{"id":20159730,"url":"https://github.com/nowsecure/r2lldb","last_synced_at":"2025-04-09T23:40:26.477Z","repository":{"id":33841962,"uuid":"37544253","full_name":"nowsecure/r2lldb","owner":"nowsecure","description":"radare2-lldb integration","archived":false,"fork":false,"pushed_at":"2019-01-22T10:44:45.000Z","size":35,"stargazers_count":62,"open_issues_count":0,"forks_count":11,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-03-07T10:26:15.469Z","etag":null,"topics":["android","debugging","ios","lldb","radare2"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nowsecure.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-06-16T17:08:36.000Z","updated_at":"2024-11-16T14:52:14.000Z","dependencies_parsed_at":"2022-08-17T22:05:25.629Z","dependency_job_id":null,"html_url":"https://github.com/nowsecure/r2lldb","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nowsecure%2Fr2lldb","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nowsecure%2Fr2lldb/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nowsecure%2Fr2lldb/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nowsecure%2Fr2lldb/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nowsecure","download_url":"https://codeload.github.com/nowsecure/r2lldb/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248131465,"owners_count":21052819,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["android","debugging","ios","lldb","radare2"],"created_at":"2024-11-14T00:09:45.659Z","updated_at":"2025-04-09T23:40:26.457Z","avatar_url":"https://github.com/nowsecure.png","language":"Python","funding_links":[],"categories":["Scripts"],"sub_categories":["Conferences"],"readme":"r2lldb\n======\n\nradare2-(lldb|gdb) integration\n\nDescription\n-----------\n\nThis repository contains all the necessary scripts required to debug\nand manipulate anything running behind an LLDB the LLVM debugger from\nan interactive radare2 session.\n\nIt has been developed for debugging iOS applications running on non\njailbroken devices. And it has been tested on arm32, arm64, i386\n(simulator), and real OSX applications (x86-64).\n\nThe `debugserver` required to debug on jailbroken devices can be\nobtained by using the `viatools/salvarez/ios-debugserver` repository.\n\nIn theory it shuold be possible to use r2lldb on Linux and debug\nAndroid devices running gdbserver, but this hasn't been tested yet.\n\nFeatures\n--------\n\nThis is the list of features that r2lldb brings:\n\n* Debug self-signed apps non-jailbroken devices with a low level debugger\n* Trace calls to any address in memory\n* Show backtrace\n* List symbols\n* List memory regions allocated\n* List ObjC classes (using code injection)\n* Inject dynamic libraries\n* Step-in/over in r2's Visual mode\n* Set breakpoints on objc methods\n* Change process environment variables\n* Run r2 commands on every traced breakpoint\n\nLocal example\n-------------\n\nUsing r2 as a frontend for local lldb is as easy as this:\n\n\t$ r2lldb /bin/ls\n\nThen in another terminal:\n\n\t$ r2lldb -R localhost:9999\n\nThe same syntax applies to remote connections or crossplatform ones.\n\n\nExample\n-------\nStart with `XCode` or `ios-deploy` an lldb session in the target process and type:\n\n\t(lldb) script del sys.modules[\"r2lldb\"]  # force module reload\n\t(lldb) script import r2lldb              # start r2rap server\n\n\nAnother Example\n---------------\n\nTarget:\n\n\t$ r2lldb -l 1234 /bin/ls\n\n\tor\n\n\t$ while : ; do debugserver *:1234 /bin/ls ; done\n\tListening to port 1234 for a connection from *...\n\tGot a connection, launched process /bin/ls (pid = 82363).\n\nHost: Terminal 1\n\n\t$ r2lldb -c :1234\n\n\t$ while : ; do lldb -s lldb/local ; done\n\tListening for r2rap connections at port 9999\n\nHost: Terminal 2\n\n\t$ r2lldb -r ios localhost:9999\n\n\tor\n\n\t$ r2 -i r2/ios rap://localhost:9999//\n\nr2lldb's help from r2\n---------------------\n\n\t[0x00000000]\u003e =!?\n\tUsage: =![cmd] ...       # r2lldb integration\n\t=!?                      # show r2lldb's help (this one)\n\t=!help                   # show lldb's help\n\t=!i                      # target information\n\t=!is                     # list symbols\n\t=!dfv                    # show frame variables (arguments + locals)\n\t=!up,down,list           # lldb's command to list select frames and show source\n\t=!dks                    # stop debugged process\n\t=!dm                     # show maps (image list)\n\t=!dr                     # show registers\n\t=!dra                    # show all registers\n\t=!dr*                    # \"\" \"\" in r2 commands\n\t=!dr-*                   # remove all breakpoints\n\t=!db                     # list breakpoints\n\t=!db 0x12924             # set breakpoint at address\n\t=!db objc_msgSend        # set breakpoint on symbol\n\t=!dbo NSString init:     # set objc breakpoint\n\t=!dbt                    # show backtrace\n\t=!ds                     # step\n\t=!dcue                   # continue until entrypoint\n\t=!dso                    # step over\n\t=!dt                     # list all trace points\n\t=!dt 0x804040 =!dr       # add tracepoint for this address\n\t=!dc                     # continue\n\t=!dct                    # continue with tracing\n\t=!env                    # show process environment\n\t=!objc                   # list all objc classes\n\t=!setenv k v             # set variable in target process\n\t=!dlopen /path/to/lib    # dlopen lib (libr2.so, frida?)\n\nGDB notes\n---------\n\nRecently, this project got the ability to use `gdb` as target for r2,\nso the project name will probably change to make this clear.\n\nIn order to run r2lldb in `ndk-gdb` you may do the following:\n\n\t$ prebuilt/darwin-x86_64/bin/gdb\n\t(gdb) python-interactive\n\t\u003e\u003e\u003e import sys\n\t\u003e\u003e\u003e sys.path.append('/path/to/r2lldb')\n\t\u003e\u003e\u003e sys.path.append('/path/to/r2lldb/r2lldb')\n\t\u003e\u003e\u003e sys.path.append('/path/to/r2lldb/r2lldb/backend/gdb/')\n\t\u003e\u003e\u003e sys.path.append('/path/to/radare2-r2pipe/python/')\n\t\u003e\u003e\u003e import r2lldb\n\nIn another terminal:\n\n\t$ r2 rap://localhost:9999\n\nAndroid\n-------\n\nTo debug Android apps in the target device you will need to find a copy of the `gdbserver` binary. which can be found in Termux if you install the `gdb` package, but also, it can be found inside the NDK under the `prebuilt/` directory.\n\niOS\n---\n\nThe `debugserver` is deployed by XCode in the debugger image. If you have a jailbroken device you can just extract this binary from the dmg and copy it via SSH.\n\n--pancake\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnowsecure%2Fr2lldb","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnowsecure%2Fr2lldb","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnowsecure%2Fr2lldb/lists"}