5

I have an application running in debug mode in Xcode. I want to inspect entire memory of application (stack and heap). I know that I can use lldb for making dumps. I use following command:

(lldb) memory read --outfile filename address

eg. 

(lldb) memory read --outfile /tmp/mem-dump.txt --force --count 10000 0x000000010d051000

, but I need specify start address and size of a memory. I do not know how to find regions of memory that my app occupies to make a dump. Is there possibility to find address space of a memory? Maybe other way to make a dump (not using lldb) exist? I do not use jailbroken device.

rojarand
  • 445
  • 6
  • 18
  • Take a look at `vmmap` https://stackoverflow.com/questions/33337740/is-there-any-api-for-the-command-vmmap https://medium.com/better-programming/ios-advanced-memory-debugging-to-the-masses-24d25852a91c I'm not sure though if it's possible to self-inspect somehow a running process though (especially in iOS app sandbox). For `lldb` possibilities start with https://stackoverflow.com/a/58275752/5329717 – Kamil.S May 30 '20 at 18:39
  • `vmmap` API used from process https://stackoverflow.com/a/62090824/5329717 – Kamil.S May 31 '20 at 06:03
  • 2
    Note, the "heap" command implemented by: https://github.com/llvm/llvm-project/blob/master/lldb/examples/darwin/heap_find/heap.py takes a hybrid approach, both inserting code into the debugee to call vm introspection routines, and then adding a Python command to lldb to process the results. You might take a look at that code for hints if you do decide to go this route. – Jim Ingham Jun 02 '20 at 18:11

1 Answers1

8

Use lldb python script bridging interface. It allows to access memory region information and memory data itself, even if application runs on a physical device not on a simulator. No changes to an application required.

To access memory:

  • Copy and save following python script to your Mac. Let's name it mem.py
import lldb

def processAllMemoryRegions():
    process = lldb.debugger.GetSelectedTarget().GetProcess()
    memoryRegionInfoList = process.GetMemoryRegions()
    numberOfMemoryRegions = memoryRegionInfoList.GetSize()
    memoryRegionIndex = 0
    while (memoryRegionIndex < numberOfMemoryRegions):
        memoryRegionInfo = lldb.SBMemoryRegionInfo()
        success = memoryRegionInfoList.GetMemoryRegionAtIndex(memoryRegionIndex, memoryRegionInfo)
        if success:
            print("Processing: "+str(memoryRegionIndex+1)+"/"+str(numberOfMemoryRegions))
            processOneMemoryRegion(process, memoryRegionInfo)
        else:
            print("Could not get memory at index: "+str(memoryRegionIndex))    
        memoryRegionIndex = memoryRegionIndex+1

def processOneMemoryRegion(process, memoryRegionInfo):
    begAddressOfMemoryRegion = memoryRegionInfo.GetRegionBase()
    endAddressOfMemoryRegion = memoryRegionInfo.GetRegionEnd()
    if memoryRegionInfo.IsReadable():
        print("Beg address of a memory region: "+stringifyMemoryAddress(begAddressOfMemoryRegion))
        print("End address of a memory region: "+stringifyMemoryAddress(endAddressOfMemoryRegion))
        error = lldb.SBError()
        regionSize = endAddressOfMemoryRegion-begAddressOfMemoryRegion
        memoryData = process.ReadMemory(begAddressOfMemoryRegion, regionSize, error)
        if error.Success():
            #do something with memoryData (bytearray) eg. save it to file
            pass
        else:
            print("Could not access memory data.")
    else:
        print("Memory region is not readable.")

def stringifyMemoryAddress(memoryAddress):
    return '0x{:016x}'.format(memoryAddress)
  • Stop execution of an application on a breakpoint

In lldb window

  • Enter: script

  • Import the python script: exec(open('/absolute/path/to/mem.py').read())

  • Enter: processAllMemoryRegions()

enter image description here

You are done.

You can read memory with process.ReadMemory function. Check sample sniped above.

You can also try launching script execution with : 

(lldb) command script import  ~/path/to/script.py

It is described here and here, ... but in my case this leads to XCode freeze. It is described here

Code tested on Xcode 11.3.1.

rojarand
  • 445
  • 6
  • 18
  • can someone tell if 'Fridump' has any advantage over this manual solution, or they both achieve the same result? – vigdora Jul 20 '23 at 09:03