场景
某一天，项目经理扔来一个APP，叫我检测一下，结果发现这个APP做了越狱检测，在越狱手机上一开就exit(0)，那么现在最流行的frida动态砸壳方法就行不通了，虽然最后使用Clutch静态砸壳工具砸壳成功，然而这个工具在iOS11.1之后因为兼容性问题被ban，只能在iOS10的越狱机上使用，那么如果哪天运气差，遇见一个只支持iOS12及以上，并且做了越狱检测的APP，那么该怎么办呢？
经过一番寻找，终于找到了传说中的LLDB脱壳工具。
支持版本
目前测试下来，iOS12及以上的机器可以正常使用，iOS10的机器不行，手头没有iOS11的手机，因此无法测试。
使用方法
首先安装issh跟xia0LLDB，从github下载，然后执行install.sh
➜ ~ git clone https://github.com/4ch12dy/issh.git
➜ ~ git clone https://github.com/4ch12dy/xia0LLDB.git
然后安装usbmuxd：
➜ ~ brew install usbmuxd
在命令行里进行端口转发：
➜ ~ iproxy 1234 1234
➜ ~ iproxy 2222 22
在已越狱的手机中找到需要砸壳的可执行文件路径，例如：
/var/containers/Bundle/Application/7B8641C3-1C26-493D-8065-CF7259087190/Shadowrocket.app/Shadowrocket
执行命令：
➜ ~ issh debug -x backboard /var/containers/Bundle/Application/7B8641C3-1C26-493D-8065-CF7259087190/Shadowrocket.app/Shadowrocket
-----以下是输出-----
[*]:iproxy install. lets go
[*]:iproxy process for 2222 port alive, pid=7699
[*]:scp id_rsa.pub to connect iDevice [1/2]
root@localhost's password:
[*]:add id_rsa.pub to authorized_keys [2/2]
root@localhost's password:
[*]:++++++++++++++++++ Nice to Work :) +++++++++++++++++++++
[*]:iOSRE dir not exist
[*]:Run mkdir -p /iOSRE/tmp;mkdir -p /iOSRE/dylib;mkdir -p /iOSRE/deb;mkdir -p /iOSRE/tools
[*]:iproxy process for 1234 port alive, pid=7742
[*]:Run ps -e | grep debugserver | grep -v grep; [[ 0 == 0 ]] && (killall -9 debugserver 2> /dev/null)
sh: line 1: 3215 Done ps -e
3216 Broken pipe: 13 | grep debugserver
3217 Killed: 9 | grep -v grep
[*]:kill app because debug with -x backboard
[*]:Run ps -e | grep /var/containers/Bundle/Application/7B8641C3-1C26-493D-8065-CF7259087190/Shadowrocket.app/Shadowrocket | grep -v grep; [[ 0 == 0 ]] && (killall -9 Shadowrocket 2> /dev/null)
[*]:/iOSRE/tools/debugserver file not exist
[*]:Run cat > /iOSRE/tmp/ent.xml << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>com.apple.backboardd.debugapplications</key>
<true/>
<key>com.apple.backboardd.launchapplications</key>
<true/>
<key>com.apple.diagnosticd.diagnostic</key>
<true/>
<key>com.apple.frontboard.debugapplications</key>
<true/>
<key>com.apple.frontboard.launchapplications</key>
<true/>
<key>com.apple.security.network.client</key>
<true/>
<key>com.apple.security.network.server</key>
<true/>
<key>com.apple.springboard.debugapplications</key>
<true/>
<key>com.apple.system-task-ports</key>
<true/>
<key>get-task-allow</key>
<true/>
<key>platform-application</key>
<true/>
<key>run-unsigned-code</key>
<true/>
<key>task_for_pid-allow</key>
<true/>
</dict>
</plist>
EOF
[*]:Run cp /Developer/usr/bin/debugserver /iOSRE/tmp/; cd /iOSRE/tmp;ldid -Sent.xml /iOSRE/tmp/debugserver; chmod +x /iOSRE/tmp/debugserver; cp /iOSRE/tmp/debugserver /iOSRE/tools/;
[*]:Run /iOSRE/tools/debugserver 127.0.0.1:1234 -x backboard /var/containers/Bundle/Application/7B8641C3-1C26-493D-8065-CF7259087190/Shadowrocket.app/Shadowrocket
新建命令窗口，执行lldb以及砸壳命令：
➜ ~ lldb
(lldb) dumpdecrypted -X
-----以下是输出信息-----
[*] set breakpoint at CFBundleGetMainBundle
[*] will continue process and dump
[*] start execute dumpdecrypted
[*] delete all breakpoints
[*] now is image: 0,/var/containers/Bundle/Application/7B8641C3-1C26-493D-8065-CF7259087190/Shadowrocket.app/Shadowrocket
[*] start dump [0] image:/var/containers/Bundle/Application/7B8641C3-1C26-493D-8065-CF7259087190/Shadowrocket.app/Shadowrocket
[+] fix main addr:0x10019a4f0
[+] Dumping Shadowrocket
[+] detected 64bit ARM binary in memory.
[+] offset to cryptid found: @0x1000fcc08(from 0x1000fc000) = c08
[+] Found encrypted data at address 00004000 of length 2932736 bytes - type 1.
[+] Opening /private/var/containers/Bundle/Application/7B8641C3-1C26-493D-8065-CF7259087190/Shadowrocket.app/Shadowrocket for reading.
[+] Reading header
[+] Detecting header type
[+] Executable is a FAT image - searching for right architecture
[+] Correct arch is at offset 3293184 in the file
[+] Opening /var/mobile/Containers/Data/Application/6B12BDA5-C128-4E09-B016-BA3CF6667521/Documents/Shadowrocket.decrypted for writing.
[+] Copying the not encrypted start of the file
[+] Dumping the decrypted data into the file
[+] Copying the not encrypted remainder of the file
[+] Setting the LC_ENCRYPTION_INFO->cryptid to 0 at offset 324c08
[+] Closing original file
[+] Closing dump file
[*] This mach-o file decrypted done.
[+] dump macho file at:/var/mobile/Containers/Data/Application/6B12BDA5-C128-4E09-B016-BA3CF6667521/Documents/Shadowrocket.decrypted
[-] image info is null, skip image #
[*] Developed By xia0@2019
可以看到砸壳之后的文件放在了：
/var/mobile/Containers/Data/Application/6B12BDA5-C128-4E09-B016-BA3CF6667521/Documents/Shadowrocket.decrypted
使用issh命令将砸壳文件拷贝到电脑上，当然也可以自行使用scp命令拷贝：
➜ ~ issh scp /var/mobile/Containers/Data/Application/6B12BDA5-C128-4E09-B016-BA3CF6667521/Documents/Shadowrocket.decrypted ~/Desktop
[*]:iproxy install. lets go
[*]:iproxy process for 2222 port alive, pid=7699
[*]:++++++++++++++++++ Nice to Work :) +++++++++++++++++++++
[*]:/var/mobile/Containers/Data/Application/6B12BDA5-C128-4E09-B016-BA3CF6667521/Documents/Shadowrocket.decrypted is remote file, so cp it from device
Shadowrocket.decrypted