MASTG-TECH-0113: Obtaining Debugging Symbols
To retrieve debug symbols from iOS binaries you can use radare2 for iOS, objdump - iOS or nm - iOS to inspect all of the app binaries.
radare2¶
Using radare2 for iOS with the command is
:
r2 -A MASTestApp
[0x100007408]> is~Sec
70 0x00007894 0x100007894 LOCAL FUNC 0 imp.SecKeyCopyExternalRepresentation
71 0x000078a0 0x1000078a0 LOCAL FUNC 0 imp.SecKeyCopyPublicKey
72 0x000078ac 0x1000078ac LOCAL FUNC 0 imp.SecKeyCreateRandomKey
73 0x000078b8 0x1000078b8 LOCAL FUNC 0 imp.SecKeyCreateSignature
74 0x000078c4 0x1000078c4 LOCAL FUNC 0 imp.SecKeyVerifySignature
Alternatively, you can use rabin2 to obtain the symbols by running rabin2 -s MASTestApp
.
objdump¶
The following snippet shows how you can apply objdump - iOS on MASTestApp
(the iOS main app executable) with the typical output of a binary containing debug symbols. Those are marked with the d
(debug) flag. Check the objdump man page for information about various other symbol flag characters.
$ objdump --syms MASTestApp | grep " d " | grep "swift"
...
0000000000000000 d *UND* MastgTest.swift
0000000000000000 d *UND* __swift_FORCE_LOAD_$_swiftFoundation_$_MASTestApp
0000000000000000 d *UND* __swift_FORCE_LOAD_$_swiftObjectiveC_$_MASTestApp
0000000000000000 d *UND* __swift_FORCE_LOAD_$_swiftDarwin_$_MASTestApp
0000000000000000 d *UND* __swift_FORCE_LOAD_$_swiftCoreFoundation_$_MASTestApp
...
nm¶
With nm - iOS you can compare the symbols from a plain call to nm
with the output of a call to nm -a
. The latter also prints the debug symbols. The following command will show only debug symbols in a diff format. If this is empty, now debug symbols are present.
$ diff <(nm MASTestApp) <(nm -a MASTestApp)
...
28a228
> 0000000100009928 - 01 0000 FUN _$s10MASTestApp11ContentViewV7SwiftUI0D0AadEP05_makeD4List4view6inputsAD01_dH7OutputsVAD11_GraphValueVyxG_AD01_dH6InputsVtFZTW
30a231
> 000000010000992c - 01 0000 FUN _$s10MASTestApp11ContentViewV7SwiftUI0D0AadEP14_viewListCount6inputsSiSgAD01_dhI6InputsV_tFZTW
31a233,234
> 0000000100009944 - 01 0000 FUN _$s10MASTestApp11ContentViewV7SwiftUI0D0AadEP4body4BodyQzvgTW
> 0000000000000000 - 00 0000 GSYM _$s10MASTestApp11ContentViewVAC7SwiftUI0D0AAWL
32a236
> 000000010000a220 - 01 0000 FUN _$s10MASTestApp11ContentViewVAC7SwiftUI0D0AAWl
...