Help/Support How to bypass ASLR?

[CodeName9 5k iPad Pro (3rd gen) 15.3.1]

Hi!

before, i was looking around on some tutorial, and specifically how to remove or bypass ASLR but im not sure if these tutorials are up to date, i believe one was posted back in 2015?

And i was reminded again whilst looking at the chat box, so i thought i'd create another support topic with the chance maybe someone can help me? ;  How to bypass ASLR?

thanks!

also if it helps, im on ios 13.

[bR34Kr 19.3k]

To "bypass" ASLR, you need to find the ASLR offset so you can add/subtract it from your offset to know its original/ASLRed offset. To get it when hooking to a process use this function:

_dyld_get_image_vmaddr_slide()

(Info here -> https://developer.apple.com/library/archive/documentation/System/Conceptual/ManPages_iPhoneOS/man3/dyld.3.html)

The header for it is on the manpage

 

 

For removing it from your LLDB session you want to do

image list PROC_NAME

in LLDB (while replacing PROC_NAME with the process name). That will give you the ASLR offset for that process and you need to subtract it from every offset you get through it