2017-03-02 58 views
1

我試圖逆向工程之一使用發佈配置構建的應用程序。LLDB打印快速陣列只知道十六進制地址

我的線程信息如下所示。

* thread #21: tid = 0x876cb, 0x000000010133856c SomeLibSwift`SomeLibSwift.Auth.auth (Swift.Array<Swift.UInt8>) throws -> Swift.Array<Swift.UInt8>, queue = 'com.apple.root.utility-qos', stop reason = breakpoint 1.6 
    * frame #0: 0x000000010133856c SomeLibSwift`SomeLibSwift.Auth.auth (Swift.Array<Swift.UInt8>) throws -> Swift.Array<Swift.UInt8> 

註冊X0(地址0x181ba4174)包含所需參數

內存讀取顯示類似的信息(我已經嘗試了不同的格式)

memory read -s1 -fC -c1000 --force 0x181ba4174 

0x181ba4174: ...??._?.......??._?0......??._? 
0x181ba4194: P......??._?p......??._?.......? 
0x181ba41b4: ?._ְ......??._??......??._?.... 
0x181ba41d4: ...??._?0......??._?P......??._? 
0x181ba41f4: p......??._?.......??._ְ......? 
0x181ba4214: ?._??......??._?.......??._?P... 
0x181ba4234: ...??._?p......??._?.......??._? 
.... 

我發現,權威性FUNC有這樣的定義

func auth(_ bytes: Array<UInt8>) throws -> Array<UInt8> 

所以基本上我只想得到地址爲0的字節變量x181ba4174。

我也知道,「權威性」的方法被調用的說法是這樣的:

let key = "somekey".utf8 
let result = auth(key) 

理想我想回去關鍵。

回答

1

最後我能夠完成這件事。

expr -l Swift -- String(unsafeBitCast(0x181ba4174, to: Array<UInt8>.self)) 

它給像輸出:

(String) $R0 = "[10, 11, 118, 105, 19, 1]" 

然後使用Xcode中我能拿到鑰匙:

var arr: [UInt8] = [10, 11, 118, 105, 19, 1] 

let data = Data(bytes: arr) 
let key = String(data: data, encoding: .ascii) 

而且我寫的,以防有人需要它的命令。

ptrInt8Array 0x181ba4174 

command regex ptrInt8Array 's/(.+)/expr -l Swift -- String(describing: unsafeBitCast(%1, to: Array<UInt8>.self))/' 

通過執行它