Debugserver: Difference between revisions

From iPhone Development Wiki
m (Clarify -x backboard option)
(Remove 64-bit specific instructions as modern ldid supports FAT binaries)
Line 76: Line 76:
'''3.''' Apply the entitlement with <tt>ldid</tt>:
'''3.''' Apply the entitlement with <tt>ldid</tt>:
  ldid -Sent.xml debugserver
  ldid -Sent.xml debugserver
== Alternative Instructions (64-bit compatible) ==
Alternatively if you are on a Mac with Xcode, installed you can follow Peter Steinberger's instructions to add entitlements to the debugserver that comes with Xcode. This will allow you to keep it as a fat binary, which will work on all devices including 64-bit iPhone 5s [https://speakerd.s3.amazonaws.com/presentations/43ca7dd05d120131795d129291fe58eb/Taking_Advantage_of_the_Runtime.pdf Here are Peter's full slides in PDF format] or [https://speakerdeck.com/steipete/taking-advantage-of-the-runtime on a website (with more tips)] - start at slide 45 for instructions for getting the debugserver to work.
I am not sure if you need an Apple developer membership and certificate to add the entitlements. If this fails for you, try the first method above.
'''1.''' Mount Xcode's developer disk image on your Mac and copy the debugserver binary to your working directory:
hdiutil attach /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/ DeviceSupport/7.0.3\ \(11B508\)/DeveloperDiskImage.dmg
cp /Volumes/DeveloperDiskImage/usr/bin/debugserver .
'''2.''' Save the following as <tt>entitlements.plist</tt>:
<source lang="xml">
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/ PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.springboard.debugapplications</key>
<true/>
<key>run-unsigned-code</key>
<true/>
<key>get-task-allow</key>
<true/>
<key>task_for_pid-allow</key>
<true/>
</dict>
</plist>
</source>
'''3.''' Apply the entitlement with <tt>codesign</tt>:
codesign -s - --entitlements entitlements.plist -f debugserver


= Attaching to a process =
= Attaching to a process =

Revision as of 22:22, 31 March 2020


debugserver is a console app that acts as server for remote gdb or lldb debugging. It is installed when a device is marked for development. It can be found in /Developer/usr/bin/debugserver. This is also the process invoked by Xcode to debug applications on the device.

If you're using iOS 7, see Debugging on iOS 7 for more context.

Command line options

debugserver can be invoked with

debugserver [<options>] host:<port> [<prog-name> <arg1> <arg2> ...]

Where options can be:

Option Effect
-a process Attach debugserver to process. The process can be a pid or executable name.
-d integer Assign the waitfor-duration.
-f ? ?
-g Turn on debugging.
-i integer Assign the waitfor-interval.
-l filename Log to file. Set filename to stdout to log to standard output.
-t Use task ID instead of process ID.
-v Verbose.
-w ? ?
-x method
--launch=method
How to launch the program. Can be one of:
  • auto: Auto-detect the best launch method to use.
  • fork: Launch program using fork(2) and exec(3).
  • posix: Launch program using posix_spawn(2).
  • backboard: Launch program via BackBoard Services.

The backboard option is only available in the closed-source version included in Xcode.

--lockdown Obtain parameters from lockdown (?)

Patching for process attaching

The vanilla debugserver lacks the task_for_pid() entitlement. For building and debugging your own apps on a properly provisioned device, this is not a problem; assuming your project and device are properly configured with your active iOS Developer Program, debugserver should have no trouble attaching to an app built and sent down to the device by Xcode. However, debugserver cannot attach to any other processes, including other apps from the App Store, due to lack of entitlement to allow task_for_pid(). An entitlement must be inserted into the binary to allow this. Note: The /Developer directory is actually a mounted read-only ramdisk. You cannot add any entitlements to the copy of debugserver installed there; it must be extracted to another directory and used from there.

0. cd ~

1. Thin the binary because ldid does not support fat binaries:

lipo -thin armv6 /Developer/usr/bin/debugserver -output ~/debugserver

2. Save the following as ent.xml:

<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>com.apple.springboard.debugapplications</key>
	<true/>
	<key>get-task-allow</key>
	<true/>
	<key>task_for_pid-allow</key>
	<true/>
	<key>run-unsigned-code</key>
	<true/>
</dict>
</plist>

3. Apply the entitlement with ldid:

ldid -Sent.xml debugserver

Attaching to a process

1. On the device, type:

./debugserver 0.0.0.0:1234 -a "YouTube"

Example:

My-iPhone-5S:~ root# ./debugserver *:1234 -a "YouTube"
debugserver-300.2 for arm64.
Attaching to process YouTube...
Spawning general listening thread.
Spawning kqueue listening thread.
Listening to port 1234 for a connection from *...

2. On your Mac, launch lldb and type the following commands (but replace the IP with your device's IP):

platform select remote-ios
process connect connect://192.168.2.104:1234

Example:

mbkim:Debug_Server Kim$ lldb
(lldb) platform select remote-ios
  Platform: remote-ios
 Connected: no
  SDK Path: "/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/7.0"
 SDK Roots: [ 0] "/Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/DeviceSupport/4.2"
[...]
 SDK Roots: [21] "/Users/Kim/Library/Developer/Xcode/iOS DeviceSupport/7.0.4 (11B554a)"
(lldb) process connect connect://192.168.2.104:1234
Process 2612 stopped
* thread #1: tid = 0x30d1e, 0x3ba51a84 libsystem_kernel.dylib`mach_msg_trap + 20, queue = 'com.apple.main-thread, stop reason = signal SIGSTOP
    frame #0: 0x3ba51a84 libsystem_kernel.dylib`mach_msg_trap + 20
libsystem_kernel.dylib`mach_msg_trap + 20:
-> 0x3ba51a84:  pop    {r4, r5, r6, r8}
   0x3ba51a88:  bx     lr

libsystem_kernel.dylib`mach_msg_overwrite_trap:
   0x3ba51a8c:  mov    r12, sp
   0x3ba51a90:  push   {r4, r5, r6, r8}
(lldb) po [[UIApplication sharedApplication] delegate]
<YTAppDelegate: 0x15e635a0>
(lldb) 

Debugging through USB instead of WiFi

If you find that debugging through WiFi is a little slow, or if you need to debug an app while WiFi is off, you can use usbmuxd to connect through USB. Refer to SSH Over USB, replacing the source and destination ports with 1234.

Connecting lldb:

(lldb) process connect connect://localhost:1234
Process 2612 stopped
* thread #1: tid = 0x30d1e, 0x3ba51a84 libsystem_kernel.dylib`mach_msg_trap + 20, queue = 'com.apple.main-thread, stop reason = signal SIGSTOP
    frame #0: 0x3ba51a84 libsystem_kernel.dylib`mach_msg_trap + 20
libsystem_kernel.dylib`mach_msg_trap + 20:
-> 0x3ba51a84:  pop    {r4, r5, r6, r8}
   0x3ba51a88:  bx     lr

libsystem_kernel.dylib`mach_msg_overwrite_trap:
   0x3ba51a8c:  mov    r12, sp
   0x3ba51a90:  push   {r4, r5, r6, r8}
(lldb) po [[UIApplication sharedApplication] delegate]
<YTAppDelegate: 0x15e635a0>

Example session (old instructions)

Note: these instructions only work on iOS 6 and older. For iOS 7, follow the example above.

1. Copy MobileNotes to your Mac, e.g. to /Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS3.1.sdk/Applications/MobileNotes.app/MobileNotes.

2. On the device, type:

~/debugserver -x spring host:6789 /Applications/MobileNotes.app/MobileNotes

This will launch MobileNotes and wait for the remote debugger.

3. Launch the debugger and attach it to the remote process: If using GDB:

  • On your Mac, launch /Developer/Platforms/iPhoneOS.platform/Developer/usr/libexec/gdb/gdb-arm-apple-darwin.
  • Type the following in gdb:
set shlib-path-substitutions / /Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS3.1.sdk/
file /Developer/Platforms/iPhoneOS.platform/Developer/SDKs/iPhoneOS3.1.sdk/Applications/MobileNotes.app/MobileNotes
target remote-macosx 192.168.1.101:6789

Where 192.168.1.101 should be replaced by the actual IP address of your device. The remote debug connection is now complete.

If using LLDB:

  • On your Mac, launch lldb.
  • Type the following in lldb:
platform select remote-ios
process connect connect://192.168.1.101:6789

4. Enter c to continue and do whatever you want.

External links