Search code examples
iosassemblyarmreverse-engineeringlldb

Why isn't there an output when I enter image lookup <address > in lldb?


So when I enter the commands image lookup in lldb, I get no output. I am using debugserver by the way. I searched in google about this problem and didn't find anything.


Solution

  • Usually this means the address is stack or heap memory, so it isn't in the image list. The vmmap tool (run from terminal) is a good way to look at the allocated memory in your application. Run it like:

     $ vmmap <PID> <ADDRESS> 
    

    and if this is allocated memory vmmap will tell you how it was allocated. lldb has a memory region command but the data from vmmap is currently more useful...

    You can use the stack logging feature of the macOS malloc library to track down where it was allocated. You have to launch the app with MallocStackLoggingNoCompact in your environment. Then you can either use malloc_history in Terminal, or in lldb do:

    (lldb) env MallocStackLoggingNoCompact=1
    (lldb) run
    ...
    (lldb) command script import lldb.macosx.heap
    (lldb) malloc_info -s 0x100300000
    0x0000000100300000: malloc(   112) -> 0x100300000
    stack[0]: addr = 0x100300000, type=malloc, frames:
         [0] 0x00007fff68e0c601 libsystem_malloc.dylib`malloc_zone_malloc + 140
         [1] 0x00007fff68e0c558 libsystem_malloc.dylib`malloc + 21
         [2] 0x0000000100000f59 foo`main + 25 at foo.c:7:10
         [3] 0x00007fff68c52341 libdyld.dylib`start + 1