IOS debugserver with IDA

1. On Mac. Open /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/7.0 (XXXXXX)

2. hdiutil attach ./DeveloperDiskImage.dmg

3. Mount DeveloperDiskImage.dmg, copy everything into a folder
4. Use iFunbox or SCP tool upload all files in DeveloperDiskImage.dmg to iphone /Developer
5. iPhone root# /Developer/usr/bin/debugserver port:2008 /var/mobile/Containers/Bundle/Application/xx-xxxx-xx/Scan.app/Scan

Refer to [1]
Another more recent post http://bbs.pediy.com/showthread.php?t=190126

I finally got it working by following this link http://versprite.com/og/ios-reverse-engineering-part-one-configuring-lldb/

Debugging with lldb

When you got gdbserver working

// ssh to iphone
/usr/bin/debugserver *:2008 --attach tgame

On Mac open a new terminal tab

lldb

platform select remote-ios
process connect connect://192.168.1.106:2008

In lldb, to find out the app memory offset

image list -o -f

#[  0] 0x00000000000a0000 /private/var/mobile/Containers/Bundle/Application/xxxxx-xxxxx/tgame.app/game(0x00000001000a0000)
#[  1] 0x0000000102888000 /Library/MobileSubstrate/MobileSubstrate.dylib(0x0000000102888000)

The 0x00000000000a0000 would be the offset

To set break point at address do

br s -a 0x00000001014665bc

Method2