Advanced Apple Debugging and Reverse Engineering

475 Pages·2017·64.773 MB·English

by  Derek Selander

Advanced Apple Debugging
Advanced Apple Debugging & Reverse Engineering
Derek Selander
Copyright ©2017 Razeware LLC.
Notice of Rights
All rights reserved. No part of this book or corresponding materials (such as text,
images, or source code) may be reproduced or distributed by any means without prior
written permission of the copyright owner.
Notice of Liability
This book and all corresponding materials (such as source code) are provided on an “as
is” basis, without warranty of any kind, express of implied, including but not limited to
the warranties of merchantability, fitness for a particular purpose, and
noninfringement. In no event shall the authors or copyright holders be liable for any
claim, damages or other liability, whether in action of contract, tort or otherwise,
arising from, out of or in connection with the software or the use of other dealing in the
software.
Trademarks
All trademarks and registered trademarks appearing in this book are the property of
their own respective owners.
raywenderlich.com 2
Advanced Apple Debugging
Dedications
"I would like to thank my wife, Brittany, for all her love and support
while I silently wept in the fetal position trying to get this book out
the door"
— Derek Selander
raywenderlich.com 3
Advanced Apple Debugging
About the author
Derek Selander is the author of this book. His interest with
debugging grew when he started exploring how to make (the now
somewhat obsolete) Xcode plugins and iOS tweaks on his jailbroken
phone, both of which required exploring and augmenting programs
with no source available. In his free time, he enjoys pickup soccer,
guitar, and playing with his two doggies, Jake & Squid.
About the editors
Chris Belanger is the editor of this book. Chris Belanger is the Book
Team Lead and Lead Editor for raywenderlich.com. If there are words
to wrangle or a paragraph to ponder, he‘s on the case. When he kicks
back, you can usually find Chris with guitar in hand, looking for the
nearest beach, or exploring the lakes and rivers in his part of the
world in a canoe.
Matt Galloway is a software engineer with a passion for excellence.
He stumbled into iOS programming when it first was a thing, and has
never looked back. When not coding, he likes to brew his own beer.
Darren Ferguson is the final pass editor of this book. He is a
Software Developer, with a passion for mobile development, for a
leading systems integration provider based out of Northern Virginia
in the D.C. metro area. When he's not coding, you can find him
enjoying life with his wife and daughter trying to travel as much as
possible.
raywenderlich.com 4
Advanced Apple Debugging
Table of Contents: Overview
Introduction ............................................................. 15
Section I: Beginning LLDB Commands .............. 20
Chapter 1: Getting Started ............................... 21
Chapter 2: Help & Apropos.............................. 36
Chapter 3: Attaching with LLDB ...................... 41
Chapter 4: Stopping in Code........................... 48
Chapter 5: Expression ..................................... 66
Chapter 6: Thread, Frame & Stepping
Around.............................................................. 80
Chapter 7: Image ............................................. 90
Chapter 8: Persisting & Customizing
Commands ..................................................... 105
Chapter 9: Regex Commands........................ 110
Section II: Understanding Assembly................. 119
Chapter 10: Assembly Register Calling
Convention ..................................................... 120
Chapter 11: Assembly & Memory ................... 141
Chapter 12: Assembly and the Stack ............ 157
Section III: Low Level ........................................ 178
Chapter 13: Hello, Ptrace ............................... 179
raywenderlich.com 5
Advanced Apple Debugging
Chapter 14: Dynamic Frameworks ................ 189
Chapter 15: Hooking & Executing Code
with dlopen & dlsym ...................................... 203
Chapter 16: Exploring and Method
Swizzling Objective-C Frameworks .............. 220
Section IV: Custom LLDB Commands.............. 242
Chapter 17: Hello Script Bridging .................. 243
Chapter 18: Debugging Script Bridging........ 253
Chapter 19: Script Bridging Classes and
Hierarchy........................................................ 268
Chapter 20: Script Bridging with Options &
Arguments...................................................... 288
Chapter 21: Script Bridging with SBValue &
Memory .......................................................... 314
Chapter 22: SB Examples, Improved
Lookup ........................................................... 339
Chapter 23: SB Examples, Resymbolicating
a Stripped ObjC Binary.................................. 356
Chapter 24: SB Examples, Malloc Logging... 372
Section V: DTrace ............................................. 397
Chapter 25: Hello, DTrace ............................. 398
Chapter 26: Intermediate DTrace .................. 417
Chapter 27: DTrace vs objc_msgSend.......... 435
raywenderlich.com 6
Advanced Apple Debugging
Appendix A: LLDB Cheatsheet...................... 463
Appendix B: Python Environment Setup....... 470
Conclusion ............................................................ 474
raywenderlich.com 7
Advanced Apple Debugging
Table of Contents: Extended
Introduction ............................................................. 15
What you need..................................................................................... 16
Who this book is for............................................................................. 16
Book source code and forums............................................................. 17
Book updates....................................................................................... 17
Custom LLDB scripts repo................................................................... 17
License................................................................................................. 18
Acknowledgments ............................................................................... 19
About the cover ................................................................................... 19
Section I: Beginning LLDB Commands .............. 20
Chapter 1: Getting Started ...................................... 21
Getting around Rootless...................................................................... 22
Attaching LLDB to Xcode.................................................................... 24
Where to go from here? ...................................................................... 35
Chapter 2: Help & Apropos .................................... 36
The "help" command........................................................................... 37
The "apropos" command .................................................................... 39
Where to go from here? ...................................................................... 40
Chapter 3: Attaching with LLDB............................. 41
Where to go from here?....................................................................... 47
Chapter 4: Stopping in Code ................................. 48
Signals................................................................................................. 49
LLDB breakpoint syntax ...................................................................... 52
Finally... creating breakpoints.............................................................. 56
Where to go from here?...................................................................... 64
Chapter 5: Expression ............................................ 66
Formatting p & po................................................................................ 67
Swift vs Objective-C debugging contexts........................................... 71
raywenderlich.com 8
Advanced Apple Debugging
User defined variables......................................................................... 72
Where to go from here?....................................................................... 79
Chapter 6: Thread, Frame & Stepping Around...... 80
Stack 101.............................................................................................. 81
Examining the stackʼs frames.............................................................. 82
Stepping.............................................................................................. 85
Examining data in the stack................................................................. 87
Where to go from here? ...................................................................... 89
Chapter 7: Image.................................................... 90
Wait... modules? .................................................................................. 91
Snooping around................................................................................. 99
Where to go from here?..................................................................... 104
Chapter 8: Persisting & Customizing
Commands............................................................ 105
Persisting... how?............................................................................... 106
Creating the .lldbinit file .................................................................... 106
Command aliases with arguments..................................................... 108
Where to go from here?..................................................................... 109
Chapter 9: Regex Commands............................... 110
command regex.................................................................................. 111
Executing complex logic..................................................................... 112
Chaining regex inputs......................................................................... 114
Supplying multiple parameters .......................................................... 116
Where to go from here? ..................................................................... 118
Section II: Understanding Assembly................. 119
Chapter 10: Assembly Register Calling
Convention............................................................ 120
Assembly 101...................................................................................... 121
x86_64 register calling convention.................................................... 123
Objective-C and registers.................................................................. 125
raywenderlich.com 9
Advanced Apple Debugging
Putting theory to practice.................................................................. 126
Swift and registers ............................................................................. 131
RAX, the return register..................................................................... 133
Changing around values in registers................................................. 134
Registers and SDK............................................................................. 137
Where to go from here?..................................................................... 139
Chapter 11: Assembly & Memory.......................... 141
Setting up the Intel-Flavored Assembly Experience™...................... 142
The RIP register................................................................................. 145
Registers and breaking up the bits.................................................... 148
Breaking down the memory ............................................................... 151
Endianness... this stuff is reversed?.................................................. 154
Where to go from here?..................................................................... 156
Chapter 12: Assembly and the Stack ................... 157
The stack, revisited ........................................................................... 158
Stack pointer & base pointer registers.............................................. 159
Stack related opcodes ....................................................................... 161
Observing RBP & RSP in action......................................................... 163
The stack and 7+ parameters............................................................ 170
The stack and debugging info........................................................... 172
Stack exploration takeaways.............................................................. 175
Where to go from here?..................................................................... 176
Section III: Low Level ........................................ 178
Chapter 13: Hello, Ptrace...................................... 179
System calls....................................................................................... 180
The foundation of attachment, ptrace............................................... 180
ptrace arguments .............................................................................. 182
Creating attachment issues............................................................... 185
Getting around PT_DENY_ATTACH.................................................... 186
Other anti-debugging techniques..................................................... 188
Where to go from here?..................................................................... 188
raywenderlich.com 10