Advanced Apple Debugging and Reverse Engineering

Table of Contents : Extended......Page 8
Introduction......Page 15
Who this book is for......Page 16
Custom LLDB scripts repo......Page 17
License......Page 18
About the cover......Page 19
Section I: Beginning LLDB Commands......Page 20
Chapter 1: Getting Started......Page 21
Getting around Rootless......Page 22
Attaching LLDB to Xcode......Page 24
Where to go from here?......Page 35
Chapter 2: Help & Apropos......Page 36
The "help" command......Page 37
The "apropos" command......Page 39
Where to go from here?......Page 40
Chapter 3: Attaching with LLDB......Page 41
Where to go from here?......Page 47
Chapter 4: Stopping in Code......Page 48
Signals......Page 49
LLDB breakpoint syntax......Page 52
Finally creating breakpoints......Page 56
Where to go from here?......Page 64
Chapter 5: Expression......Page 66
Formatting p & po......Page 67
Swift vs Objective-C debugging contexts......Page 71
User defined variables......Page 72
Where to go from here?......Page 79
Chapter 6: Thread, Frame & Stepping Around......Page 80
Stack 101......Page 81
Examining the stackʼs frames......Page 82
Stepping......Page 85
Examining data in the stack......Page 87
Where to go from here?......Page 89
Chapter 7: Image......Page 90
Wait modules?......Page 91
Snooping around......Page 99
Where to go from here?......Page 104
Chapter 8: Persisting & Customizing Commands......Page 105
Creating the lldbinit file......Page 106
Command aliases with arguments......Page 108
Where to go from here?......Page 109
Chapter 9: Regex Commands......Page 110
command regex......Page 111
Executing complex logic......Page 112
Chaining regex inputs......Page 114
Supplying multiple parameters......Page 116
Where to go from here?......Page 118
Section II: Understanding Assembly......Page 119
Chapter 10: Assembly Register Calling Convention......Page 120
Assembly 101......Page 121
x86_64 register calling convention......Page 123
Objective-C and registers......Page 125
Putting theory to practice......Page 126
Swift and registers......Page 131
RAX, the return register......Page 133
Changing around values in registers......Page 134
Registers and SDK......Page 137
Where to go from here?......Page 139
Chapter 11: Assembly & Memory......Page 141
Setting up the Intel-Flavored Assembly ExperienceTM......Page 142
The RIP register......Page 145
Registers and breaking up the bits......Page 148
Breaking down the memory......Page 151
Endianness this stuff is reversed?......Page 154
Where to go from here?......Page 156
Chapter 12: Assembly and the Stack......Page 157
The stack, revisited......Page 158
Stack pointer & base pointer registers......Page 159
Stack related opcodes......Page 161
Observing RBP & RSP in action......Page 163
The stack and 7+ parameters......Page 170
The stack and debugging info......Page 172
Stack exploration takeaways......Page 175
Where to go from here?......Page 176
Section III: Low Level......Page 178
Chapter 13: Hello, Ptrace......Page 179
The foundation of attachment, ptrace......Page 180
ptrace arguments......Page 182
Creating attachment issues......Page 185
Getting around PT_DENY_ATTACH......Page 186
Where to go from here?......Page 188
Chapter 14: Dynamic Frameworks......Page 189
Statically inspecting an executableʼs frameworks......Page 190
Modifying the load commands......Page 194
Loading frameworks at runtime......Page 197
Exploring frameworks......Page 198
Loading frameworks on an actual iOS device......Page 201
Where to go from here?......Page 202
Chapter 15: Hooking & Executing Code with dlopen & dlsym......Page 203
Setting up your project......Page 204
Easy mode: hooking C functions......Page 205
Hard mode: hooking Swift methods......Page 213
Where to go from here?......Page 219
Chapter 16: Exploring and Method Swizzling Objective-C Frameworks......Page 220
Between iOS 10 and 11......Page 221
Sidestepping checks in prepareDebuggingOverlay......Page 228
Introducing Method Swizzling......Page 233
Where to go from here?......Page 240
Section IV: Custom LLDB Commands......Page 242
Chapter 17: Hello Script Bridging......Page 243
Python 101......Page 244
Creating your first LLDB Python script......Page 248
Setting up commands efficiently......Page 250
Where to go from here?......Page 252
Chapter 18: Debugging Script Bridging......Page 253
Debugging your debugging scripts with pdb......Page 254
pdbʼs post mortem debugging......Page 256
expressionʼs Debug Option......Page 261
How to handle problems......Page 265
Where to go from here?......Page 267
Chapter 19: Script Bridging Classes and Hierarchy......Page 268
The essential classes......Page 269
Learning & finding documentation on script bridging classes......Page 274
Creating the BreakAfterRegex command......Page 276
Where to go from here?......Page 286
Chapter 20: Script Bridging with Options & Arguments......Page 288
Setting up......Page 289
Adding options without params......Page 291
Adding options with params......Page 298
Passing parameters into the breakpoint callback function......Page 302
Real world example: exploring Swift return Strings with bar......Page 308
Where to go from here?......Page 313
Chapter 21: Script Bridging with SBValue & Memory......Page 314
A detour down memory layout lane......Page 315
SBValue......Page 328
Where to go from here?......Page 337
Chapter 22: SB Examples, Improved Lookup......Page 339
Automating script creation......Page 340
lldbinit directory structure suggestions......Page 342
Implementing the lookup command......Page 343
Adding options to lookup......Page 351
Where to go from here?......Page 354
Chapter 23: SB Examples, Resymbolicating a Stripped ObjC Binary......Page 356
So how are you doing this, exactly?......Page 357
50 Shades of Ray......Page 358
The "stripped" 50 Shades of Ray......Page 365
Building sbt.py......Page 368
Implementing the code......Page 369
Where to go from here?......Page 371
Chapter 24: SB Examples, Malloc Logging......Page 372
Setting up the scripts......Page 373
MallocStackLogging explained......Page 374
Hunting in getenv......Page 377
Testing the functions......Page 382
Turning numbers into stack frames......Page 387
Stack trace from a Swift object......Page 390
DRY Python code......Page 391
Where to go from here?......Page 396
Section V: DTrace......Page 397
Chapter 25: Hello, DTrace......Page 398
Jumping right in......Page 399
DTrace Terminology......Page 403
Learning while listing probes......Page 406
A script that makes DTrace scripts......Page 408
Where to go from here?......Page 416
Chapter 26: Intermediate DTrace......Page 417
DTrace & Swift in theory......Page 418
DTrace variables & control flow......Page 422
Inspecting process memory......Page 426
Playing with open syscalls......Page 428
DTrace & destructive actions......Page 430
Where to go from here?......Page 433
Chapter 27: DTrace vs objc_msgSend......Page 435
Building your proof-of-concept......Page 436
How to get around no probes in a stripped binary......Page 440
Researching method calls using DTrace!......Page 441
Scary assembly, part II......Page 449
Converting research into code......Page 451
Limiting scope with LLDB......Page 456
Fixing up the snoopie script......Page 460
Where to go from here?......Page 461
Finding code......Page 463
Breakpoints......Page 464
Expressions......Page 465
Stepping......Page 466
Memory......Page 467
Registers & assembly......Page 468
Modules......Page 469
Python text editors......Page 470
Working with the LLDB Python module......Page 473
Conclusion......Page 474