How to reinstall / reset lldb?

Question

My LLDB seems like broken by a plugin. Its output seems a little bit weird like this:

Process 771 stopped
* thread #1, stop reason = signal SIGSTOP
    frame #0: 0x0000000100ac1000 cy-5Xn7dn.dylib`_dyld_start
cy-5Xn7dn.dylib`_dyld_start:

I don't know what cy-5Xn7dn.dylib is and I want to reinstall/reset my LLDB to fix this problem. Is there any possible way to reinstall or reset it?

Update:

This is otool information:

$ otool -l /usr/bin/lldb|grep " name"
         name /usr/lib/dyld (offset 12)
         name /usr/lib/libxcselect.dylib (offset 24)
         name /usr/lib/libSystem.B.dylib (offset 24)

@trojanfoe I have already removed the plugin by deleting all the content in `.lldbinit` file. The plugin seems not loaded after I did this. But the weird outputs are still there. — r1cdjuabna1djauk1u, Jun 28 '20 at 08:37
@trojanfoe Yes, I also restarted my computer, but it didn't work. — r1cdjuabna1djauk1u, Jun 28 '20 at 08:39
You could try removing Xcode then I guess, using something like *AppCleaner*, and then reinstalling it. It's crappy advise tho. — trojanfoe, Jun 28 '20 at 08:41
And you've done `find / -name cy-5Xn7dn.dylib` from the shell to check if this `.dylib` is real or not? — trojanfoe, Jun 28 '20 at 09:06
Can you provide output of `otool -l /usr/bin/lldb|grep " name"`? — Kamil.S, Jun 28 '20 at 11:57
@ZinLu your lldb looks legit. It seems something else is trying to load the `cy-5Xn7dn.dylib` either some rootkit or maybe some corporate administrative tool. You could also try `echo ${DYLD_INSERT_LIBRARIES}` in terminal. — Kamil.S, Jun 29 '20 at 07:36
@Kamil.S I tried `echo ${DYLD_INSERT_LIBRARIES}`, and the output is empty. — r1cdjuabna1djauk1u, Jun 29 '20 at 07:56

score 0 · Answer 1 · answered Jul 02 '20 at 00:03

It looks like something is loading an alternative to the normal dynamic loader into the program you are running? I don’t think this is something lldb is doing, however. It is just relaying to you the dynamic library information that it got from the dynamic loader.

I’d first find that oddly named library and see if that tells you anything. You can use the lldb ‘image list <library_name>’ command to get the full path to the library. Is that in a place that maybe explains what it is?

It is possible to specify an alternate dynamic loader with the LC_DYLINKER command in the main binary. You might check the program you are debugging to see if it is doing that.

The DYLD_INSERT_LIBRARIES environment variable can also be used to force a program to load some other dylib. You should also make sure that isn’t being set. You can use ‘expr (char *) printenv(“DYLD_INSERT_LIBRARIES”)’ in lldb to check What it is in the app directly.

Note, it is not uncommon for tools that encrypt binaries to use a special purpose loader, to decrypt code on load. Maybe you are debugging a program that does that? — Jim Ingham, Jul 02 '20 at 22:38
Yep, I am doing some iOS reverse engineering research. Thank you for your answer, I will try it later. — r1cdjuabna1djauk1u, Jul 03 '20 at 08:33
Here is `image list -o -f` result: `[ 1] 0x0000000104698000 /Library/Caches/cy-JXJcTY.dylib(0x0000000104698000)` but I can't find the dylib under `/Library/Caches` directory. — r1cdjuabna1djauk1u, Jul 12 '20 at 07:09

How to reinstall / reset lldb?

1 Answers1