0

I have an iOS application I am analyzing/reverse engineering. There is a function I want to intercept with Frida. Normally, this wouldn't be a problem but the function is called at or soon after the app is launched so there is no time for Frida to attach before the function is called.

I am working on an iPhone 5 which is a 32-bit armv7 device. Unfortunately apparently launching applications is broken for Frida on armv7.

Therefore, I tried a long shot that was unsuccessful. I wrote a dylib that swizzles the target method. In the swizzled implementation, I trigger a debugger interrupt (__asm__('trap'), I also tried bkpt 3). I started the debugserver and connected lldb on my machine to it. I was hoping that the debugserver would intercept the trap from the application but clearly I was wrong.

Does anyone have a) How traps are normally intercepted (by say, the debugger), b) Any information on how debugserver attaches itself to a process, or c) Any other ideas as to how I can accomplish this?

7
  • Did you try __builtin_trap()? raise(SIGINT)? asm("svc 0");? asm("int 3");?
    – Brandon
    Jul 10, 2019 at 4:25
  • Yes, the trap itself works. I ran it in a test app through Xcode and the Xcode debugger is triggered. What I am having trouble with is how to have debugserver/lldb catch this trap and trigger. Jul 10, 2019 at 12:00
  • If you need time for the debugger to attach, why not simply inject a dylib with raise(SIGSTOP);?
    – Siguza
    Jul 10, 2019 at 13:34
  • I liked the idea but I tried it and debugserver won't attach. It must be that it can only attach when the process is in the running state. Jul 10, 2019 at 13:45
  • What happens if you inject sleep(5000) or something? Attach the debugger, then the sleep will finish and voila?
    – Brandon
    Jul 10, 2019 at 13:48

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.