MASTG-TECH-0113: Obtaining Debugging Symbols
To retrieve debug symbols from iOS binaries, you can use radare2 (iOS), objdump (iOS), or nm (iOS) to inspect all the app binaries.
radare2¶
Using radare2 (iOS) with the command is:
r2 -A MASTestApp
[0x100007408]> is~Sec
70 0x00007894 0x100007894 LOCAL FUNC 0 imp.SecKeyCopyExternalRepresentation
71 0x000078a0 0x1000078a0 LOCAL FUNC 0 imp.SecKeyCopyPublicKey
72 0x000078ac 0x1000078ac LOCAL FUNC 0 imp.SecKeyCreateRandomKey
73 0x000078b8 0x1000078b8 LOCAL FUNC 0 imp.SecKeyCreateSignature
74 0x000078c4 0x1000078c4 LOCAL FUNC 0 imp.SecKeyVerifySignature
Alternatively, you can use rabin2 to obtain the symbols by running rabin2 -s MASTestApp.
objdump¶
The following snippet shows how you can apply objdump (iOS) on MASTestApp (the iOS main app executable) with the typical output of a binary containing debug symbols. Those are marked with the d (debug) flag. Check the objdump man page for information about various other symbol flag characters.
$ objdump --syms MASTestApp | grep " d " | grep "swift"
...
0000000000000000 d *UND* MastgTest.swift
0000000000000000 d *UND* __swift_FORCE_LOAD_$_swiftFoundation_$_MASTestApp
0000000000000000 d *UND* __swift_FORCE_LOAD_$_swiftObjectiveC_$_MASTestApp
0000000000000000 d *UND* __swift_FORCE_LOAD_$_swiftDarwin_$_MASTestApp
0000000000000000 d *UND* __swift_FORCE_LOAD_$_swiftCoreFoundation_$_MASTestApp
...
nm¶
With nm (iOS), you can compare the symbols from a plain call to nm with the output of a call to nm -a. The latter also prints the debug symbols. The following command will show only debug symbols in a diff format. If this is empty, now debug symbols are present.
$ diff <(nm MASTestApp) <(nm -a MASTestApp)
...
28a228
> 0000000100009928 - 01 0000 FUN _$s10MASTestApp11ContentViewV7SwiftUI0D0AadEP05_makeD4List4view6inputsAD01_dH7OutputsVAD11_GraphValueVyxG_AD01_dH6InputsVtFZTW
30a231
> 000000010000992c - 01 0000 FUN _$s10MASTestApp11ContentViewV7SwiftUI0D0AadEP14_viewListCount6inputsSiSgAD01_dhI6InputsV_tFZTW
31a233,234
> 0000000100009944 - 01 0000 FUN _$s10MASTestApp11ContentViewV7SwiftUI0D0AadEP4body4BodyQzvgTW
> 0000000000000000 - 00 0000 GSYM _$s10MASTestApp11ContentViewVAC7SwiftUI0D0AAWL
32a236
> 000000010000a220 - 01 0000 FUN _$s10MASTestApp11ContentViewVAC7SwiftUI0D0AAWl
...