libsystem_kernel.dylibmacx_swapon: 0x1894c08b8 <+0>: mov x16, #-0x30 0x1894c08bc <+4>: svc #0x80 0x1894c08c0 <+8>: ret Target 0: (WeChat) stopped. Executable module set to "/Applications/WeChat.app/Contents/MacOS/WeChat". Architecture set to: arm64-apple-macosx-. (lldb) br set -n sqlite3_key Breakpoint 1: where = libsqlite3.dylibsqlite3_key, address = 0x000000019023352c
(lldb) c
Process 76031 resuming
(lldb) memory read --size 1 --format x --count 32 $rsi
error: Process is running. Use 'process interrupt' to pause execution.
(lldb)
➜ ~ sudo lldb -p $(pgrep WeChat) Password: (lldb) process attach --pid 76031 Process 76031 stopped
mach_msg2_trap + 8 libsystem_kernel.dylib
mach_msg2_trap: -> 0x1894c08b4 <+8>: retlibsystem_kernel.dylib
macx_swapon: 0x1894c08b8 <+0>: mov x16, #-0x30 0x1894c08bc <+4>: svc #0x80 0x1894c08c0 <+8>: ret Target 0: (WeChat) stopped. Executable module set to "/Applications/WeChat.app/Contents/MacOS/WeChat". Architecture set to: arm64-apple-macosx-. (lldb) br set -n sqlite3_key Breakpoint 1: where = libsqlite3.dylib
sqlite3_key, address = 0x000000019023352c (lldb) c Process 76031 resuming (lldb) memory read --size 1 --format x --count 32 $rsi error: Process is running. Use 'process interrupt' to pause execution. (lldb)