CODEWITHSUNDEEP
iosjailbreak
Wingzero
Wingzero

Reputation: 9754

iOS11 JB debugserver Failed to get connection from a remote gdb process

So there is a jailbreak for iOS11 without substrate/cydia. Now I want to run debugserver after jb the device.

I already signed with enough entitlements I think:

-bash-3.2# jtool --ent debugserver 
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>platform-application</key>
        <true/>
        <key>com.apple.backboardd.debugapplications</key>
        <true/>
        <key>com.apple.backboardd.launchapplications</key>
        <true/>
        <key>com.apple.diagnosticd.diagnostic</key>
        <true/>
        <key>com.apple.frontboard.debugapplications</key>
        <true/>
        <key>com.apple.frontboard.launchapplications</key>
        <true/>
        <key>com.apple.springboard.debugapplications</key>
        <true/>
        <key>com.apple.springboard.launchapplications</key>
        <true/>
        <key>com.apple.security.network.client</key>
        <true/>
        <key>com.apple.security.network.server</key>
        <true/>
        <key>run-unsigned-code</key>
        <true/>
        <key>get-task-allow</key>
        <true/>
        <key>task_for_pid-allow</key>
        <true/>
        <key>com.apple.system-task-ports</key>
        <true/>
    </dict>
</plist>

However when trying to debugserver *:1234 -a UnityExample, it always shows

Attaching to process UnityExample...
Listening to port 1234 for a connection from *...
Failed to get connection from a remote gdb process.

If I change the ip to iPhone IP, like debugserver 192.168.1.157:1234 -a UnityExample, it can actually wait:

Attaching to process UnityExample...
Listening to port 1234 for a connection from 192.168.1.157...

But apparently, it will only allow connection from the device, so using mac's lldb won't work.

I checked the kernel log, it prints:

Dec 27 10:21:54 iPhone1111 debugserver[564] <Notice>: 1 +0.000000 sec [0234/0303]: ::listen or ::bind failed err = 0x00000000

What did I miss? Thanks.

Upvotes: 1

Views: 3440

Answers (4)

crifan
crifan

Reputation: 14338

Edit (iOS 12.4) debugserver's entitlement:

  • remove
    • com.apple.security.network.server
    • com.apple.security.network.client
    • seatbelt-profiles
  • add
    • get-task-allow
    • task_for_pid-allow
    • run-unsigned-code

to:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.springboard.debugapplications</key>
    <true/>
    <key>com.apple.backboardd.launchapplications</key>
    <true/>
    <key>com.apple.backboardd.debugapplications</key>
    <true/>
    <key>com.apple.frontboard.launchapplications</key>
    <true/>
    <key>com.apple.frontboard.debugapplications</key>
    <true/>
    <key>com.apple.diagnosticd.diagnostic</key>
    <true/>
    <key>com.apple.private.memorystatus</key>
    <true/>
    <key>com.apple.private.cs.debugger</key>
    <true/>
    <key>get-task-allow</key>
    <true/>
    <key>task_for_pid-allow</key>
    <true/>
    <key>run-unsigned-code</key>
    <true/>
</dict>
</plist>

then saved to debugserver_entitlement_debuggable.xml

then do re-codesign:

  • (support all iOS) using codesign 
    codesign -f -s - --entitlements debugserver_entitlement_debuggable.xml debugserver
  • (for iOS <15.0) using ldid 
    ldid -Sdebugserver_entitlement_debuggable.xml debugserver

For details, pls refer my tutorial:

Upvotes: 0

Xi Zhang
Xi Zhang

Reputation: 31

Delete the Debugserver file com.apple.security.network.server com.apple.security.network.client seatbelt-profiles These three Settings, and then re-sign the DebugServer.

Upvotes: 3

rustyMagnet
rustyMagnet

Reputation: 4105

On your jailbroken device, ssh into device and:

/Developer/usr/bin/debugserver 127.0.0.1:6666 -a 1393

I got the same error you reported when I used *:6666

Have you tried this article:

https://kov4l3nko.github.io/blog/2016-04-27-debugging-ios-binaries-with-lldb/

It explains connecting to a jailbroken iOS device over USB, sending files to a device, ssh into a device and getting your debugger (lldb) setup.

Upvotes: 0

boudarbalat
boudarbalat

Reputation: 211

Same happens with me.

I get around this by:

  • connecting the device to the mac with USB
  • Using usbmuxd to for example forward local port 1234 on mac to remote 1234 on device
  • then run debugserver localhost:1234 -a pid
  • and in lldb: process connect connect://localhost:1234

This should work. Unfortunately I can only debug my own apps. Debugging Chrome.app for example starts well and works as long as i'm on the initial paused state, but the minute I resume it fails with EXC_BAD_ACCESS

Upvotes: 3

Related Questions