# LLDB

# Cheat sheet

Basic commands

<table border="1" id="bkmrk-command-example-comm" style="border-collapse: collapse; width: 109.643%; height: 343px;"><colgroup><col style="width: 26.2217%;"></col><col style="width: 45.1728%;"></col><col style="width: 28.7247%;"></col></colgroup><thead><tr style="height: 29.7969px;"><td class="align-center" style="height: 29.7969px;">**Command**</td><td class="align-center" style="height: 29.7969px;">**Example**</td><td class="align-center" style="height: 29.7969px;">**Comment**</td></tr></thead><tbody><tr style="height: 29.7969px;"><td style="height: 29.7969px;">re re

re wr

</td><td style="height: 29.7969px;">  
</td><td style="height: 29.7969px;">Read the registers

Write to registers

</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">b </td><td style="height: 29.7969px;">b 0x00000076cb964ed0

b libc.so`sendto

breakpoint set -s libc.so -n send

</td><td style="height: 29.7969px;">setting up a breakpoint</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">watchpoint</td><td style="height: 29.7969px;">`w s e -s 1 -w read\_write -- $x0&amp;0x0000FFFFFFFFFFFF` </td><td style="height: 29.7969px;">hardware breakpoint, ignoring memory tags</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">image lookup -r -n &lt;symbol&gt;</td><td style="height: 29.7969px;">image lookup -r -n fopen

image lookup -r -n send libc.so

</td><td style="height: 29.7969px;">regex lookup function name</td></tr><tr><td style="height: 29.7969px;">image lookup -a &lt;address&gt;</td><td style="height: 29.7969px;">(lldb) image lookup -a `((int \*\*\*)$x0)\[0\]\[6\]`  
 Address: libart.so\[0x00000000003900c0\]   
 ... FindClass(\_JNIEnv\*, char const\*)  
(lldb) image lookup -a 0x000000787952b0c0  
 Address: libart.so\[0x00000000003900c0\]   
 ... FindClass(\_JNIEnv\*, char const\*)  
</td><td style="height: 29.7969px;">translate address to symbol, in example - parsing JNIEnv \* object</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">memory region &lt;ADDRESS&gt;</td><td style="height: 29.7969px;">(lldb) mem reg 0x0000007c23b510f8  
\[0x0000007c23b47000-0x0000007c23b52000) r-- /data/app/XXX/YYY/base.apk  
</td><td style="height: 29.7969px;">shows the region of the specified address  
  
</td></tr><tr style="height: 29.7969px;"><td style="height: 29.7969px;">memory read --outfile &lt;PATH&gt; --binary --force &lt;START\_ADDR&gt; &lt;END\_ADDR&gt;</td><td style="height: 29.7969px;">(lldb) memory read --outfile C:\\temp\\dump.bin --binary --force 0x0000007872124000 0x000000787219a000  
483328 bytes written to 'C:\\temp\\dump.bin'  
</td><td style="height: 29.7969px;">dump binary memory</td></tr></tbody></table>