iOS-应用安全10 chisel&DerekSelander/LLDB

再来100个需求
914 阅读7分钟

chisel

chisel 是LLDB的一个插件，它能让LLDB调试变得更加轻松

安装

通过Homebrew安装。PS：如果Homebrew长时间卡在 Updating Homebrew ...，建议更换Homebrew国内镜像

brew install chisel

安装后将chisel中的fblldb.py路径配置到.lldbinit文件中

编辑.lldbinit

vi .lldbinit

内部填写fblldb.py路径

#/usr/local/Cellar/chisel/2.0.0/libexec/fblldb.py 这个是我本地fblldb.py文件路径
command script import /usr/local/Cellar/chisel/2.0.0/libexec/fblldb.py

使用

一般按照上面安装流程，就可以打开xcode直接在LLDB控制台使用了。如果不能，可以在LLDB控制台输入 command source ~/.lldbinit，应该就OK了。下面是一些在平常在调试第三方app时用到的指令示例。

pclass 打印对象的类

pviews 打印当前视图层级

(lldb) pviews
<UIWindow: 0x7fa7b160dc60; frame = (0 0; 414 896); gestureRecognizers = <NSArray: 0x600001c4e1c0>; layer = <UIWindowLayer: 0x6000012414e0>>
   | <UITransitionView: 0x7fa7b1706c70; frame = (0 0; 414 896); autoresize = W+H; layer = <CALayer: 0x60000123f400>>
   |    | <UIDropShadowView: 0x7fa7b170e6a0; frame = (0 0; 414 896); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x60000123f520>>
   |    |    | <UILayoutContainerView: 0x7fa7b160e480; frame = (0 0; 414 896); autoresize = W+H; layer = <CALayer: 0x600001240860>>
   |    |    |    | <UITransitionView: 0x7fa7b160f460; frame = (0 0; 414 896); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x6000012415c0>>
   |    |    |    |    | <UIViewControllerWrapperView: 0x7fa7b1626ad0; frame = (0 0; 414 896); autoresize = W+H; layer = <CALayer: 0x600001242140>>
   |    |    |    |    |    | <UILayoutContainerView: 0x7fa7b149ab30; frame = (0 0; 414 896); clipsToBounds = YES; autoresize = W+H; gestureRecognizers = <NSArray: 0x600001c584b0>; layer = <CALayer: 0x600001210f40>>
   |    |    |    |    |    |    | <UINavigationTransitionView: 0x7fa7b1400b50; frame = (0 0; 414 896); clipsToBounds = YES; autoresize = W+H; layer = <CALayer: 0x600001211460>>
   ...
   ...
   ...

pactions 打印对象动作

pmethods 打印对象的实例方法

pinternals 打印实例变量

pvc 打印当前vc层级

lldb) pvc
<RFToutiao.RFTabBarController 0x7fe85780ac00>, state: appeared, view: <UILayoutContainerView 0x7fe85740e620>
   | <RFToutiao.RFNavigationController 0x7fe857835000>, state: appeared, view: <UILayoutContainerView 0x7fe85740e8d0>
   |    | <RFToutiao.HomeViewController 0x7fe85740fbb0>, state: appeared, view: <UIView 0x7fe857714720>
   |    |    | <RFToutiao.HomeSubViewController 0x7fe858820000>, state: disappeared, view: <UIView 0x7fe8574c33a0> not in the window
   |    |    | <RFToutiao.HomeSubViewController 0x7fe858820600>, state: disappeared, view: <UIView 0x7fe85760cec0> not in the window
   |    |    | <RFToutiao.HomeSubViewController 0x7fe85785c800>, state: disappeared, view: <UIView 0x7fe8574c80d0> not in the window
   |    |    | <RFToutiao.HomeSubViewController 0x7fe85786e800>, state: disappeared, view: <UIView 0x7fe8574ca650> not in the window
   |    |    | <RFToutiao.HomeSubViewController 0x7fe857866800>, state: disappeared, view: <UIView 0x7fe8574cc0a0> not in the window
   |    |    | <RFToutiao.HomeSubViewController 0x7fe85787e000>, state: disappeared, view: <UIView 0x7fe859801890> not in the window
   |    |    | <RFToutiao.HomeSubViewController 0x7fe85802aa00>, state: disappeared, view: <UIView 0x7fe857504190> not in the window
  
(lldb)

presponder 打印响应链

fv 打印同种类型的的控件(前提是这个控件继承于UIView)

fvc 打印同种类型的vc

fvc -v 打印控件所属的vc

taplog 点击动作锁定

输入后会监控触摸动作

(lldb) taplog
Process 32484 resuming
//点击某个控件会有对应的打印
<UIButton: 0x7fda437027b0; frame = (350 7; 30 30); opaque = NO; autoresize = RM+BM; layer = <CALayer: 0x6000024bb920>>

flicker 锁定控件

flicker对应控件地址，控件就会闪动一下，方便锁定控件

(lldb) flicker 0x7fda437027b0

vs 锁定控件，并移动

(lldb) vs 0x7fdc84d5a290

Use the following and (q) to quit.
(w) move to superview
(s) move to first subview
(a) move to previous sibling
(d) move to next sibling
(p) print the hierarchy

<UILabel: 0x7fdc84d5a290; frame = (16 10; 382 17); text = '3232'; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x6000005a5450>>
w
<UITableViewCellContentView: 0x7fdc84d5b620; frame = (0 0; 414 57.5); gestureRecognizers = <NSArray: 0x600002872a00>; layer = <CALayer: 0x60000268c6c0>>
s
<UILabel: 0x7fdc84d5a290; frame = (16 10; 382 17); text = '3232'; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x6000005a5450>>
a
<UILabel: 0x7fdc84d5a500; frame = (16 36; 356 12); text = ' 307 5'; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x6000005a63a0>>
p
<UILabel: 0x7fdc84d5a500; frame = (16 36; 356 12); text = ' 307 5'; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x6000005a63a0>>
   | <_UILabelContentLayer: 0x60000268d460> (layer)
d
<UILabel: 0x7fdc84d5a290; frame = (16 10; 382 17); text = '3232'; userInteractionEnabled = NO; layer = <_UILabelLayer: 0x6000005a5450>>
q

I hope 0x00007fdc84d5a290 was what you were looking for. I put it on your clipboard.
(lldb) c //退出LLDB调试
Process 32654 resuming

DerekSelander/LLDB

DerekSelander/LLDB 也是一个LLDB的插件，方便调试第三方app

安装

在GitHub上有详细的安装教程 github.com/DerekSeland…

使用

下面举两个列子

search 打印同种类型的的控件

search和chisel的fv功能类似

lldb) search SGPageTitleButton
<SGPageTitleButton: 0x7f89d1c132c0; baseClass = UIButton; frame = (253 0; 50.6 38); opaque = NO; tag = 5; layer = <CALayer: 0x60000158f0e0>>

<SGPageTitleButton: 0x7f89d1c12840; baseClass = UIButton; frame = (151.8 0; 50.6 38); opaque = NO; tag = 3; layer = <CALayer: 0x60000158f100>>

<SGPageTitleButton: 0x7f89d1c14d00; baseClass = UIButton; frame = (506 0; 50.6 38); opaque = NO; tag = 10; layer = <CALayer: 0x60000158f700>>

<SGPageTitleButton: 0x7f89d1c11dc0; baseClass = UIButton; frame = (50.6 0; 50.6 38); opaque = NO; tag = 1; layer = <CALayer: 0x60000158ef20>>

<SGPageTitleButton: 0x7f89d1c14280; baseClass = UIButton; frame = (404.8 0; 50.6 38); opaque = NO; tag = 8; layer = <CALayer: 0x60000158f540>>

sbt 恢复调用堆栈

//打印对象方法list 拿到方法指针
(lldb) methods 0x7fd9638034e0
<RFToutiao.HomeNaviBarView: 0x7fd9638034e0>:
in RFToutiao.HomeNaviBarView:
	Properties:
		@property (nonatomic, weak) UIButton* cameraBtn;  (@synthesize cameraBtn = cameraBtn;)
	...
	Instance Methods:
		- (id) cameraBtn; (0x10311d5e0)
		- (void) setCameraBtn:(id)arg1; (0x10311d690)
		- (id) searchBtn; (0x10311d9d0)
		- (void) setSearchBtn:(id)arg1; (0x10311da80)
		- (id) avatarBtn; (0x10311ddc0)
		- (void) setAvatarBtn:(id)arg1; (0x10311de70)
		// 拿到方法指针
		- (void) click_avatarBtn:(id)arg1; (0x10311f350)
	... 
(UIView ...)

//下指针断点
(lldb) b -a 0x10311f350
Breakpoint 1: where = RFToutiao`@objc RFToutiao.HomeNaviBarView.click_avatarBtn(Any) -> () at <compiler-generated>, address = 0x000000010311f350
(lldb) c //退出LLDB
Process 33151 resuming

//恢复调用堆栈符号
(lldb) sbt 
frame #0 : 0x10311f350 RFToutiao`@objc RFToutiao.HomeNaviBarView.click_avatarBtn(Any) -> () 
frame #1 : 0x10dbeefff UIKitCore`-[UIApplication sendAction:to:from:forEvent:] + 83
frame #2 : 0x10d5c700e UIKitCore`-[UIControl sendAction:to:forEvent:] + 223
frame #3 : 0x10d5c7358 UIKitCore`-[UIControl _sendActionsForEvents:withEvent:] + 398
frame #4 : 0x10d5c62b7 UIKitCore`-[UIControl touchesEnded:withEvent:] + 481
frame #5 : 0x10dc29bbf UIKitCore`-[UIWindow _sendTouchesForEvent:] + 2604
frame #6 : 0x10dc2b4c6 UIKitCore`-[UIWindow sendEvent:] + 4596
frame #7 : 0x10dc0653b UIKitCore`-[UIApplication sendEvent:] + 356
frame #8 : 0x10dc8771a UIKitCore`__dispatchPreprocessedEventFromEventQueue + 6847
frame #9 : 0x10dc8a1e0 UIKitCore`__handleEventQueueInternal + 5980
frame #10: 0x10dc8a5d3 UIKitCore`__handleEventQueueInternal + 6991
frame #11: 0x10754b471 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
frame #12: 0x10754b39c CoreFoundation`__CFRunLoopDoSource0 + 76
frame #13: 0x10754abcc CoreFoundation`__CFRunLoopDoSources0 + 268
frame #14: 0x10754587f CoreFoundation`__CFRunLoopRun + 1263
frame #15: 0x107545066 CoreFoundation`CFRunLoopRunSpecific + 438
frame #16: 0x111de6bb0 GraphicsServices`GSEventRunModal + 65
frame #17: 0x10dbedd4d UIKitCore`UIApplicationMain + 1621
frame #18: 0x10313cc5b RFToutiao`main + 75
frame #19: 0x109bebc25 libdyld.dylib`start + 1
frame #20: 0x109bebc25 libdyld.dylib`start + 1
avatar
文章
阅读
粉丝