skills.rest
dslsdzc
dslsdzcCOMMUNITY
Explore all skills by this author →
GitHub

re-lldb

Debug macOS and iOS binaries with lldb using attach, breakpoints, and memory inspection.

64|9|Updated Aug 17, 2026
Search Tags:#debugging#ios#macos#breakpoints#reverse engineering#lldb#memory inspection
One-click install
npx skills add https://github.com/dslsdzc/rev-skills --skill re-lldb-dslsdzc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: re-lldb
Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-lldb
Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-lldb-dslsdzc

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Dynamic debugging of macOS and iOS targets requires navigating lldb's command set plus Apple's permission stack (TCC, SIP, Hardened Runtime), and mistakes like hardcoded addresses or side-effecting expressions silently break analysis sessions. ## Core Features & Use Cases - Attach and Launch Workflows: Attach by PID or process name, launch with stop-at-entry, and handle Developer Tools authorization and SIP/TCC permission failures. - Symbol, Breakpoint, and Memory Operations: Use image lookup for symbol resolution under ASLR, set conditional and scripted breakpoints, evaluate expressions, and search or dump process memory. - Use Case: A reverse engineer needs to bypass a license check in a stripped macOS binary: resolve the module base with image list, set a breakpoint on the validation function, patch the return register, and dump the decrypted region to a file for evidence. ## Quick Start Use the re-lldb skill to attach lldb to a running macOS process, set a breakpoint on the target function, and inspect its arguments and memory.

Frequently Asked Questions about re-lldb

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I attach lldb to a running process on macOS?▼

Use lldb -p <pid> from the command line or process attach --pid <pid> inside lldb. The terminal must be authorized under System Settings > Privacy & Security > Developer Tools, otherwise attach fails with permission denied.

How do I set breakpoints in lldb by symbol or address?▼

Use breakpoint set -n <symbol> for symbol names, -a <address> for raw addresses, and -r <regex> for pattern matching. Symbol breakpoints are preferred because ASLR changes module base addresses on every run.

Why does lldb attach fail with permission denied on macOS?▼

Attach failures come from the macOS permission stack: TCC Developer Tools authorization, task_for_pid entitlement, Hardened Runtime on the target, and SIP. Check each layer in order with csrutil status and target signature inspection rather than disabling SIP.

Can lldb debug stripped binaries without symbols?▼

Yes, but breakpoint set -n will not resolve. Use image lookup -a to map addresses to modules, image list -o to get ASLR base offsets, and set address breakpoints computed from the runtime base.

When should I use gdb or x64dbg instead of lldb?▼

Use gdb for Linux targets and x64dbg for Windows targets. lldb is the right choice for macOS and iOS userland debugging and also works well on Linux for DWARF-based debug builds from the clang toolchain.

Related Skills

Explore More Software Engineering Skills→
LeoWSY-hashblueLeoWSY-hashblue
3

reverse-engineering

Identify and map reverse-engineering patterns in ELF/PE/Mach-O binaries.

Community
Advanced
FYTJFYTJ
2

lldb-debug

Debug C/C++ applications with LLDB breakpoints, crash analysis, and core-dump inspection.

Community
Advanced
dariushouledariushoule
196

state-snapshot

Capture committed memory regions and processor state from x64dbg sessions.

Community
Intermediate
lNwNllNwNl

anti-debugging-techniques

Detect and bypass anti-debugging checks in Linux and Windows binaries during reverse engineering.

Community
Advanced