http://blog.csdn.net/mercuryvenus/article/details/51545071
root# debugserver *:6080 /var/mobile/Containers/Bundle/Application/18E19CF5-E863-4D59-8988-BF3BE20AFB72/MEStore.app/MEStore
启动调试模式
在mac上启动lldb:
topsectekiMac:~ topsec$ lldb
(lldb) platform select remote-ios
Platform: remote-ios
Connected: no
SDK Path: "/Users/topsec/Library/Developer/Xcode/iOS DeviceSupport/8.4 (12H143)"
SDK Roots: [ 0] "/Users/topsec/Library/Developer/Xcode/iOS DeviceSupport/(null) ((null))"
SDK Roots: [ 1] "/Users/topsec/Library/Developer/Xcode/iOS DeviceSupport/8.4 (12H143)"
(lldb) process connect connect://172.26.4.2:6080
Process 655 stopped
ni执行如下指令
0x1fe12000 <+0>: mov r8, sp
0x1fe12004 <+4>: sub sp, sp, #0x100x1fe12008 <+8>: bic sp, sp, #0x7
0x1fe1200c <+12>: ldr r3, [pc, #0x70] ; <+132>
0x1fe12010 <+16>: sub r0, pc, #0x8
0x1fe12014 <+20>: ldr r3, [r0, r3]
0x1fe12018 <+24>: sub r3, r0, r3
0x1fe1201c <+28>: ldr r0, [r8]
0x1fe12020 <+32>: ldr r1, [r8, #0x4]
0x1fe12024 <+36>: add r2, r8, #0x8
0x1fe12028 <+40>: ldr r4, [pc, #0x58] ; <+136>
0x1fe1202c <+44>: add r4, r4, pc
0x1fe12030 <+48>: str r4, [sp]
0x1fe12034 <+52>: add r4, sp, #0xc
0x1fe12038 <+56>: str r4, [sp, #0x4]
0x1fe1203c <+60>: blx 0x1fe12098 ; dyldbootstrap::start(macho_header const*, int, char const**, long, macho_header const*, unsigned long*)
-> 0x1fe12040 <+64>: ldr r5, [sp, #0xc]
0x1fe12044 <+68>: cmp r5, #0x0
0x1fe12048 <+72>: bne 0x1fe12054 ; <+84>
0x1fe1204c <+76>: add sp, r8, #0x4
0x1fe12050 <+80>: bx r0 【跳转到ios主程序,点击s进入函数】
0x1fe12054 <+84>: mov lr, r5
0x1fe12058 <+88>: mov r5, r0
0x1fe1205c <+92>: ldr r0, [r8, #0x4]
跳到0x1fe992aa