【iOS安全】使用LLDB调试iOS App | LLDB基本架构 | LLDB安装和配置

Jouzzy2025-06-03 20:58

LLDB基本架构

参考：

https://crifan.github.io/ios_re_dynamic_debug/website/debug_code/lldb_debugserver.html

https://book.crifan.org/books/ios_re_debug_debugserver_lldb/website/


LLDB安装和配置

1. 让iPhone中出现/Developer/usr/bin/debugserver

最初的iPhone中没有 /Developer/usr/bin/debugserver：

需要让iPhone中出现/Developer/usr/bin/debugserver

1.1 启动xcode并创建项目

用数据线把iPhone连到MacBook ，MacBook 上打开xcode，创建项目并连接设备，自动配置好后xcode就会把debugserver发送到iPhone上

1.2 报错：MacBook xcode连接iPhone时报错xxx is not available

Window → Devices and Simulators 报错如下：

bash 复制代码 
The current device configuration is unsupported. This iPhone 8 (Model A1863, A1905, A1906, A1907) is running iOS 14.3 (18C66), which is not supported by Xcode 11.7.
Domain: com.apple.dtdevicekit
Code: 601
Recovery Suggestion: To run on this device, please update to a version of Xcode that supports iOS 14.3. You can download Xcode from the Mac App Store or the Apple Developer website.
User Info: {
    DVTRadarComponentKey = 487927;
    DeviceType = "iPhone10,1";
}

解决方法：

参考：https://developer.apple.com/forums/thread/659166

从这里下载14.3的支持文件

https://github.com/JinjunHan/iOSDeviceSupport/tree/master/iOSDeviceSupport

复制粘贴到

/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/

但是出现新的报错：

bash 复制代码 
Details

Failed to start remote service on device.
Domain: com.apple.dtdevicekit
Code: 811
Recovery Suggestion: Please check your connection to your device.
User Info: {
    DVTRadarComponentKey = 261622;
}
--
The service is invalid.
Domain: com.apple.dt.MobileDeviceErrorDomain
Code: -402653150
User Info: {
    DVTRadarComponentKey = 261622;
    MobileDeviceErrorCode = "(0xE8000022)";
    "com.apple.dtdevicekit.stacktrace" = (
    0   DTDeviceKitBase                     0x000000011d61e81a DTDKCreateNSErrorFromAMDErrorCode + 233
    1   DTDeviceKitBase                     0x000000011d630161 __63-[DTDKRemoteDeviceConnection startFirstServiceOf:unlockKeybag:]_block_invoke + 564
    2   DTDeviceKitBase                     0x000000011d62f829 __48-[DTDKRemoteDeviceConnection futureWithSession:]_block_invoke_3 + 22
    3   DTDeviceKitBase                     0x000000011d620df9 __DTDKExecuteInSession_block_invoke_2 + 35
    4   DTDeviceKitBase                     0x000000011d620209 __DTDKExecuteWithConnection_block_invoke_2 + 473
    5   DTDeviceKitBase                     0x000000011d620007 __DTDKExecuteWithConnection_block_invoke + 106
    6   libdispatch.dylib                   0x00007fff70ae9658 _dispatch_client_callout + 8
    7   libdispatch.dylib                   0x00007fff70af56ec _dispatch_lane_barrier_sync_invoke_and_complete + 60
    8   DVTFoundation                       0x0000000103f24138 DVTDispatchBarrierSync + 208
    9   DVTFoundation                       0x0000000103efaa93 -[DVTDispatchLock performLockedBlock:] + 64
    10  DTDeviceKitBase                     0x000000011d61ff08 DTDKExecuteWithConnection + 226
    11  DTDeviceKitBase                     0x000000011d620c63 DTDKExecuteInSession + 376
    12  DTDeviceKitBase                     0x000000011d62f66a __48-[DTDKRemoteDeviceConnection futureWithSession:]_block_invoke_2 + 131
    13  DVTFoundation                       0x0000000103f215c4 __DVT_CALLING_CLIENT_BLOCK__ + 7
    14  DVTFoundation                       0x0000000103f23206 __DVTDispatchAsync_block_invoke + 1194
    15  libdispatch.dylib                   0x00007fff70ae86c4 _dispatch_call_block_and_release + 12
    16  libdispatch.dylib                   0x00007fff70ae9658 _dispatch_client_callout + 8
    17  libdispatch.dylib                   0x00007fff70aeec44 _dispatch_lane_serial_drain + 597
    18  libdispatch.dylib                   0x00007fff70aef609 _dispatch_lane_invoke + 414
    19  libdispatch.dylib                   0x00007fff70af8c09 _dispatch_workloop_worker_thread + 596
    20  libsystem_pthread.dylib             0x00007fff70d43a3d _pthread_wqthread + 290
    21  libsystem_pthread.dylib             0x00007fff70d42b77 start_wqthread + 15
);
}
--
System Information

macOS Version 10.15.7 (Build 19H1323)
Xcode 11.7 (16142)

但是手机上出现构建好的App

解决方法见下文

1.3 报错：运行编写的App时报错Failed to start remote service on device.
bash 复制代码 
Details

Failed to start remote service on device.
Domain: com.apple.dtdevicekit
Code: 811
Recovery Suggestion: Please check your connection to your device.
User Info: {
    DVTRadarComponentKey = 261622;
}
--
The service is invalid.
Domain: com.apple.dt.MobileDeviceErrorDomain
Code: -402653150
User Info: {
    DVTRadarComponentKey = 261622;
    MobileDeviceErrorCode = "(0xE8000022)";
    "com.apple.dtdevicekit.stacktrace" = (
    0   DTDeviceKitBase                     0x000000011d61e81a DTDKCreateNSErrorFromAMDErrorCode + 233
    1   DTDeviceKitBase                     0x000000011d630161 __63-[DTDKRemoteDeviceConnection startFirstServiceOf:unlockKeybag:]_block_invoke + 564
    2   DTDeviceKitBase                     0x000000011d62f829 __48-[DTDKRemoteDeviceConnection futureWithSession:]_block_invoke_3 + 22
    3   DTDeviceKitBase                     0x000000011d620df9 __DTDKExecuteInSession_block_invoke_2 + 35
    4   DTDeviceKitBase                     0x000000011d620209 __DTDKExecuteWithConnection_block_invoke_2 + 473
    5   DTDeviceKitBase                     0x000000011d620007 __DTDKExecuteWithConnection_block_invoke + 106
    6   libdispatch.dylib                   0x00007fff70ae9658 _dispatch_client_callout + 8
    7   libdispatch.dylib                   0x00007fff70af56ec _dispatch_lane_barrier_sync_invoke_and_complete + 60
    8   DVTFoundation                       0x0000000103f24138 DVTDispatchBarrierSync + 208
    9   DVTFoundation                       0x0000000103efaa93 -[DVTDispatchLock performLockedBlock:] + 64
    10  DTDeviceKitBase                     0x000000011d61ff08 DTDKExecuteWithConnection + 226
    11  DTDeviceKitBase                     0x000000011d620c63 DTDKExecuteInSession + 376
    12  DTDeviceKitBase                     0x000000011d62f66a __48-[DTDKRemoteDeviceConnection futureWithSession:]_block_invoke_2 + 131
    13  DVTFoundation                       0x0000000103f215c4 __DVT_CALLING_CLIENT_BLOCK__ + 7
    14  DVTFoundation                       0x0000000103f23206 __DVTDispatchAsync_block_invoke + 1194
    15  libdispatch.dylib                   0x00007fff70ae86c4 _dispatch_call_block_and_release + 12
    16  libdispatch.dylib                   0x00007fff70ae9658 _dispatch_client_callout + 8
    17  libdispatch.dylib                   0x00007fff70aeec44 _dispatch_lane_serial_drain + 597
    18  libdispatch.dylib                   0x00007fff70aef609 _dispatch_lane_invoke + 414
    19  libdispatch.dylib                   0x00007fff70af8c09 _dispatch_workloop_worker_thread + 596
    20  libsystem_pthread.dylib             0x00007fff70d43a3d _pthread_wqthread + 290
    21  libsystem_pthread.dylib             0x00007fff70d42b77 start_wqthread + 15
);
}
--
System Information

macOS Version 10.15.7 (Build 19H1323)
Xcode 11.7 (16142)

不好使的解决办法：

https://cloud.tencent.com/developer/ask/sof/107747170

cd ~/Library/Developer/Xcode/DerivedData

rm -rf *

解决方法：
安装Xcode 12.3

1.4 报错： Signing for xxx requires a development team

Signing for "lldbTest" requires a development team.Select a development team in the Signing & Capabilities editor.

解决方法：

添加team

1.5 报错： iPhone is not available. Please reconnect the device

iPhone is not available. Please reconnect the device

解决方法：

参考：https://blog.csdn.net/zjpjay/article/details/108770188

Window → Devices And Simulators 能看到报错信息

我是iOS 14.3，因此可以下载xcode 12.3

下载地址

https://developer.apple.com/download/all/

使用xcode 12.3之后出现新的报错

1.6 报错： iPhone is not available. Please reconnect the device

Failed to start remote service "com.apple.debugserver" on device.

Please check your connection to your deviice.

解决方法：

我没管这个报错，好像没什么影响，这一步骤只要保证iPhone中出现/Developer/usr/bin/debugserver即可

1.7 iPhone中出现debugserver

/Developer/usr/bin/debugserver

2. 确保iPhone中debugserver有正确的权限entitlement

2.1 从iPhone中导出debugserver到MacBook
2.2 MacBook上给debugserver加权限

参考：https://www.cnblogs.com/ludashi/p/5730338.html

找到iPhone中的debugserver，在macos上进行如下操作：

2.2.1 根据机型对debugserver进行瘦身
复制代码 
lipo -thin arm64 debugserver -output debugserver

-thin后方填写你的测试机相应的ARM指令集架构即可

指令集架构参考：https://blog.csdn.net/zgpeace/article/details/104290302

2.2.2 安装ldid
复制代码 
brew install ldid
2.2.3 导出debugserver现有的权限

参考：https://www.jianshu.com/p/fa2f080fb4bb

复制代码 
ldid -e debugserver > debugserver-origin.entitlements

我导出的：

bash 复制代码 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.springboard.debugapplications</key>
    <true/>
    <key>com.apple.backboardd.launchapplications</key>
    <true/>
    <key>com.apple.backboardd.debugapplications</key>
    <true/>
    <key>com.apple.frontboard.launchapplications</key>
    <true/>
    <key>com.apple.frontboard.debugapplications</key>
    <true/>
    <key>seatbelt-profiles</key>
    <array>
        <string>debugserver</string>
    </array>
    <key>com.apple.private.logging.diagnostic</key>
    <true/>
    <key>com.apple.security.network.server</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.private.memorystatus</key>
    <true/>
    <key>com.apple.private.cs.debugger</key>
    <true/>
</dict>
</plist>
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.springboard.debugapplications</key>
    <true/>
    <key>com.apple.backboardd.launchapplications</key>
    <true/>
    <key>com.apple.backboardd.debugapplications</key>
    <true/>
    <key>com.apple.frontboard.launchapplications</key>
    <true/>
    <key>com.apple.frontboard.debugapplications</key>
    <true/>
    <key>seatbelt-profiles</key>
    <array>
        <string>debugserver</string>
    </array>
    <key>com.apple.private.logging.diagnostic</key>
    <true/>
    <key>com.apple.security.network.server</key>
    <true/>
    <key>com.apple.security.network.client</key>
    <true/>
    <key>com.apple.private.memorystatus</key>
    <true/>
    <key>com.apple.private.cs.debugger</key>
    <true/>
</dict>
</plist>

ldid对于FAT格式会输出多份entitlement权限信息，需要去除其中重复的一份xml

参考：https://book.crifan.org/books/ios_re_debug_debugserver_lldb/website/usage_note/entitlement/check_entitlement/

例如我这里从iPhone8中导出的debugserver就是包含arm64和arm64e的FAT格式的debugserver，因此entitlement权限信息就有多份，需要去掉一份

2.2.4 修改entitlement权限

然后对entitlement权限进行如下修改

参考：https://book.crifan.org/books/ios_re_debug_debugserver_lldb/website/debugserver_lldb_debug/proper_entitlemets.html

  • 已加上权限：get-task-allow、task_for_pid-allow、run-unsigned-code
    目的：允许debugserver调试其他app
  • 已去掉权限：com.apple.security.network.server、com.apple.security.network.client
    目的：防止后续lldb调试报错Failed to get connection from a remote gdb process
  • 已去掉权限：seatbelt-profiles
    目的：方式后续debugserver加上-l的日志文件时报错：Failed to open log file for writing errno = 1 Operation not permitted

最终修改为如下，保存为debugserver.entitlements：

bash 复制代码 
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.springboard.debugapplications</key>
    <true/>
    <key>com.apple.backboardd.launchapplications</key>
    <true/>
    <key>com.apple.backboardd.debugapplications</key>
    <true/>
    <key>com.apple.frontboard.launchapplications</key>
    <true/>
    <key>com.apple.frontboard.debugapplications</key>
    <true/>
    <key>com.apple.private.logging.diagnostic</key>
    <true/>
    <key>com.apple.private.memorystatus</key>
    <true/>
    <key>com.apple.private.cs.debugger</key>
    <true/>
    <key>get-task-allow</key>
    <true/>
    <key>task_for_pid-allow</key>
    <true/>
    <key>run-unsigned-code</key>
    <true/>
</dict>
</plist>
2.2.5 对debugserver进行重新签名

如果iOS < 15.0，可以用ldid

ldid -Sdebugserver.entitlements debugserver

注意S是大写，并且与debugserver紧挨着

如果iOS ≥ 15.0 或者 iOS < 15.0，可以用codesign

codesign -f -s - --entitlements debugserver.entitlements debugserver

（未尝试）

2.3 将debugserver拷贝到iPhone并赋执行权限

将已经签好权限的debugserver拷贝到iPhone的/usr/bin目录下

iPhone中的，原始版本的debugserver位置是：/Developer/usr/bin/debugserver

但该位置只读，无法修改

所以才需要拷贝到/usr/bin，因为/usr/bin是用于存放可执行文件工具的路径之一

理论上也可以拷贝到/bin/sbin /usr/sbin等，保证此路径出现在echo $PATH中即可

参考：

https://book.crifan.org/books/ios_re_debug_debugserver_lldb/website/debugserver_lldb_debug/proper_entitlemets.html

chmod +x debugserver

赋完权限后，你就可以使用debugserver命令来开启debugserver了

3. iPhone中运行debugserver

整体参考：

https://book.crifan.org/books/ios_re_debug_debugserver_lldb/website/debugserver_lldb_debug/mac_run_lldb_debug.html

3.1 attach模式

先手动启动app，再用debugserver去attach

3.1.1 找到App进程名

一般也就是App的可执行Mach-O文件名

PC端

frida-ps -H 192.168.31.32:6666 -a

bash 复制代码 
6461  顺丰速运       com.sf-express.waybillcn

手机端查看进程名

ps -ef | grep "6461"

bash 复制代码 
  501  6461     1   0 12:02AM ??         0:25.81 /var/containers/Bundle/Application/81449B8F-7C5D-4A06-8970-A3EEDF922AC2/SFMainland_Store_Pro.app/SFMainland_Store_Pro

后续用debugserver attach到App时：

可以使用Mach-O文件名

debugserver 0.0.0.0:12345 -a "SFMainland_Store_Pro"

可以使用完整Mach-O文件名

debugserver 0.0.0.0:12345 -a "/var/containers/Bundle/Application/81449B8F-7C5D-4A06-8970-A3EEDF922AC2/SFMainland_Store_Pro.app/SFMainland_Store_Pro"

可以使用进程号

debugserver 0.0.0.0:12345 -a 6461

其中12345是端口号，可以设置为任意值，只要不和其他端口号冲突即可；后续Macbook中lldb连接时，要用到此端口号

3.1.2 使用iproxy进行端口映射

参考：

https://blog.csdn.net/u010775335/article/details/127691013

需要将iPhone通过数据线连接至MacBook

MacBook安装usbmuxd

参考：https://cloud.tencent.com/developer/article/1173911

brew install usbmuxd

MacBook使用iproxy 将iPhone的端口映射到PC端口

iproxy 12345 12345

第一个参数是你要映射到的电脑端口

第二个是iPhone的端口

然后保持此窗口不动

3.1.3 用debugserver attach到App

启动顺丰速运app

iPhone SSH端

debugserver 0.0.0.0:12345 -a "SFMainland_Store_Pro"

3.2 spawn模式（未尝试）

debugserver -x auto 0.0.0.0:12345 "/var/containers/Bundle/Application/FD516591-AAA8-47B4-AD8B-5DA9EC88856B/UCWEB.app/UCWEB"

4. Mac中启动lldb来调试app

MacBook另起终端：

lldb

process connect connect://127.0.0.1:12345

等待若干分钟：

bash 复制代码 
xxx@xxx lldb % lldb 
(lldb) process connect connect://127.0.0.1:12345
Process 10038 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
    frame #0: 0x0000000102ee6bc0 SFMainland_Store_Pro
->  0x102ee6bc0: adrp   x1, 3044
    0x102ee6bc4: ldr    x1, [x1, #0x1f0]
    0x102ee6bc8: adrp   x16, 1705
    0x102ee6bcc: ldr    x16, [x16, #0xf78]
Target 0: (SFMainland_Store_Pro) stopped.
(lldb)

此时iPhone SSH 变成

MacBook

(lldb) b ptrace

(lldb) c

完整的双侧截图如下：

LLDB指令教程

参考：https://www.jianshu.com/p/fa2f080fb4bb

breakpoint set -n "-[RNCWeakScriptMessageDelegate userContentController:didReceiveScriptMessage:]"

breakpoint set -n "-[* userContentController:didReceiveScriptMessage:]"

breakpoint list

禁用所有断点

breakpoint disable

临时修改显示汇编行数

disassemble --count 16

永久修改显示汇编行数

settings set stop-disassembly-count 16

用Frida拿到地址，再用LLDB调试

复制代码 
frida-trace -m "-[* userContentController:didReceiveScriptMessage:]"  -H 192.168.71.114:6666 顺丰速运

确认有-[RNCWeakScriptMessageDelegate userContentController:didReceiveScriptMessage:]

lldb检查符号是否存在

(lldb) image lookup -s "-[RNCWeakScriptMessageDelegate userContentController:didReceiveScriptMessage:]"

没有输出，说明LLDB找不到这个方法

(lldb) image lookup -rn "RNCWeakScriptMessageDelegate.*didReceiveScriptMessage"

问DeepSeek

复制代码 
// Frida 脚本
const method = ObjC.classes.RNCWeakScriptMessageDelegate["- userContentController:didReceiveScriptMessage:"];
console.log("Method address:", method.implementation);

frida -H 192.168.71.128:6666 -F -l addr-frida-script.js

bash 复制代码 
[*] Starting Hooking
Method address: 0x102bc86dc

(lldb) breakpoint set --address 0x102bc86dc

打开webview时真的命中了

相关推荐
豪冷啊3 分钟前
iOS UIActivityViewController 组头处理
ios·objective-c·xcode
向上的车轮19 分钟前
Spring Boot微服务架构（十一）：独立部署是否抛弃了架构优势？
spring boot·微服务·架构
昭阳~2 小时前
Kafka深度技术解析：架构、原理与最佳实践
分布式·架构·kafka
向上的车轮2 小时前
Spring Boot微服务架构（十）：Docker与K8S部署的区别
spring boot·微服务·架构
brzhang2 小时前
iOS 26 的备忘录，终于他娘的要支持 Markdown 了！
前端·后端·架构
二流小码农2 小时前
鸿蒙开发：loading动画的几种实现方式
android·ios·harmonyos
安全系统学习2 小时前
【网络安全】漏洞分析：阿帕奇漏洞学习
java·网络·安全·web安全·系统安全
wsxlgg2 小时前
IOS 打包账号发布上传和IOS Xcode证书配置
ios
链上Sniper3 小时前
Python 区块链开发实战：从零到一构建智能合约
开发语言·网络·python·架构·区块链·php·智能合约
Digitally3 小时前
iTunes 无法备份 iPhone：10 种解决方法
ios·gradle·iphone
热门推荐
01从零安装 LLaMA-Factory 微调 Qwen 大模型成功及所有的坑02KGG转MP3工具|非KGM文件|解密音频03YOLOv8入门 | 重要性能衡量指标、训练结果评价及分析及影响mAP的因素【发论文关注的指标】04机器学习实验--- 金融数据基础与计算在线实验闯关05【SpeedAI科研小助手】2分钟极速解决知网维普重复率、AIGC率过高，一键全文降！文件格式不变，公式都保留的！06DeepSeek各版本说明与优缺点分析07山东大学2024深度学习期末考试回忆08【2025年最新】OpenWrt 更换国内源的指南（图形界面版)09组基轨迹建模 GBTM的介绍与实现（Stata 或 R）10VMware虚拟机安装Win7专业版保姆级教程（附镜像包）