Repository navigation
KeyError in antidebug command #22
Description
After executing the antidebug command, running a program that uses the sysctl anti-debugging technique will result in a KeyError.
However, since anti-anti-debugging works fine, this issue is considered a low priority.
% lldb ./sysctl
[+] Loaded lldbinit version 3.1.383 @ lldb-1500.0.404.7
(lldbinit) target create "./sysctl"
Current executable set to '/Users/macforensics/Documents/src/anti-debugging/sysctl' (arm64).
(lldbinit) process launch --stop-at-entry
------------------------------------------------------------------------------------------------------[regs]
X0: 0x0000000000000000 X8: 0x0000000000000000 X16: 0x0000000000000000 X24: 0x0000000000000000
X1: 0x0000000000000000 X9: 0x0000000000000000 X17: 0x0000000000000000 X25: 0x0000000000000000
X2: 0x0000000000000000 X10: 0x0000000000000000 X18: 0x0000000000000000 X26: 0x0000000000000000
X3: 0x0000000000000000 X11: 0x0000000000000000 X19: 0x0000000000000000 X27: 0x0000000000000000
X4: 0x0000000000000000 X12: 0x0000000000000000 X20: 0x0000000000000000 X28: 0x0000000000000000
X5: 0x0000000000000000 X13: 0x0000000000000000 X21: 0x0000000000000000 FP: 0x0000000000000000
X6: 0x0000000000000000 X14: 0x0000000000000000 X22: 0x0000000000000000 LR: 0x0000000000000000
X7: 0x0000000000000000 X15: 0x0000000000000000 X23: 0x0000000000000000 SP: 0x000000016FDFF5E0
PC: 0x0000000100010B70 n z c v a i f
------------------------------------------------------------------------------------------------------[code]
_dyld_start @ /usr/lib/dyld:
-> 0x100010b70 (0x1800bdb70): e0 03 00 91 mov x0, sp
0x100010b74 (0x1800bdb74): 1f ec 7c 92 and sp, x0, #0xfffffffffffffff0
0x100010b78 (0x1800bdb78): 1d 00 80 d2 mov x29, #0x0
0x100010b7c (0x1800bdb7c): 1e 00 80 d2 mov x30, #0x0
0x100010b80 (0x1800bdb80): 0a 03 00 14 b 0x1000117a8 ; start
dyld4::restartWithDyldInCache(dyld4::KernelArgs const*, dyld3::MachOFile const*, void*) @ /usr/lib/dyld:
0x100010b84 (0x1800bdb84): 1f 00 00 91 mov sp, x0
0x100010b88 (0x1800bdb88): 40 00 1f d6 br x2
mach_init @ /usr/lib/dyld:
0x100010b8c (0x1800bdb8c): 7f 23 03 d5 pacibsp
------------------------------------------------------------------------------------------------------------
Process 67978 stopped
* thread #1, stop reason = signal SIGSTOP
frame #0: 0x0000000100010b70 dyld`_dyld_start
Target 0: (sysctl) stopped.
Process 67978 launched: '/Users/macforensics/Documents/src/anti-debugging/sysctl' (arm64)
(lldbinit) antidebug
[+] Enabled anti-anti-debugging measures
(lldbinit) c
Process 67978 resuming
1 location added to breakpoint 1
1 location added to breakpoint 2
1 location added to breakpoint 3
1 location added to breakpoint 4
Traceback (most recent call last):
File "<string>", line 8, in lldb_autogen_python_bp_callback_func__0
KeyError: 'lldb_autogen_python_bp_callback_func__4'
[+] Hit sysctl antidebug request
SUCCESS
Process 67978 exited with status = 0 (0x00000000)
Activity
gdbinit commentedon Jan 10, 2025
I can reproduce it. There is something broken with newer lldb version that is triggering this because older versions work fine. Investigating!
gdbinit commentedon Jan 11, 2025
Didn't read my own comments because it's already documented in the code. There is some regression where it generates this error when setting a new callback inside another callback. It still works but this error message is shown :(