Chapters

Hide chapters

Advanced Apple Debugging & Reverse Engineering

Fourth Edition · iOS 16, macOS 13.3 · Swift 5.8, Python 3 · Xcode 14

Section I: Beginning LLDB Commands

Section 1: 10 chapters
Show chapters Hide chapters

Section IV: Custom LLDB Commands

Section 4: 8 chapters
Show chapters Hide chapters

A. Appendix A: LLDB Cheat Sheet
Written by Walter Tyree

Heads up... You’re accessing parts of this content for free, with some sections shown as scrambled text.

Heads up... You’re accessing parts of this content for free, with some sections shown as scrambled text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now

A cheat sheet for commands and ideas on how to use LLDB.

Getting Help

(lldb) help

List all commands and aliases.

(lldb) help po

Get help documentation for po (expression) command.

(lldb) help break set

Get help documentation for breakpoint set.

(lldb) apropos step-in

Search through help documentation containing step-in.

Finding Code

(lldb) image lookup -rn UIAlertController

Look up all code containing UIAlertController that’s compiled or loaded into an executable.

(lldb) image lookup -rn (?i)hosturl
(lldb) image lookup -rn 'UIViewController\ set\w+:\]'
(lldb) image lookup -rn . Security
(lldb) image lookup -a 0x10518a720
(lldb) image lookup -s mmap

Breakpoints

(lldb) b viewDidLoad

Creates a breakpoint on all methods named viewDidLoad for both Swift and Objective-C.

(lldb) b setAlpha:
(lldb) b -[CustomViewControllerSubclass viewDidLoad]
(lldb) rbreak CustomViewControllerSubclass.viewDidLoad
(lldb) breakpoint delete
(lldb) breakpoint delete 2
(lldb) breakpoint list
(lldb) rbreak viewDid
(lldb) rbreak viewDid -s SwiftRadio
(lldb) rbreak viewDid(Appear|Disappear) -s SwiftHN
(lldb) rb "\-\[UIViewController\ set" -s UIKit
(lldb) rb . -s SwiftHN -o 1
(lldb) rb . -f ViewController.m

Expressions

(lldb) po "hello, debugger"

Prints "hello, debugger" regardless of the debugging context.

(lldb) expression -lobjc -O -- [UIApplication sharedApplication]
(lldb) expression -lswift -O -- UIApplication.shared
(lldb) b getenv
(lldb) expression -i0 -- getenv("HOME")
(lldb) expression -u0 -O -- [UIApplication test]
(lldb) expression -p -- NSString *globalString = [NSString stringWithUTF8String: "Hello, Debugger"];
(lldb) po globalString
Hello, Debugger
(lldb) expression -g -O -lobjc -- [NSObject new]

Stepping

(lldb) thread return false

Return early from code with false.

(lldb) thread step-in
(lldb) s
(lldb) thread step-over
(lldb) n
(lldb) thread step-out
(lldb) finish
(lldb) thread step-inst
(lldb) ni

GDB Formatting

(lldb) p/x 128

Print value in hexadecimal.

(lldb) p/d 128
(lldb) p/t 128
(lldb) p/a 128
(lldb) x/gx 0x000000010fff6c40
(lldb) x/wx 0x000000010fff6c40

Memory

(lldb) memory read 0x000000010fff6c40

Read memory at address 0x000000010fff6c40.

(lldb) po id $d = [NSData dataWithContentsOfFile:@"..."]
(lldb) mem read `(uintptr_t)[$d bytes]` `(uintptr_t)[$d bytes] + (uintptr_t)[$d length]` -r -b -o /tmp/file

Registers and Assembly

(lldb) register read -a

Display all registers on the system.

(lldb) register read rdi rsi
(lldb) register read x0 x1
(lldb) register read arg1 arg2
(lldb) register write rsi 0x0
(lldb) register write x2 0x0
(lldb) register write arg2 0x42
(lldb) register write rflags `$rflags ^ 64`
(lldb) register write rflags `$rflags | 64`
(lldb) register write rflags `$rflags & ~64`
(lldb) disassemble
(lldb) disassemble -p
(lldb) disassemble -b
(lldb) disassemble -n '-[UIViewController setTitle:]'
(lldb) disassemble -a 0x000000010b8d972d

Modules

(lldb) image list

List all modules loaded into the executable’s process space.

(lldb) image list -b
(lldb) process load /Path/To/Module.framework/Module
Have a technical question? Want to report a bug? You can ask questions and report bugs to the book authors in our official book forum here.
© 2024 Kodeco Inc.

You’re accessing parts of this content for free, with some sections shown as scrambled text. Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now