Tutorial LLDB Debugger Working with Watchpoints iOS 11 [ Electra ]

mikeyb · August 17, 2018

Ok this will only work on mac os

If you don't own a mac use VMware there are lots a tuts for getting Vmware set up with mac even if u have a amd processor like me :p

ok 1st download this debugger and place in /usr/bin/ set permission 775

Hidden Content

React or reply to this topic to see the hidden content & download link.

Ok now to begin

1st Make sure you have xcode installed to be able to use lldb.

1. You will have to install usbmuxed and iproxy. To do this open a terminal in mac and type

brew install usbmuxd

when it's downloades and installed open another terminal and type

iproxy 2222 22 &
When it's opened new port at 2222
close terminal and open another
type
iproxy 6666 6666 &
It will say waiting for connection leave terminal open just minimize it

2. Connect your phone via usb cable make sure you set up VMware usb config so you can connect.

Open 2 new teminals and

Type

ssh -p 2222 root@localhost

In both to connect to your device,When connected

In 1 terminal Type

debugserver device ip

debugserver will start

in the other terminal Type

ps ax

this will show you pid of debugserver

now type

/electra/jailbreakd_client <debugserver pid> 1

Now u can close debugserver terminal and stay in pid 1

Type

/usr/bin/debugserver localhost:6666 -a <game pid or game binary name> 
either 1 will work

game will now attach

open new terminal for lldb

type lldb

when lldb is ready type

process connect connect://localhost:6666

now it will connect give it a bit sometimes lldb take long than others all depends on game. Once it have

type image list

Go right to the top to very 1st call you will see game name example

Var/container/bundle/gamename 0x0000000100fa4000

this is the aslr slide take a note of it as it changes every time you detach and re-attach game

now you have you offset from igg ect

type in lldb w s e -- 0xiggadress

then

c to continue

when you a hit it will show like below

value will be here:

0x101703d78 <+7732600>: ldr x20, [x19, #0x30] 0x <+7732604>: adrp x24, 9017 0x101703d80 <+7732608>: add x24, x24, #0xeb8 ; =0xeb8 0x101703d84 <+7732612>: ldr x0, [x24] TropicThunderDev`_mh_execute_header: -> 0x101c1be88 <+13074056>: ldr w8, [x19, #0x50] 0x101c1be8c add w8, w8, #0x1 ; =0x1 0x101c1be90 <+13074064>: str w8, [x19, #0x50] 0x101c1be94 <+13074068>: ldp x29, x30, [sp, #0x70]

now remember your aslr

example 0x0000000100fa4000

now subtract fa4000 from the offsets you got.

0x101c1be8c - fa4000

Use the new offset in ida that's all to it :p