[XCODE] LLDB 특정 DATA 메모리 덤프 저장하기

Suppose we would like to dump byte buffer managed by Data instance, which is our case is UTF8 encoded string representation.

(lldb) po data
▿ 1278 bytes
  - count : 1278
  ▿ pointer : 0x00007ff5fc861800
    - pointerValue : 140694480361472

The following command will read1 1278 bytes starting at 0x00007ff5fc861800 and save command output to file at specified path.

(lldb) memory read --force --count 1278 --outfile /Users/wojtek/data.hexdump 0x00007ff5fc861800

The file format is quite similar to the one used by xxd2. The only difference is that xxd hexdump format does not precede address with 0x.

wojtek@MacBook:~$ head -n 4 data.hexdump
0x7ff5fc861800: 4c 6f 72 65 6d 20 69 70 73 75 6d 20 64 6f 6c 6f  Lorem ipsum dolo
0x7ff5fc861810: 72 20 73 69 74 20 61 6d 65 74 2c 20 63 6f 6e 73  r sit amet, cons
0x7ff5fc861820: 65 63 74 65 74 75 72 20 61 64 69 70 69 73 63 69  ectetur adipisci
0x7ff5fc861830: 6e 67 20 65 6c 69 74 2e 20 49 6e 20 61 63 20 63  ng elit. In ac c

Conversion is trivial, we need to remove first two bytes in every line.

wojtek@MacBook:~$ cut -b 3- data.hexdump > data.xxd

wojtek@MacBook:~$ head -n 4 data.xxd
7ff5fc861800: 4c 6f 72 65 6d 20 69 70 73 75 6d 20 64 6f 6c 6f  Lorem ipsum dolo
7ff5fc861810: 72 20 73 69 74 20 61 6d 65 74 2c 20 63 6f 6e 73  r sit amet, cons
7ff5fc861820: 65 63 74 65 74 75 72 20 61 64 69 70 69 73 63 69  ectetur adipisci
7ff5fc861830: 6e 67 20 65 6c 69 74 2e 20 49 6e 20 61 63 20 63  ng elit. In ac c

Finally we can proceed with hexdump to binary conversion. Note that we need to tell xxd not to write 0x7ff5fc861800 bytes of zeros before starting to write the actual data.

wojtek@MacBook:~$ xxd -revert -groupsize 1 --seek -0x7ff5fc861800 data.xxd data.txt

1. Normally, memory read will not read over 1024 bytes of data, use --force option to override this restriction. ↩
2. Command line tool for creating hexdumps or do the reverse ↩

출처: https://wnagrodzki.eu/dumping_memory_content_to_file_with_lldb/

Dumping memory to file with LLDB