Chapters

Hide chapters

Advanced Apple Debugging & Reverse Engineering

Third Edition · iOS 12 · Swift 4.2 · Xcode 10

Before You Begin

Section 0: 3 chapters
Show chapters Hide chapters

Section III: Low Level

Section 3: 7 chapters
Show chapters Hide chapters

Section IV: Custom LLDB Commands

Section 4: 8 chapters
Show chapters Hide chapters

A. Appendix A: LLDB Cheatsheet
Written by Derek Selander

Heads up... You’re accessing parts of this content for free, with some sections shown as sqsersmof text.

Heads up... You’re accessing parts of this content for free, with some sections shown as wdjatmfam text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now

A cheatsheet for commands and ideas on how to use LLDB.

Getting help

(lldb) help

List all commands and aliases.

(lldb) help po

Get help documentation for po (expression) command.

(lldb) help break set

Get help documentation for breakpoint set.

(lldb) apropos step-in

Search through help documentation containing step-in.

Finding code

(lldb) image lookup -rn UIAlertController

Look up all code containing UIAlertController that’s compiled or loaded into an executable.

(lldb) image lookup -rn (?i)hosturl

Heads up... You’re accessing parts of this content for free, with some sections shown as jhcicjmot text.

Heads up... You’re accessing parts of this content for free, with some sections shown as dssuxlwav text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now
(lldb) image lookup -rn 'UIViewController\ set\w+:\]'
(lldb) image lookup -rn . Security
(lldb) image lookup -a 0x10518a720
(lldb) image lookup -s mmap

Breakpoints

(lldb) b viewDidLoad

Creates a breakpoint on all methods named viewDidLoad for both Swift and Objective-C.

(lldb) b setAlpha:
(lldb) b -[CustomViewControllerSubclass viewDidLoad]
(lldb) rbreak CustomViewControllerSubclass.viewDidLoad
(lldb) breakpoint delete
(lldb) breakpoint delete 2
(lldb) breakpoint list

Heads up... You’re accessing parts of this content for free, with some sections shown as plxavshyg text.

Heads up... You’re accessing parts of this content for free, with some sections shown as bjguhncuk text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now
(lldb) rbreak viewDid
(lldb) rbreak viewDid -s SwiftRadio
(lldb) rbreak viewDid(Appear|Disappear) -s SwiftHN
(lldb) rb "\-\[UIViewController\ set" -s UIKit
(lldb) rb . -s SwiftHN -o 1
(lldb) rb . -f ViewController.m

Expressions

(lldb) po "hello, debugger"

Prints "hello, debugger" regardless of the debugging context.

(lldb) expression -lobjc -O -- [UIApplication sharedApplication]
(lldb) expression -lswift -O -- UIApplication.shared
(lldb) b getenv
(lldb) expression -i0 -- getenv("HOME")
(lldb) expression -u0 -O -- [UIApplication test]

Heads up... You’re accessing parts of this content for free, with some sections shown as frvudvlaq text.

Heads up... You’re accessing parts of this content for free, with some sections shown as sjhadncyc text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now
(lldb) expression -p -- NSString *globalString = [NSString stringWithUTF8String: "Hello, Debugger"]; 
(lldb) po globalString
Hello, Debugger
(lldb) expression -g -O -lobjc -- [NSObject new] 

Stepping

(lldb) thread return false

Return early from code with false.

(lldb) thread step-in
(lldb) s
(lldb) thread step-over
(lldb) n
(lldb) thread step-out
(lldb) finish
(lldb) thread step-inst
(lldb) ni

GDB formatting

(lldb) p/x 128

Print value in hexadecimal.

(lldb) p/d 128
(lldb) p/t 128
(lldb) p/a 128
(lldb) x/gx 0x000000010fff6c40

Heads up... You’re accessing parts of this content for free, with some sections shown as dnbezlqeg text.

Heads up... You’re accessing parts of this content for free, with some sections shown as lxmapsguc text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now
(lldb) x/wx 0x000000010fff6c40

Memory

(lldb) memory read 0x000000010fff6c40

Read memory at address 0x000000010fff6c40.

(lldb) po id $d = [NSData dataWithContentsOfFile:@"..."]
(lldb) mem read `(uintptr_t)[$d bytes]` `(uintptr_t)[$d bytes] + (uintptr_t)[$d length]` -r -b -o /tmp/file

Registers & assembly

(lldb) register read -a

Display all registers on the system.

(lldb) register read rdi rsi
(lldb) register write rsi 0x0
(lldb) register write rflags `$rflags ^ 64`
(lldb) register write rflags `$rflags | 64`
(lldb) register write rflags `$rflags & ~64`
(lldb) register write pc `$pc+4`
(lldb) disassemble
(lldb) disassemble -p

Heads up... You’re accessing parts of this content for free, with some sections shown as znwashfyp text.

Heads up... You’re accessing parts of this content for free, with some sections shown as cxkingkyw text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now
(lldb) disassemble -b
(lldb) disassemble -n '-[UIViewController setTitle:]'
(lldb) disassemble -a 0x000000010b8d972d

Modules

(lldb) image list 

List all modules loaded into the executable’s process space.

(lldb) image list -b
(lldb) process load /Path/To/Module.framework/Module
Have a technical question? Want to report a bug? You can ask questions and report bugs to the book authors in our official book forum here.
© 2025 Kodeco Inc.

You’re accessing parts of this content for free, with some sections shown as hrnorbpux text. Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now