disassemble

TODO：

【记录】lldb命令使用心得：disassemble

disassemble == dis == di

  di        -- Disassemble specified instructions in the current target. 
              Defaults to the current function for the current thread and
              stack frame.
  dis       -- Disassemble specified instructions in the current target. 
              Defaults to the current function for the current thread and
              stack frame.

disassemble举例

官网的例子

GDB to LLDB command map — The LLDB Debugger (llvm.org)

官网有相关例子：

Disassemble the current function for the current frame
```
(lldb) disassemble --frame
(lldb) di -f
```

Disassemble any functions named main

(lldb) disassemble --name main
(lldb) di -n main

Disassemble an address range

(lldb) disassemble --start-address 0x1eb8 --end-address 0x1ec3
(lldb) di -s 0x1eb8 -e 0x1ec3

Disassemble 20 instructions from a given address

(lldb) disassemble --start-address 0x1eb8 --count 20
(lldb) di -s 0x1eb8 -c 20

Show mixed source and disassembly for the current function for the current frame
```
(lldb) disassemble --frame --mixed
(lldb) di -f -m
```
Disassemble the current function for the current frame and show the opcode bytes
```
(lldb) disassemble --frame --bytes
(lldb) di -f -b
```
Disassemble the current source line for the current frame
```
(lldb) disassemble --line
(lldb) di -l
```

某次测试的一些命令

如果当前已处于某个函数，则：
```
dis -f == dis = dis -n FunctionName
```

其他常见用法：

disassemble == dis = di
dis -n "-[AAUISignInViewController _nextButtonSelected:]"
dis -f
dis --start-address 0x1b30cb978 --end-address 0x1b30cb990
dis --start-address 0x1b30cb978 --count 10
dis --frame --mixed
dis --frame --bytes
dis --line

当前frame = 当前函数的全部汇编代码

dis -f

效果

(lldb) dis -f
AppleAccountUI`-[AAUISignInViewController _nextButtonSelected:]:
->  0x1b30cb978 <+0>:  stp    x20, x19, [sp, #-0x20]!
    0x1b30cb97c <+4>:  stp    x29, x30, [sp, #0x10]
    0x1b30cb980 <+8>:  add    x29, sp, #0x10            ; =0x10
    0x1b30cb984 <+12>: mov    x19, x0
    0x1b30cb988 <+16>: adrp   x8, -84407
    0x1b30cb98c <+20>: add    x1, x8, #0xc7a            ; =0xc7a
    0x1b30cb990 <+24>: bl     0x1b2c70578
    0x1b30cb994 <+28>: adrp   x8, -84407
    0x1b30cb998 <+32>: add    x1, x8, #0xc91            ; =0xc91
    0x1b30cb99c <+36>: mov    x0, x19
    0x1b30cb9a0 <+40>: ldp    x29, x30, [sp, #0x10]
    0x1b30cb9a4 <+44>: ldp    x20, x19, [sp], #0x20
    0x1b30cb9a8 <+48>: b      0x1b2c70578

指定函数

disassemble -n "-[AAUISignInViewController _nextButtonSelected:]"

效果

(lldb) disassemble -n "-[AAUISignInViewController _nextButtonSelected:]"
AppleAccountUI`-[AAUISignInViewController _nextButtonSelected:]:
->  0x1b30cb978 <+0>:  stp    x20, x19, [sp, #-0x20]!
    0x1b30cb97c <+4>:  stp    x29, x30, [sp, #0x10]
    0x1b30cb980 <+8>:  add    x29, sp, #0x10            ; =0x10
    0x1b30cb984 <+12>: mov    x19, x0
    0x1b30cb988 <+16>: adrp   x8, -84407
    0x1b30cb98c <+20>: add    x1, x8, #0xc7a            ; =0xc7a
    0x1b30cb990 <+24>: bl     0x1b2c70578
    0x1b30cb994 <+28>: adrp   x8, -84407
    0x1b30cb998 <+32>: add    x1, x8, #0xc91            ; =0xc91
    0x1b30cb99c <+36>: mov    x0, x19
    0x1b30cb9a0 <+40>: ldp    x29, x30, [sp, #0x10]
    0x1b30cb9a4 <+44>: ldp    x20, x19, [sp], #0x20
    0x1b30cb9a8 <+48>: b      0x1b2c70578

指定地址范围

disassemble --start-address 0x1b30cb978 --end-address 0x1b30cb990

参数说明
- 包括：start address=0x1b30cb978
- 不包括：end address=0x1b30cb990

输出效果

(lldb) disassemble --start-address 0x1b30cb978 --end-address 0x1b30cb990
AppleAccountUI`-[AAUISignInViewController _nextButtonSelected:]:
->  0x1b30cb978 <+0>:  stp    x20, x19, [sp, #-0x20]!
    0x1b30cb97c <+4>:  stp    x29, x30, [sp, #0x10]
    0x1b30cb980 <+8>:  add    x29, sp, #0x10            ; =0x10
    0x1b30cb984 <+12>: mov    x19, x0
    0x1b30cb988 <+16>: adrp   x8, -84407
    0x1b30cb98c <+20>: add    x1, x8, #0xc7a            ; =0xc7a

额外加上行数：

disassemble --start-address 0x1b30cb978 --count 10

输出效果

(lldb) disassemble --start-address 0x1b30cb978 --count 10
AppleAccountUI`-[AAUISignInViewController _nextButtonSelected:]:
->  0x1b30cb978 <+0>:  stp    x20, x19, [sp, #-0x20]!
    0x1b30cb97c <+4>:  stp    x29, x30, [sp, #0x10]
    0x1b30cb980 <+8>:  add    x29, sp, #0x10            ; =0x10
    0x1b30cb984 <+12>: mov    x19, x0
    0x1b30cb988 <+16>: adrp   x8, -84407
    0x1b30cb98c <+20>: add    x1, x8, #0xc7a            ; =0xc7a
    0x1b30cb990 <+24>: bl     0x1b2c70578
    0x1b30cb994 <+28>: adrp   x8, -84407
    0x1b30cb998 <+32>: add    x1, x8, #0xc91            ; =0xc91
    0x1b30cb99c <+36>: mov    x0, x19

显示opcode

disassemble --frame --bytes

说明
- 和IDA中设置显示opcode的效果类似：解析后的arm指令前面，显示出对应的二进制数据opcode

输出效果

(lldb) disassemble --frame --bytes
AppleAccountUI`-[AAUISignInViewController _nextButtonSelected:]:
->  0x1b30cb978 <+0>:  0xa9be4ff4   stp    x20, x19, [sp, #-0x20]!
    0x1b30cb97c <+4>:  0xa9017bfd   stp    x29, x30, [sp, #0x10]
    0x1b30cb980 <+8>:  0x910043fd   add    x29, sp, #0x10            ; =0x10
    0x1b30cb984 <+12>: 0xaa0003f3   mov    x19, x0
    0x1b30cb988 <+16>: 0xb0f5b248   adrp   x8, -84407
    0x1b30cb98c <+20>: 0x9131e901   add    x1, x8, #0xc7a            ; =0xc7a
    0x1b30cb990 <+24>: 0x97ee92fa   bl     0x1b2c70578
    0x1b30cb994 <+28>: 0xb0f5b248   adrp   x8, -84407
    0x1b30cb998 <+32>: 0x91324501   add    x1, x8, #0xc91            ; =0xc91
    0x1b30cb99c <+36>: 0xaa1303e0   mov    x0, x19
    0x1b30cb9a0 <+40>: 0xa9417bfd   ldp    x29, x30, [sp, #0x10]
    0x1b30cb9a4 <+44>: 0xa8c24ff4   ldp    x20, x19, [sp], #0x20
    0x1b30cb9a8 <+48>: 0x17ee92f4   b      0x1b2c70578

其他例子

显示某个地址的反汇编

disassemble -s 0x00000001091694a4

输出效果

(lldb) disassemble -s 0x00000001091694a4
Module_Framework`___lldb_unnamed_symbol171165$$Module_Framework:
    0x1091694a4 <+0>: ret    

Module_Framework`___lldb_unnamed_symbol171166$$Module_Framework:
    0x1091694a8 <+0>: b      0x1091a45ac               ; ___lldb_unnamed_symbol174729$$Module_Framework

Module_Framework`___lldb_unnamed_symbol171167$$Module_Framework:
    0x1091694ac <+0>: ldr    x2, [x0, #0x10]
    0x1091694b0 <+4>: br     x2

Module_Framework`___lldb_unnamed_symbol171168$$Module_Framework:
    0x1091694b4 <+0>: ret    

Module_Framework`___lldb_unnamed_symbol171169$$Module_Framework:
    0x1091694b8 <+0>: b      0x1091a45ac               ; ___lldb_unnamed_symbol174729$$Module_Framework

Module_Framework`___lldb_unnamed_symbol171170$$Module_Framework:
    0x1091694bc <+0>: ldr    x2, [x0, #0x10]
    0x1091694c0 <+4>: br     x2

指定显示的行数

显示从函数最开始算起的 20行代码
```
dis -c 20
```
显示从当前PC位置算起的 20行代码
```
dis --pc -c 20
```

输出效果：

(lldb) c
Process 869 resuming
Process 869 stopped
* thread #3, queue = 'com.apple.akd.anisette', stop reason = breakpoint 2.1
    frame #0: 0x0000000102e704d4 akd`___lldb_unnamed_symbol2575$$akd + 116
akd`___lldb_unnamed_symbol2575$$akd:
->  0x102e704d4 <+116>: ldrsw  x9, [x25, w9, sxtw #2]
    0x102e704d8 <+120>: nop
    0x102e704dc <+124>: ldr    x10, #0x58c7c
    0x102e704e0 <+128>: add    x9, x9, x10
Target 0: (akd) stopped.
(lldb) dis -c 20
akd`___lldb_unnamed_symbol2575$$akd:
    0x102e70460 <+0>:  sub    sp, sp, #0xf0             ; =0xf0
    0x102e70464 <+4>:  stp    x28, x27, [sp, #0x90]
    0x102e70468 <+8>:  stp    x26, x25, [sp, #0xa0]
    0x102e7046c <+12>: stp    x24, x23, [sp, #0xb0]
    0x102e70470 <+16>: stp    x22, x21, [sp, #0xc0]
    0x102e70474 <+20>: stp    x20, x19, [sp, #0xd0]
    0x102e70478 <+24>: stp    x29, x30, [sp, #0xe0]
    0x102e7047c <+28>: add    x29, sp, #0xe0            ; =0xe0
    0x102e70480 <+32>: nop
    0x102e70484 <+36>: ldr    x8, #0x54354              ; (void *)0x00000001f13db058: __stack_chk_guard
    0x102e70488 <+40>: ldr    x8, [x8]
    0x102e7048c <+44>: stur   x8, [x29, #-0x58]
    0x102e70490 <+48>: mov    w26, #0x5a87
    0x102e70494 <+52>: movk   w26, #0x6c24, lsl #16
    0x102e70498 <+56>: add    x8, x0, #0x6              ; =0x6
    0x102e7049c <+60>: cmp    x8, #0x5                  ; =0x5
    0x102e704a0 <+64>: ccmn   x0, #0x8, #0x4, hs
    0x102e704a4 <+68>: mov    w8, #0x1
    0x102e704a8 <+72>: csel   w8, wzr, w8, eq
    0x102e704ac <+76>: mov    w11, #0xa5a2
(lldb) dis --pc -c 20
akd`___lldb_unnamed_symbol2575$$akd:
->  0x102e704d4 <+116>: ldrsw  x9, [x25, w9, sxtw #2]
    0x102e704d8 <+120>: nop
    0x102e704dc <+124>: ldr    x10, #0x58c7c
    0x102e704e0 <+128>: add    x9, x9, x10
    0x102e704e4 <+132>: mov    w22, #-0xafc9
    0x102e704e8 <+136>: br     x9
    0x102e704ec <+140>: mov    x23, x1
    0x102e704f0 <+144>: mov    x28, x0
    0x102e704f4 <+148>: eor    w8, w8, #0x1
    0x102e704f8 <+152>: sub    w9, w11, #0x29            ; =0x29
    0x102e704fc <+156>: madd   w22, w8, w9, w26
    0x102e70500 <+160>: mov    x20, #0xa930
    0x102e70504 <+164>: movk   x20, #0xea59, lsl #16
    0x102e70508 <+168>: movk   x20, #0x9bdd, lsl #32
    0x102e7050c <+172>: movk   x20, #0xd570, lsl #48
    0x102e70510 <+176>: add    w8, w22, #0xb             ; =0xb
    0x102e70514 <+180>: adr    x24, #0x59acc
    0x102e70518 <+184>: nop
    0x102e7051c <+188>: ldr    x8, [x24, w8, sxtw #3]
    0x102e70520 <+192>: sub    x8, x8, #0x2              ; =0x2
(lldb)

disassemble语法

(lldb) help disassemble
Disassemble specified instructions in the current target.  Defaults to the
current function for the current thread and stack frame.

Syntax: disassemble [<cmd-options>]

Command Options Usage:
  disassemble [-bmr] -s <address-expression> [-A <arch>] [-C <num-lines>] [-e <address-expression>] [-F <disassembly-flavor>] [-P <plugin>]
  disassemble [-bmr] -s <address-expression> [-A <arch>] [-C <num-lines>] [-c <num-lines>] [-F <disassembly-flavor>] [-P <plugin>]
  disassemble [-bmr] [-A <arch>] [-C <num-lines>] [-c <num-lines>] [-F <disassembly-flavor>] [-n <function-name>] [-P <plugin>]
  disassemble [-bfmr] [-A <arch>] [-C <num-lines>] [-c <num-lines>] [-F <disassembly-flavor>] [-P <plugin>]
  disassemble [-bmpr] [-A <arch>] [-C <num-lines>] [-c <num-lines>] [-F <disassembly-flavor>] [-P <plugin>]
  disassemble [-blmr] [-A <arch>] [-C <num-lines>] [-F <disassembly-flavor>] [-P <plugin>]
  disassemble [-bmr] [-a <address-expression>] [-A <arch>] [-C <num-lines>] [-c <num-lines>] [-F <disassembly-flavor>] [-P <plugin>]

       --force
            Force dissasembly of large functions.

       -A <arch> ( --arch <arch> )
            Specify the architecture to use from cross disassembly.

       -C <num-lines> ( --context <num-lines> )
            Number of context lines of source to show.

       -F <disassembly-flavor> ( --flavor <disassembly-flavor> )
            Name of the disassembly flavor you want to use. Currently the only
            valid options are default, and for Intel architectures, att and
            intel.

       -P <plugin> ( --plugin <plugin> )
            Name of the disassembler plugin you want to use.

       -a <address-expression> ( --address <address-expression> )
            Disassemble function containing this address.

       -b ( --bytes )
            Show opcode bytes when disassembling.

       -c <num-lines> ( --count <num-lines> )
            Number of instructions to display.

       -e <address-expression> ( --end-address <address-expression> )
            Address at which to end disassembling.

       -f ( --frame )
            Disassemble from the start of the current frame's function.

       -l ( --line )
            Disassemble the current frame's current source line instructions if
            there is debug line table information, else disassemble around the
            pc.

       -m ( --mixed )
            Enable mixed source and assembly display.

       -n <function-name> ( --name <function-name> )
            Disassemble entire contents of the given function name.

       -p ( --pc )
            Disassemble around the current pc.

       -r ( --raw )
            Print raw disassembly with no symbol information.

       -s <address-expression> ( --start-address <address-expression> )
            Address at which to start disassembling.

disassemble

disassemble

disassemble举例

官网的例子

某次测试的一些命令

当前frame = 当前函数的全部汇编代码

指定函数

指定地址范围

显示opcode

其他例子

显示某个地址的反汇编

指定显示的行数

disassemble语法

results matching ""

No results matching ""

disassemble

disassemble举例

官网的例子

某次测试的一些命令

当前frame = 当前函数的 全部汇编代码

指定函数

指定地址范围

显示opcode

其他例子

显示某个地址的反汇编

指定显示的行数

disassemble语法

results matching ""

No results matching ""

当前frame = 当前函数的全部汇编代码