Jump to content

HEX editing, dissassembled binary HEX values and binary HEX values different...wt#


5 posts in this topic

Recommended Posts

Posted (edited)

i guess i could have choose something easier for my first start ^^, but thats that one i want to hack...

so i have a problem, when i dissassemble the binary as arm7 in ida (arm proc), he show a different hex view... as just to open the binary as raw...

i tried to open the binary with several Hex editors, they never match with the hex values from ida

i was thinking to edit the binary inside my iphone with a hexeditor and test it straight away... 

binary of assassin creed unity, thinned and alsr removed

HEX value from binary

Spoiler

003D08E0  252B 447D 7828 BBE0 F641 0088 F235 DB2C F649 31C0 F2C0 2104 4479 6809 6008 F641
003D0900  300A F235 DB21 F64B 4136 F2C0 2104 4479 6809 6008 F641 300E F235 DB16 F64B 4180
003D0920  F2C0 2104 4479 6809 6008 F241 305A F2C8 0000 F235 DB07 F64B 41AE F2C0 2104 4479

HEX value from dissassembled binary in IDA

Spoiler

003D08E0  D193 4605 A801 212A 4622 F239 DB37 9A02 4629 9801 6813 4798 B003 BDF0 6880 4770
003D0900  6087 4770 B580 466F B082 4602 4668 2118 F239 DB24 E89D 0003 680A 4790 B002 BD80
003D0920  B590 AF01 B082 460C 4602 4668 2119 F239 DB15 E89D 0005 4621 6813 4798 B002 BD90

the watchpoint is health going down in 32b float

lldb watchpoint

Spoiler

Watchpoint 1 hit:
old value: 1134626297
new value: 1133971717
Process 766 stopped
* thread #1: tid = 0x1898, 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2
acier`___lldb_unnamed_function18218$$acier:
->  0x3d0902 <+2>: bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>: push   {r7, lr}
    0x3d0906 <+2>: mov    r7, sp
    0x3d0908 <+4>: sub    sp, #0x8
(lldb) dis -c 20
acier`___lldb_unnamed_function18218$$acier:
    0x3d0900 <+0>:  str    r1, [r0, #0x8]
->  0x3d0902 <+2>:  bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>:  push   {r7, lr}
    0x3d0906 <+2>:  mov    r7, sp
    0x3d0908 <+4>:  sub    sp, #0x8
    0x3d090a <+6>:  mov    r2, r0
    0x3d090c <+8>:  mov    r0, sp
    0x3d090e <+10>: movs   r1, #0x18
    0x3d0910 <+12>: bl     0xe09f5c                  ; ___lldb_unnamed_function81925$$acier
    0x3d0914 <+16>: ldm.w  sp, {r0, r1}
    0x3d0918 <+20>: ldr    r2, [r1]
    0x3d091a <+22>: blx    r2
    0x3d091c <+24>: add    sp, #0x8
    0x3d091e <+26>: pop    {r7, pc}

acier`___lldb_unnamed_function18220$$acier:
    0x3d0920 <+0>:  push   {r4, r7, lr}
    0x3d0922 <+2>:  add    r7, sp, #0x4
    0x3d0924 <+4>:  sub    sp, #0x8
    0x3d0926 <+6>:  mov    r4, r1
    0x3d0928 <+8>:  mov    r2, r0
    0x3d092a <+10>: mov    r0, sp

 

IDA view-A

Spoiler


__text:003D08FC ; =============== S U B R O U T I N E =======================================
__text:003D08FC
__text:003D08FC
__text:003D08FC sub_3D08FC                              ; DATA XREF: __const:024C77F0o
__text:003D08FC                 LDR             R0, [R0,#8]
__text:003D08FE                 BX              LR
__text:003D08FE ; End of function sub_3D08FC
__text:003D08FE
__text:003D0900
__text:003D0900 ; =============== S U B R O U T I N E =======================================
__text:003D0900
__text:003D0900
__text:003D0900 sub_3D0900                              ; DATA XREF: __const:024C77F4o
__text:003D0900                 STR             R7, [R0,#8]
__text:003D0902                 BX              LR
__text:003D0902 ; End of function sub_3D0900
__text:003D0902
__text:003D0904
__text:003D0904 ; =============== S U B R O U T I N E =======================================
__text:003D0904
__text:003D0904
__text:003D0904 sub_3D0904                              ; DATA XREF: __const:024C77F8o
__text:003D0904                 PUSH            {R7,LR}
__text:003D0906                 MOV             R7, SP
__text:003D0908                 SUB             SP, SP, #8
__text:003D090A                 MOV             R2, R0
__text:003D090C                 MOV             R0, SP
__text:003D090E                 MOVS            R1, #0x18
__text:003D0910                 BL.W            sub_E09F5C
__text:003D0914                 LDMFD.W         SP, {R0,R1}
__text:003D0918                 LDR             R2, [R1]
__text:003D091A                 BLX             R2
__text:003D091C                 ADD             SP, SP, #8
__text:003D091E                 POP             {R7,PC}
__text:003D091E ; End of function sub_3D0904

 

when i convert arm to hex or hex to arm... nothing is matching with the value i find when i open the binary in a hex editor..

why is that so, a protection?

all the tuto i have red or watched dont have that issue...

thanks

 

Updated by Anonymonk
Posted

IDA and Hex are at different address

ItbTaac.png

Left is Hex address  and right is IDA address

Posted
5 minutes ago, Anonymonk said:

i guess i could have choose something easier for my first start ^^, but thats that one i want to hack...

so i have a problem, when i dissassemble the binary as arm7 in ida (arm proc), he show a different hex view... as just to open the binary as raw...

i tried to open the binary with several Hex editors, they never match with the hex values from ida

i was thinking to edit the binary inside my iphone with a hexeditor and test it straight away... 

binary of assassin creed unity, thinned and alsr removed

HEX value from binary

  Hide contents

003D08E0  252B 447D 7828 BBE0 F641 0088 F235 DB2C F649 31C0 F2C0 2104 4479 6809 6008 F641
003D0900  300A F235 DB21 F64B 4136 F2C0 2104 4479 6809 6008 F641 300E F235 DB16 F64B 4180
003D0920  F2C0 2104 4479 6809 6008 F241 305A F2C8 0000 F235 DB07 F64B 41AE F2C0 2104 4479

HEX value from dissassembled binary in IDA

  Hide contents

003D08E0  D193 4605 A801 212A 4622 F239 DB37 9A02 4629 9801 6813 4798 B003 BDF0 6880 4770
003D0900  6087 4770 B580 466F B082 4602 4668 2118 F239 DB24 E89D 0003 680A 4790 B002 BD80
003D0920  B590 AF01 B082 460C 4602 4668 2119 F239 DB15 E89D 0005 4621 6813 4798 B002 BD90

the watchpoint is health going down in 32b float

lldb watchpoint

  Hide contents

Watchpoint 1 hit:
old value: 1134626297
new value: 1133971717
Process 766 stopped
* thread #1: tid = 0x1898, 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2
acier`___lldb_unnamed_function18218$$acier:
->  0x3d0902 <+2>: bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>: push   {r7, lr}
    0x3d0906 <+2>: mov    r7, sp
    0x3d0908 <+4>: sub    sp, #0x8
(lldb) dis -c 20
acier`___lldb_unnamed_function18218$$acier:
    0x3d0900 <+0>:  str    r1, [r0, #0x8]
->  0x3d0902 <+2>:  bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>:  push   {r7, lr}
    0x3d0906 <+2>:  mov    r7, sp
    0x3d0908 <+4>:  sub    sp, #0x8
    0x3d090a <+6>:  mov    r2, r0
    0x3d090c <+8>:  mov    r0, sp
    0x3d090e <+10>: movs   r1, #0x18
    0x3d0910 <+12>: bl     0xe09f5c                  ; ___lldb_unnamed_function81925$$acier
    0x3d0914 <+16>: ldm.w  sp, {r0, r1}
    0x3d0918 <+20>: ldr    r2, [r1]
    0x3d091a <+22>: blx    r2
    0x3d091c <+24>: add    sp, #0x8
    0x3d091e <+26>: pop    {r7, pc}

acier`___lldb_unnamed_function18220$$acier:
    0x3d0920 <+0>:  push   {r4, r7, lr}
    0x3d0922 <+2>:  add    r7, sp, #0x4
    0x3d0924 <+4>:  sub    sp, #0x8
    0x3d0926 <+6>:  mov    r4, r1
    0x3d0928 <+8>:  mov    r2, r0
    0x3d092a <+10>: mov    r0, sp

 

IDA view-A

  Reveal hidden contents

__text:003D08F4 ; End of function sub_3D0854
__text:003D08F4
__text:003D08F6                 BLX             R3
__text:003D08F8                 ADD             SP, SP, #0xC
__text:003D08FA                 POP             {R4-R7,PC}
__text:003D08FC ; ---------------------------------------------------------------------------
__text:003D08FC                 LDR             R0, [R0,#8]
__text:003D08FE                 BX              LR
__text:003D0900 ; ---------------------------------------------------------------------------
__text:003D0900                 STR             R0, [R0,#8]
__text:003D0902                 BX              LR
__text:003D0904
__text:003D0904 ; =============== S U B R O U T I N E =======================================
__text:003D0904
__text:003D0904
__text:003D0904 sub_3D0904
__text:003D0904                 PUSH            {R7,LR}
__text:003D0906                 MOV             R7, SP
__text:003D0908                 SUB             SP, SP, #8
__text:003D090A                 MOV             R2, R0
__text:003D090C                 MOV             R0, SP
__text:003D090E                 MOVS            R1, #0x18
__text:003D0910                 BL.W            sub_E09F5C
__text:003D0914                 LDMFD.W         SP, {R0,R1}
__text:003D0918                 LDR             R2, [R1]
__text:003D091A                 BLX             R2
__text:003D091C                 ADD             SP, SP, #8
__text:003D091E                 POP             {R7,PC}
__text:003D091E ; End of function sub_3D0904
__text:003D091E
__text:003D0920

 

when i convert arm to hex or hex to arm... nothing is matching with the value i find when i open the binary in a hex editor..

why is that so, a protection?

all the tuto i have red or watched dont have that issue...

thanks

 

1 - did you disable aslr? if never disable aslr, watchpoint offset from lldb is not correct.

2 - if you done disable aslr, when you find hex from hex editor , it must be -4000 from the IDA offset.

Posted
7 minutes ago, xiaov said:

1 - did you disable aslr? if never disable aslr, watchpoint offset from lldb is not correct.

2 - if you done disable aslr, when you find hex from hex editor , it must be -4000 from the IDA offset.

i disabled the alsr, and i guess its proper as the lldb display show the same instruction than Ida

 

9 minutes ago, Amuyea said:

IDA and Hex are at different address

ItbTaac.png

Left is Hex address  and right is IDA address

i see... thank you both for your help, i will give a try right now

Posted

yep.. thats it.. i can now try...

but it seems really hard  to begin to learn instruction in that assassin creed unity

i made a try and everyone became immortal, and all attribute to max.... big mess

seems like i will have to spend time to learn all that...

if someone feel to tell me what to edit ... i welcome everyone, hihihi

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Mr Autofire v4.0.1 [ +12 Cheats ] Currency Max
      Modded/Hacked App: Mr Autofire By Lightheart Entertainment Oy
      Bundle ID: games.lightheart.mrautofire
      iTunes Store Link: https://apps.apple.com/us/app/mr-autofire/id1483457500?uo=4


      Hack Features:
      - N0 ADS [ Reward Free ]

      - Damage 

      - Health 

      - Pet Damage

      - Rome Clear [ 1 Wave Clear ]

      Level Rearwards 

      [ Gems - Silver - Pet Card - Hero Card - Guns Card ]
      • 47 replies
    • Mr Autofire v4.0.1 [ +12 Jailed ] Currency Max
      Modded/Hacked App: Mr Autofire By Lightheart Entertainment Oy
      Bundle ID: games.lightheart.mrautofire
      iTunes Store Link: https://apps.apple.com/us/app/mr-autofire/id1483457500?uo=4


      Hack Features:

      - N0 ADS [ Reward Free ]

      - Damage 

      - Health 

      - Pet Damage

      - Rome Clear [ 1 Wave Clear ]

      Level Rearwards 

      [ Gems - Silver - Pet Card - Hero Card - Guns Card ]
      • 15 replies
    • Spin Break: Roulette Battle v1.6.4 [ +5 Cheats ] Currency Max
      Modded/Hacked App: Spin Break: Roulette Battle By Fifty-one percent Corp.
      Bundle ID: com.FiftyOnePercent.SpinBreak
      iTunes Store Link: https://apps.apple.com/us/app/spin-break-roulette-battle/id6462842820?uo=4

      Hack Features:

      - Currency Max

      - Energy Max

      - LvL Rewards Gold

      - Hero Status [ HP DMG DEF Luck Gold ]

      - Enemy Status [ ATK HP DEF 0 ]

       
      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 34 replies
    • Spin Break: Roulette Battle v1.6.4 [ +5 Jailed ] Currency Max
      Modded/Hacked App: Spin Break: Roulette Battle By Fifty-one percent Corp.
      Bundle ID: com.FiftyOnePercent.SpinBreak
      iTunes Store Link: https://apps.apple.com/us/app/spin-break-roulette-battle/id6462842820?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:

      - Currency Max

      - Energy Max

      - LvL Rewards Gold

      - Hero Status [ HP DMG DEF Luck Gold ]

      - Enemy Status [ ATK HP DEF 0 ]


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 31 replies
    • Chaos Road: 3D Car Racing Game v5.16.0 [ +3 Jailed ] Currency Max
      Modded/Hacked App: Chaos Road: 3D Car Racing Game By Supercharge Mobile Corp.
      Bundle ID: com.Zeeppo.ChaosRoad
      iTunes Store Link: https://apps.apple.com/us/app/chaos-road-3d-car-racing-game/id1471023434?uo=4

      Hack Features:
      - Gems
      - Gold
      - ViP Active 
      • 23 replies
    • Chaos Road: 3D Car Racing Game v5.16.0 [ +3 Cheats ] Currency Max
      Modded/Hacked App: Chaos Road: 3D Car Racing Game By Supercharge Mobile Corp.
      Bundle ID: com.Zeeppo.ChaosRoad
      iTunes Store Link: https://apps.apple.com/us/app/chaos-road-3d-car-racing-game/id1471023434?uo=4

      Hack Features:
      - Gems
      - Gold
      - ViP Active
      • 16 replies
    • Swamp Attack 2 v1.0.77 [ +4 Cheats ] Currency Max
      Modded/Hacked App: Swamp Attack 2 By Voodoo
      Bundle ID: com.hyperdotstudios.swampattack2
      iTunes Store Link: https://apps.apple.com/us/app/swamp-attack-2/id1531686083?uo=4


      Hack Features:
      - Gems
      - Gold
      - Ammo
      - Monster ATK No


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 31 replies
    • Swamp Attack 2 v1.0.77 [ +4 Jailed ] Currency Max
      Modded/Hacked App: Swamp Attack 2 By Voodoo
      Bundle ID: com.hyperdotstudios.swampattack2
      iTunes Store Link: https://apps.apple.com/us/app/swamp-attack-2/id1531686083?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:

      - Gems

      - Gold
      - Ammo
      - Monster ATK No


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 34 replies
    • Backpacker™ Go! v1.5.4 [ +3 Cheats ] Dice Unlimited
      Modded/Hacked App: Backpacker™ Go! By Qiiwi Games AB
      Bundle ID: com.qiiwi.backpackergo
      iTunes Store Link: https://apps.apple.com/us/app/backpacker-go/id6478389736?uo=4


      Hack Features:
      - ADS NO [ Between Playing ] 
      - Cash Unlimited [ This Hack Linked Other Items - Ticket Exp Etc. Use Only Cash ] Use Another Items Maybe Game Freeze But Works  
      - Dice Unlimited
      • 21 replies
    • Backpacker™ Go! v1.5.4 [ +3 Jailed ] Dice Unlimited
      Modded/Hacked App: Backpacker™ Go! By Qiiwi Games AB
      Bundle ID: com.qiiwi.backpackergo
      iTunes Store Link: https://apps.apple.com/us/app/backpacker-go/id6478389736?uo=4



      Hack Features:
      - ADS NO [ Between Playing ] 
      - Cash Unlimited [ This Hack Linked Other Items - Ticket Exp Etc. Use Only Cash ] Use Another Items Maybe Game Freeze But Works  
      - Dice Unlimited 
        • Agree
      • 26 replies
    • Paradise Paws: Merge Animals v0.2.4 [ +9 Cheats ] Currency Max
      Modded/Hacked App: Animal Sanctuary By Wildlife Studios, Inc
      Bundle ID: com.wildlifestudios.merge.animal.sanctuary
      App Store Link: https://apps.apple.com/us/app/animal-sanctuary/id6741805691?uo=4
       

      🤩 Hack Features

      - Gems

      - Coins

      - Heart

      - Spin

      - LvL

      - Exp

      - Fog Auto Remove [ Linked With LvL ]

      - Premum Lands Unlocked [ Just Tap ]

      - Store Free [ IAP Not ]

      Note:- Game Close After Currency Hack Don't Worry
      • 14 replies
    • Paradise Paws: Merge Animals v0.2.4 [ +9 Jailed ] Currency Max
      Modded/Hacked App: Animal Sanctuary By Wildlife Studios, Inc
      Bundle ID: com.wildlifestudios.merge.animal.sanctuary
      App Store Link: https://apps.apple.com/us/app/animal-sanctuary/id6741805691?uo=4


      🤩 Hack Features

      - Gems

      - Coins

      - Heart

      - Spin

      - LvL

      - Exp

      - Fog Auto Remove [ Linked With LvL ]

      - Premum Lands Unlocked [ Just Tap ]

      - Store Free [ IAP Not ]

      Note:- Game Close After Currency Hack Don't Worry
      • 7 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines