General Easiest way of finding arm64 offset from armv7 offset?

[Rook 548.3k Donor]

Hello,

 

I'm noticing some apps don't work well with iOS 9.3+. They start crashing in the splash screen or like MapleStory, it detects if the binary is modified.

 

Do you guys have any suggested way of finding arm64 offsets if you have the x32 ones and no strings around?

 

 

Thank you!

[AnotherLurker 1.5k]

There really isn't much if you don't have strings. The only tool you have at your arsenal is comparing the 2 architectures. When programming an application, the same code is being converted into both armv7 and arm64, so if you compare those 2 (arm64 has some different instructions, but they do the same things), you should be able to find your way around

[Rook 548.3k Donor]

There really isn't much if you don't have strings. The only tool you have at your arsenal is comparing the 2 architectures. When programming an application, the same code is being converted into both armv7 and arm64, so if you compare those 2 (arm64 has some different instructions, but they do the same things), you should be able to find your way around

Like for example converting a few x32 instructions to x64 and then converting x64 instruction to hex so you can find the function?

[AnotherLurker 1.5k]

Like for example converting a few x32 instructions to x64 and then converting x64 instruction to hex so you can find the function?

 

It's not that simple. Unless they're simple instructions like add/sub, you won't be able to do that. Branches for example depend on offsets, which are much different, and it's highly unlikely there may be some guaranteed difference in the offsets from 32-bit and 64-bit.

[Rook 548.3k Donor]

It's not that simple. Unless they're simple instructions like add/sub, you won't be able to do that. Branches for example depend on offsets, which are much different, and it's highly unlikely there may be some guaranteed difference in the offsets from 32-bit and 64-bit.

Simple instructions of course. Simple instructions that come one after another. So you can narrow down the occurrences in x64.

[AnotherLurker 1.5k]

Simple instructions of course. Simple instructions that come one after another. So you can narrow down the occurrences in x64.

 

Yea that would work. As you can imagine, the more simple instructions, the better your chances of finding the arm64 locations

[TripMX 17]

So in theory:

 

ARM x32

LDR R1, R0

is NOT the same as

 

ARM x64

LDR X1, X0

....even if the identical offset happens to be within the identical function?