Jump to content

Debugging apps on iOS 13 with LLDB (watchpoints supported)


64 posts in this topic

Recommended Posts

Updated (edited)

Hi, I looked at the tutorials section here and saw that the only tutorial about debugging was a tutorial by Ted22 without support for watchpoints. This does support wp and is you don't need to download stuff from unofficial sources. But I do recommend reading his tutorial as it covers other stuff.

For this you need Xcode & Homebrew. (on macOS). Probably works on GNU/Linux if you get debugserver and the right iOS SDK some other way, or you could run macOS in a VM.

Run this to get ldid:

brew install ldid

Then you need to get the right debugserver. Run 

cd /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/ (iPadOS if you're using an iPad, I guess)

Then do an ls to list all available versions. In my case "13.3" since I run iOS 13.3.1 on an iPhone X.

Run this to mount the DeveloperDiskImage of your version. 13.3 in my case.

open ./13.3/DeveloperDiskImage.dmg

Then open your mounted disk image and go to DeveloperDiskImage/usr/bin. There you'll find debugserver. Copy that to your computer somewhere. I used ~/Documents/debugserver

To thin your binary, run 

lipo -thin arm64 ./debugserver -output ./debugserverthin (if using arm64)
lipo -thin arm64e ./debugserver -output ./debugserverthin (if using arm64e, iPhone XS and above, haven't tried though, maybe arm64 will work fine aswell)

Next, sign debugserver with this xml file (save as ent.xml):

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
        <key>com.apple.springboard.debugapplications</key>
        <true/>
        <key>get-task-allow</key>
        <true/>
        <key>task_for_pid-allow</key>
        <true/>
        <key>run-unsigned-code</key>
        <true/>
</dict>
</plist>

Using ldid as such: 

ldid -Sent.xml ./debugserverthin

Copy it to your phone using sftp.

sftp root@yourphoneip

then 

put debugserverthin

now SSH into your phone and run

mv ./debugserverthin /usr/bin/debugserver (/usr/local/bin is more standard but /usr/bin just worked for me so I'll go with that, doesn't really matter).

 

Run this to find all running processes.  I'll use Hill Climb Racing as an example:

ps -A

Example output: 51523 ??         0:34.60 /var/containers/Bundle/Application/72FDFED4-16FB-47FE-999D-1CD53CF16B8C/Hill Climb Racing.app/Hill Climb Racing

Run debugserver to start the debugging server. To specify which process to attach on, do it like this:

debugserver 0.0.0.0:1234 -a "Hill Climb Racing"

To attach LLDB from your Mac, run this (ON MAC, not phone).

lldb
(lldb) platform select remote-ios
(lldb) process connect connect://yourphoneip:1234

To set watchpoints (got addr from iGG, gold value):

(lldb) process interrupt
Process 51523 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
    frame #0: 0x00000001b7044634 libsystem_kernel.dylib`mach_msg_trap + 8
libsystem_kernel.dylib`mach_msg_trap:
->  0x1b7044634 <+8>: ret

libsystem_kernel.dylib`mach_msg_overwrite_trap:
    0x1b7044638 <+0>: mov    x16, #-0x20
    0x1b704463c <+4>: svc    #0x80
    0x1b7044640 <+8>: ret
Target 0: (Hill Climb Racing) stopped.
(lldb) w s e -s 4 -- 0x106128024
Watchpoint created: Watchpoint 1: addr = 0x106128024 size = 4 state = enabled type = w
    new value: 148742069
(lldb) c
Process 51523 resuming

When your watchpoints gets triggered you'll see disassembled code that ran some instruction on your data. Example (when buying from store):

Watchpoint 1 hit:
old value: 148742069
new value: 148642069
Process 51523 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x0000000104a38a74 Hill Climb Racing`___lldb_unnamed_symbol5830$$Hill Climb Racing + 276
Hill Climb Racing`___lldb_unnamed_symbol5830$$Hill Climb Racing:
->  0x104a38a74 <+276>: mov    x0, x19
    0x104a38a78 <+280>: mov    x1, x20
    0x104a38a7c <+284>: bl     0x104a38d94               ; ___lldb_unnamed_symbol5832$$Hill Climb Racing
    0x104a38a80 <+288>: add    x8, sp, #0x30             ; =0x30
Target 0: (Hill Climb Racing) stopped.

I have literally no idea how to write ARM assembly but I'd guess that you could replace the instructions at 0x104a38a74 with NOP's to get free-buy, or write a jmp to your own function for mid-function hooks. I suggest watching other tutorials for that, I'm only good at Windows hacking but I may learn some iOS soon :D.

 

For moderators who review: can I wrap everything in hide-tags without messing up everything? I don't really care but a few more likes is cool 😛

I'll make a follow-up some day when I actually create a fully featured cheat with this, iGG, Theos and a disassembler like Ghidra or Binary Ninja.

Secret:

Hidden Content

React or reply to this topic to see the hidden content & download link. 👀

Updated by Affe2626
  • Like 114
  • Winner 14
  • Thanks 7
  • Haha 4
  • Agree 2
  • Informative 8
Posted

Thank you for sharing this with us!

I think adding hide here will ruin the topic. :)

  • Like 1
Posted
  On 4/15/2020 at 7:16 PM, Rook said:

Thank you for sharing this with us!

I think adding hide here will ruin the topic. :)

Expand  

Yep, that's fine, I attached a hidden meme instead. I may do a video next time when I make a cheat with this. Let's see how that goes

Posted

So this has to done on a mac?..

Posted
  On 4/16/2020 at 4:08 AM, K_K said:

So this has to done on a mac?..

Expand  

I haven't tried anything else. If you get LLDB to run with an iOS SDK on another OS then probably. The remote-ios platform maybe only exists on the macOS version of LLDB (but you can always try). Search for how to set SDK path. It does that automatically if you have Xcode installed for macOS. 

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Car Match - Traffic Puzzle v2.61 +4 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Car Match - Traffic Puzzle By GRAND GAMES OYUN VE YAZILIM ANONIM SIRKETI
      Bundle ID: com.grandgames.carmatch
      App Store Link: https://apps.apple.com/us/app/car-match-traffic-puzzle/id6504421808?uo=4

       
       

      🤩 Hack Features

      - Freeze Currencies
      - Unlimited Currencies -> Will increase instead of decrease.
      - Auto Win -> Quit the level.
      - Level Modifier
      • 0 replies
    • Car Match - Traffic Puzzle v2.61 +4 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Car Match - Traffic Puzzle By GRAND GAMES OYUN VE YAZILIM ANONIM SIRKETI
      Bundle ID: com.grandgames.carmatch
      App Store Link: https://apps.apple.com/us/app/car-match-traffic-puzzle/id6504421808?uo=4

       
       

      🤩 Hack Features

      - Freeze Currencies
      - Unlimited Currencies -> Will increase instead of decrease.
      - Auto Win -> Quit the level.
      - Level Modifier
        • Like
      • 0 replies
    • Last War:Survival v1.0.300 [+1 Jailed Cheats]
      Modded/Hacked App: Last War:Survival By FUNFLY PTE. LTD.
      Bundle ID: com.lastwar.ios
      App Store Link: https://apps.apple.com/us/app/last-war-survival/id6448786147?uo=4



      Important


      Only work on Pve contents

      Enable on loading screen!

       

      🤩 Hack Features

      - Never Die
       
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 16 replies
    • Last War:Survival v1.0.300 [+1 Cheats]
      Modded/Hacked App: Last War:Survival By FUNFLY PTE. LTD.
      Bundle ID: com.lastwar.ios
      App Store Link: https://apps.apple.com/us/app/last-war-survival/id6448786147?uo=4



      Important


      Only work on Pve contents

      Enable on loading screen!

       

       

      🤩 Hack Features

      - Never Die
       
        • Agree
        • Thanks
        • Winner
        • Like
      • 23 replies
    • Dawn of Ages: Medieval Games v2.0.7 +5 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Dawn of Ages: total war battle By BoomBit, Inc.
      Bundle ID: com.stratospheregames.dawnofages
      App Store Link: https://apps.apple.com/us/app/dawn-of-ages-total-war-battle/id6477473268?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Dumb Enemy
      - Premium Enabled
        • Agree
        • Winner
        • Like
      • 8 replies
    • Disney Speedstorm v1.13.0 +1 Jailed Cheat [ Unlimited Nitro ]
      Modded/Hacked App: Disney Speedstorm By Gameloft
      Bundle ID: com.gameloft.disneyspeedstorm
      iTunes Store Link: https://apps.apple.com/us/app/disney-speedstorm/id6449708682?uo=4


      Hack Features:
      - Unlimited Nitro -> Will not decrease.
      - Instant Nitro Max


      Jailbreak required hack(s): [Mod Menu Hack] Disney Speedstorm v1.5.0 +2 Cheats [ Unlimited Nitro ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 85 replies
    • Disney Speedstorm v1.13.0 +1 Cheat [ Unlimited Nitro ]
      Modded/Hacked App: Disney Speedstorm By Gameloft
      Bundle ID: com.gameloft.disneyspeedstorm
      iTunes Store Link: https://apps.apple.com/us/app/disney-speedstorm/id6449708682?uo=4


      Hack Features:
      - Unlimited Nitro -> Will not decrease.
      - Instant Nitro Max


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Disney Speedstorm v1.5.0 +2 Jailed Cheats [ Unlimited Nitro ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 78 replies
    • Dawn of Ages: Medieval Games v2.0.7 +5 Cheats [ Damage & Defence ]
      Modded/Hacked App: Dawn of Ages: total war battle By BoomBit, Inc.
      Bundle ID: com.stratospheregames.dawnofages
      App Store Link: https://apps.apple.com/us/app/dawn-of-ages-total-war-battle/id6477473268?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Dumb Enemy
      - Premium Enabled

       

      ⬇️ iOS Hack Download Link


      Hidden Content

      Download Hack







       

      📖 iOS Installation Instructions

      STEP 1: Download the .deb hack file from the link above. Use Safari, Google Chrome or other iOS browsers to download.
      STEP 2: Once the file has downloaded, tap on it and then you will be prompted on whether you want to open the deb with iGameGod or copy it to Filza.
      STEP 3: If needed, tap on the downloaded file again, then select ‘Normal Install’ from the options on your screen.
      STEP 4: Let iGameGod/Filza finish the cheat installation. If it doesn’t install successfully, see the note below.
      STEP 5: Open the game, log in to your iOSGods account when asked, then toggle on the features you want and enjoy!

       

      NOTE: If you have any questions or problems, read our Jailbreak iOS Hack Troubleshooting & Frequently Asked Questions & Answers topic. If you still haven't found a solution, post your issue below and we'll do our best to help! If the hack does work for you, please post your feedback below and help out other fellow members that are encountering issues.

       

      🙌 Credits

      - @Puddin
      - @Laxus

       

      📷 Cheat Video/Screenshots

      N/A

       

      More iOS App Hacks
      If you’re looking for Non-Jailbroken & No Jailbreak required iOS IPA hacks, visit the iOS Game Cheats & Hacks or the iOSGods App for a variety of modded games and apps for non-jailbroken iOS devices.

      Modded Android APKs
      Need modded apps or games for Android? Check out the latest custom APK mods, cheats & more in our Android Section.
        • Agree
        • Thanks
        • Winner
        • Like
      • 14 replies
    • Earth Inc. Tycoon Idle Miner v5.3.0 +3 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Earth Inc. Tycoon Idle Miner By Treetop Crew Oy
      Bundle ID: com.TreetopCrew.EarthInc
      iTunes Store Link: https://apps.apple.com/us/app/earth-inc-tycoon-idle-miner/id1582514877?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Jailbreak required hack(s): [Mod Menu Hack] Earth Inc. v2.2.1 +3 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 81 replies
    • Earth Inc. Tycoon Idle Miner v5.3.0 +3 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Earth Inc. Tycoon Idle Miner By Treetop Crew Oy
      Bundle ID: com.TreetopCrew.EarthInc
      iTunes Store Link: https://apps.apple.com/us/app/earth-inc-tycoon-idle-miner/id1582514877?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - Unlimited Coins -> Will increase instead of decrease.
      - Unlimited Diamonds -> Will increase instead of decrease.
      - Free In-App Purchases


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Earth Inc. v2.2.1 +3 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 49 replies
    • Slots Era - Slot Machines 777 v2.57.0 +100++ Jailed Cheats [ ULTIMATE HACK ]
      Modded/Hacked App: Slots Era - Slot Machines 777 By Murka Games Limited
      Bundle ID: com.murka.slotsera
      iTunes Store Link: https://apps.apple.com/us/app/slots-era-slot-machines-777/id1133138987
       

      Hack Features:
      - Debug Menu -> Head over to Settings and toggle the Privacy Policy button.


      Jailbreak required hack(s): https://iosgods.com/topic/172023-slots-era-slot-machines-777-v2200-100-cheat-srdebugger/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 177 replies
    • Slots Era - Slot Machines 777 v2.57.0 +100++ Cheats [ ULTIMATE HACK ]
      Modded/Hacked App: Slots Era - Slot Machines 777 By Murka Games Limited
      Bundle ID: com.murka.slotsera
      iTunes Store Link: https://apps.apple.com/us/app/slots-era-slot-machines-777/id1133138987
       

      Hack Features:
      - Debug Menu -> Head over to Settings and toggle the Privacy Policy button.


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 283 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines