Help/Support Can't view x32 portions on IDA

Cynicaaal · February 11, 2017

Hey guys! been trying to find this out for a few days and got nowhere! everytime i open up IDA, select Little endian [ARM] as the processor type and open the cracked binary file and all i see is:

__text:0000000100023454 STP D11, D10, [sP,#var_60]!

__text:0000000100023458 STP D9, D8, [sP,#0x60+var_50]

__text:000000010002345C STP X24, X23, [sP,#0x60+var_40]

__text:0000000100023460 STP X22, X21, [sP,#0x60+var_30]

__text:0000000100023464 STP X20, X19, [sP,#0x60+var_20]

__text:0000000100023468 STP X29, X30, [sP,#0x60+var_10]

__text:000000010002346C ADD X29, SP, #0x60+var_10

__text:0000000100023470 SUB SP, SP, #0xB0

__text:0000000100023474 MOV X19, X0

instead of getting R0, R1 or whatever i get X20, X19 so im not able to make the tweaks i want! Does anyone have any idea how to fix this please!

- Thanks for your time

INFO:

iPhone 6 (iOS 10.2)
Installed apps from iTunes
Cracked via Clutch2
Not thinned the binary or anything (was told i didn't need to)
Using IDA v6.6 Pro Cracked from - https://iosgods.com/topic/3933-ida-pro-v66-v68-full/

Anything else, please ask

Rook · February 11, 2017

When opening the binary in IDA, you get asked whether you want to process ARMv7 or ARM64.

32dev

Cynicaaal · February 11, 2017

When opening the binary in IDA, you get asked whether you want to process ARMv7 or ARM64.

32dev

Woooo, you're fast lol! - But when i drag the binary to IDA i only have two options:

Mach-o File (Execute).ARM64[macho64.164]

Binary file

Thats all i get i select Mach-o File and then it asks if i want to change the processor type

Rook · February 11, 2017

Woooo, you're fast lol! - But when i drag the binary to IDA i only have two options:

Mach-o File (Execute).ARM64[macho64.164]

Binary file

Thats all i get i select Mach-o File and then it asks if i want to change the processor type

Hmm then you're not cracking both portions. Are you sure you downloaded and installed the IPA from iTunes?

Cynicaaal · February 11, 2017

Hmm then you're not cracking both portions. Are you sure you downloaded and installed the IPA from iTunes?

Yes mate

i downloaded TempleRun from itunes
Went to teminal and su>xxxxx> ./Clutch2 -i
./Clutch2 -d (number)
Extracted to 'Dumped,
Opened Filza when to extraction folder and clicked the ipa, extracted it then went to payload/appname/binary
pasted it in a relevant place and then connected my device to funbox and put the binary on my desktop and drag and drop on to ida

-Tanks for your time man

Rook · February 11, 2017

Yes mate

i downloaded TempleRun from itunes

Went to teminal and su>xxxxx> ./Clutch2 -i

./Clutch2 -d (number)

Extracted to 'Dumped,

Opened Filza when to extraction folder and clicked the ipa, extracted it then went to payload/appname/binary

pasted it in a relevant place and then connected my device to funbox and put the binary on my desktop and drag and drop on to ida

-Tanks for your time man

Try Rasticrac perhaps?

Cynicaaal · February 11, 2017

Try Rasticrac perhaps?

Just tried it on rasticrac, installed via xarlod repo (v3.3.3RC) went to usr/bin and renamed rc.sh to 'a' then went to terminal su root>xxxxx>a -m and selected the number of the app i wanted from the list.

i get this error though:

(1/1) Found 'spiral: Spiral [Ketchapp]

Trying to do man executable...

Info: MonsterXO2 (9 - 64 - 0)

Error: RastDecrypted failed (64on64=134)

Note: iDevice is 102 and executable is '60'

Nothing wants to work for me lol -.-

Updated February 11, 2017 by Cynicaaal