Help/Support Getting LLDB breakpoint address from IDA

[maddo7 0 14]

Hello,

 

I checked an App using IDA and I found an interesting line where I'd like to get the values from. The lineitself is a _strlen command which should hold the value.

 

Now I right clicked the line and did "Copy address to command line" wich gave me "0xC10C4C".

 

Then I did "b s -a 0xC10C4C" on LLDB but it just returned "Breakpoint 1: no locations (pending). WARNING: Unable to resolve breakpoint to any actual locations."

 

And when I resume the app the breakpoint won't "break", the app just continues

 

How can I get the right address to set the breakpoint?

[Patricktph 36.6k 10.2.1]

keep trying.

[maddo7 0 14]

Now I read somewhere that I would need to do "image list -o -f" to get a list of the objects.

The base address should be the value after [0] which is 0x00000000000e4000 in my case.

 

Then I went to IDA to check the line where it says __text:0002512C which is 0x2512C

 

Now I should add the 2 to get the address:

 

0x2512C + 0x00000000000e4000 = 0x10912C

 

Now when I do "b s -a 0x10912C" it says "Breakpoint 1: address = 0x000000000010912C" so it seems it found the address now.

 

When I open the app and perform an action that should trigger the breakpoint it still does not.

 

What could be the issue here?

[Crypto 7.7k iPhone 6 9.1.0]

Try using GDB, you're not the only one who had issues with breakpoints while using LLDB I believe

[maddo7 0 14]

I just tried it with GDB

 

I had to thin the app to make it work.

 

I used "info shared" to get the string with offset  (offset 0x10000) (Why is the offset different this time?)

 

Then I used this 0x10000 + 0x2512C = 0x3512C

 

Afterwards I used break *0x3512C and the breakpoint registered

 

(gdb) break *0x3512C

Breakpoint 1 at 0x3512C

 

But again the breakpoint doesn't get hit.

 

What could potentially be wrong?

 

EDIT:

 

I just hooked a function that comes after the part where I want to put a breakpoint

 

break funcname

 

and GDB returned Breakpoint 2, 0x35f9e6f8 in funcname ()

 

when I ran the App the breakpoint hit without any issues.

 

Now I think I got the wrong address.

 

GDB returned 0x35f9e6f8 as address for the function

 

When I look it up in IDA it is listed as "__picsymbolstub4:00C6F5CC"

 

so address should be 0xC6F5CC

 

When I do the math

 

0xC6F5CC + 0x10000 = 0xC7F5CC the result is totally different from 0x35f9e6f8

 

So maybe I misinterpret the pointer I got from IDA?

 

Edit 2:

 

Could it be I need to use a different base offset? info shared lists multiple files with offsets.

 

I examined the App.app/App binary in IDA and the function was there along with the pointer I need. How do I know if this function is in the main executable or in a lib?

Updated November 27, 2016 by maddo7

[Mr. Hyperion 627 9 9.0.2]

I just tried it with GDB

 

I had to thin the app to make it work.

 

I used "info shared" to get the string with offset  (offset 0x10000) (Why is the offset different this time?)

 

Then I used this 0x10000 + 0x2512C = 0x3512C

 

Afterwards I used break *0x3512C and the breakpoint registered

 

(gdb) break *0x3512C

Breakpoint 1 at 0x3512C

 

But again the breakpoint doesn't get hit.

 

What could potentially be wrong?

 

EDIT:

 

I just hooked a function that comes after the part where I want to put a breakpoint

 

break funcname

 

and GDB returned Breakpoint 2, 0x35f9e6f8 in funcname ()

 

when I ran the App the breakpoint hit without any issues.

 

Now I think I got the wrong address.

 

GDB returned 0x35f9e6f8 as address for the function

 

When I look it up in IDA it is listed as "__picsymbolstub4:00C6F5CC"

 

so address should be 0xC6F5CC

 

When I do the math

 

0xC6F5CC + 0x10000 = 0xC7F5CC the result is totally different from 0x35f9e6f8

 

So maybe I misinterpret the pointer I got from IDA?

 

Edit 2:

 

Could it be I need to use a different base offset? info shared lists multiple files with offsets.

 

I examined the App.app/App binary in IDA and the function was there along with the pointer I need. How do I know if this function is in the main executable or in a lib?

Did you remove ASLR?

[maddo7 0 14]

Did you remove ASLR?

 

No, I'm new to this and followed a tutorial. How would I do this? I used a cracked version of the App to begin with.

[Crypto 7.7k iPhone 6 9.1.0]

No, I'm new to this and followed a tutorial. How would I do this? I used a cracked version of the App to begin with.

You download the game/app from itunes, import it to your phone, crack it, take the binary to ArmConverter , thin and remove ASLR

[maddo7 0 14]

You download the game/app from itunes, import it to your phone, crack it, take the binary to ArmConverter , thin and remove ASLR

 

Should I analyze it with IDA after doing all this?

[Mr. Hyperion 627 9 9.0.2]

Should I analyze it with IDA after doing all this?

No