1、連接iPhone手機(jī)
ssh root@123.123.12.123
2、找到啟動(dòng)的進(jìn)程
ps aux
3、找到目標(biāo)進(jìn)程，根據(jù)進(jìn)程名稱進(jìn)行調(diào)試
debugserver localhost:1234 -a jinchengmingcheng
或 根據(jù)進(jìn)程號(hào)進(jìn)行調(diào)試
debugserver localhost:1234 -a jinchenghao例如6666
此時(shí)終端結(jié)果
debugserver-@(#)PROGRAM:LLDB PROJECT:lldb-123.3.23
for arm64.
Attaching to process jinchengmingcheng...
Listening to port 1234 for a connection from localhost...
Waiting for debugger instructions for process 0.
注意：如果此時(shí)不用usb調(diào)試，需把localhost改為*或?qū)?yīng)手機(jī)IP地址，
命令如下：
debugserver *:1234 -a jinchengmingcheng
但這樣經(jīng)常報(bào)錯(cuò)
lldb報(bào)錯(cuò)：
error: failed to get reply to handshake packet
debugserver報(bào)錯(cuò)：
error: rejecting incoming connection from
4、用usb調(diào)試，因?yàn)閣ifi調(diào)試非常慢，且經(jīng)常報(bào)錯(cuò)，所以這里做端口轉(zhuǎn)發(fā)后，再連接
4.1、下載http://cgit.sukimashita.com/usbmuxd.git/snapshot/usbmuxd-1.0.8.tar.bz2
4.2、進(jìn)入cd到下載usbmuxd-1.0.8.tar.bz2的目錄中，并執(zhí)行如下命令
tar xjfv usbmuxd-1.0.8.tar.bz2
cd usbmuxd-1.0.8/python-client
python tcprelay.py -t 1234:1234
執(zhí)行結(jié)果
Forwarding local port 1234 to remote port 1234
Incoming connection to 1234
Waiting for devices...
Connecting to device <MuxDevice: ID 456 ProdID 0x7890 Serial 'jfieaojgiajgieiajgiajgijafiojeihguabghfhuehfuaeufu' Location 0x12340000>
Connection established, relaying data
Connection closed
5、新建終端
lldb
6、連接
(lldb) process connect connect://localhost:1234
注意：如果此時(shí)不做端口轉(zhuǎn)發(fā)，即不走第4步，需要把localhost改成真實(shí)的手機(jī)IP地址，
可以用如下命令
process connect connect://123.123.12.123:1234
但這樣經(jīng)常遇到連接失敗，報(bào)錯(cuò)如下
error：failed to get reply to handshake packet
等一會(huì)就會(huì)出現(xiàn)
Process 6985 stopped
* thread #1, stop reason = signal SIGSTOP
frame #0: 0x00000001b29000f4 libsystem_kernel.dylib`mach_msg_trap + 8
libsystem_kernel.dylib`mach_msg_trap:
-> 0x1b29000f4 <+8>: ret
libsystem_kernel.dylib`mach_msg_overwrite_trap:
0x1b29000f8 <+0>: mov x16, #-0x20
0x1b29000fc <+4>: svc #0x80
0x1b2900100 <+8>: ret
Target 0: (picsmagicartae) stopped.
此時(shí)輸入
c
能讓程序繼續(xù)運(yùn)行響應(yīng)外部事件
內(nèi)存真實(shí)地址 = Hopper或IDA中獲取的方法對(duì)應(yīng)的地址 + 模塊加載的基地址
7、對(duì)內(nèi)存真實(shí)地址設(shè)置調(diào)試斷點(diǎn)
b 0x000000000008932c
