Help/Support How to bypass ASLR?

CodeName9 · July 19, 2020

Hi!

before, i was looking around on some tutorial, and specifically how to remove or bypass ASLR but im not sure if these tutorials are up to date, i believe one was posted back in 2015?

And i was reminded again whilst looking at the chat box, so i thought i'd create another support topic with the chance maybe someone can help me? ; How to bypass ASLR?

thanks!

also if it helps, im on ios 13.

bR34Kr · July 19, 2020

To "bypass" ASLR, you need to find the ASLR offset so you can add/subtract it from your offset to know its original/ASLRed offset. To get it when hooking to a process use this function:

_dyld_get_image_vmaddr_slide()

(Info here -> https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/dyld.3.html)

The header for it is on the manpage

For removing it from your LLDB session you want to do

image list PROC_NAME

in LLDB (while replacing PROC_NAME with the process name). That will give you the ASLR offset for that process and you need to subtract it from every offset you get through it