Contained in: Advanced Apple Debugging & Reverse Engineering
objective c
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Hello, DTrace
Jul 5 2023 · Chapter
…explore a very small section of what DTrace is capable of doing by tracing Objective-C code in already compiled applications. Using DTrace to observe iOS frameworks (like UIKit) can give you an incredible insight into how the authors designed their code…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Expression
Jul 5 2023 · Chapter
…will be able to interpret that value and display meaningful information to you. For example lldb can interpret: a C int, Objective-C NSObject or a Swift struct, a variable in source code, a register’s value, etc. If you do a quick help po in the lldb console…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
SB Examples, Resymbolicating a Stripped ObjC Binary
Jul 5 2023 · Chapter
…method, but doesn’t know what to call it. In this chapter, you’ll build an LLDB script that will resymbolicate stripped Objective-C functions in a stack trace…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Assembly Register Calling Convention
Jul 5 2023 · Chapter
…stop at the start of a function call in order to inspect or modify the parameters without having to actually dive into the assembly. Objective-C and Registers As you learned in the previous section, registers use a specific calling convention. You can take that same knowledge and apply…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Script Bridging With SBValue & Memory
Jul 5 2023 · Chapter
…when evaluating JIT code (i.e. Objective-C, Swift, C, etc. code that’s executed through your Python script), you’ve used a small set of APIs to evaluate the code. It’s time to talk about a new class in the lldb Python module, SBValue, and how it can simplify…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Stopping in Code
Jul 5 2023 · Chapter
Whether you’re using Swift, Objective-C, C++, C, or an entirely different language in your technology stack, you’ll need to learn how to create breakpoints. It’s easy to click on the side panel in Xcode to create a breakpoint using the GUI, but the LLDB console…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Shared Libraries
Jul 5 2023 · Chapter
…reverse engineering or stumbling upon someone else’s work on GitHub). The starter project directory includes Private.m and Private.h, which contain an Objective-C class called PrivateObjcClass, an NSString constant called SomeStringConstant and a C function called SomeCode. In Terminal, navigate to where you’ve saved the demo code…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Getting Started
Jul 5 2023 · Chapter
…address again: (lldb) process launch -e /dev/ttys027 -- The launch argument e specifies the location of stderr. Common logging functionality, such as Objective-C’s NSLog or Swift’s print function, outputs to stderr — yes, not stdout! You’ll print your own logging to stderr later. Notes will launch after…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Intermediate DTrace
Jul 5 2023 · Chapter
…they need to be visually displayed (if it’s an on-screen component, it must inherit from UIView, which inherits from NSObject, meaning Objective-C) DTrace is agnostic to whatever Swift code inherits from whatever class as it’s all the same to DTrace. You can still profile Objective-C…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Script Bridging With Options & Arguments
Jul 5 2023 · Chapter
…input which contains special characters like a dash; otherwise, OptionParser will incorrectly assume that’s an option being passed in. This is important because Objective-C has dashes in instance methods, so you don’t want the dash to be incorrectly interpreted as an option! Using the newly created generateOptionParser…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Appendix A: LLDB Cheat Sheet
Jul 5 2023 · Chapter
Look up code for the symbol named mmap. Breakpoints (lldb) b viewDidLoad Creates a breakpoint on all methods named viewDidLoad for both Swift and Objective-C. (lldb) b setAlpha: Creates a breakpoint on either the setAlpha: Objective-C method or the setter of the Objective-C alpha property. (lldb…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Image
Jul 5 2023 · Chapter
UIViewController(CategoryName) methodName]. Search for all UIViewController category methods: (lldb) image lookup -rn '\[UIViewController\(' Searching for the presence of the parenthesis immediately following the Objective-C class name returns category methods for that particular class. Not only does this print out both public and undocumented APIs, but it also gives…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Debugging Script Bridging
Jul 5 2023 · Chapter
…your LLDB Python scripts using the Python pdb module, which is used for debugging Python scripts. In addition, you can execute your own “normal” Objective-C, Objective-C++, C, Swift, or even other languages code within SBDebugger’s, or SBCommandReturnObject’s, HandleCommand method. In fact, there’s alternative ways…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Hooking & Executing Code With dlopen & dlsym
Jul 5 2023 · Chapter
…code within your own application. To do this, you’re going to call on the help of two awesome functions: dlopen and dlsym. The Objective-C Runtime vs. Swift & C Objective-C, thanks to its powerful runtime, is a truly dynamic language. Even when compiled and running, not even…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Assembly & Memory
Jul 5 2023 · Chapter
…expression -f x -l objc -- This command, cpx, is a convenience command you can use to print out something in hexadecimal format, using the Objective-C context. This will be useful when printing out register contents. Remember, registers aren’t available in the Swift context, so you need…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Regex Commands
Jul 5 2023 · Chapter
…visible, depending what the previous state was. Note that isHidden doesn’t know the return type, so you need to cast it to an Objective-C BOOL. The final command, [CATransaction flush], flushes the CATransaction queue. Manipulating the UI in the debugger normally means the screen will not reflect…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Mach-O Fun
Jul 5 2023 · Chapter
Then just choose a number greater than that. Numerous other sections contain UTF-8 strings for different purposes. For example, the __TEXT.__objc_methname section contains Objective-C method names that are referenced directly by your application. The __TEXT.__swift4_reflstr section contains references to Swift’s reflected items. A candidate for Swift runtime…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Persisting & Customizing Commands
Jul 5 2023 · Chapter
…just created a new command called cpo. The cpo command will do a normal po (print object), but it’ll use the Objective-C context instead. This is an ideal command to use when you’re in a Swift context, but want to use Objective-C to print…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Watchpoints
Jul 5 2023 · Chapter
…allocated Swift/Objective-C object when you don’t know how a property is getting set, i.e. via direct ivar access, Swift inout parameter initialization, Objective-C property setter method, Swift property setter method, hardcoded offset access, or other methods. Monitoring when a hardcoded string is being utilized, such…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Thread, Frame & Stepping Around
Jul 5 2023 · Chapter
…breakpoint it will break twice. Build and run the program. We want the break in the Swift context, so if you broke in the Objective-C context, type c or click the resume button. As expected, the debugger will pause the program on the viewWillAppear(_:) method of MainViewController. Next, take…