Couldn't load top-level module Foundation

[menushka]

A lot of the methods in the plugin don't seem to be working for me. They all seem to revolve around giving me this "Couldn't load top-level module Foundation". Sorry if this is a dumb question, I'm very new to reverse engineering binaries.

(lldb) dclass
Dumping classes
error: error: while importing modules:
error: Couldn't load top-level module Foundation


(lldb) search UIView
error: 
**************************************
error: error: error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableArrayRef'
error: unknown type name 'CFMutableSetRef'
error: use of undeclared identifier 'CFMutableSetRef'
error: use of undeclared identifier 'CFMutableSetRef'
error: use of undeclared identifier 'CFMutableArrayRef'
error: 'NSClassFromString' has unknown return type; cast the call to its declared return type
error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableArrayRef'
error: use of undeclared identifier 'CFIndex'
error: assigning to 'uint32_t' (aka 'unsigned int') from incompatible type 'char *(const char *, int)'
error: while importing modules:
error: Couldn't load top-level module Foundation

I tried following along with your "Reverse Engineering the iOS Simulator’s SpringBoard" but dumping the SpringBoard classes returned zero results. Any ideas what could be wrong?

(lldb) dclass -m SpringBoard
Dumping classes
error: error: while importing modules:
error: Couldn't load top-level module Foundation

[DerekSelander]

LLDB is complaining about not knowing about the Foundation framework's headers. You are either: too early in the process for Foundation is loaded, Foundation is not loaded in the process you are inspecting or LLDB couldn't import the header.

If it's the last one, I'd try a cpo @import Foundation first, then a image list Foundation to make sure it is indeed loaded.

If that doesn't fix that, I'll need more details

[menushka]

(lldb) cpo @import Foundation
error: while importing modules:
error: Couldn't load top-level module Foundation

(lldb) image list Foundation
[  0] E5391C7B-0161-33AF-A5A7-1E18DBF9041F 0x000000010b776000 /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer/Library/CoreSimulator/Profiles/Runtimes/iOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/Frameworks/Foundation.framework/Foundation 
(lldb) dclass -m SpringBoard
Dumping classes
error: error: while importing modules:
error: Couldn't load top-level module Foundation

From my understanding it seems like it already loaded? But still no luck. What kind of details would help?

[DerekSelander]

Are you debugging via the simulator or on a jb device? If jb was jb are you using and what's your iOS version?

If it's a jb, try setting breakpoint at a spot you know you'll hit and see what happens, if that's an error, that's a certain problem (see http://newosxbook.com/articles/MDGA.html)

If you are debugging the SB on the Simulator, how early in to the process are you? If you are too early, then try continuing to a later part in the process to see if it's fixed.

[menushka]

Currently I'm debugging on a simulator (iPhone XS, 12.1). I've tried it on other versions and simulators and get similar errors. How would I continue in a later part? Like this?

(lldb) continue
Process 1994 resuming
(lldb) process interrupt
Process 1994 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
    frame #0: 0x00000001122d1c2a libsystem_kernel.dylib` mach_msg_trap  + 10
libsystem_kernel.dylib`mach_msg_trap:
->  0x1122d1c2a <+10>: ret    
    0x1122d1c2b <+11>: nop    
libsystem_kernel.dylib'mach_msg_overwrite_trap:    0x1122d1c2c <+0>: mov    r10, rcx
    0x1122d1c2f <+3>:  mov    eax, 0x1000020
    0x1122d1c34 <+8>:  syscall 
    0x1122d1c36 <+10>: ret    
    0x1122d1c37 <+11>: nop    
libsystem_kernel.dylib'semaphore_signal_trap:    0x1122d1c38 <+0>: mov    r10, rcx
Target 0: (SpringBoard) stopped.
(lldb) dclass -m SpringBoard
Dumping classes
error: error: while importing modules:
error: Couldn't load top-level module Foundation

[DerekSelander]

Unfortunately, I don't have a 12 jb device. I'll do some digging over this week to see if there's a testable solution for this.

[menushka]

Ok thanks!

[nilminus]

I have the exact same behaviour as @menushka, working at a simulator, attaching to Springboard:

(lldb) search NSObject
error:
**************************************
error: error: error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableArrayRef'
error: unknown type name 'CFMutableSetRef'
error: use of undeclared identifier 'CFMutableSetRef'
error: use of undeclared identifier 'CFMutableSetRef'
error: use of undeclared identifier 'CFMutableArrayRef'
error: 'NSClassFromString' has unknown return type; cast the call to its declared return type
error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableSetRef'
error: unknown type name 'CFMutableArrayRef'
error: use of undeclared identifier 'CFIndex'
error: assigning to 'uint32_t' (aka 'unsigned int') from incompatible type 'char *(const char *, int)'
error: while importing modules:
error: Couldn't load top-level module Foundation

It only breaks through standalone lldb; In Xcode-lldb, the command works as intended.

[melvyn2]

I'm having the same issue, but while debugging a normal osx binary.

[doronz88]

I found myself having the same problem, but strangely updating the OSX version to the latest fixed that.
As it seems, Apple changed the layout of /System/Library/Frameworks and the latest debugserver seems somewhat broken when using without the latest version of the OSX.