Beautify lldb: customizing lldb with Voltron, Tmux and Tmuxinator

Hi, everyone. Batistella here again.

In my last post, I talked a little bit about shellcode in macOS and some aspects of memory permissions. And, one thing that I forgot to show is this screen:

That’s the screen of the macOS built-in debugger called lldb. However, the original screen is not that. That is the ‘face’ of this debugger without any modifications:

Way harder to understand what is happening with the stack, the registers or anything in general.

So, with the help of Voltron, Tmux and Tmuxinator, today, I want to show how to get this setup in order to help you analyze any binary. (And because the process is not exactly as easy as you might think).

The Torture (process)

The first thing you should thing about, is to guarantee that you have your $PATH updated. Ah, I highly recommend you to do this hole process with the root privileges.

export PATH=”/path/your/python/bin/path:$PATH”

Next, let’s install Homebrew, if have not already. (This could take a while)

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Once with homebrew installed, it is time to install wget (because it does not comes installed already in macOS). :’>

brew install wget

Right, we are ready to begin the process.

First, head to the official Voltron Github’s page, clone it and run the installer script with root privileges.

git clone git clone https://github.com/snare/voltron.git
cd voltron
sudo sh install.sh

Great, after that, time to install Tmux. Simply run: (This could take a while as well)

Now comes the difficult part: installing Tmuxinator. In the Github’s official project page, it shows two options to install it, via homebrew or ruby gem. I have tested via homebrew and it seems it did not work for me (or after 20 minutes of a frozen prompt I simply lost my patience). So, I’ll show via ruby’s gem, but feel free to try it via the easiest way:

brew install tmuxinator

First, let’s install ruby: (This could really take a time to complete)

brew install ruby

After that, simply type:

sudo gem install tmuxinator

In my case, my ruby version is outdated so it could not install the latest version of tmuxinator, but gave me the option to install the 3.3.4 version of it. Let’s try to install this version.

sudo gem install tmuxinator -v 3.3.4

Great, following the documentation, it says to export a variable named EDITOR with the name of a terminal editor, like VI, VIM, NANO etc and create a new tmuxinator template; I named my voltron:

NOTE: do not forget to do this step with root.

echo $EDITOR
export EDITOR='nano'
tmuxinator new voltron

After that, copy and past this config into the .yml file created and save it:

# ~/.tmuxinator/voltron.yml
name: voltron
root: ~/
windows:
  # two spaces
  - madhax:
      # four spaces
      layout: 15a8,169x41,0,0{147x41,0,0[147x13,0,0{81x13,0,0,60,65x13,82,0,61},147x19,0,14,62,147x7,0,34{89x7,0,34,63,57x7,90,34,64}],21x41,148,0,65}
      panes:
        # two spaces
        - voltron view disasm
        - voltron view bp
        - 
        - voltron view stack
        - voltron view bt
        - voltron view reg

This step is going to create a config file located at ~/.config/tmuxinator/<name>.yml.

Almost there. Since we have installed via gem, the documentation recommends you to run the following command in order to put the completion files where they will be loaded.

sudo wget https://raw.githubusercontent.com/tmuxinator/tmuxinator/master/completion/tmuxinator.zsh -O /usr/local/share/zsh/site-functions/_tmuxinator

That’s it. Hopefully, you should have a beautiful lldb now. Let’s test it. Start the tmuxinator session with:

root# tmuxinator start <name_given_by_you>

If everything worked properly, you should see a screen as above. Only the terminal in the middle is to be used to manipulate the files as you want and load them into lldb. To access it, press CTRL + B, and down arrow. Now, you should have a terminal in the middle accessible.

In order to test it, I have created a simple ASM script to print a happy face on the terminal.

Let’s load it and see if we can analyze it:

Great, worked perfectly.

See, today’s post was not a big deal, but I had terrible times trying to remembering all the process necessary in order to make lldb easier to manipulate. Now, there is not need to go through that again.

That’s pretty much everything I wanted to cover today and I hope this post could be useful for you. Thank you so much for your time.

Bye.

Vinicius Batistella Bispo