Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

KeyError in antidebug command #22

Open
mnrkbys opened this issue Aug 23, 2024 · 2 comments
Open

KeyError in antidebug command #22

mnrkbys opened this issue Aug 23, 2024 · 2 comments

Comments

@mnrkbys
Copy link

mnrkbys commented Aug 23, 2024

After executing the antidebug command, running a program that uses the sysctl anti-debugging technique will result in a KeyError.
However, since anti-anti-debugging works fine, this issue is considered a low priority.

% lldb ./sysctl
[+] Loaded lldbinit version 3.1.383 @ lldb-1500.0.404.7
(lldbinit) target create "./sysctl"
Current executable set to '/Users/macforensics/Documents/src/anti-debugging/sysctl' (arm64).
(lldbinit) process launch --stop-at-entry
------------------------------------------------------------------------------------------------------[regs]
   X0:  0x0000000000000000   X8:  0x0000000000000000  X16:  0x0000000000000000  X24:  0x0000000000000000
   X1:  0x0000000000000000   X9:  0x0000000000000000  X17:  0x0000000000000000  X25:  0x0000000000000000
   X2:  0x0000000000000000  X10:  0x0000000000000000  X18:  0x0000000000000000  X26:  0x0000000000000000
   X3:  0x0000000000000000  X11:  0x0000000000000000  X19:  0x0000000000000000  X27:  0x0000000000000000
   X4:  0x0000000000000000  X12:  0x0000000000000000  X20:  0x0000000000000000  X28:  0x0000000000000000
   X5:  0x0000000000000000  X13:  0x0000000000000000  X21:  0x0000000000000000   FP:  0x0000000000000000
   X6:  0x0000000000000000  X14:  0x0000000000000000  X22:  0x0000000000000000   LR:  0x0000000000000000
   X7:  0x0000000000000000  X15:  0x0000000000000000  X23:  0x0000000000000000   SP:  0x000000016FDFF5E0
   PC:  0x0000000100010B70  n z c v a i f
------------------------------------------------------------------------------------------------------[code]
_dyld_start @ /usr/lib/dyld:
->  0x100010b70 (0x1800bdb70): e0 03 00 91  mov       x0, sp
    0x100010b74 (0x1800bdb74): 1f ec 7c 92  and       sp, x0, #0xfffffffffffffff0
    0x100010b78 (0x1800bdb78): 1d 00 80 d2  mov       x29, #0x0
    0x100010b7c (0x1800bdb7c): 1e 00 80 d2  mov       x30, #0x0
    0x100010b80 (0x1800bdb80): 0a 03 00 14  b         0x1000117a8 ; start
dyld4::restartWithDyldInCache(dyld4::KernelArgs const*, dyld3::MachOFile const*, void*) @ /usr/lib/dyld:
    0x100010b84 (0x1800bdb84): 1f 00 00 91  mov       sp, x0
    0x100010b88 (0x1800bdb88): 40 00 1f d6  br        x2
mach_init @ /usr/lib/dyld:
    0x100010b8c (0x1800bdb8c): 7f 23 03 d5  pacibsp   
------------------------------------------------------------------------------------------------------------
Process 67978 stopped
* thread #1, stop reason = signal SIGSTOP
    frame #0: 0x0000000100010b70 dyld`_dyld_start
Target 0: (sysctl) stopped.
Process 67978 launched: '/Users/macforensics/Documents/src/anti-debugging/sysctl' (arm64)
(lldbinit) antidebug
[+] Enabled anti-anti-debugging measures
(lldbinit) c
Process 67978 resuming
1 location added to breakpoint 1
1 location added to breakpoint 2
1 location added to breakpoint 3
1 location added to breakpoint 4
Traceback (most recent call last):
  File "<string>", line 8, in lldb_autogen_python_bp_callback_func__0
KeyError: 'lldb_autogen_python_bp_callback_func__4'
[+] Hit sysctl antidebug request
SUCCESS
Process 67978 exited with status = 0 (0x00000000) 
@gdbinit
Copy link
Owner

gdbinit commented Jan 10, 2025

I can reproduce it. There is something broken with newer lldb version that is triggering this because older versions work fine. Investigating!

@gdbinit
Copy link
Owner

gdbinit commented Jan 11, 2025

Didn't read my own comments because it's already documented in the code. There is some regression where it generates this error when setting a new callback inside another callback. It still works but this error message is shown :(

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants