TuT How to Defeat/Remove ASLR On iOS 9 - Armv7 and ARM64 Devices

[mikeyb 8.8k iPad (5th Generation) 11.2.1]

I like gdb because you don't have to wait a million years

m on Yosemite and lldb actually flies for me via usb connection

[mikeyb 8.8k iPad (5th Generation) 11.2.1]

@@shmoo

 

added the gdb tut just for you

[Razzile 5]

glad you could read my tut

[Guest]

glad you could read my tut

lol

@@shmoo

 

added the gdb tut just for you

thanks man but I didn't need it

[KingRalph 819 9.3.5]

glad you could read my tut

Is it possible to automate this process with script?

[infernusdoleo 0 9]

Heads up - Just tried this on an armv7 binary running on an ipod touch 6th gen, iOS 9.0.2, and the first method you list, using the address in the image list output of lldb did NOT work for me. In fact the output of that was exactly the same as the info address _mh_execute_header output in gdb (I attached with GDB, read it, detached, then attached with lldb so I had the same session).

 

I needed to subtract the header offset from BOTH to get the correct position.

 

Not sure if thats a universal issue, but it applied in my situation.

[ada1016 10 iPhone Xs Max 15.6.1]

this is really key to learn

[i0s_tweak3r 12.4k iPhone X 13.5]

On 11/2/2015 at 3:18 PM, shmoo said:

GDB does work on ios 9 I use it all the time

Another forum member told me Gdb doesn't work on arm64 for iOS 9 or 10.  (I made sure to set permissions, owner and user as well but had errors like others in getting gdb working on ios 9 thread.)

Are you using Gdb from radare on your 6s running 9.3.3? 

Just wondering if I can stop trying to get lldb to work and give Gdb another chance. (On my 6s+ running 9.3.3)

Thanks in advance for clearing that up for me. 

[vinhthai222006 6.2k iPhone 5s 10.3.3]

(lldb) 10062ac58-54000
error: '10062ac58-54000' is not a valid command.

help me fix :(((

[Goran 1.9k]

@mikeyb @Ted2

Why you say here we got "correct offset for IDA"??? do you mean ADDRESS???