查看ASLR偏移

(lldb) image list -o -f
[  0] 0x00035000 /private/var/db/stash/_.29LMeZ/Applications/MobileNotes.app/MobileNotes(0x0000000000039000)
[  1] 0x00197000 /Library/MobileSubstrate/MobileSubstrate.dylib (0x0000000000197000)
[  2] 0x06db3000 /Users/snakeninny/Library/Developer/Xcode/iOS DeviceSupport/8.1 (12B411)/Symbols/System/Library/Frameworks/QuickLook.framework/QuickLook
……

设置断点

b function

br s –a address

br s –a 'ASLROffset+address'

(lldb) br s -a 0x4BE70
Breakpoint 1: where = MobileNotes`___lldb_unnamed_function382$$MobileNotes, address = 0x0004be70

当进程停下来之后，可以用“c”命令让进程继续运行。

断点处运行指令

(lldb) br com add 1

执行这条命令后，LLDB会要求我们设置一系列指令，以“DONE”结束，如下:

Enter your debugger command(s).  Type 'DONE' to end.
> po [$r0 class]
> p (char *)$r1
> c
> DONE