yangyss / lldb-trace

A python script .Instruction level tracing tool and block level tracing tool for lldb debugger. First tracing code, then dumping all valid code to file, finally analysing it.

lldbTrace

How to use it?

1.Break at an address where you want to begin tracing.

2, Import lldb python script.

3,Use 'trace' command,and set end tracing addresses.Multi-address split by ";".

4,Result like ...

参考：https://github.com/gm281/lldb-trace

lldb-trace's Issues

貌似s寄存器的值没打印

Segmentation fault: 11 无法执行TBZ指令

'err : ALSR is None'

TypeError: unsupported operand type(s) for -: 'int' and 'NoneType'
File "/Users/incollagepro/lldb-trace/lldbTrace.py", line 409, in print_tracing_progress
file_addr = mem_addr - ASLR

还有589 也是NoneType 需要加上 str(sym_name)
self.append_msg = sym_name + self.append_msg

通过.plt段调用函数时好像有问题

如图所示，在.plt里的get_state函数的ldr pc指令之后应该是跳到.text段的get_state函数里才对。但是trace.log文件里缺没有.text段的内容。

我看debug.log文件里有这样的内容：

查看代码，它好像是认为.text段已经超出get_state()符号范围了，就没有记录了

有办法把.text段里get_state()真正的内容记录到trace.log里吗？

遇到了一个报错

error: libarclite_iphoneos.a(arclite.o) failed to load objfile for /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/arc/libarclite_iphoneos.a │
PLEASE submit a bug report to https://bugs.llvm.org/ and include the crash backtrace. │
Stack dump: │
0. Program arguments: /Applications/Xcode.app/Contents/Developer/usr/bin/lldb
是什么原因呢？

bug we need set ASLR to number, not str

def init_ASLR(debugger:lldb.SBDebugger):
global ASLR
interpreter:lldb.SBCommandInterpreter = debugger.GetCommandInterpreter()
returnObject = lldb.SBCommandReturnObject()
interpreter.HandleCommand('image list -o', returnObject)
output = returnObject.GetOutput()
match = re.match(r'.+(0x[0-9a-fA-F]+)', output)
if match:
ASLRHexStr:str = match.group(1)
ASLR = int(ASLRHexStr,16)
print('ALSR : {}'.format(ASLRHexStr))
return ASLRHexStr
else:
ASLR = '' ====> set 0
print('err : ALSR is None')
return None