debugme issues

[secretpray]

(lldb) debugme
[] start patch ptrace funtion to bypass antiDebug
[+] success ptrace funtion to bypass antiDebug
[] start patch svc ins to bypass antiDebug
[-] failed to get text segment:["rror: warning: format specifies type 'unsigned long' but the argument has type 'uint64_t' (aka 'unsigned long long')\nwarning: format specifies type 'unsigned long' but the argument has type 'uint64_t' (aka 'unsigned long long')\nwarning: ISO C++11 does not allow conversion from string literal to 'char *'\nerror: Couldn't lookup symbols:\n _sprint"]
[x] happy debugging~ kill antiDebug by xia0@2019

[secretpray]

Error in choose.py

$ lldb

[traceOC]: trace ObjectC function call
traceOC
more usage, try "traceOC -h"

[xutil]: some util tool for debug, this command is flexable and some options maybe remove future
xutil [-b addr, -s module, -l dylib]
more usage, try "xutil -h"
error: module importing failed: invalid syntax (choose.py, line 274)
File "temp.py", line 1, in

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print('please specify the param, for example: "-[UIView initWithFrame:]"')? (xbr.py, line 531)
File "temp.py", line 1, in

error: module importing failed: invalid syntax (dumpdecrypted.py, line 431)
File "temp.py", line 1, in

[4ch12dy]

Error in choose.py

$ lldb

[traceOC]: trace ObjectC function call

traceOC
more usage, try "traceOC -h"
[xutil]: some util tool for debug, this command is flexable and some options maybe remove future
xutil [-b addr, -s module, -l dylib]
more usage, try "xutil -h"
error: module importing failed: invalid syntax (choose.py, line 274)
File "temp.py", line 1, in

error: module importing failed: Missing parentheses in call to 'print'. Did you mean print('please specify the param, for example: "-[UIView initWithFrame:]"')? (xbr.py, line 531)
File "temp.py", line 1, in

error: module importing failed: invalid syntax (dumpdecrypted.py, line 431)
File "temp.py", line 1, in

traceOC还没完成…

[4ch12dy]

你那是什么app，我这边测试下

[wxq491216]

➜ gif lldb
========
[traceOC]: trace ObjectC function call
traceOC
more usage, try "traceOC -h"
========
[xutil]: some util tool for debug, this command is flexable and some options maybe remove future
xutil [-b addr, -s module, -l dylib]
more usage, try "xutil -h"
error: module importing failed: invalid syntax (choose.py, line 274)
File "temp.py", line 1, in
error: module importing failed: Missing parentheses in call to 'print'. Did you mean print('please specify the param, for example: "-[UIView initWithFrame:]"')? (xbr.py, line 531)
File "temp.py", line 1, in
pcc
error: module importing failed: invalid syntax (dumpdecrypted.py, line 431)
File "temp.py", line 1, in
========
[debugme]: kill anti-debug in lldb
debugme
more usage, try "debugme -h"
========
[info]: get basic info of process/function/module/address/...
info [-m moduleName, -a address, -f funtionName, -u UserDefaults]
more usage, try "info -h"
error: module importing failed: invalid syntax (sbt.py, line 166)
File "temp.py", line 1, in

不论什么app，一连上lldb就会报这个错误，xbr完全用不了

[4ch12dy]

使用的最新的xia0LLDB吗，我这边测了下没有复现这个问题。从错误上看起来像是Python文件解析错误，是不是用的Python3？

[wxq491216]

python -V
Python 2.7.10

默认要用python3么？

[4ch12dy]

用python2

[wxq491216]

看起来应该是python环境造成的，没安装python3之前是正常的。安装python3之后就出现这个问题了，但实际上mac默认用的是python2。还在摸索该怎么解决！

[wxq491216]

This error is done with bellow command:

defaults write com.apple.dt.lldb DefaultPythonVersion 2

The newest xcode11 use python3 defaultly, so this command change the python version from 3 to 2

[4ch12dy]

thanks! I will update xia0LLDB with python3 soon.

[colordancer]

[-] failed to get text segment:["rror: warning: format specifies type 'unsigned long' but the argument has type 'uint64_t' (aka 'unsigned long long')\nwarning: format specifies type 'unsigned long' but the argument has type 'uint64_t' (aka 'unsigned long long')\nwarning: ISO C++11 does not allow conversion from string literal to 'char *'\nerror: Couldn't lookup symbols:\n _sprint"]

Couldn't lookup symbols:\n _sprint，这个bug解了吗

[4ch12dy]

Couldn't lookup symbols:\n _sprint，这个bug解了吗

什么app，我这边测下看看

[colordancer]

Couldn't lookup symbols:\n _sprint，这个bug解了吗

什么app，我这边测下看看

kwai_gif，6.9.1

[4ch12dy]

执行时机的问题，因为lldb attach以后，还没加载各个模块。参考这篇文章
http://4ch12dy.site/2019/09/23/lldb-dumpdecrypted/lldb-dumpdecrypted/
在xbr -E main 以后执行debugme(在执行之前一定要删除所有断点)

不过需要说明的一点在于，debugme主要针对ptrace以及恶心的svc内联汇编的反调试，其他方式的话debugme暂时没解决

另外补充一点在于某手的可执行文件里面并不包含关键代码，都在另一个dylib里面。所以需要手动分析

[colordancer]

执行时机的问题，因为lldb attach以后，还没加载各个模块。参考这篇文章
http://4ch12dy.site/2019/09/23/lldb-dumpdecrypted/lldb-dumpdecrypted/
在xbr -E main 以后执行debugme(在执行之前一定要删除所有断点)

不过需要说明的一点在于，debugme主要针对ptrace以及恶心的svc内联汇编的反调试，其他方式的话debugme暂时没解决

另外补充一点在于某手的可执行文件里面并不包含关键代码，都在另一个dylib里面。所以需要手动分析

哈哈，谢谢