gdb的相关信息
(gdb) info sh
The DYLD shared library state has not yet been initialized.
Requested State Current State
Num Basename Type Address Reason | | Source
| | | | | | | |
1 QQ - 0x4000 exec Y Y /private/var/mobile/Applications/A66DF95C-9C14-48A6-8BF3-EF68DA00C2F9/QQ.app/QQ (offset 0x0)
Breakpoint 1, 0x01e0513c in SecurityAccountServer::AddressBookItem::AddressBookItem ()
1: x/10i $pc
0x1e0513c: f0 b5 push {r4, r5, r6, r7, lr}
0x1e0513e: 03 af add r7, sp, #12
0x1e05140: 2d e9 00 05 stmdb sp!, {r8, r10}
0x1e05144: 81 b0 sub sp, #4
0x1e05146: 04 46 mov r4, r0
0x1e05148: 4a f6 92 20 movw r0, #43666 ; 0xaa92
0x1e0514c: c0 f2 a6 00 movt r0, #166 ; 0xa6
0x1e05150: 98 46 mov r8, r3
0x1e05152: 78 44 add r0, pc
0x1e05154: 92 46 mov r10, r2
(gdb) x/s $r1
0x22fcc18: "loadDiscussMemberList:"
(gdb) info st
#0 0x01e0513c in SecurityAccountServer::AddressBookItem::AddressBookItem ()
#1 0x01e02f1e in SecurityAccountServer::AddressBookItem::AddressBookItem ()
#2 0x01e00338 in SecurityAccountServer::AddressBookItem::AddressBookItem ()
#3 0x01e0044e in SecurityAccountServer::AddressBookItem::AddressBookItem ()
#4 0x01e395a8 in SecurityAccountServer::AddressBookItem::AddressBookItem ()
#5 0x00512040 in _t_::_p_::__internal_new_creator<ucache::multibusid::url::ReqUsrInfo> ()
#6 0x003e4c10 in KQQ::ProfFriendInfoRes::ProfFriendInfoRes ()
#7 0x007aedfa in VIP::VipUserInfo::readFrom<taf::BufferReader> ()
#8 0x007aea66 in VIP::VipUserInfo::readFrom<taf::BufferReader> ()
#9 0x0093380e in std::vector<AvatarInfo::DestQQHeadInfo, std::allocator<AvatarInfo::DestQQHeadInfo> >::~vector ()
#10 0x357cf1fa in -[NSObject performSelector:withObject:] ()
IDA分析的结果
__text:01E0513C
__text:01E0513C ; =============== S U B R O U T I N E =======================================
__text:01E0513C
__text:01E0513C ; DiscussGroupStorage - (id)loadDiscussMemberList:(int64_t)
__text:01E0513C ; Attributes: bp-based frame
__text:01E0513C
__text:01E0513C ; id __cdecl -[DiscussGroupStorage loadDiscussMemberList:](struct DiscussGroupStorage *self, SEL, int64_t)
__text:01E0513C __DiscussGroupStorage_loadDiscussMemberList__
__text:01E0513C ; DATA XREF: __objc_const:02825BE0o
__text:01E0513C
__text:01E0513C var_18 = -0x18
__text:01E0513C
__text:01E0513C PUSH {R4-R7,LR}
__text:01E0513E ADD R7, SP, #0xC
__text:01E05140 PUSH.W {R8,R10}
__text:01E05144 SUB SP, SP, #4
__text:01E05146 MOV R4, R0
__text:01E05148 MOV R0, #(selRef_getDiscussMemberListPathEnc_ - 0x1E05156)
(gdb) info sh
The DYLD shared library state has not yet been initialized.
Requested State Current State
Num Basename Type Address Reason | | Source
| | | | | | | |
1 QQ - 0x4000 exec Y Y /private/var/mobile/Applications/A66DF95C-9C14-48A6-8BF3-EF68DA00C2F9/QQ.app/QQ (offset 0x0)
基址不可能是0X4000.不知道你在那里复制的。
i mach-region 0 显示基址 例如是0XDA000
在GDB定义下面二个宏
define bbvm
set $__bbvm=$arg0-(0x4000)
end
define bb
b *($__bbvm+$arg0)
end
然后运行 bbvm 0XDA000
然后再 bb 0x01E0515E 就可以到正确的断了
0x35ea2004 in mach_msg_trap ()
(gdb) i mach-region 0
Region from 0x4000 to 0x24bc000 (r-x, max r-x; copy, private, not-reserved)
(gdb) define bbvm
Type commands for definition of "bbvm".
End with a line saying just "end".
>set $__bbvm=$arg0-(0x4000)
>end
(gdb) define bb
Type commands for definition of "bb".
End with a line saying just "end".
>b *($__bbvm+$arg0)
>end
(gdb) bbvm 0X4000
(gdb) bb 0x01E0266C
Breakpoint 1 at 0x1e0266c
(gdb) c
Continuing.
gdb) info sh
The DYLD shared library state has not yet been initialized.
Requested State Current State
Num Basename Type Address Reason | | Source
| | | | | | | |
1 QQ - 0x4000 exec Y Y /private/var/mobile/Applications/A66DF95C-9C14-48A6-8BF3-EF68DA00C2F9/QQ.app/QQ (offset 0x0)
通过这命令,得到的模块基地址是0x0.
(gdb) i mach-region 0
Region from 0x4000 to 0x24bc000 (r-x, max r-x; copy, private, not-reserved)