Using the binary slows down load time, but gives you access to the symbols that are in the binary. It is possible to use the debugger with or without the Mach-O kernel binary. Debugging with lldb is beneficial for virtual devices running iOS because lldb already has built-in knowledge of the Mach-O format and the fact that it is dealing with an XNU kernel.

The platform supports the version of LLDB that ships with Xcode on macOS. The output will appear in IDA's text output window above. For instance, instead of monitor sr, simply write sr and press Enter. Enter the monitor commands there, without the word monitor itself. To access monitor commands from IDA, locate the GDB command line bar at the bottom of the window (just above the status bar, next to a GDB button). After this setup, which is saved in the IDA database, select Debugger | Attach to process. from main menu, enter the stub's address in the Hostname and Port fields. Finally, select Debugger | Process options.Click the Set specific options button and make sure the Use stepping support checkbox is checked. Then, again from main menu, select Debugger | Debugger options.from main menu, then pick Remote GDB debugger in the dialog box. On the local gdb end, nothing will visually indicate that this is happening unless the condition is met, in which case you’ll receive a prompt. This is how gdb functions, but it is typically not noticeable for local debugging. If you use features like watch / awatch / rwatch with conditions, every breakpoint is sent to your local machine, the condition is calculated, and then resumed if it was meant to ignore. High latency can cause the VM to visually “freeze” or “stutter” as the underlying kernel is breakpointing and communicating with your gdb.Only one concurrent debug stub connection is supported per VM.Also, only actual RAM is visible to the debugger access to MMIO regions is ignored / returns 0. Memory addresses from debugger are passed through virtual-to-physical address translation - this is necessary to make it work.(Up to 4 of each at a time.) Software breakpoint packets issued to the stub are converted into hardware breakpoints.

Hardware breakpoints and watchpoints are supported.In case of vCont packets, if a CPU single-steps and other CPUs do not have actions specified, they do not perform a step.

Single-stepping is supported by using AArch64 single-stepping features.Only all-stop mode is supported: if one CPU stops, the others stop as well.(GDB protocol does not allow for a thread called 0.) For instance, on an iPhone 6, there are two threads: 1 and 2, corresponding to CPU 0 and CPU 1. The kernel debug stub presents the multiple CPUs in the system as 'threads' of the process being debugged.

How to find kernel stack size