sudo su
sudo xcode-select -s /Applications/Xcode6.2.app/Contents/Developer
sudo xcode-select -s /Applications/Xcode.app/Contents/Developer
/Applications/usbmuxd-1.0.8/python-client/tcprelay.py -t 1234:1234
/Applications/usbmuxd-1.0.8/python-client/tcprelay.py -t 22:22
iPhone4:
ssh root@localhost -p 22
iPhone5:
ssh root@127.0.0.1 -p 22
debugserver_armv7 *:1234 -a "installer"
iPhone5:
debugserver_armv7 -x backboard *:1234 /var/mobile/Containers/Bundle/Application/737C88C8-BD49-43B7-B2E0-87C47A01710E/Installer.app/installer
iPhone4:
debugserver_armv7 -x backboard *:1234 /var/mobile/Applications/A2575F76-18E3-4F3C-ACEB-84721FDE5412/Installer.app/installer
以下这种方式process connect不上
debugserver_armv7 port:1234 /var/mobile/Containers/Bundle/Application/737C88C8-BD49-43B7-B2E0-87C47A01710E/Installer.app/installer
lldb
process connect connect://127.0.0.1:1234
image list -o -f
br s -r MobClick(breakpoint set —func-regex regular-expression)
b function
br s –a address
br s –a 'ASLROffset+address'
br dis
br en
br del
指定在某个断点得到触发的时候,执行预先设置的指令
br com add 1
Enter your debugger command(s). Type 'DONE' to end.
> po [$r0 class]
> p (char *)$r1
> c
> DONE
bt(thread backtrace)
bt all (thread backtrace all)
register read
p $r0
p (char *)$r1
po $r0
x/10xb 0x0000000000015000
register write r0 1
条件断点:
br s -a 0x02107730+0x000ab000 -c '(BOOL)[(NSString *)$r2 isEqualToString:@"snakeninny"
以arm汇编显示
di -b -s 0x4dc30
以thumb汇编显示
di -A thumb -b -s 0x4dc30
sudo xcode-select -s /Applications/Xcode6.2.app/Contents/Developer
sudo xcode-select -s /Applications/Xcode.app/Contents/Developer
/Applications/usbmuxd-1.0.8/python-client/tcprelay.py -t 1234:1234
/Applications/usbmuxd-1.0.8/python-client/tcprelay.py -t 22:22
iPhone4:
ssh root@localhost -p 22
iPhone5:
ssh root@127.0.0.1 -p 22
debugserver_armv7 *:1234 -a "installer"
iPhone5:
debugserver_armv7 -x backboard *:1234 /var/mobile/Containers/Bundle/Application/737C88C8-BD49-43B7-B2E0-87C47A01710E/Installer.app/installer
iPhone4:
debugserver_armv7 -x backboard *:1234 /var/mobile/Applications/A2575F76-18E3-4F3C-ACEB-84721FDE5412/Installer.app/installer
以下这种方式process connect不上
debugserver_armv7 port:1234 /var/mobile/Containers/Bundle/Application/737C88C8-BD49-43B7-B2E0-87C47A01710E/Installer.app/installer
lldb
process connect connect://127.0.0.1:1234
image list -o -f
br s -r MobClick(breakpoint set —func-regex regular-expression)
b function
br s –a address
br s –a 'ASLROffset+address'
br dis
br en
br del
指定在某个断点得到触发的时候,执行预先设置的指令
br com add 1
Enter your debugger command(s). Type 'DONE' to end.
> po [$r0 class]
> p (char *)$r1
> c
> DONE
bt(thread backtrace)
bt all (thread backtrace all)
register read
p $r0
p (char *)$r1
po $r0
x/10xb 0x0000000000015000
register write r0 1
条件断点:
br s -a 0x02107730+0x000ab000 -c '(BOOL)[(NSString *)$r2 isEqualToString:@"snakeninny"
以arm汇编显示
di -b -s 0x4dc30
以thumb汇编显示
di -A thumb -b -s 0x4dc30