I was wondering if it's possible to create a completely custom debugger for the iPhone. To do this I would need to read the process of my app installed in the iPhone. While I think this is not possible, there may be a workaround through lldb.
From Xcode, when you launch your app you can see a PID (process id) that the Xcode debugger attaches to. This PID is not available on macOS, it's local to the iPhone and cannot be inspected directly in any way.
I discovered that the iPhone uses a debugserver, which is a way of doing remote debugging from macOS with Xcode.
The way it works, is that when you launch your app from Xcode, a service called debugserver is launched inside the iPhone that starts LISTENING for TCP packets at some port that I guess Xcode specifies and then from macOS you send TCP packets to the iPhone, using the gdb-remote protocol. This practice is nothing special and you can read more about it here: https://lldb.llvm.org/use/remote.html
I inspected TCP connection using the following command:
sudo lsof -i -n -P | grep TCP
Then sniffing the packets using this command: (where the IPv6 belongs to the iPhone)
sudo tcpdump -i en0 -p -vv -A ip6 and net de90:4::31:e77b:81f1:5cdb
Every time I create a breakpoint or step through in Xcode I see packets traveling with tcpdump.
The issue is, that Xcode establishes the connection, and the port is no longer in LISTENING mode, but rather ESTABLISHED. So I can't simply send packets.
What I need to do is to execute debugserver that is located in the iPhone, the command should look something like this:
lldb-server platform --listen "*:1234" --server
Anyway I can do this? Because Xcode can, I don't see why I couldn't do the same from the command line terminal. I need to either do it completely using lldb or running an Xcode command that puts the connection in listening mode and stops before establishing it, so I can establish it myself through lldb.
It seems to be possible using jailbreak (source:https://iphonedev.wiki/index.php/Debugserver)
Using this command:
./debugserver *:1234 -a "YouTube"
Resulting in this:
My-iPhone-5S:~ root# ./debugserver *:1234 -a "YouTube"
debugserver-300.2 for arm64.
Attaching to process YouTube...
Spawning general listening thread.
Spawning kqueue listening thread.
Listening to port 1234 for a connection from *...
I'm looking to do exactly that without jailbreaking as I'll only debug my own apps and because Xcode can do it I assume I can too.