KeyError in antidebug command #22
Description
After executing the antidebug command, running a program that uses the sysctl anti-debugging technique will result in a KeyError.
However, since anti-anti-debugging works fine, this issue is considered a low priority.
% lldb ./sysctl
[+] Loaded lldbinit version 3.1.383 @ lldb-1500.0.404.7
(lldbinit) target create "./sysctl"
Current executable set to '/Users/macforensics/Documents/src/anti-debugging/sysctl' (arm64).
(lldbinit) process launch --stop-at-entry
------------------------------------------------------------------------------------------------------[regs]
X0: 0x0000000000000000 X8: 0x0000000000000000 X16: 0x0000000000000000 X24: 0x0000000000000000
X1: 0x0000000000000000 X9: 0x0000000000000000 X17: 0x0000000000000000 X25: 0x0000000000000000
X2: 0x0000000000000000 X10: 0x0000000000000000 X18: 0x0000000000000000 X26: 0x0000000000000000
X3: 0x0000000000000000 X11: 0x0000000000000000 X19: 0x0000000000000000 X27: 0x0000000000000000
X4: 0x0000000000000000 X12: 0x0000000000000000 X20: 0x0000000000000000 X28: 0x0000000000000000
X5: 0x0000000000000000 X13: 0x0000000000000000 X21: 0x0000000000000000 FP: 0x0000000000000000
X6: 0x0000000000000000 X14: 0x0000000000000000 X22: 0x0000000000000000 LR: 0x0000000000000000
X7: 0x0000000000000000 X15: 0x0000000000000000 X23: 0x0000000000000000 SP: 0x000000016FDFF5E0
PC: 0x0000000100010B70 n z c v a i f
------------------------------------------------------------------------------------------------------[code]
_dyld_start @ /usr/lib/dyld:
-> 0x100010b70 (0x1800bdb70): e0 03 00 91 mov x0, sp
0x100010b74 (0x1800bdb74): 1f ec 7c 92 and sp, x0, #0xfffffffffffffff0
0x100010b78 (0x1800bdb78): 1d 00 80 d2 mov x29, #0x0
0x100010b7c (0x1800bdb7c): 1e 00 80 d2 mov x30, #0x0
0x100010b80 (0x1800bdb80): 0a 03 00 14 b 0x1000117a8 ; start
dyld4::restartWithDyldInCache(dyld4::KernelArgs const*, dyld3::MachOFile const*, void*) @ /usr/lib/dyld:
0x100010b84 (0x1800bdb84): 1f 00 00 91 mov sp, x0
0x100010b88 (0x1800bdb88): 40 00 1f d6 br x2
mach_init @ /usr/lib/dyld:
0x100010b8c (0x1800bdb8c): 7f 23 03 d5 pacibsp
------------------------------------------------------------------------------------------------------------
Process 67978 stopped
* thread #1, stop reason = signal SIGSTOP
frame #0: 0x0000000100010b70 dyld`_dyld_start
Target 0: (sysctl) stopped.
Process 67978 launched: '/Users/macforensics/Documents/src/anti-debugging/sysctl' (arm64)
(lldbinit) antidebug
[+] Enabled anti-anti-debugging measures
(lldbinit) c
Process 67978 resuming
1 location added to breakpoint 1
1 location added to breakpoint 2
1 location added to breakpoint 3
1 location added to breakpoint 4
Traceback (most recent call last):
File "<string>", line 8, in lldb_autogen_python_bp_callback_func__0
KeyError: 'lldb_autogen_python_bp_callback_func__4'
[+] Hit sysctl antidebug request
SUCCESS
Process 67978 exited with status = 0 (0x00000000)