a pointer, whose value is

0x6e838c. And the “x/10” command has printed the 10 continuous words SP points to.

4. nexti and stepi

Both of “nexti” and “stepi” are used to execute the next instruction, but the biggest

difference between them is that the former does not go/step inside a function but the latter

does. They are two of the most used commands, and can be abbreviated as “ni” and “si”

respectively. You may wonder, what does “go inside a function or not” mean? Let’s still take “-

[SpringBoard _menuButtonDown:]” for example, as shown in figure 4-20.

Figure 4- 20 [SpringBoard _menuButtonDown:]

The base address with offset of “BL

SpringBoardaccessibilityObjectWithinProximity__0” is 0xEE92E, this instruction calls

_SpringBoardaccessibilityObjectWithinProximity0. Set a breakpoint on it and execute the