Goran

i installed Theos from this tutorial... and all went good... then i copied template how instruction said in this one... But when i start command in terminal as su... /var/theos/bin/nic.pl is says... this sh: /var/theos/bin/nic.pl: /usr/bin/perl: bad interpreter; No such file or directory i installed just theos and this template... so what is wrong here, and what i miss...

Great tutorial, thanks a lot... this is good one.. i hope you will make good one too for advanced also you are doing this REALLY GOOD, so i hope you will make for Arm64 too... hope that advanced one is coming soon... RESPECT+++ just change this in tutorial to be perfect... "Alright, so we want to know the ida offsets of the gameplayer addresses we have." its not offset, its address.. offset in Ida is at bottom.. thanks man... ❤❤❤ PID= Process ID this need to be edited also,,, " The first offset, is the ida hex offset & the second is the hacked offset" this " The first offset, is the ida hex offset & the second is the hacked HEX" to this @Ted2

if i try to watch or breakpoint nothing... also everything with ASLR is done... calculated etc... and in ida pro it shows this one....

thansk man

what is backtrace function? when we are using this and how?

am begginer and when i get basics, i will make tutorial like you never seen before... to make it clear once for all... cuz i get many troubles by now.. because of lack of information and deformations... in tutorials.... binary was ARM64bit, but i thinned binary, and it works on iPhone 6s.. i found with iGG value its I64, and in lldb gave me this weird function, so i ask, what means this function??? why have codes like that??? -> 0x425cb4: andlo r6, r1, r0, lsr r11 0x425cb8: andlt r6, r7, r0, lsr r3 0x425cbc: stceq p8, c14, [r0, #-756]

you need to check places where is goes in ida to compare.... and then try that to watch....

@K_K you solved me many mistery, can you tell me why this code look like this??? also i sent you pm about code in CoinDozer.. Thanks man a lot for all your help..

nope, why to remove ASLR when i substract it from hex....

some game cant be unlinked.....

Here it is in details... i have iPhone 6s, that app is ARM64 and ARM7, so i thinned binary to ARMv7, and it works on phone... i found value for diamonds in app it is I64 in iGG, attached to lldb, do image list... w s e -- 0xiGGaddress and got this in lldb... * thread #1: tid = 0x36f39, 0x00425cb4 covetHome, stop reason = watch 1 frame #0: 0x00425cb4 covetHome -> 0x425cb4: andlo r6, r1, r0, lsr r11 0x425cb8: andlt r6, r7, r0, lsr r3 0x425cbc: stceq p8, c14, [r0, #-756] than i was stuck... because when i go 425cb4-F4000(ASLR) it give me "331cb4" ida address... but in IDA, there is no that address, as you can see on picture... Tried to watch and breakpoint those 0x425cb4, 0x425cb8, 0x425cbc... but no luck... here is IDA PRO part... as you can see here even don't have 331cb4 address... so what can it be problem here, because functions don't match... and how could you solve this? if you are working on that...

"IMAGE LIST" of course, i got ASLR in this case "F4000", but that is also have nothing with this on LLDB, aslr is important for IDA PRO, BUT WHAT TO DO IN THIS CASE? IF YOU GOTZ THIS ONE, WHAT YOU WILL DO NEXT IN THIS CASE?

@Ted2 man where did you got that i do watch on ida ADDRESS??? that is not offset that is ADDRESS.... i just gave you example where that lead me in ida... in which function.... man, you dont get the point what i ask... I JUST ASKED WHAT TO DO NEXT, SINCE THIS CAN BE IDA FUNCTION, THAT IDA FUNCTION NOT EXIST.... SO WHAT IS NEXT STEP, ALSO THERE IS NO OTHER IGG ADRESS TO WATCH JUST ONE THAT...

thats the case, it is now always, but i just post here and it says R1... that is not important in this case, important is WHAT TO DO NEXT.... TRIED TO WATCH 0x425cb4: andlo r6, r1, r0, lsr r11 0x425cb8: andlt r6, r7, r0, lsr r3 0x425cbc: stceq p8, c14, [r0, #-756] BUT NOTHING HAPPENED...

this is what i got in IDA PRO sub_331CA6 PUSH {R4-R7,LR} ; Push registers ADD R7, SP, #0xC ; Rd = Op1 + Op2 MOV R4, R1 ; Rd = Op2 MOV R5, R0 ; Rd = Op2 LDR R0, [R4,#0xC] ; Load from Memory LDR R0, [R0,#0x54] ; Load from Memory LDR.W R6, [R0,#0xD0] ; Load from Memory MOV R0, R6 ; Rd = Op2 BL.W sub_FB2FC8 ; Branch with Link MOV R0, R6 ; Rd = Op2 BL.W sub_FC5A74 ; Branch with Link MOV R6, R0 ; Rd = Op2 LDR R0, [R4,#0xC] ; Load from Memory MOV R1, R5 ; Rd = Op2 LDR R0, [R0,#0x54] ; Load from Memory LDR.W R2, [R0,#0xD4] ; Load from Memory MOV R0, R6 ; Rd = Op2 LDR R3, [R2] ; Load from Memory BLX R3 ; Branch with Link and Exchange (register indirect) MOV R0, R6 ; Rd = Op2 POP {R4-R7,PC} ; Pop registers

I know that R1 hold value, but how the hell i find in ida when this dont exist

i just got one address from iGG, then i w s e over LLDB, and got this * thread #1: tid = 0x36f39, 0x00425cb4 covetHome, stop reason = breakpoint 1.1 frame #0: 0x00425cb4 covetHome -> 0x425cb4: andlo r6, r1, r0, lsr r11 0x425cb8: andlt r6, r7, r0, lsr r3 0x425cbc: stceq p8, c14, [r0, #-756] what i need to do next??? to watch or breakpoint what???

thanks will study this

Nope, game can be edited with iGG, but am learning on this one IDA PRO... over LLDB....

Here is function, that i got from LLDB.. it is for coins... X1 and W1 hold values. i need something to increase coins... to increase intead of decrease, or to be big constant value... GAME IS NOT SERVER SIDED, CAN BE EDITED WITH IGG... BUT AM LEARNING ON THIS GAME.. SO I GO OVER LLDB AND IDA PRO..

Done...

Difference Between ADDRESS and OFFSET In the initial days when I started writing assembly programs on my own I used to get confused as to when to use ADDRESS and when to use OFFSET in the program. This article is an attempt to clear the doubts of assembly programmers regarding the meaning and usage of ADDRESS and OFFSET. First and foremost, the purpose of using either ADDRESS or OFFSET is to get the memory address of variables during program execution. Now, we know that variables in any assembly program are of two types, i.e. local and global variables. While global variables remain in the memory throughout the execution of the program, local variables exist only during the execution of the functions in which they are declared and will be removed from the stack memory once the function in which they are declared completes is execution. Since the global variables exist in memory throughout the lifetime of a program's execution, their memory address is allocated during assembly time by the assembler. The assembler knows the exact location of the global variable's memory address during assembly time. In case of local variables, the assembler has no idea about the address of the variable as it's address is allocated during runtime in the stack as and when the function in which it is declared is executed. now coming back to our assembler instructions, OFFSET will get the address of a variable which already has it's address allocated. This in turn means, OFFSET could be used to get the address of global variables only. We cannot receive the address of a local variable by using OFFSET as the address of a local variable is not decided during assembly time. To overcome this difficulty we have ADDRESS instruction. This instruction should be used if we want to retrieve the address of a local variable. Now naturally a question arises as to how does ADDRESS know the address of a local variable while OFFSET cannot. Well, even ADDRESS will not know the actual address of a local variable as it is referred during assembly time. What ADDRESS actually does is a simple substitution in the code as follows, just before the function is executed. lea eax, localvar push eax What really this means is that ADDRESS causes the address of the local variable which is generated during runtime to be returned. lea is used to refer to the stack memory. LEA means Load Effective Address! It is used to load variables from the stack. If you still did not get it, then imagine a situation as follows. I am standing somewhere on the street there and you come to meet me there in search of the address of a beautiful girl which you feel I know. So, now your asking me of the address could be considered as the assembly time of the program, you are the assembly program in search of the (girl's) address and I am the assembler. Now if I know her exact address I'll give it to you: with perfect street address, door number, etc. This is what OFFSET does. Now if I don't know where she lives, but I know somebody who I know knows the address of that girl, then I'll give you the address of that somebody and ask you to checkout there for the address of the girl you are searching for. That's what ADDRESS does. So it's clear that even ADDRESS doesn't have the exact address of the variable. Now that we clearly know when to use ADDRESS and OFFSET, another question arises. Can we use ADDRESS to load global variables???? Yes, of course! If you are referring to global variables using ADDRESS, then ADDRESS simply substitutes is as following. mov eax, 3000h where 3000h is the actual address of the global variable. Remember, the actual address of a global variable is known during assemble and link time. But then, why does ADDRESS use LEA instead of MOV in case of local variables. Well, for the simple reason that mov eax,ebp+2 is an invalid CPU instruction. Note that EBP also known as base address is the register used to access stack, and it is in stack where the local variables are stored. Hence, LEA is used by ADDRESS in case of local variables. So it is clear that OFFSET is to be used to global variables and ADDRESS for local variables. ADDRESS could ALSO be used while referring to global variables, BUT OFFSET cannot be used while referring to local variables. Credits to author: http://www.hitxp.com/comp/pro/asm/120403.htm

its about usb mux tunneling.... and is really good, but i dont have software to compile this.... https://github.com/onlinemediagroup/ocaml-usbmux

I need explain whe is needed to re3verse HEX codes, for example, if i got address in LLDB 69 85 28, do i need to reverse it when i search in IDA PRO to 28 85 69...? When comes to that reverse, in which cases??? I need detail answer so i can understand... THANKS...

maybe it just need to be like that... also, what game is?