D06
Debugger attached on an iPhoneValidated
Attaching LLDB from Xcode raises debugger_attached — plus hooking_dyld_insert, from Xcode's injected tooling.
How to read this page
A scenario is one test case: prepare the environment, run the steps, then compare the expected result (written before the run) with the observed result (copied from the run, with screenshots).
- D06 · D
- Run on a real phone, used normally.
- Validated
- Run, and the result matched what was expected.
Why it matters
Confirms the debugger check on hardware. Development builds usually ignore this signal.
Environment
- App
- Example app, library 0.2.1 (Release build with Frida Gadget, from A05)
- Device
- iPhone XS Max (A12), iOS 18.7.10, stock
- Tool
- Xcode with LLDB attached (Run from Xcode)
Setup
Prepare the environment.Then run the steps.
- 01Build the app without ignoring debugger_attached.
- 02Run it from Xcode so LLDB is attached.
Steps
What to run.What to read.
- 01Open the app with the debugger attached.
- 02Read the status and signals.
- 03Launch again from the home screen (no debugger) and compare.
Expected result · written before the run
Status: compromised1 signal.
Xcode also injects its view-debugging library through DYLD_INSERT_LIBRARIES, so hooking_dyld_insert is expected alongside.
Observed result · copied from the run
Status: compromisedObserved 2026-10-02.
Observed during the A05 run. hooking_libraries comes from the Frida Gadget embedded in that build, not from the debugger. Both debugger_attached and hooking_dyld_insert disappear without Xcode. The iOS Simulator with LLDB attached (S01, second screenshot) also reported debugger_attached.
Run from Xcode: Status COMPROMISED · [debugger] debugger_attached · [hooking] hooking_dyld_insert · [hooking] hooking_libraries. Launched from the home screen, the same build reported hooking_libraries only.
Checks this scenario covers
Every check this test case touches — including ones that aren't expected to fire here. The expected and observed results above say which ones should and did. Each links to how the check works.