imoldman / dsymcreator

symbol recreate tool for iOS app

DSYMCreator

Symbol restore tool for iOS apps whose debug info are stripped.

With IDA Pro's help, it can create a DSYM/DWARF file. You can import the symbol file to lldb by yourself.

Please Note. If the executable binary is fetched from App Store, it likely is encrypted, you should decrypt the armv7 part first by dumpdecrypted.

Usage (default mode)

1. Install IDA Pro. The tool needs IDA Pro. So You should install it first. If you don't want to use IDA Pro, see Usage (only-objc mode)

   Demo version is enough! It's free, you can download from here.

2. Create Symbol File.

$ ./main.py --input /path/to/binary/xxx

Well done! Now your task in only wait (and wait, and wait...). Then a symbol file /path/to/binary/xxx.symbol will be created.

Then you can import it to lldb by yourself. Have fun!

Usage (only-objc mode)

If you don't want to use IDA Pro, you can use this mode. In this mode, you don't install any software, just create symbol file like this.

$ ./main.py --only-objc --input /path/to/binary/xxx

Also, a symbol file /path/to/binary/xxx.symbol will be created.

Please note, since it only dumps objective-c functions, the function count in symbole file is less than the function count in symbol file created in default mode (i.e. IDA Pro mode).

---

注:

Technical Doc : 高效逆向 - 为任意iOS App生成符号表

dsymcreator's Issues

无法显示函数名

你好，
使用如下代码：

auto addr = 0;
for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)) {
auto name = GetFunctionName(addr);
auto end = GetFunctionAttr(addr, FUNCATTR_END);
Message("0x%x\t0x%x\t%s\n", addr, end, name);
}

破解 mach-o 文件，在ida ,使用上述代码，可以正常显示函数名，但是，用项目中的脚本去破解，无法显示函数名！ 求解 ？

如下：
0x100007f20 0x100008150 sub_100007F20
0x1000081cc 0x100008458 sub_1000081CC
0x1000084cc 0x100008504 sub_1000084CC

请问有谁遇到过吗？

求助~输入到DSYMCreator中的IDA产物是什么样子

我有自己解析的堆栈数据，我想使用DSYMCreator脚本生成dsym文件，脚本运行成功了，但是产物使用atom/dwarfdump却出现问题，日志如下
➜ DSYMCreator git:(master) ✗ dwarfdump -debug-info ./aaa
error: ./aaa: Invalid data was encountered while parsing the file
➜ DSYMCreator git:(master) ✗ atos -o ./aaa -arch arm64 0x100030
atos cannot load symbols for the file aaa for architecture arm64.

我使用的文件如下：（我用|替换了\t）
0x100007680|0x10000769b|-[MFEssayDetailViewController viewDidLoad]
0x10000769c|0x10000779b|-[MFEssayDetailViewController viewDidLoae]
0x10000779c|0x1000077cb|-[MFEssayDetailViewController viewDidLoaf]
0x1000077cc|0x1000078cb|-[MFEssayDetailViewController viewDidLoag]
0x1000078cc|0x1000079cb|-[MFEssayDetailViewController viewDidLoah]

使用的命令如下：
./toolchain/DSYMCreator --uuid 91AE4831-3D40-3FCE-ABFC-17E0CB64FD26 --raw_ida_symbol ./input.txt --dwarf_section_vmbase 0x100000000 --output ./aaa --arm64

拜求大神赐教！

add support for arm64

invalid binary file: /Users/mac/Downloads/DSYMCreator-master/App

不是说已经添加arm64支持了吗 请问为什么用arm64的binary出现这个。。