iOS調試速查表

這篇文章寫自2016年5月份，但我在日常工作中自己還是會查詢一下，再次分享一下哈。不只是逆向中使用，日常調試也會用到。

逆向過程中命令太多記不住，就整理了這個速查表，分享給大家。我只是看完了小黃書《iOS應用逆向工程》，這幾個月沒有再深入研究逆向。最近又想逆向幾個app學習下怎麼實現，發現很多命令都忘記了。於是整理了這個表。copy and paste就可以愉快的學習其他app的實現了。

命令都很基礎、簡單、常用，主要是我也只學了這麼多哈。

common

ssh免密碼：

ssh-copy-id -i /Users/everettjf/.ssh/id_rsa root@localhost -p 2222
查找進程：
ps aux | grep /Appps -e | grep /Applications
查找文件：
grep -r ToBeFind /System/Library/
分離fat binary
lipo -thin armv7 WeChat.decrypted -output WeChat_armv7.decryptedlipo -thin armv64 xxx.decrypted -output xxx_arm64.decrypted
class dump
class-dump --list-arches AlipayWallet.decrypted
class-dump -S -s -H WeChat_armv7.decrypted -o dumparmv7class-dump -s -S -H --arch armv7 AlipayWallet.decrypted -o dumpAlipay
lldb
參考
•https://github.com/iosre/iOSAppReverseEngineering[1]•http://objccn.io/issue-19-2/[2]
幫助
列印UI結構
po [[[UIWindow keyWindow] rootViewController] _printHierarchy]    (iOS 8)po [[UIWindow keyWindow] recursiveDescription]
棧信息
bt (backtrace)bt all (all threads)
objc_msgSend 參數列印
po $r0p (char*)$r1p (SEL)$r1
返回地址
斷點
br s -a 0x0023234fbreakpoint set -F "-[NSArray objectAtIndex:]"
br s -a 0x02107730+0x000ab000 -c '(BOOL)[(NSString *)$r2 isEqualToString:@"snakeninny"]'
b ptrace
列舉模塊
lldb基礎命令
cnsframe infoexpr
thread returnbreakpoint command add 1
遠程調試
debugserver *:1234 -a AlipayWalletdebugserver -x backboard *:1234 /var/mobile/Containers/Bundle/Application/9DB7CE45-3B4C-42A3-9D4D-49A3A5122903/AlipayWallet.app/AlipayWallet
lldb連接遠程調試
(lldb) process connect connect://192.168.199.164:1234
lldb expr例子
(lldb) expr char *$str = (char *)malloc(8)(lldb) expr (void)strcpy($str, "munkeys")(lldb) expr $str[1] = 'o'(char) $0 = 'o'(lldb) p $str(char *) $str = 0x00007fd04a900040 "monkeys"
(lldb) x/4c $str(lldb) x/1w `$str + 3`(lldb) expr (void)free($str)
(lldb) expr id $myView = (id)0x7f82b1d01fd0(lldb) expr (void)[$myView setBackgroundColor:[UIColor blueColor]](lldb) expr (void)[CATransaction flush]
(lldb) po [$myButton allTargets]
(lldb) p (ptrdiff_t)ivar_getOffset((struct Ivar *)class_getInstanceVariable([MyView class], "_layer"))
觀察點
(lldb) watchpoint set expression -- (int *)$myView + 8
arm64
param1 $x0param2 $x1
po $x0p (char*)$x1
cycript
參考： http://www.cycript.org/manual/[3]
開始
列印UI結構
[[UIWindow keyWindow] recursiveDescription].toString()[[[UIWindow keyWindow] rootViewController] _printHierarchy].toString()
列印沙盒Documents路徑
[[NSFileManager defaultManager] URLsForDirectory:NSDocumentDirectory inDomains:NSUserDomainMask]
基本使用
cy# [#0xb226710 url]@"ww4fd1rfRDShBo_4K6rqfwAAACMAAQED"
cy# c = #0x1752d8c0cy#"<FavAudioPlayerController: 0x1752d8c0; frame = (0 0; 290 60); autoresize = W; layer = <CALayer: 0x172dc2b0>>"cy# c->m_audioInfocy#"<FavAudioInfo: 0x172b2a30>"cy# c->m_audioInfo.m_nsAudioPath
linker
-Wl,-sectcreate,__RESTRICT,__restrict,/dev/nullinto Other link flag
Anti
iHex replace RESTRICT , restrictldid -S AppNameAppSync
Info.plist
輸出bundle id
/var/mobile/Containers/Bundle/Application/9DB7CE45-3B4C-42A3-9D4D-49A3A5122903/AlipayWallet.app root# cat Info.plist | grep com.    <string>com.alipay.iphoneclient</string>
dumpdecrypted
https://github.com/stefanesser/dumpdecrypted[4]
例子
scp -P 2222 Security/dumpdecrypted-master/dumpdecrypted.dylib root@localhost:/var/mobile/Containers/Data/Application/BA2644DB-450F-4DB0-A71F-A38F65488A48/Documents/
scp ~/sec/dumpdecrypted-master/dumpdecrypted.dylib root@192.168.199.164:/var/mobile/Containers/Data/Application/72AB36DD-2E9B-47C0-9695-099235E40C3C/Documents/dumpdecrypted.dylib
everettjfs-iPhone:/var/mobile/Containers/Data/Application/72AB36DD-2E9B-47C0-9695-099235E40C3C/Documents root# DYLD_INSERT_LIBRARIES=dumpdecrypted.dylib /var/mobile/Containers/Bundle/Application/2DAD493D-6275-4CED-8242-BDEF27F36740/AlipayWallet.app/AlipayWallet
theos
https://github.com/theos/theos[5]
開始
everettjf@e WeChatVoiceSaver (master)]$ ~/sec/theos/bin/nic.pl
chisel
參考：https://github.com/facebook/chisel[6]
usbmuxd
•https://cgit.sukimashita.com/usbmuxd.git/snapshot/usbmuxd-1.0.8.tar.gz[7]•https://cgit.sukimashita.com/usbmuxd.git/[8]
First:
cd python-clientpython tcprelay.py -t 22:2222
Then:
ssh root@localhost -p 2222
PS：文章首次發布於iosre.com[9]
References
[1]: https://github.com/iosre/iOSAppReverseEngineering
[2]: http://objccn.io/issue-19-2/
[3]: http://www.cycript.org/manual/
[4]: https://github.com/stefanesser/dumpdecrypted
[5]: https://github.com/theos/theos
[6]: https://github.com/facebook/chisel
[7]: https://cgit.sukimashita.com/usbmuxd.git/snapshot/usbmuxd-1.0.8.tar.gz
[8]: https://cgit.sukimashita.com/usbmuxd.git/
[9] 文章首次發布於iosre.com: http://iosre.com/t/debug/3778
推薦閱讀
關於TapGesture、UIResponder 鏈和 target-action 事件的相互影響的機理和應用
Swift 5
Xcode 10.2
Core Graphic 指南：模式
從webview到flutter：詳解iOS中的Web開發
在看就點點吧