Works now, don't ignore

Works: you can attach a debugger to processes

Doesn't work: the image mounts and loads the launchd jobs, but the launchd jobs can only refer to binaries on the DeveloperDiskImage.

I tried adding my own (developer signed) binaries and it didn't work; not sure if I need to do something specific...

./gencert.sh, or just use the existing certs
sudo ./patchddi.sh
Open cert.pem on your device
Settings -> General -> VPN & Device Management -> AbsoluteSolver DDI -> Install

** WARNING **: adding a certificate SEVERELY reduces your device's security. (The certificate has an expiry date of 2014 to match Apple's, so I don't think this can be used to sniff network traffic, but I'm not completely sure.) Remove this cert IMMEDIATELY after mounting, or (better) generate your own cert.pem
unplug phone (to prevent Xcode from mounting a Developer Disk Image)
reboot device
use any MacDirtyCow file switcher to switch /System/Library/Lockdown/iPhoneDebug.pem with cert.pem
plug in phone
ideviceimagemounter DeveloperDiskImageModified.dmg DeveloperDiskImageModified.dmg.signature
I couldn't figure out what to do with this, so I just made another debugserver LaunchDaemon that launches on port 24601
iproxy 24601 24601
lldb can attach to processes:
- process connect connect://localhost:24601
- attach <pid>
- it'll take about a minute to pull the libraries from dyld cache, then it attaches
but lldb can't spawn processes:
- target create /bin/ps
- process connect connect://localhost:24601
- run
- You'll get a sandbox denial in Console.app from debugserver trying to start /bin/ps:
  
  1 +0.000000 sec [0198/0103]: error: ::posix_spawnp ( pid => 0, path = '/bin/ps', file_actions = , attr = , argv = , envp = ) err = Operation not permitted (0x00000001)

Thanks to @alkalinesec for the approach.

Provide feedback