The engine logs the observatory URL, but for a real iOS device that log is no longer accessible from the attached host, so there's a series of mDNS/other fallbacks in place to try to detect and then guess this port.

ios-deploy uses lldb to launch the app on an iOS device, and could be configured to remain attached to read logs from the process, including the observatory logs, launch exceptions, or anything printed before the VM is connected.