Contained in: Advanced Apple Debugging & Reverse Engineering
swift
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Shared Libraries
Jul 5 2023 · Chapter
…this using clang without Xcode to appreciate what’s happening. For this example, you’ll create a C executable that calls code from a Swift dynamic library. You’re using Swift with C on purpose — instead of Swift with Swift — as it emphasizes the concept of resolving symbol names…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Expression
Jul 5 2023 · Chapter
…able to interpret that value and display meaningful information to you. For example lldb can interpret: a C int, Objective-C NSObject or a Swift struct, a variable in source code, a register’s value, etc. If you do a quick help po in the lldb console, you’ll find…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Getting Started
Jul 5 2023 · Chapter
…lldb) process launch -e /dev/ttys027 -- The launch argument e specifies the location of stderr. Common logging functionality, such as Objective-C’s NSLog or Swift’s print function, outputs to stderr — yes, not stdout! You’ll print your own logging to stderr later. Notes will launch after a moment. Switch…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Script Bridging With SBValue & Memory
Jul 5 2023 · Chapter
…when evaluating JIT code (i.e. Objective-C, Swift, C, etc. code that’s executed through your Python script), you’ve used a small set of APIs to evaluate the code. It’s time to talk about a new class in the lldb Python module, SBValue, and how it can simplify…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Image
Jul 5 2023 · Chapter
…shared library. A private symbol is a symbol that can’t be linked to from another module — i.e., dictated from the private keyword in Swift or the static symbol declaration in C. The presence of a private symbol’s name in the symbol table hints that Apple didn’t care…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Intermediate DTrace
Jul 5 2023 · Chapter
This chapter will act as a grab-bag of more DTrace fundamentals, destructive actions (yay!), as well as how to use DTrace with Swift. In this chapter, you'll learn additional ways DTrace can profile code, as well as how to augment existing code without laying a finger…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Hooking & Executing Code With dlopen & dlsym
Jul 5 2023 · Chapter
…about the complementary skills of developing with these frameworks. In this chapter, you’re going to learn about methods and strategies to “hook” into Swift and C code as well as execute methods you wouldn’t normally have access…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Stopping in Code
Jul 5 2023 · Chapter
Whether you’re using Swift, Objective-C, C++, C, or an entirely different language in your technology stack, you’ll need to learn how to create breakpoints. It’s easy to click on the side panel in Xcode to create a breakpoint using the GUI, but the LLDB console…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Overview & Getting Help
Jul 5 2023 · Chapter
…executing a command in lldb via a (lldb) po something_here, there’s hidden complexities that might need to occur. A compiled language like Swift needs to be compiled. As a result, LLDB needs a compiler to dynamically parse your expression, compile it on the fly, then return the results…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Assembly Register Calling Convention
Jul 5 2023 · Chapter
This is important so code compiled with one compiler can be used with code compiled with another compiler. Take a look at this simple Swift code: let fName = "Zoltan" When viewing code through assembly, the computer doesn’t care about names for variables; it only cares about locations in memory…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Watchpoints
Jul 5 2023 · Chapter
…address, but with breakpoints you can’t monitor when memory is being read or written to. You can’t monitor value changes to instantiated Swift objects on the heap, nor can you monitor reads to a particular address (say, a hardcoded string) in memory. This is where a watchpoint comes…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Persisting & Customizing Commands
Jul 5 2023 · Chapter
…print object), but it’ll use the Objective-C context instead. This is an ideal command to use when you’re in a Swift context, but want to use Objective-C to print out an address or register of something you know is a valid Objective-C object. Save your…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Hello, Script Bridging
Jul 5 2023 · Chapter
…custom command. Don’t know Python? Don’t fret. Python is one of the most friendly languages to learn. And just like the Swift Playgrounds everyone’s losing their mind over, Python has an attractive REPL for learning. Note: LLDB has completely transitioned from Python version 2 to Python…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Regex Commands
Jul 5 2023 · Chapter
…objects in memory and registers. Also, anything that begins with the square open bracket or the ‘@’ character is (likely) Objective-C. This is because Swift makes it difficult to work with memory, and Swift won’t let you access registers, nor do Swift expressions usually ever begin with an open…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Hello, Mach-O
Jul 5 2023 · Chapter
…found in each module. Open Xcode, create a new project, select macOS then Command Line Tool, and name this program MachOSegments. Make sure the Swift language is selected. Open main.swift and replace its contents with the following: import Foundation import MachO // 1 for i in 0..<_dyld_image_count…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Hello, DTrace
Jul 5 2023 · Chapter
…errors if you get a build time or runtime DTrace error (yeah, it’s on the same level of cryptic as some of those Swift compiler errors). To help mitigate these build issues as you learn DTrace, I’ve created a lovely little script called tobjectivec.py (trace Objective-C), which…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Thread, Frame & Stepping Around
Jul 5 2023 · Chapter
…last chapter, if you set a symbolic breakpoint it will break twice. Build and run the program. We want the break in the Swift context, so if you broke in the Objective-C context, type c or click the resume button. As expected, the debugger will pause the program…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Mach-O Fun
Jul 5 2023 · Chapter
…purposes. For example, the __TEXT.__objc_methname section contains Objective-C method names that are referenced directly by your application. The __TEXT.__swift4_reflstr section contains references to Swift’s reflected items. A candidate for Swift runtime reflection would be references to IBOutlet or IBInspectable variables. I highly recommend exploring these sections further…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
Script Bridging With Options & Arguments
Jul 5 2023 · Chapter
…need to experiment with a different breakpoint. This will create a regex breakpoint on all Objective-C objects that are subclassed by a Swift object and stick a breakpoint on their initializer. You are filtering this breakpoint query to only search for breakpoints inside the RWDevCon module. Run the application…
iOS & Swift
Chapter in Advanced Apple Debugging & Reverse Engineering
SB Examples, Malloc Logging
Jul 5 2023 · Chapter
…stack trace for an object. Now it’s time to level up and give this script some cool options! Stack Trace From a Swift Object OK — I know you want me to talk about Swift code. You’ll cover a Swift example as well. Included in the 50 Shades…