Difference between revisions of "IOS debugserver with IDA"

Revision as of 07:04, 9 July 2016

Setup debugserver on ios device

1. On Mac. Open /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/7.0 (XXXXXX)

hdiutil attach ./DeveloperDiskImage.dmg

3. Mount DeveloperDiskImage.dmg, copy everything into a folder

4. Use iFunbox or SCP tool upload all files in DeveloperDiskImage.dmg to iphone /Developer (if you use xcode to debug on device before, you can skip this step)

5. optional, extract the debugserver part you need

lipo -thin armv7 /Developer/usr/bin/debugserver -output ~/debugserver
lipo -thin armv7S /Developer/usr/bin/debugserver -output ~/debugserver
lipo -thin arm64 /Developer/usr/bin/debugserver -output ~/debugserver // >= iphone 6

6. next we need to sign the debugserver

 First make a xml file entitlements.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/ PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.springboard.debugapplications</key> <true/>
    <key>run-unsigned-code</key>
    <true/>
    <key>get-task-allow</key>
    <true/>
    <key>task_for_pid-allow</key>
    <true/>
</dict>
</plist>

 Then sign it

codesign -s - --entitlements entitlements.plist -f debugserver

7. copy debugserver to iphone

scp ./debugserver root@192.168.1.106:/usr/bin/

8. iPhone root# /Developer/usr/bin/debugserver *:2008 --attach gameProcessName

Refer to [1]
Another more recent post http://bbs.pediy.com/showthread.php?t=190126

I finally got it working by following this link http://versprite.com/og/ios-reverse-engineering-part-one-configuring-lldb/

Debugging with lldb

When you got gdbserver working

// ssh to iphone
/usr/bin/debugserver *:2008 --attach tgame

On Mac open a new terminal tab

lldb

platform select remote-ios
process connect connect://192.168.1.106:2008

In lldb, to find out the app memory offset

image list -o -f

#[  0] 0x00000000000a0000 /private/var/mobile/Containers/Bundle/Application/xxxxx-xxxxx/tgame.app/game(0x00000001000a0000)
#[  1] 0x0000000102888000 /Library/MobileSubstrate/MobileSubstrate.dylib(0x0000000102888000)

The 0x00000000000a0000 would be the offset

To set break point at address do

br s -a 0x00000001014665bc
or
br s -a 0x010C29F8+0xa0000

run command c to continue

Method2