// Maximum packet size supported by remote stub.
//
// If not set, IDA will detect the maximum packet size as follows:
//   - use value specified by PacketSize response to qSupported (if available)
//   - use size of 'g' packet response
//   - use min size of 399 bytes

// MAXPACKETSIZE = 399


// Default timeout for remote iOS stub responses (milliseconds)

REMOTE_TIMEOUT = 1000


// Use stub's support for single-stepping, if available.
// Overrides configuration parameters below.

// SINGLE_STEP = 1


// Path to local iOS symbol cache.
//
// Assuming that you have already allowed Xcode to pull these symbols off of your device,
// specify the path here to allow for faster and more detailed debugging.
//
// These symbols are usually located in:
//    /Developer/Platforms/iPhoneOS.platform/DeviceSupport/<iOS version>/Symbols
// or possibly:
//    ~/Library/Developer/Xcode/iOS DeviceSupport/<iOS version>/Symbols

SYMBOL_PATH = "";


// Prevent the debugger from hooking into dyld_notify for library loads/unloads.
//
// Because of the dyld_shared_cache, iOS tends to be very liberal with library loading
// and can load hundreds of libraries even for simple apps. Thus, managing the images in memory
// (creating debugger segments, collecting debug names, etc.) can be complex and time consuming.
//
// If this option is set to YES, IDA will only load dyld and the executable module,
// which is often times sufficient for rudimentary debugging.

DISABLE_DYLD_NOTIFY = NO


// This option can be very useful for troubleshooting. It will instruct the debugserver
// to log important information about the remote debugged process to the device's system log,
// which can be retrieved with:
//
//   $ ios_deploy syslog -f /tmp/syslog.txt
//
// or with some other third-party tool, e.g. iOS Console (https://lemonjar.com/iosconsole).
//
// The config string should be formatted like this:
//
//    SYSLOG_FLAGS = "LOG_PROCESS|LOG_THREAD|LOG_EXCEPTIONS|LOG_RNB_PACKETS";
//
// All known LOG_... values are documented below.
//
//   LOG_PROCESS            // log generic events involving the debugged process
//   LOG_THREAD             // log important thread events
//   LOG_EXCEPTIONS         // log exceptions in the target process
//   LOG_SHLIB              // log information about shared library loads
//   LOG_MEMORY             // log memory reads/writes calls
//   LOG_MEMORY_DATA_SHORT  // log short memory reads/writes bytes
//   LOG_MEMORY_DATA_LONG   // log all memory reads/writes bytes
//   LOG_MEMORY_PROTECTIONS // log memory protection changes
//   LOG_BREAKPOINTS        // log software/exec breakpoints
//   LOG_WATCHPOINTS        // log information about hardware watchpoints
//   LOG_EVENTS             // log debugserver event loop
//   LOG_STEP               // log single stepping operations
//   LOG_TASK               // log mach task info for the target process
//   LOG_DARWIN_LOG         // log os_log*() and NSLog() messages
//   LOG_VERBOSE            // enable multiple logging options (LOG_DEFAULT is better)
//   LOG_ALL                // enable all logging options
//   LOG_DEFAULT            // alias for LOG_PROCESS|LOG_TASK|LOG_THREAD|LOG_EXCEPTIONS|LOG_SHLIB|LOG_MEMORY|LOG_BREAKPOINTS|LOG_WATCHPOINTS|LOG_STEP
//
// The following flags enable logging for the debugserver's internal logic (i.e. important operations not necessarily related to the debugged process).
//
//   LOG_RNB_PACKETS        // log all gdb remote packets sent/received by the server
//   LOG_RNB_COMM           // log communications (RNBSocket)
//   LOG_RNB_EVENTS         // log events         (PThreadEvents)
//   LOG_RNB_PROC           // log process state  (Process thread)
//   LOG_RNB_REMOTE         // log remote         (RNBRemote)
//   LOG_RNB_MINIMAL        // minimal logging    (min verbosity)
//   LOG_RNB_MEDIUM         // medium logging     (med verbosity)
//   LOG_RNB_MAX            // max logging        (max verbosity)
//   LOG_RNB_ALL            // enable all internal logging
//
// For more background, see RNBRemote.cpp in the lldb source.
//
// A good go-to logging option is:
//
//    SYSLOG_FLAGS = "LOG_DEFAULT|LOG_RNB_PACKETS";
//
// while at the same time using the "-z10000 -L/tmp/ida.log" command line options in IDA.
//
// This way both IDA and the debugserver are logging the gdb packets that are sent/received,
// so it is easy to match up events in IDA's log with events in the iOS syslog.

SYSLOG_FLAGS = "";


#ifdef __MAC__

// Launch the debugserver automatically. This option is only available on Mac.
//
// When AUTOLAUNCH is YES, IDA will connect to an iOS device, launch the debugserver on it,
// and automatically start a debugging session.
//
// If you don't want IDA to launch the debugserver automatically, set this option to NO.
// IDA will then connect to a running debugserver via 'hostname' and 'port' in the
// Process Options dialog.
// This option uses the MobileDevice framework to communicate with iOS devices,
// as of iOS 17 it is no longer a viable option.

// AUTOLAUNCH = YES


// Unique ID of the device IDA will use when debugging. This option is only available on Mac.
//
// For example, if AUTOLAUNCH = YES, IDA will try to find a connected device with the given device ID,
// and start a debugging session on this device. The target device can be also be specified in
// menu Debugger->Debugger options->Set specific options.
//
// If AUTOLAUNCH = NO, this ID will still be used for operations like attaching to a process -
// the list of running applications will be retrieved from the device with the given ID.
//
// If this option is not specified and the user has not specified the target device in
// the debugger specific options, IDA will simply use the first device it finds.

DEVICE_ID = "";


// Path to MobileDevice framework.
//
// This framework allows the debugger to work with iOS devices that have not been jailbroken.
// If empty, defaults to /System/Library/PrivateFrameworks/MobileDevice.framework/MobileDevice.

MD_PATH = "";

#endif


// copied from idp.hpp
#define PLFM_ARM        13        ///< Advanced RISC Machines

// format of the entries:
// "user description":
//  [
//    <IDA Platform ID>,
//    <0 for little-endian/1 for big-endian>,
//    <address size>,
//    <required processor-specific flags>,
//    <IDA processor name>,
//    <GDB architecture name>,
//    <root XML file name with register layout>,
//    <hex bytes of the software breakpoint instruction>,
//    <use stub's support for single-stepping, if available> (override with SINGLE_STEP)
//  ],

CONFIGURATIONS =
{
  // description         platform  bigendian addrsize reqflags processor archictecture xmlfile          softbpt     ss
  "ARM Little-endian": [ PLFM_ARM, 0,        4,       0,       "arm",    "arm",        "ios-arm.xml",   "FEDEFFE7", 1 ],
  "ARM64 (AArch64)":   [ PLFM_ARM, 0,        8,       0,       "arm",    "arm64",      "ios-arm64.xml", "D4200020", 1 ]
}

// Default configuration for instant debugging (without database)
#ifdef __EA64__
DEFAULT_CONFIG = "ARM64 (AArch64)";
#else
DEFAULT_CONFIG = "ARM Little-endian";
#endif

IDA_FEATURES =
{
  "arm":
  {
    "com.apple.debugserver.arm.general":
    {
      "title": "General Purpose Registers",
      "rename": { "cpsr": "psr" },
      "stack_ptr": "sp",
      "code_ptr": "pc",
      "frame_ptr": "r7",
      "data_ptr":
      [
        "r0", "r1", "r2",  "r3",  "r4",  "r5", "r6", "r7",
        "r8", "r9", "r10", "r11", "r12", "sp", "lr", "pc"
      ],
      "bitfields":
      {
        "psr":
        {
          "MODE": [  0,  4 ],
          "T":    [  5,  5 ],
          "F":    [  6,  6 ],
          "I":    [  7,  7 ],
          "A":    [  8,  8 ],
          "E":    [  9,  9 ],
          "IT":   [ 10, 15 ],
          "GE":   [ 16, 19 ],
          "J":    [ 24, 24 ],
          "IT2":  [ 25, 26 ],
          "Q":    [ 27, 27 ],
          "V":    [ 28, 28 ],
          "C":    [ 29, 29 ],
          "Z":    [ 30, 30 ],
          "N":    [ 31, 31 ]
        }
      }
    },
    "com.apple.debugserver.arm.single":
    {
      "title": "Floating Point Registers (Single Precision)"
    },
    "com.apple.debugserver.arm.double":
    {
      "title": "Floating Point Registers (Double Precision)"
    },
    "com.apple.debugserver.arm.neon":
    {
      "title": "NEON Registers"
    },
    "com.apple.debugserver.arm.state":
    {
      "title": "FP/Exception State Registers"
    }
  },

  "arm64":
  {
    "com.apple.debugserver.arm64.general":
    {
      "title": "General Purpose Registers",
      "rename":
      {
        "cpsr": "psr",
        "fp": "x29",
        "lr": "x30"
      },
      "stack_ptr": "sp",
      "code_ptr": "pc",
      "frame_ptr": "x29",
      "data_ptr":
      [
         "x0",  "x1",  "x2",  "x3",  "x4",  "x5",  "x6",  "x7",
         "x8",  "x9", "x10", "x11", "x12", "x13", "x14", "x15",
        "x16", "x17", "x18", "x19", "x20", "x21", "x22", "x23",
        "x24", "x25", "x26", "x27", "x28", "x29", "x30"
      ],
      "bitfields":
      {
        "psr":
        {
          "SPSEL": [  0,  0 ],
          "EL":    [  2,  3 ],
          "NRW":   [  4,  4 ],
          "F":     [  6,  6 ],
          "I":     [  7,  7 ],
          "A":     [  8,  8 ],
          "D":     [  9,  9 ],
          "IL":    [ 20, 20 ],
          "SS":    [ 21, 21 ],
          "V":     [ 28, 28 ],
          "C":     [ 29, 29 ],
          "Z":     [ 30, 30 ],
          "N":     [ 31, 31 ]
        }
      }
    },
    "com.apple.debugserver.arm64.low":
    {
      "title": "General Purpose Registers (Low 32-bits)"
    },
    "com.apple.debugserver.arm64.single":
    {
      "title": "Floating Point Registers (Single Precision)"
    },
    "com.apple.debugserver.arm64.double":
    {
      "title": "Floating Point Registers (Double Precision)"
    },
    "com.apple.debugserver.arm64.neon":
    {
      "title": "NEON Registers"
    },
    "com.apple.debugserver.arm64.state":
    {
      "title": "FP/Exception State Registers"
    }
  }
}

// IDA detects the architecture by using the target information sent by the GDB stub.
// The necessary information is: cpu name, endianness, and bitness.
// Extra flags may also be used to distinguish between sub-architectures.
//
// Since the GDB stub fails to provide the necessary information in a simple manner,
// IDA uses a combination of different methods until all fields are obtained.
//
// Each method may provide any number of fields, where the value of -1 represents a
// field that cannot be unequivocally detected by this method.
//
// If the target information sent by the GDB stub fails to provide endianness and
// bitness, IDA will attempt to detect those fields after starting or attaching to
// the debuggee by reading the returned registers values.

// Architecture name given by the <architecture> tag.
ARCH_MAP =
{ //         cpu       is_64 is_be flags
  "arm":   [ PLFM_ARM,  0,    0,   -1 ],
  "arm64": [ PLFM_ARM,  1,    0,   -1 ]
}

// Feature name given by the <feature> tags' "name" attribute.
FEATURE_MAP =
{ //                                       cpu       is_64 is_be flags
  "com.apple.debugserver.arm.general":   [ PLFM_ARM,  0,    0,   -1 ],
  "com.apple.debugserver.arm64.general": [ PLFM_ARM,  1,    0,   -1 ]
}

// A register name (from all <reg> entries) that uniquely identifies the architecture.
UNIQUE_REGISTER_MAP =
{ // reg   cpu       is_64 is_be flags
  "pc":  [ PLFM_ARM,  0,    0,   -1 ],
  "xpc": [ PLFM_ARM,  1,    0,   -1 ]
}