Hide chapters

Advanced Apple Debugging & Reverse Engineering

Third Edition · iOS 12 · Swift 4.2 · Xcode 10

Before You Begin

Section 0: 3 chapters
Show chapters Hide chapters

Section III: Low Level

Section 3: 7 chapters
Show chapters Hide chapters

Section IV: Custom LLDB Commands

Section 4: 8 chapters
Show chapters Hide chapters

A. Appendix A: LLDB Cheatsheet
Written by Derek Selander

Heads up... You're reading this book for free, with parts of this chapter shown beyond this point as scrambled text.

A cheatsheet for commands and ideas on how to use LLDB.

Getting help

(lldb) help

List all commands and aliases.

(lldb) help po

Get help documentation for po (expression) command.

(lldb) help break set

Get help documentation for breakpoint set.

(lldb) apropos step-in

Search through help documentation containing step-in.

Finding code

(lldb) image lookup -rn UIAlertController

Look up all code containing UIAlertController that’s compiled or loaded into an executable.

(lldb) image lookup -rn (?i)hosturl
(lldb) image lookup -rn 'UIViewController\ set\w+:\]'
(lldb) image lookup -rn . Security
(lldb) image lookup -a 0x10518a720
(lldb) image lookup -s mmap


(lldb) b viewDidLoad

Creates a breakpoint on all methods named viewDidLoad for both Swift and Objective-C.

(lldb) b setAlpha:
(lldb) b -[CustomViewControllerSubclass viewDidLoad]
(lldb) rbreak CustomViewControllerSubclass.viewDidLoad
(lldb) breakpoint delete
(lldb) breakpoint delete 2
(lldb) breakpoint list
(lldb) rbreak viewDid
(lldb) rbreak viewDid -s SwiftRadio
(lldb) rbreak viewDid(Appear|Disappear) -s SwiftHN
(lldb) rb "\-\[UIViewController\ set" -s UIKit
(lldb) rb . -s SwiftHN -o 1
(lldb) rb . -f ViewController.m


(lldb) po "hello, debugger"

Prints "hello, debugger" regardless of the debugging context.

(lldb) expression -lobjc -O -- [UIApplication sharedApplication]
(lldb) expression -lswift -O -- UIApplication.shared
(lldb) b getenv
(lldb) expression -i0 -- getenv("HOME")
(lldb) expression -u0 -O -- [UIApplication test]
(lldb) expression -p -- NSString *globalString = [NSString stringWithUTF8String: "Hello, Debugger"]; 
(lldb) po globalString
Hello, Debugger
(lldb) expression -g -O -lobjc -- [NSObject new] 


(lldb) thread return false

Return early from code with false.

(lldb) thread step-in
(lldb) s
(lldb) thread step-over
(lldb) n
(lldb) thread step-out
(lldb) finish
(lldb) thread step-inst
(lldb) ni

GDB formatting

(lldb) p/x 128

Print value in hexadecimal.

(lldb) p/d 128
(lldb) p/t 128
(lldb) p/a 128
(lldb) x/gx 0x000000010fff6c40
(lldb) x/wx 0x000000010fff6c40


(lldb) memory read 0x000000010fff6c40

Read memory at address 0x000000010fff6c40.

(lldb) po id $d = [NSData dataWithContentsOfFile:@"..."]
(lldb) mem read `(uintptr_t)[$d bytes]` `(uintptr_t)[$d bytes] + (uintptr_t)[$d length]` -r -b -o /tmp/file

Registers & assembly

(lldb) register read -a

Display all registers on the system.

(lldb) register read rdi rsi
(lldb) register write rsi 0x0
(lldb) register write rflags `$rflags ^ 64`
(lldb) register write rflags `$rflags | 64`
(lldb) register write rflags `$rflags & ~64`
(lldb) register write pc `$pc+4`
(lldb) disassemble
(lldb) disassemble -p
(lldb) disassemble -b
(lldb) disassemble -n '-[UIViewController setTitle:]'
(lldb) disassemble -a 0x000000010b8d972d


(lldb) image list 

List all modules loaded into the executable’s process space.

(lldb) image list -b
(lldb) process load /Path/To/Module.framework/Module
Have a technical question? Want to report a bug? You can ask questions and report bugs to the book authors in our official book forum here.
© 2024 Kodeco Inc.

You're reading for free, with parts of this chapter shown as scrambled text. Unlock this book, and our entire catalogue of books and videos, with a Kodeco Personal Plan.

Unlock now