IOS逆向-动态调试

LLDB

1. Xcode -> Attach -> 点击 || 按钮 -> 使用lldb
2. 终端
   1. 手机/Developer/usr/bin/debugserver localhost:2233 /var/containers/Bundle/Application/*/*/xxxx
   2. 电脑 lldb -> init

Xcode

重新签名版本调试(手动) ✅

1. 建立 XCode 工程 -> IOS -> APP(Product Name最好一致)
   
2. 找到Build Phases Tab
3. 点击+号，new run script phases

# Type a script or drag a script file from your workspace to insert its path.
cp -r "${SRCROOT}/Target/xxxx.app" "${BUILT_PRODUCTS_DIR}/"

6. cd xxxxx 主目录
7. mkdir Target
8. cp -r /tmp/xxx.app ./Target/xxx.app (已脱壳)
9. mv ./Target/xxx.app/Info.plist ../xxx/Info.plist
10. rm -r Watch PlugIns
11. Info.plist 里把 bundle Id 改成 $(PRODUCT_BUNDLE_IDENTIFIER)
12. 点击Xcode -> Clean build Folder
13. 点击▶️ Build & Run

重新签名版本调试(自动)

1. 安装theos sudo git clone --recursive https://github.com/theos/theos.git /opt/theos
2. 安装ldid brew install ldid
3. 安装MonkeyDev sudo /bin/sh -c "$(curl -fsSL https://raw.githubusercontent.com/AloneMonkey/MonkeyDev/master/bin/md-install)"
4. Xcode->File->New project->选择IOS-> 选择MonkeyApp
5. TargetApp文件夹放入脱壳的app

不重新签名版本调试

前提: 需Patch debuggerserver

1. Xcode->ios->app->Product Name尽量一致
2. Product->Build
3. 左边栏找到Products文件夹->右键文件夹打开
4. 替换xxxx.app (注意: 必须是原始app,不能是脱壳app)
5. Product->Perform Action-> Run Without Building
6. 调试开始