Explore Apple Code Through LLDB, Python & DTrace! Learn the powerful secrets of Apple's software debugger, LLDB, that can get more information out of any program than you ever thought possible. In Advanced Apple Debugging & Reverse Engineering, you'll come to realize debugging is an enjoyable process to help you better understand software. Not only will you learn to find bugs faster, but you’ll also learn how other developers have solved problems similar to yours. You'll also learn how to create custom, powerful debugging scripts that will help you quickly find the secrets behind any bit of code that piques your interest. Who This Book Is For This book is for intermediate to advanced iOS/macOS developers who are already familiar with either Swift or Objective-C and want to take their debugging skills to the next level. Topics Covered in Advanced Apple Debugging & Reverse Engineering LLDB Max Achievement : Master LLDB and learn about its extensive list of subcommands and options. 1's and 0's : Learn the low-level components available to help extract useful information from a program, from assembly calling conventions to exploring the process of dynamically-loaded frameworks. The Power of Python : Use LLDB’s Python module to create powerful custom debugging commands to introspect and augment existing programs. Nothing is Secret : Learn how to use DTrace, a dynamic tracing framework, and how to write D scripts to query anything you were ever curious about on your macOS machine. Case Studies : Quickly find and solve the real-world issues that iOS and macOS developers typically face in their day-to-day development workflow. One thing you can count on: After reading this book, you'll have the tools and knowledge to answer even the most obscure question about your code — or someone else’s. What You Need Book Source Code & Forums About the Author About the Editors Acknowledgments Introduction Who This Book Is For Custom LLDB Scripts Repo Chapter 1: Getting Started Getting around System Integrity Protection (SIP) Attaching LLDB to the Notes App Key Points Where to Go From Here? Chapter 2: Overview & Getting Help Building LLDB via Xcode The apropos Command Other Helpful Resources Chapter 3: Attaching With LLDB Creating a Debuggee Program Attaching to an Existing Process Attaching to a Future Process Launching a Process Using LLDB Options While Launching Environment Variables stdin, stderr and stout The curses Interface Key Points Where to Go From Here? Chapter 4: Stopping in Code Signals lldb Breakpoint Syntax Finally... Creating Breakpoints Key Points Where to Go From Here? Chapter 5: Expression Formatting With p and po Swift vs Objective-C Debugging Contexts User Defined Variables Key Points Where to Go From Here? Chapter 6: Thread, Frame & Stepping Around Stack 101 Examining the Stack’s Frames Stepping Examining Data in the Stack Key Points Where to Go From Here? Chapter 7: Image Listing Modules Swift Symbol Naming Dyld Shared Cache Key Points Where to Go From Here? Need Another Challenge? Chapter 8: Watchpoints Watchpoint Best Practices Finding a Property’s Offset The Xcode GUI Watchpoint Equivalent Key Points Where to Go From Here? Chapter 9: Persisting & Customizing Commands Persisting... How? Creating the .lldbinit File Command Aliases With Arguments Key Points Where to Go From Here? Chapter 10: Regex Commands command regex Executing Complex Logic Chaining Regex Inputs Key Points Where to Go From Here? Chapter 11: Assembly Register Calling Convention Assembly 101 arm64 Register Calling Convention Objective-C and Registers Putting Theory to Practice Swift and Registers The Return Register Changing Around Values in Registers Key Points Where to Go From Here? Chapter 12: Assembly & Memory Reviewing Reading Assembly The Program Counter Register Registers and Breaking Up the Bits Breaking Down the Memory Endianness... This Stuff Is Reversed? Key Points Where to Go From Here? Chapter 13: Assembly & the Stack The Stack, Revisited Stack Pointer, Frame Pointer and Link Register Stack Related Opcodes Observing Registers in Action The Stack and Extra Parameters The Stack and Debugging Info Key Points Chapter 14: System Calls & Ptrace ptrace Creating Attachment Issues Getting Around PT_DENY_ATTACH Other Anti-Debugging Techniques Key Points Where to Go From Here? Chapter 15: Shared Libraries Shared Libraries 101 Linking Tricks Static Libraries Modules and Module Maps dyld Shared Cache Key Points Where to Go From Here? Chapter 16: Hooking & Executing Code With dlopen & dlsym The Objective-C Runtime vs. Swift & C Setting Up Your Project Easy Mode: Hooking C Functions Hard Mode: Hooking Swift Methods Key Points Where to Go From Here? Chapter 17: Hello, Mach-O Terminology The Mach-O Header The Load Commands Segments Programmatically Finding Segments and Sections Key Points Where to Go From Here? Chapter 18: Mach-O Fun Mach-O Refresher The Mach-O Sections Finding HTTP Strings Sections in the __DATA Segment Cheating Freemium Games Key Points Where to Go From Here? Chapter 19: Code Signing Setting Up Terminology Public/Private Keys Entitlements Provisioning Profiles Exploring the WordPress App Resigning the WordPress App Key Points Where to Go From Here? Chapter 20: Hello, Script Bridging Credit Where Credit’s Due Python 101 Creating Your First LLDB Python Script Setting Up Commands Efficiently Key Points Where to Go From Here? Chapter 21: Debugging Script Bridging Debugging Your Debugging Scripts With pdb pdb’s Post-Mortem Debugging How to Handle Problems Key Points Where to Go From Here? Chapter 22: Script Bridging Classes & Hierarchy The Essential Classes Learning & Finding Documentation on Script Bridging Classes Creating the BreakAfterRegex Command Key Points Where to Go From Here? Chapter 23: Script Bridging With Options & Arguments Setting Up The optparse Python Module Adding Options Without Params Adding Options With Params Key Points Where to Go From Here? Chapter 24: Script Bridging With SBValue & Memory A Detour Down Memory Layout Lane SBValue lldb.value Key Points Where to Go From Here? Chapter 25: SB Examples, Improved Lookup Automating Script Creation lldbinit Directory Structure Suggestions Implementing the Lookup Command Adding Options to Lookup Key Points Where to Go From Here? Chapter 26: SB Examples, Resymbolicating a Stripped ObjC Binary So How Are You Doing This, Exactly? 50 Shades of Ray The “Stripped” 50 Shades of Ray Building sbt.py Implementing the Code Key Points Where to Go From Here? Chapter 27: SB Examples, Malloc Logging Setting Up the Scripts MallocStackLogging Explained Hunting for a Starting Point Testing the Functions Turning Numbers Into Stack Frames Stack Trace From a Swift Object DRY Python Code Key Points Where to Go From Here? Chapter 28: Hello, DTrace The Bad News Jumping Right In DTrace Terminology Learning While Listing Probes A Script That Makes DTrace Scripts Key Points Where to Go From Here? Chapter 29: Intermediate DTrace Getting Started DTrace & Swift in Theory DTrace Variables & Control Flow Inspecting Process Memory Playing With Open Syscalls DTrace & Destructive Actions Key Points Where to Go From Here? Conclusion Appendix A: LLDB Cheat Sheet Getting Help Finding Code Breakpoints Expressions Stepping GDB Formatting Memory Registers and Assembly Modules Appendix B: Python Environment Setup Getting Python Python Text Editors Working With the LLDB Python Module Appendix C: Helpful Code Snippets