Help with disabling _syscall

[Zahir 392.8k iPad Mini 4 13.6]

haha worked for me in bia3 too

[Oxytyramine 42.3k iPhone X 13.3]

I know that already, this is one of the first forums I've signed up with. I know how to use GDB to find offsets in IDA and I know how to patch a binary. My first hack was a savegame for COD: BOZ for v1.3.3, I already learned MS, MSHook, and I'm doing IDA and code inject (writeData) right now and I'm working on Dead Trigger 2 but decided to take a break and do this because I get angry very easily lol

 

so im not really a beginner

 

@ 

@

sorry u were new thats why i thought that! ok then keep it up bro

haha worked for me in bia3 too

hack it or i will

[Zahir 392.8k iPad Mini 4 13.6]

@

 

go on, hack it legend

[Oxytyramine 42.3k iPhone X 13.3]

@

 

go on, hack it legend

@@ZahirSher but can i find values via iGG for gayloft games? 

[Guest]

@@ZahirSher but can i find values via iGG for gayloft games? 

you can

[Oxytyramine 42.3k iPhone X 13.3]

you can

ok thanks bro go on u too

[Guest]

I'm using a 5S by the way

 

I've never worked with disabling _syscall and _dlsym before so this is pretty hard, and I can't figure this out. I know that NOP'ing a BLX or any branch would result in a crash, so I stayed away from that. I xref'ed to operand for _dlsym and it gave me this:

 

__text:00648B04 loc_648B04                              ; CODE XREF: sub_648A04+D8j

__text:00648B04                 LDR             R0, [sP,#0x70+var_1C]

__text:00648B06                 BL              sub_649168

__text:00648B0A                 MOVS            R2, #1

__text:00648B10                 MOV             R1, #(_objc_msgSend_ptr - 0x648B1C)

__text:00648B18                 ADD             R1, PC ; _objc_msgSend_ptr

__text:00648B1A                 LDR             R1, [R1] ; __imp__objc_msgSend

__text:00648B1C                 MOV             R3, #(selRef_cStringUsingEncoding_ - 0x648B28)

__text:00648B24                 ADD             R3, PC ; selRef_cStringUsingEncoding_

__text:00648B26                 STR             R0, [sP,#0x70+var_2C]

__text:00648B28                 LDR             R0, [sP,#0x70+var_2C]

__text:00648B2A                 LDR.W           R9, [sP,#0x70+var_20]

__text:00648B2E                 LDR             R3, [R3] ; "cStringUsingEncoding:"

__text:00648B30                 STR             R0, [sP,#0x70+handle]

__text:00648B32                 MOV             R0, R9

__text:00648B34                 STR             R1, [sP,#0x70+var_50]

__text:00648B36                 MOV             R1, R3

__text:00648B38                 LDR             R3, [sP,#0x70+var_50]

__text:00648B3A                 BLX             R3

__text:00648B3C                 LDR             R1, [sP,#0x70+handle]

__text:00648B3E                 STR             R0, [sP,#0x70+symbol]

__text:00648B40                 MOV             R0, R1  ; handle 

__text:00648B42                 LDR             R1, [sP,#0x70+symbol] ; symbol

__text:00648B44                 BLX             _dlsym

__text:00648B48                 MOV             R1, #(_objc_msgSend_ptr - 0x648B54)

__text:00648B50                 ADD             R1, PC ; _objc_msgSend_ptr

__text:00648B52                 LDR             R1, [R1] ; __imp__objc_msgSend

__text:00648B54                 MOV             R2, R1

__text:00648B56                 MOV             R3, #(selRef_setObject_forKey_ - 0x648B62)

__text:00648B5E                 ADD             R3, PC ; selRef_setObject_forKey_

__text:00648B60                 MOV             R9, #(selRef_valueWithPointer_ - 0x648B6C)

__text:00648B68                 ADD             R9, PC ; selRef_valueWithPointer_

__text:00648B6A                 MOV             R12, #(classRef_NSValue - 0x648B76)

__text:00648B72                 ADD             R12, PC ; classRef_NSValue

__text:00648B74                 MOV             LR, #(dword_B062A4 - 0x648B80)

__text:00648B7C                 ADD             LR, PC ; dword_B062A4

__text:00648B7E                 STR             R0, [sP,#0x70+var_30]

__text:00648B80                 LDR.W           R0, [LR]

__text:00648B84                 LDR.W           R12, [R12] ; _OBJC_CLASS_$_NSValue

__text:00648B88                 LDR.W           LR, [sP,#0x70+var_30]

__text:00648B8C                 LDR.W           R9, [R9] ; "valueWithPointer:"

__text:00648B90                 STR             R0, [sP,#0x70+var_58]

__text:00648B92                 MOV             R0, R12

__text:00648B94                 STR             R1, [sP,#0x70+var_5C]

__text:00648B96                 MOV             R1, R9

__text:00648B98                 STR             R2, [sP,#0x70+var_60]

__text:00648B9A                 MOV             R2, LR

__text:00648B9C                 LDR.W           R9, [sP,#0x70+var_5C]

__text:00648BA0                 STR             R3, [sP,#0x70+var_64]

__text:00648BA2                 BLX             R9

__text:00648BA4                 LDR             R1, [sP,#0x70+var_24]

__text:00648BA6                 LDR             R2, [sP,#0x70+var_64]

__text:00648BA8                 LDR             R3, [R2]

__text:00648BAA                 LDR.W           R9, [sP,#0x70+var_58]

__text:00648BAE                 STR             R0, [sP,#0x70+var_68]

__text:00648BB0                 MOV             R0, R9

__text:00648BB2                 STR             R1, [sP,#0x70+var_6C]

__text:00648BB4                 MOV             R1, R3

__text:00648BB6                 LDR             R2, [sP,#0x70+var_68]

__text:00648BB8                 LDR             R3, [sP,#0x70+var_6C]

__text:00648BBA                 LDR.W           R9, [sP,#0x70+var_60]

__text:00648BBE                 BLX             R9

__text:00648BC0                 LDR             R0, [sP,#0x70+var_30]

__text:00648BC2                 STR             R0, [sP,#0x70+var_18]

 

And I was not really sure about what to do with any of this. I feel like changing these four lines would do the trick, but I really have no idea what to change them to.

 

__text:00648B3C                 LDR             R1, [sP,#0x70+handle]

__text:00648B3E                 STR             R0, [sP,#0x70+symbol]

__text:00648B40                 MOV             R0, R1  ; handle 

__text:00648B42                 LDR             R1, [sP,#0x70+symbol] ; symbol

__text:00648B44                 BLX             _dlsym ----> I wouldn't change this, I just put it there for clarity.

 

So, not knowing really what to do there I xref'ed to operand loc_648B04 and got this:

 

__text:00648A50 loc_648A50                              ; CODE XREF: sub_648A04+1Ej

__text:00648A50                                         ; sub_648A04:loc_648A4Ej

__text:00648A50                 MOVS            R0, #0

__text:00648A56                 MOV             R1, #(_objc_msgSend_ptr - 0x648A62)

__text:00648A5E                 ADD             R1, PC ; _objc_msgSend_ptr

__text:00648A60                 LDR             R1, [R1] ; __imp__objc_msgSend

__text:00648A62                 MOV             R2, R1

__text:00648A64                 MOV             R3, #(selRef_objectForKey_ - 0x648A70)

__text:00648A6C                 ADD             R3, PC ; selRef_objectForKey_

__text:00648A6E                 MOV             R9, #(dword_B062A4 - 0x648A7A)

__text:00648A76                 ADD             R9, PC ; dword_B062A4

__text:00648A78                 MOV             R12, #(stru_AE58E0 - 0x648A84) ; "%@:%@"

__text:00648A80                 ADD             R12, PC ; "%@:%@"

__text:00648A82                 MOV             LR, #(selRef_stringWithFormat_ - 0x648A8E)

__text:00648A8A                 ADD             LR, PC ; selRef_stringWithFormat_

__text:00648A8C                 MOV             R4, #(classRef_NSString - 0x648A98)

__text:00648A94                 ADD             R4, PC ; classRef_NSString

__text:00648A96                 LDR             R4, [R4] ; _OBJC_CLASS_$_NSString

__text:00648A98                 LDR             R5, [sP,#0x70+var_1C]

__text:00648A9A                 LDR             R6, [sP,#0x70+var_20]

__text:00648A9C                 LDR.W           LR, [LR] ; "stringWithFormat:"

__text:00648AA0                 STR             R0, [sP,#0x70+var_34]

__text:00648AA2                 MOV             R0, R4

__text:00648AA4                 STR             R1, [sP,#0x70+var_38]

__text:00648AA6                 MOV             R1, LR

__text:00648AA8                 STR             R2, [sP,#0x70+var_3C]

__text:00648AAA                 MOV             R2, R12

__text:00648AAC                 STR             R3, [sP,#0x70+var_40]

__text:00648AAE                 MOV             R3, R5

__text:00648AB0                 STR             R6, [sP,#0x70+var_70]

__text:00648AB2                 LDR.W           R12, [sP,#0x70+var_38]

__text:00648AB6                 STR.W           R9, [sP,#0x70+var_44]

__text:00648ABA                 BLX             R12

__text:00648ABC                 STR             R0, [sP,#0x70+var_24]

__text:00648ABE                 LDR             R0, [sP,#0x70+var_44]

__text:00648AC0                 LDR             R1, [R0]

__text:00648AC2                 LDR             R2, [sP,#0x70+var_24]

__text:00648AC4                 LDR             R3, [sP,#0x70+var_40]

__text:00648AC6                 LDR.W           R9, [R3]

__text:00648ACA                 MOV             R0, R1

__text:00648ACC                 MOV             R1, R9

__text:00648ACE                 LDR.W           R9, [sP,#0x70+var_3C]

__text:00648AD2                 BLX             R9

__text:00648AD4                 STR             R0, [sP,#0x70+var_28]

__text:00648AD6                 LDR             R0, [sP,#0x70+var_28]

__text:00648AD8                 LDR             R1, [sP,#0x70+var_34]

__text:00648ADA                 CMP             R0, R1

__text:00648ADC                 BEQ             loc_648B04

__text:00648ADE                 MOV             R0, #(_objc_msgSend_ptr - 0x648AEA)

__text:00648AE6                 ADD             R0, PC ; _objc_msgSend_ptr

__text:00648AE8                 LDR             R0, [R0] ; __imp__objc_msgSend

__text:00648AEA                 MOV             R1, #(selRef_pointerValue - 0x648AF6)

__text:00648AF2                 ADD             R1, PC ; selRef_pointerValue

__text:00648AF4                 LDR             R2, [sP,#0x70+var_28]

__text:00648AF6                 LDR             R1, [R1] ; "pointerValue"

__text:00648AF8                 STR             R0, [sP,#0x70+var_48]

__text:00648AFA                 MOV             R0, R2

__text:00648AFC                 LDR             R2, [sP,#0x70+var_48]

__text:00648AFE                 BLX             R2

__text:00648B00                 STR             R0, [sP,#0x70+var_18]

__text:00648B02                 B               loc_648BC4

 

I'm pretty sure that these lines mean to

 

__text:00648AD4                 STR             R0, [sP,#0x70+var_28] ----> store the value of R0 into SP+70+var_28

__text:00648AD6                 LDR             R0, [sP,#0x70+var_28] ----> load SP+70+var_28 into R0

__text:00648AD8                 LDR             R1, [sP,#0x70+var_34] ----> load SP+70+var_34 into R1

__text:00648ADA                 CMP             R0, R1 ----> compare R1 with R0

__text:00648ADC                 BEQ             loc_648B04 ----> branch if equal to loc_648B04

 

I changed CMP R0, R1 to CMP R0, #0 to at least try to make it false and CMP R0, R7 because I know it would never be equal to 800 million. I'm used to having to set MOVS R1, #0x1F to MOVS R1, #0x00 to make this work, not all of this stuff.

 

@@Laxus you said that you got it to work, would you be able to send me a binary with all of this stuff disabled? And I have a 5S, would that affect anything?

 

Thanks everyone for trying to help, I really appreciate it

[CmakLove 9.6k 17]

Can you send it to me too ?

[K_K 166.2k iPhone 13 Pro Max 15.1]

 

I'm using a 5S by the way

 

I've never worked with disabling _syscall and _dlsym before so this is pretty hard, and I can't figure this out. I know that NOP'ing a BLX or any branch would result in a crash, so I stayed away from that. I xref'ed to operand for _dlsym and it gave me this:

 

__text:00648B04 loc_648B04 ; CODE XREF: sub_648A04+D8j

__text:00648B04 LDR R0, [sP,#0x70+var_1C]

__text:00648B06 BL sub_649168

__text:00648B0A MOVS R2, #1

__text:00648B10 MOV R1, #(_objc_msgSend_ptr - 0x648B1C)

__text:00648B18 ADD R1, PC ; _objc_msgSend_ptr

__text:00648B1A LDR R1, [R1] ; __imp__objc_msgSend

__text:00648B1C MOV R3, #(selRef_cStringUsingEncoding_ - 0x648B28)

__text:00648B24 ADD R3, PC ; selRef_cStringUsingEncoding_

__text:00648B26 STR R0, [sP,#0x70+var_2C]

__text:00648B28 LDR R0, [sP,#0x70+var_2C]

__text:00648B2A LDR.W R9, [sP,#0x70+var_20]

__text:00648B2E LDR R3, [R3] ; "cStringUsingEncoding:"

__text:00648B30 STR R0, [sP,#0x70+handle]

__text:00648B32 MOV R0, R9

__text:00648B34 STR R1, [sP,#0x70+var_50]

__text:00648B36 MOV R1, R3

__text:00648B38 LDR R3, [sP,#0x70+var_50]

__text:00648B3A BLX R3

__text:00648B3C LDR R1, [sP,#0x70+handle]

__text:00648B3E STR R0, [sP,#0x70+symbol]

__text:00648B40 MOV R0, R1 ; handle

__text:00648B42 LDR R1, [sP,#0x70+symbol] ; symbol

__text:00648B44 BLX _dlsym

__text:00648B48 MOV R1, #(_objc_msgSend_ptr - 0x648B54)

__text:00648B50 ADD R1, PC ; _objc_msgSend_ptr

__text:00648B52 LDR R1, [R1] ; __imp__objc_msgSend

__text:00648B54 MOV R2, R1

__text:00648B56 MOV R3, #(selRef_setObject_forKey_ - 0x648B62)

__text:00648B5E ADD R3, PC ; selRef_setObject_forKey_

__text:00648B60 MOV R9, #(selRef_valueWithPointer_ - 0x648B6C)

__text:00648B68 ADD R9, PC ; selRef_valueWithPointer_

__text:00648B6A MOV R12, #(classRef_NSValue - 0x648B76)

__text:00648B72 ADD R12, PC ; classRef_NSValue

__text:00648B74 MOV LR, #(dword_B062A4 - 0x648B80)

__text:00648B7C ADD LR, PC ; dword_B062A4

__text:00648B7E STR R0, [sP,#0x70+var_30]

__text:00648B80 LDR.W R0, [LR]

__text:00648B84 LDR.W R12, [R12] ; _OBJC_CLASS_$_NSValue

__text:00648B88 LDR.W LR, [sP,#0x70+var_30]

__text:00648B8C LDR.W R9, [R9] ; "valueWithPointer:"

__text:00648B90 STR R0, [sP,#0x70+var_58]

__text:00648B92 MOV R0, R12

__text:00648B94 STR R1, [sP,#0x70+var_5C]

__text:00648B96 MOV R1, R9

__text:00648B98 STR R2, [sP,#0x70+var_60]

__text:00648B9A MOV R2, LR

__text:00648B9C LDR.W R9, [sP,#0x70+var_5C]

__text:00648BA0 STR R3, [sP,#0x70+var_64]

__text:00648BA2 BLX R9

__text:00648BA4 LDR R1, [sP,#0x70+var_24]

__text:00648BA6 LDR R2, [sP,#0x70+var_64]

__text:00648BA8 LDR R3, [R2]

__text:00648BAA LDR.W R9, [sP,#0x70+var_58]

__text:00648BAE STR R0, [sP,#0x70+var_68]

__text:00648BB0 MOV R0, R9

__text:00648BB2 STR R1, [sP,#0x70+var_6C]

__text:00648BB4 MOV R1, R3

__text:00648BB6 LDR R2, [sP,#0x70+var_68]

__text:00648BB8 LDR R3, [sP,#0x70+var_6C]

__text:00648BBA LDR.W R9, [sP,#0x70+var_60]

__text:00648BBE BLX R9

__text:00648BC0 LDR R0, [sP,#0x70+var_30]

__text:00648BC2 STR R0, [sP,#0x70+var_18]

 

And I was not really sure about what to do with any of this. I feel like changing these four lines would do the trick, but I really have no idea what to change them to.

 

__text:00648B3C LDR R1, [sP,#0x70+handle]

__text:00648B3E STR R0, [sP,#0x70+symbol]

__text:00648B40 MOV R0, R1 ; handle

__text:00648B42 LDR R1, [sP,#0x70+symbol] ; symbol

__text:00648B44 BLX _dlsym ----> I wouldn't change this, I just put it there for clarity.

 

So, not knowing really what to do there I xref'ed to operand loc_648B04 and got this:

 

__text:00648A50 loc_648A50 ; CODE XREF: sub_648A04+1Ej

__text:00648A50 ; sub_648A04:loc_648A4Ej

__text:00648A50 MOVS R0, #0

__text:00648A56 MOV R1, #(_objc_msgSend_ptr - 0x648A62)

__text:00648A5E ADD R1, PC ; _objc_msgSend_ptr

__text:00648A60 LDR R1, [R1] ; __imp__objc_msgSend

__text:00648A62 MOV R2, R1

__text:00648A64 MOV R3, #(selRef_objectForKey_ - 0x648A70)

__text:00648A6C ADD R3, PC ; selRef_objectForKey_

__text:00648A6E MOV R9, #(dword_B062A4 - 0x648A7A)

__text:00648A76 ADD R9, PC ; dword_B062A4

__text:00648A78 MOV R12, #(stru_AE58E0 - 0x648A84) ; "%@:%@"

__text:00648A80 ADD R12, PC ; "%@:%@"

__text:00648A82 MOV LR, #(selRef_stringWithFormat_ - 0x648A8E)

__text:00648A8A ADD LR, PC ; selRef_stringWithFormat_

__text:00648A8C MOV R4, #(classRef_NSString - 0x648A98)

__text:00648A94 ADD R4, PC ; classRef_NSString

__text:00648A96 LDR R4, [R4] ; _OBJC_CLASS_$_NSString

__text:00648A98 LDR R5, [sP,#0x70+var_1C]

__text:00648A9A LDR R6, [sP,#0x70+var_20]

__text:00648A9C LDR.W LR, [LR] ; "stringWithFormat:"

__text:00648AA0 STR R0, [sP,#0x70+var_34]

__text:00648AA2 MOV R0, R4

__text:00648AA4 STR R1, [sP,#0x70+var_38]

__text:00648AA6 MOV R1, LR

__text:00648AA8 STR R2, [sP,#0x70+var_3C]

__text:00648AAA MOV R2, R12

__text:00648AAC STR R3, [sP,#0x70+var_40]

__text:00648AAE MOV R3, R5

__text:00648AB0 STR R6, [sP,#0x70+var_70]

__text:00648AB2 LDR.W R12, [sP,#0x70+var_38]

__text:00648AB6 STR.W R9, [sP,#0x70+var_44]

__text:00648ABA BLX R12

__text:00648ABC STR R0, [sP,#0x70+var_24]

__text:00648ABE LDR R0, [sP,#0x70+var_44]

__text:00648AC0 LDR R1, [R0]

__text:00648AC2 LDR R2, [sP,#0x70+var_24]

__text:00648AC4 LDR R3, [sP,#0x70+var_40]

__text:00648AC6 LDR.W R9, [R3]

__text:00648ACA MOV R0, R1

__text:00648ACC MOV R1, R9

__text:00648ACE LDR.W R9, [sP,#0x70+var_3C]

__text:00648AD2 BLX R9

__text:00648AD4 STR R0, [sP,#0x70+var_28]

__text:00648AD6 LDR R0, [sP,#0x70+var_28]

__text:00648AD8 LDR R1, [sP,#0x70+var_34]

__text:00648ADA CMP R0, R1

__text:00648ADC BEQ loc_648B04

__text:00648ADE MOV R0, #(_objc_msgSend_ptr - 0x648AEA)

__text:00648AE6 ADD R0, PC ; _objc_msgSend_ptr

__text:00648AE8 LDR R0, [R0] ; __imp__objc_msgSend

__text:00648AEA MOV R1, #(selRef_pointerValue - 0x648AF6)

__text:00648AF2 ADD R1, PC ; selRef_pointerValue

__text:00648AF4 LDR R2, [sP,#0x70+var_28]

__text:00648AF6 LDR R1, [R1] ; "pointerValue"

__text:00648AF8 STR R0, [sP,#0x70+var_48]

__text:00648AFA MOV R0, R2

__text:00648AFC LDR R2, [sP,#0x70+var_48]

__text:00648AFE BLX R2

__text:00648B00 STR R0, [sP,#0x70+var_18]

__text:00648B02 B loc_648BC4

 

I'm pretty sure that these lines mean to

 

__text:00648AD4 STR R0, [sP,#0x70+var_28] ----> store the value of R0 into SP+70+var_28

__text:00648AD6 LDR R0, [sP,#0x70+var_28] ----> load SP+70+var_28 into R0

__text:00648AD8 LDR R1, [sP,#0x70+var_34] ----> load SP+70+var_34 into R1

__text:00648ADA CMP R0, R1 ----> compare R1 with R0

__text:00648ADC BEQ loc_648B04 ----> branch if equal to loc_648B04

 

I changed CMP R0, R1 to CMP R0, #0 to at least try to make it false and CMP R0, R7 because I know it would never be equal to 800 million. I'm used to having to set MOVS R1, #0x1F to MOVS R1, #0x00 to make this work, not all of this stuff.

 

@@Laxus you said that you got it to work, would you be able to send me a binary with all of this stuff disabled? And I have a 5S, would that affect anything?

 

Thanks everyone for trying to help, I really appreciate it

Nop try this C046C046 done

[Guest]

@ i didn't even think of that lol i'll try it