3

I am learning LLDB to debug ios apps, I have a jailbroken iPhone IOS 14.3 and a debugserver.

Screenshot of start connect to remote process:

here is a screenshot of start connect to remote process

Sections of my process(image dump sections hidenseek):

sections of my process

Next, I calculated the delta at the address from the disassembled unity engine as, Delta = end of PAGEZERO - start of TEXT

This is the address of the function where I want to put a breakpoint:

breakpoint

Hence, Delta = 0x104a60000 - 0x10000000 = 0x4a60000

Then I consider the address, it will be equal to delta + offset in the disassembler,

**resultant address **

but it turns out to be an unknown address, I did the same as in the training video.

What am I doing wrong? How to calculate the correct address?

I would be glad for any help.

7
  • I did the same as in the training video. Which video?
    – raspiduino
    Aug 1, 2022 at 9:34
  • 1
    youtu.be/_i_v6pWqDQQ
    – qazwsx135
    Aug 1, 2022 at 9:53
  • 1
    in the video, the situation is approximately the same, but the addresses that I get are completely different from those in the debugger
    – qazwsx135
    Aug 1, 2022 at 10:00
  • From this, try disas -a 0x5e409a8. You might also consider reading this, the ASLR section (but I don't fully understand his/her command in lldb)
    – raspiduino
    Aug 1, 2022 at 10:10
  • 1
    Most you your screen shots just show terminal content. Such content should better be posted as text. Just copy and paste it into your question and format it as code. Screen shots are bad for readability and also bad if you want later search it as image content can't be searched.
    – Robert
    Aug 1, 2022 at 14:57

1 Answer 1

2

you can set a breakpoint using lldb on func.013e09a8 like this:

b -a 0x013e09a8 -s AppExecutableName

No manual ASLR calculations required. If you continue in lldb with con you should see something like:

    frame #0: 0x013e19a8 AppExecutableName`___lldb_unnamed_symbol139640$$AppExecutableName
AppExecutableName`___lldb_unnamed_symbol139640$$AppExecutableName:
->  0x013e19a8 <+0>:  stp    x22, x21, [sp, #-0x30]!
    0x013e19ac <+4>:  stp    x20, x19, [sp, #0x10]
    0x013e19a0 <+8>:  stp    x29, x30, [sp, #0x20]
    0x013e19a4 <+12>: add    x29, sp, #0x20            ; =0x20

The formula for ASLR shift is now:

p/x 0x013e19a8-0x013e09a8

From this point provided your executable doesn't change (presumably by the means of AppStore autoupdate) you can also revisit this function with a symbolic breakpoint if you want to:

b ___lldb_unnamed_symbol139640$$AppExecutableName

To convert the other way round i.e. the ASLR shifted address to the 0x100000000 base one (suitable for disassembler) use:

image lookup -a 0x013e19a8

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.