Chapters

Hide chapters

Advanced Apple Debugging & Reverse Engineering

Fourth Edition · iOS 16, macOS 13.3 · Swift 5.8, Python 3 · Xcode 14

Section I: Beginning LLDB Commands

Section 1: 10 chapters
Show chapters Hide chapters

Section IV: Custom LLDB Commands

Section 4: 8 chapters
Show chapters Hide chapters

A. Appendix A: LLDB Cheat Sheet
Written by Walter Tyree

Heads up... You’re accessing parts of this content for free, with some sections shown as wdxugndor text.

Heads up... You’re accessing parts of this content for free, with some sections shown as rlzifpvah text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now

A cheat sheet for commands and ideas on how to use LLDB.

Getting Help

(lldb) help

List all commands and aliases.

(lldb) help po

Get help documentation for po (expression) command.

(lldb) help break set

Get help documentation for breakpoint set.

(lldb) apropos step-in

Search through help documentation containing step-in.

Finding Code

(lldb) image lookup -rn UIAlertController

Look up all code containing UIAlertController that’s compiled or loaded into an executable.

(lldb) image lookup -rn (?i)hosturl

Heads up... You’re accessing parts of this content for free, with some sections shown as clkuhrtir text.

Heads up... You’re accessing parts of this content for free, with some sections shown as mrtapntot text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now
(lldb) image lookup -rn 'UIViewController\ set\w+:\]'
(lldb) image lookup -rn . Security
(lldb) image lookup -a 0x10518a720
(lldb) image lookup -s mmap

Breakpoints

(lldb) b viewDidLoad

Creates a breakpoint on all methods named viewDidLoad for both Swift and Objective-C.

(lldb) b setAlpha:
(lldb) b -[CustomViewControllerSubclass viewDidLoad]
(lldb) rbreak CustomViewControllerSubclass.viewDidLoad
(lldb) breakpoint delete
(lldb) breakpoint delete 2
(lldb) breakpoint list

Heads up... You’re accessing parts of this content for free, with some sections shown as dpmilqbum text.

Heads up... You’re accessing parts of this content for free, with some sections shown as qjwosfhix text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now
(lldb) rbreak viewDid
(lldb) rbreak viewDid -s SwiftRadio
(lldb) rbreak viewDid(Appear|Disappear) -s SwiftHN
(lldb) rb "\-\[UIViewController\ set" -s UIKit
(lldb) rb . -s SwiftHN -o 1
(lldb) rb . -f ViewController.m

Expressions

(lldb) po "hello, debugger"

Prints "hello, debugger" regardless of the debugging context.

(lldb) expression -lobjc -O -- [UIApplication sharedApplication]
(lldb) expression -lswift -O -- UIApplication.shared
(lldb) b getenv
(lldb) expression -i0 -- getenv("HOME")
(lldb) expression -u0 -O -- [UIApplication test]

Heads up... You’re accessing parts of this content for free, with some sections shown as lfmirggut text.

Heads up... You’re accessing parts of this content for free, with some sections shown as lbcutrqyb text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now
(lldb) expression -p -- NSString *globalString = [NSString stringWithUTF8String: "Hello, Debugger"];
(lldb) po globalString
Hello, Debugger
(lldb) expression -g -O -lobjc -- [NSObject new]

Stepping

(lldb) thread return false

Return early from code with false.

(lldb) thread step-in
(lldb) s
(lldb) thread step-over
(lldb) n
(lldb) thread step-out
(lldb) finish
(lldb) thread step-inst
(lldb) ni

GDB Formatting

(lldb) p/x 128

Print value in hexadecimal.

(lldb) p/d 128
(lldb) p/t 128
(lldb) p/a 128
(lldb) x/gx 0x000000010fff6c40

Heads up... You’re accessing parts of this content for free, with some sections shown as rgjeqsmeg text.

Heads up... You’re accessing parts of this content for free, with some sections shown as cqqopxwof text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now
(lldb) x/wx 0x000000010fff6c40

Memory

(lldb) memory read 0x000000010fff6c40

Read memory at address 0x000000010fff6c40.

(lldb) po id $d = [NSData dataWithContentsOfFile:@"..."]
(lldb) mem read `(uintptr_t)[$d bytes]` `(uintptr_t)[$d bytes] + (uintptr_t)[$d length]` -r -b -o /tmp/file

Registers and Assembly

(lldb) register read -a

Display all registers on the system.

(lldb) register read rdi rsi
(lldb) register read x0 x1
(lldb) register read arg1 arg2
(lldb) register write rsi 0x0
(lldb) register write x2 0x0
(lldb) register write arg2 0x42
(lldb) register write rflags `$rflags ^ 64`
(lldb) register write rflags `$rflags | 64`

Heads up... You’re accessing parts of this content for free, with some sections shown as hsfyjpbip text.

Heads up... You’re accessing parts of this content for free, with some sections shown as dhtumqdup text.

Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now
(lldb) register write rflags `$rflags & ~64`
(lldb) disassemble
(lldb) disassemble -p
(lldb) disassemble -b
(lldb) disassemble -n '-[UIViewController setTitle:]'
(lldb) disassemble -a 0x000000010b8d972d

Modules

(lldb) image list

List all modules loaded into the executable’s process space.

(lldb) image list -b
(lldb) process load /Path/To/Module.framework/Module
Have a technical question? Want to report a bug? You can ask questions and report bugs to the book authors in our official book forum here.
© 2025 Kodeco Inc.

You’re accessing parts of this content for free, with some sections shown as rfnaxzcal text. Unlock our entire catalogue of books and courses, with a Kodeco Personal Plan.

Unlock now