Questions tagged [lldb]

LLDB is the debugger of the LLVM compiler infrastructure project.

Filter by
Sorted by
Tagged with
0 votes
1 answer
31 views

Can't find native library in lldb

・I am analyzing an Android app that was in the CTF. (https://github.com/TRkizaki/cryptoverse2023/tree/main/reverse_java_not_interesting) ・In this app, the input string is checked by the checkvaild ...
1 vote
1 answer
2k views

Reversing iOS games with LLDB and IDA on arm64

Cracked the game with clutch and set watchpoint on the value address, when the value changes it breaks just fine but when i go to that binary address in IDA it shows me different instruction, here's ...
3 votes
1 answer
236 views

IOS ASLR address calculation with delta offset (ARM64)

I am learning LLDB to debug ios apps, I have a jailbroken iPhone IOS 14.3 and a debugserver. Screenshot of start connect to remote process: Sections of my process(image dump sections hidenseek): ...
0 votes
1 answer
78 views

Paused at the right (?) breakpoint, what do I do next?

The output currently looks like this: 2022-09-10 00:09:03.955729-0500 REDACTED[51480:28773370] -openPDFWithPath: /Users/REDACTED/Library/Containers/com.REDACTED/Data/Library/Application Support/...
1 vote
0 answers
29 views

I have an application that views an encrypted document and stored it as an (encrypted) pdf

When I load this application with lldb, surprisingly no anti-debugger techniques scuttle it. I've even managed to find an interesting breakpoint to set... break set -r AES_decrypt -s /usr/lib/...
5 votes
1 answer
2k views

How to find the entry point in LLDB on OS X?

How can I identify the entry point of an executable in LLDB? In GDB, we can use the info file command, but that won't work in LLDB. Can anyone show me how to do that?
3 votes
1 answer
297 views

How to use software watchpoints in LLDB?

After trying to use watch command, LLDB said the device had 0 available hardware watchpoints. In GDB you can use set can-use-hw-watchpoints 0 How do you disable hardware watchpoints in LLDB?
2 votes
1 answer
1k views

LLDB debugging on android?

I currently don't have a pc. I have two rooted devices Arm64 host device with Debian rootfs and the device to be debugged which contains the lldb-server binary armv7. I am trying to remote debug my ...
0 votes
1 answer
122 views

How to determine the data type of a register

I'm learning reverse engineering and I'm trying to understand what process people use to identify a variable type. For example, I'm looking at an argument being passed to a function and I'm trying to ...
0 votes
1 answer
453 views

Why the disassembled code in IDA is different from in xcode? And How to solve unk_xxxx in IDA View?

I have built an executable file (the architecture is ARMv7, the base SDK is iOS), which depended on an xxx.a file in xcode; I don't have the source code of thexxx.a. I want to check some logic in `xx. ...
1 vote
1 answer
848 views

Set lldb breakpoint relative to ASLR slide

I want to set a breakpoint at an offset within a file. I can do this fine if I launch the app, check where it is loaded with image list testapp and then add the offset of where in the binary I want ...
2 votes
1 answer
1k views

Setting Breakpoints at functions decoded by Hopper/IDA Pro in an iOS app

So, its been very interesting to reverse engineer an iOS application and I have made significant improvement into learning how to read disassembly and understand them. Now I was trying to debug the ...
1 vote
1 answer
168 views

Kernel debug two physical MacBook pro devices

I've asked the same question at stackoverflow, but i'm gonna copy-paste it here as i might get more relevant answers(?): I'm trying to kernel debug a physical Macbook pro device. When my setup ...
2 votes
1 answer
217 views

Use dtrace, lldb or gdb to find which file or line of code was responsible for a line of output in stdout or stderr?

I see a string being output to my Terminal, when I ran an executable. I have the source code (in C) of the executable, but it was not written by me. I compiled it with -g flag. Is there any way to ...
2 votes
1 answer
60 views

Difference in binary behaviour (execution/under debugger)

I was trying out a simple heap overflow example (http://highaltitudehacks.com/2020/09/05/arm64-reversing-and-exploitation-part-1-arm-instruction-set-heap-overflow/) but replicated the relevant code in ...
0 votes
1 answer
564 views

Append to environment variable in LLDB

It is relatively easy to set environment variables in LLDB, via settings set target.env-vars DEBUG=1 However, I can't seem to find a way to append to an environment variable. The following doesn't ...
2 votes
1 answer
2k views

how watchpoint on register works

GDB has an option to set watchpoint on register*, how does it work ? what happens during context switching ? why the only implementation is for mips ? Is there a way to make it work for lldb also ? *...
3 votes
1 answer
3k views

gdb list functions names equivalent for lldb

is possible with lldb have a list of functions at runtime like gdb info functions? I had a look at help but didn't find it.
2 votes
0 answers
252 views

(iOS lldb) Unable to debug past a splash/loading screen

I'm trying to lldb debug this certain iOS application. Its behavior is that when I click the application, the splash/loading screen comes up, then the main activity. However, whenever I try to debug ...
2 votes
1 answer
1k views

How to check which thread crashed?

Given I've opened core file via lldb, how can I check which thread crashed? $ lldb -c core.45583 -o 'bt all' | grep -A2 'thread #' * thread #1, stop reason = signal SIGSTOP * frame #0: ...
2 votes
0 answers
507 views

IDA Pro macOS kernel debugging and lldb support

I'm trying to revers some kexts on macOS and I can't find a way to achieve the same level of debugging you can do on Windows kernel with IDA and WinDBG. Is there a way to add support for lldb? Or can ...
2 votes
1 answer
662 views

Why lldb seems to not stop at breakpoints?

While reverse engineering an iPhone app remotely, I set up breakpoints to some function's adresses. These adresses comes from the disassembled binary analysed with Hopper, and it seems like they must ...
1 vote
0 answers
586 views

Why darwin kernel crashes on function call via lldb while debugging the process?

I wanted to debug the hanging ruby process, but instead my kernel crashes each time when I'm doing the following steps: I'm re-running my ruby script (vagrant) which hangs: $ vagrant destroy -f &...
3 votes
0 answers
436 views

When I start up a remote thread in an application, why does it always crash when it tries to access data in the thread structure?

I'm on OS X 10.10 64 bit (x86_64) and created a chunk of memory called code with vm_allocate. I allocate a chunk of memory for a stack. I load a library to memory and determine an entry point to ...
1 vote
2 answers
868 views

Load symbols from __objc_* sections in LLDB

When an executable that has been stripped is opened in lldb, lldb doesn't know the names of any functions and breakpoints have to be set manually on hex addresses, which is very annoying. However, ...
2 votes
1 answer
554 views

lldb - breakpoint not reached when attach do process (but executing when set before app running)

I am trying to set breakpoint to existing processes, but when i am trying to do it breakpoint is not reached, but when i am running app directly in lldb and set breakpoint before it runs all ...
5 votes
1 answer
5k views

How to run automatically executable from CLI using lldb?

In gdb, I can run automatically the binary as (as per this post): gdb -ex run /bin/true What's the equivalent parameter for lldb? This works: echo run | lldb /bin/true but I'd like to back to ...
3 votes
2 answers
5k views

lldb: break at start of actual code, not entrypoint

I want lldb to break at the start of the actual code of an OS X application (which might be called main if symbols are existing). I am currently looking this up by hand, but as I want to script some ...
1 vote
2 answers
352 views

How to debug binary which doesn't have executable flags?

I'm trying to debug the binary which is not executable. As sample I'm using /bin/true with 644 permission: install -m 644 /bin/true . and I'm trying to run it as: $ lldb true (lldb) target create "...
4 votes
2 answers
4k views

How to stop debugger right after the execution?

I'm using /bin/true as my sample binary (without available main method): $ lldb /bin/true (lldb) target create "/bin/true" Current executable set to '/bin/true' (x86_64). (lldb) break main invalid ...
1 vote
0 answers
210 views

How to dump PHP backtrace on live running script in lldb?

I'm trying to print PHP backtrace of the live running script using the following 2 simple steps: Run PHP script as: php -r "sleep(1000);" On another console, I've called directly ...
2 votes
1 answer
4k views

What does Hopper's Debugger Server do?

Hopper offers a GDB/LLDB Debugger Server companion to the standard program. I'm unclear on what this should / can be used for. When I run the debugger server on the same machine that I'm using I see ...
2 votes
1 answer
1k views

How to set a breakpoint when a method is called using LLDB on OS X?

I'm trying to hit a breakpoint that I set in LLDB (CLI), but for whatever reason I'm not hitting my breakpoint. I am messing around with the stock Calculator.app on OS X, and am trying to call / hit ...