2

While reverse engineering an iPhone app remotely, I set up breakpoints to some function's adresses.

These adresses comes from the disassembled binary analysed with Hopper, and it seems like they must be called by the app. Like user_click_on_blue_buton, or equivalent.

I checked that the breakpoint are set up correctly:

  • none is in pending state,
  • all have the flag resolved to true: resolved = 1,
  • and the disassembled code at these addresses is the same as in the binary statically analysed with Hopper.

But then, when I click on the blue button, lldb does not stop at breakpoint. The process continues like there was no breakpoints. To be exact, some are working, but just a few, not all of them.

Is it possible that lldb misses the breakpoint ? Or is it because the app is tricking me and these functions are not called ?

Obviously the app is a released iOS app from the app store. So definitely not compiled to be debugged. Is it the reason ?

1

Because the functions were never called.

The app indeed tricked me. It's not because a function is named user_click_on_blue_button that it will be called when the user click on the blue button. Another function, with a less obvious name, was used instead.

Can't find my previous account, so using a new one.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.