Help/Support IDA vs LLDB

NotEriic · June 7, 2020

My Problem is that IDA showing me completely different stuff as LLDB.

What am I doing wrong?

[0] 8BA24170-A59C-3970-B1A2-2C11498DE299 0x000000010065c000 /private/var/containers/
Bundle/Application/47AE9E6E-BAE8-4E9D-8053-4D2978394860/PSD.app/PSD

// ASLR = 65c000

Watchpoint 1 hit:
old value: 21238
new value: 21188
Process 10300 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x00000001007c5d80 PSD`___lldb_unnamed_symbol6972$$PSD + 48
PSD`___lldb_unnamed_symbol6972$$PSD:
->  0x1007c5d80 <+48>: mov    w1, #0x1
    0x1007c5d84 <+52>: bl     0x1007c214c               ; ___lldb_unnamed_symbol 
6919$$PSD
    0x1007c5d88 <+56>: add    x8, sp, #0x18             ; =0x18
    0x1007c5d8c <+60>: mov    x1, x21

// Offset = 1007c5d80
// Offset - ASLR = 100169D80
// IDA Offset = 100169D80

My Problem is that IDA showing me completely different stuff as LLDB.

__text:0000000100169D38 loc_100169D38                           ; CODE XREF: sub_100169088+CA4↑j
__text:0000000100169D38                 LDR             X0, [X19,#0x368]
__text:0000000100169D3C                 LDR             X8, [X0]
__text:0000000100169D40                 LDR             X8, [X8,#0x208]
__text:0000000100169D44                 MOV             X1, X24
__text:0000000100169D48                 BLR             X8
__text:0000000100169D4C                 LDR             X8, [X24]
__text:0000000100169D50                 LDR             X8, [X8,#0x80]
__text:0000000100169D54                 MOV             X0, X24
__text:0000000100169D58                 MOV             V0.16B, V9.16B
__text:0000000100169D5C                 BLR             X8
__text:0000000100169D60                 LDR             X8, [X24]
__text:0000000100169D64                 LDR             X8, [X8,#0x170]
__text:0000000100169D68                 MOV             X0, X24
__text:0000000100169D6C                 MOV             W1, #0
__text:0000000100169D70                 BLR             X8
__text:0000000100169D74                 ADD             W25, W25, #1
__text:0000000100169D78                 CMP             W25, #0x1E
__text:0000000100169D7C                 B.CC            loc_100169D10
__text:0000000100169D80                 ADRP            X1, #aPinballUi17Png@PAGE ; "pinball/ui_17.png"
__text:0000000100169D84                 ADD             X1, X1, #aPinballUi17Png@PAGEOFF ; "pinball/ui_17.png"
__text:0000000100169D88                 SUB             X0, X29, #-var_A8
__text:0000000100169D8C                 BL              sub_100167760
__text:0000000100169D90                 ADRP            X1, #aPinballUi18Png@PAGE ; "pinball/ui_18.png"
__text:0000000100169D94                 ADD             X1, X1, #aPinballUi18Png@PAGEOFF ; "pinball/ui_18.png"
__text:0000000100169D98                 ADD             X0, SP, #0x170+var_C0
__text:0000000100169D9C                 BL              sub_100167760
__text:0000000100169DA0                 ADRP            X1, #asc_100F46CC8@PAGE ; ""
__text:0000000100169DA4                 ADD             X1, X1, #asc_100F46CC8@PAGEOFF ; ""
__text:0000000100169DA8                 ADD             X0, SP, #0x170+var_D8
__text:0000000100169DAC                 BL              sub_100167760
__text:0000000100169DB0                 SUB             X0, X29, #-var_A8
__text:0000000100169DB4                 ADD             X1, SP, #0x170+var_C0
__text:0000000100169DB8                 ADD             X2, SP, #0x170+var_D8
__text:0000000100169DBC                 MOV             W3, #0
__text:0000000100169DC0                 BL              sub_100972734
__text:0000000100169DC4                 MOV             X23, X0
__text:0000000100169DC8                 LDRSB           W8, [SP,#0x170+var_C1]
__text:0000000100169DCC                 TBZ             W8, #0x1F, loc_100169DD8
__text:0000000100169DD0                 LDR             X0, [SP,#0x170+var_D8] ; void *
__text:0000000100169DD4                 BL              __ZdlPv ; operator delete(void *)

0xNoctis · June 8, 2020

What's You're Device

NotEriic · June 8, 2020

1 hour ago, Noctisx said:

What's You're Device

iPad Mini 4

0xNoctis · June 8, 2020

6 minutes ago, NotEriic said:

iPad Mini 4

What IOS

NotEriic · June 8, 2020

1 hour ago, Noctisx said:

What IOS

13.5

LLDB and IDA had the right Offset before I updated the App.

Updated June 8, 2020 by NotEriic

0xNoctis · June 8, 2020

5 minutes ago, NotEriic said:

13.5

LLDB and IDA had the right Offset before I updated the App.

Hm Maybe The offsets from lldb and IDA are The same but diff offset maybe search in IDA the offset you get in lldb or get Dnspy if its a unity game

NotEriic · June 8, 2020

Just now, Noctisx said:

Hm Maybe The offsets from lldb and IDA are The same but diff offset maybe search in IDA the offset you get in lldb or get Dnspy if its a unity game

Do you know how to hack games with DnSpy? LuL 😆

I've already hacked the App.

The weird thing is, the Offset I got before Updating the App is the same as now. But my Hack won't work anymore?!

0xNoctis · June 8, 2020

Just now, NotEriic said:

Do you know how to hack games with DnSpy? LuL 😆

I've already hacked the App.

The weird thing is, the Offset I got before Updating the App is the same as now. But my Hack won't work anymore?!

Dnspy just Shows all the offsets for like "getVIP" the VA = Offset will be there and it will be a bool just place that into the Live offset patcher but thats Only unity games as youll need to dump it to get the DummyDLL files

Also maybe they have added another Function to whatever your trying to hack