Jump to content

HEX editing, dissassembled binary HEX values and binary HEX values different...wt#


5 posts in this topic

Recommended Posts

Posted (edited)

i guess i could have choose something easier for my first start ^^, but thats that one i want to hack...

so i have a problem, when i dissassemble the binary as arm7 in ida (arm proc), he show a different hex view... as just to open the binary as raw...

i tried to open the binary with several Hex editors, they never match with the hex values from ida

i was thinking to edit the binary inside my iphone with a hexeditor and test it straight away... 

binary of assassin creed unity, thinned and alsr removed

HEX value from binary

Spoiler

003D08E0  252B 447D 7828 BBE0 F641 0088 F235 DB2C F649 31C0 F2C0 2104 4479 6809 6008 F641
003D0900  300A F235 DB21 F64B 4136 F2C0 2104 4479 6809 6008 F641 300E F235 DB16 F64B 4180
003D0920  F2C0 2104 4479 6809 6008 F241 305A F2C8 0000 F235 DB07 F64B 41AE F2C0 2104 4479

HEX value from dissassembled binary in IDA

Spoiler

003D08E0  D193 4605 A801 212A 4622 F239 DB37 9A02 4629 9801 6813 4798 B003 BDF0 6880 4770
003D0900  6087 4770 B580 466F B082 4602 4668 2118 F239 DB24 E89D 0003 680A 4790 B002 BD80
003D0920  B590 AF01 B082 460C 4602 4668 2119 F239 DB15 E89D 0005 4621 6813 4798 B002 BD90

the watchpoint is health going down in 32b float

lldb watchpoint

Spoiler

Watchpoint 1 hit:
old value: 1134626297
new value: 1133971717
Process 766 stopped
* thread #1: tid = 0x1898, 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2
acier`___lldb_unnamed_function18218$$acier:
->  0x3d0902 <+2>: bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>: push   {r7, lr}
    0x3d0906 <+2>: mov    r7, sp
    0x3d0908 <+4>: sub    sp, #0x8
(lldb) dis -c 20
acier`___lldb_unnamed_function18218$$acier:
    0x3d0900 <+0>:  str    r1, [r0, #0x8]
->  0x3d0902 <+2>:  bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>:  push   {r7, lr}
    0x3d0906 <+2>:  mov    r7, sp
    0x3d0908 <+4>:  sub    sp, #0x8
    0x3d090a <+6>:  mov    r2, r0
    0x3d090c <+8>:  mov    r0, sp
    0x3d090e <+10>: movs   r1, #0x18
    0x3d0910 <+12>: bl     0xe09f5c                  ; ___lldb_unnamed_function81925$$acier
    0x3d0914 <+16>: ldm.w  sp, {r0, r1}
    0x3d0918 <+20>: ldr    r2, [r1]
    0x3d091a <+22>: blx    r2
    0x3d091c <+24>: add    sp, #0x8
    0x3d091e <+26>: pop    {r7, pc}

acier`___lldb_unnamed_function18220$$acier:
    0x3d0920 <+0>:  push   {r4, r7, lr}
    0x3d0922 <+2>:  add    r7, sp, #0x4
    0x3d0924 <+4>:  sub    sp, #0x8
    0x3d0926 <+6>:  mov    r4, r1
    0x3d0928 <+8>:  mov    r2, r0
    0x3d092a <+10>: mov    r0, sp

 

IDA view-A

Spoiler


__text:003D08FC ; =============== S U B R O U T I N E =======================================
__text:003D08FC
__text:003D08FC
__text:003D08FC sub_3D08FC                              ; DATA XREF: __const:024C77F0o
__text:003D08FC                 LDR             R0, [R0,#8]
__text:003D08FE                 BX              LR
__text:003D08FE ; End of function sub_3D08FC
__text:003D08FE
__text:003D0900
__text:003D0900 ; =============== S U B R O U T I N E =======================================
__text:003D0900
__text:003D0900
__text:003D0900 sub_3D0900                              ; DATA XREF: __const:024C77F4o
__text:003D0900                 STR             R7, [R0,#8]
__text:003D0902                 BX              LR
__text:003D0902 ; End of function sub_3D0900
__text:003D0902
__text:003D0904
__text:003D0904 ; =============== S U B R O U T I N E =======================================
__text:003D0904
__text:003D0904
__text:003D0904 sub_3D0904                              ; DATA XREF: __const:024C77F8o
__text:003D0904                 PUSH            {R7,LR}
__text:003D0906                 MOV             R7, SP
__text:003D0908                 SUB             SP, SP, #8
__text:003D090A                 MOV             R2, R0
__text:003D090C                 MOV             R0, SP
__text:003D090E                 MOVS            R1, #0x18
__text:003D0910                 BL.W            sub_E09F5C
__text:003D0914                 LDMFD.W         SP, {R0,R1}
__text:003D0918                 LDR             R2, [R1]
__text:003D091A                 BLX             R2
__text:003D091C                 ADD             SP, SP, #8
__text:003D091E                 POP             {R7,PC}
__text:003D091E ; End of function sub_3D0904

 

when i convert arm to hex or hex to arm... nothing is matching with the value i find when i open the binary in a hex editor..

why is that so, a protection?

all the tuto i have red or watched dont have that issue...

thanks

 

Updated by Anonymonk
Posted

IDA and Hex are at different address

ItbTaac.png

Left is Hex address  and right is IDA address

Posted
5 minutes ago, Anonymonk said:

i guess i could have choose something easier for my first start ^^, but thats that one i want to hack...

so i have a problem, when i dissassemble the binary as arm7 in ida (arm proc), he show a different hex view... as just to open the binary as raw...

i tried to open the binary with several Hex editors, they never match with the hex values from ida

i was thinking to edit the binary inside my iphone with a hexeditor and test it straight away... 

binary of assassin creed unity, thinned and alsr removed

HEX value from binary

  Hide contents

003D08E0  252B 447D 7828 BBE0 F641 0088 F235 DB2C F649 31C0 F2C0 2104 4479 6809 6008 F641
003D0900  300A F235 DB21 F64B 4136 F2C0 2104 4479 6809 6008 F641 300E F235 DB16 F64B 4180
003D0920  F2C0 2104 4479 6809 6008 F241 305A F2C8 0000 F235 DB07 F64B 41AE F2C0 2104 4479

HEX value from dissassembled binary in IDA

  Hide contents

003D08E0  D193 4605 A801 212A 4622 F239 DB37 9A02 4629 9801 6813 4798 B003 BDF0 6880 4770
003D0900  6087 4770 B580 466F B082 4602 4668 2118 F239 DB24 E89D 0003 680A 4790 B002 BD80
003D0920  B590 AF01 B082 460C 4602 4668 2119 F239 DB15 E89D 0005 4621 6813 4798 B002 BD90

the watchpoint is health going down in 32b float

lldb watchpoint

  Hide contents

Watchpoint 1 hit:
old value: 1134626297
new value: 1133971717
Process 766 stopped
* thread #1: tid = 0x1898, 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2
acier`___lldb_unnamed_function18218$$acier:
->  0x3d0902 <+2>: bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>: push   {r7, lr}
    0x3d0906 <+2>: mov    r7, sp
    0x3d0908 <+4>: sub    sp, #0x8
(lldb) dis -c 20
acier`___lldb_unnamed_function18218$$acier:
    0x3d0900 <+0>:  str    r1, [r0, #0x8]
->  0x3d0902 <+2>:  bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>:  push   {r7, lr}
    0x3d0906 <+2>:  mov    r7, sp
    0x3d0908 <+4>:  sub    sp, #0x8
    0x3d090a <+6>:  mov    r2, r0
    0x3d090c <+8>:  mov    r0, sp
    0x3d090e <+10>: movs   r1, #0x18
    0x3d0910 <+12>: bl     0xe09f5c                  ; ___lldb_unnamed_function81925$$acier
    0x3d0914 <+16>: ldm.w  sp, {r0, r1}
    0x3d0918 <+20>: ldr    r2, [r1]
    0x3d091a <+22>: blx    r2
    0x3d091c <+24>: add    sp, #0x8
    0x3d091e <+26>: pop    {r7, pc}

acier`___lldb_unnamed_function18220$$acier:
    0x3d0920 <+0>:  push   {r4, r7, lr}
    0x3d0922 <+2>:  add    r7, sp, #0x4
    0x3d0924 <+4>:  sub    sp, #0x8
    0x3d0926 <+6>:  mov    r4, r1
    0x3d0928 <+8>:  mov    r2, r0
    0x3d092a <+10>: mov    r0, sp

 

IDA view-A

  Reveal hidden contents

__text:003D08F4 ; End of function sub_3D0854
__text:003D08F4
__text:003D08F6                 BLX             R3
__text:003D08F8                 ADD             SP, SP, #0xC
__text:003D08FA                 POP             {R4-R7,PC}
__text:003D08FC ; ---------------------------------------------------------------------------
__text:003D08FC                 LDR             R0, [R0,#8]
__text:003D08FE                 BX              LR
__text:003D0900 ; ---------------------------------------------------------------------------
__text:003D0900                 STR             R0, [R0,#8]
__text:003D0902                 BX              LR
__text:003D0904
__text:003D0904 ; =============== S U B R O U T I N E =======================================
__text:003D0904
__text:003D0904
__text:003D0904 sub_3D0904
__text:003D0904                 PUSH            {R7,LR}
__text:003D0906                 MOV             R7, SP
__text:003D0908                 SUB             SP, SP, #8
__text:003D090A                 MOV             R2, R0
__text:003D090C                 MOV             R0, SP
__text:003D090E                 MOVS            R1, #0x18
__text:003D0910                 BL.W            sub_E09F5C
__text:003D0914                 LDMFD.W         SP, {R0,R1}
__text:003D0918                 LDR             R2, [R1]
__text:003D091A                 BLX             R2
__text:003D091C                 ADD             SP, SP, #8
__text:003D091E                 POP             {R7,PC}
__text:003D091E ; End of function sub_3D0904
__text:003D091E
__text:003D0920

 

when i convert arm to hex or hex to arm... nothing is matching with the value i find when i open the binary in a hex editor..

why is that so, a protection?

all the tuto i have red or watched dont have that issue...

thanks

 

1 - did you disable aslr? if never disable aslr, watchpoint offset from lldb is not correct.

2 - if you done disable aslr, when you find hex from hex editor , it must be -4000 from the IDA offset.

Posted
7 minutes ago, xiaov said:

1 - did you disable aslr? if never disable aslr, watchpoint offset from lldb is not correct.

2 - if you done disable aslr, when you find hex from hex editor , it must be -4000 from the IDA offset.

i disabled the alsr, and i guess its proper as the lldb display show the same instruction than Ida

 

9 minutes ago, Amuyea said:

IDA and Hex are at different address

ItbTaac.png

Left is Hex address  and right is IDA address

i see... thank you both for your help, i will give a try right now

Posted

yep.. thats it.. i can now try...

but it seems really hard  to begin to learn instruction in that assassin creed unity

i made a try and everyone became immortal, and all attribute to max.... big mess

seems like i will have to spend time to learn all that...

if someone feel to tell me what to edit ... i welcome everyone, hihihi

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Puzzle & Dragons (English) v22.3.0 Jailed Cheats +2
      Modded/Hacked App: Puzzle & Dragons (English) By GungHo Online Entertainment, INC.
      Bundle ID: jp.gungho.padEN
      iTunes Store Link: https://apps.apple.com/us/app/puzzle-dragons-english/id563474464?uo=4


      Hack Features:
      - God Mode
      - One Hit Kill


      Jailbreak required hack(s): https://iosgods.com/topic/133984-puzzle-dragons-japan-english-cheats-all-versions-3/


      iOS Hack Download Link: https://iosgods.com/topic/135066-puzzle-dragons-english-v1931-jailed-cheats-2/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 316 replies
    • [ Puzzle & Dragons KR ] 퍼즐앤드래곤 v22.3.0 Jailed Cheats +2
      Modded/Hacked App: 퍼즐앤드래곤 By GungHo Online Entertainment, INC.
      Bundle ID: jp.gungho.padKO
      iTunes Store Link: https://apps.apple.com/kr/app/%ED%8D%BC%EC%A6%90%EC%95%A4%EB%93%9C%EB%9E%98%EA%B3%A4/id588637521?uo=4


      Hack Features:
      - God Mode
      - One Hit Kill


      Jailbreak required hack(s): https://iosgods.com/topic/133984-puzzle-dragons-japan-english-cheats-all-versions-3/


      iOS Hack Download Link: https://iosgods.com/topic/146388-puzzle-dragons-korea-%ED%8D%BC%EC%A6%90%EC%95%A4%EB%93%9C%EB%9E%98%EA%B3%A4-v1920-jailed-cheats-2/
        • Agree
        • Thanks
        • Winner
        • Like
      • 23 replies
    • Skullgirls Fighting RPG V7.3.3 [ +6 Jailed ] Auto Win
      Modded/Hacked App: Skullgirls: Fighting RPG By Autumn Games, LLC
      Bundle ID: com.autumn.skullgirls
      iTunes Store Link: https://apps.apple.com/us/app/skullgirls-fighting-rpg/id1280762571?uo=4


      Hack Features:

      - Auto win

      - Damage [ One HiT WiN ]

      - Energy Max

      - Skill

      - Enemy Disable

      - Goals Claimed [ Free Pass Only ]
        • Informative
        • Thanks
        • Winner
        • Like
      • 38 replies
    • Skullgirls Fighting RPG V7.3.3 [ +6 Cheats ] Auto Win
      Modded/Hacked App: Skullgirls: Fighting RPG By Autumn Games, LLC
      Bundle ID: com.autumn.skullgirls
      iTunes Store Link: https://apps.apple.com/us/app/skullgirls-fighting-rpg/id1280762571?uo=4


      Hack Features:
      - Auto win

      - Damage [ One HiT WiN ]

      - Energy Max

      - Skill

      - Enemy Disable

      - Goals Claimed [ Free Pass Only ]
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 127 replies
    • Fortress Saga: AFK RPG Cheats v1.8.09 +5
      Modded/Hacked App: Fortress Saga: AFK RPG By cookapps
      Bundle ID: com.cookapps.bm.fortresssaga
      iTunes Store Link: https://apps.apple.com/us/app/fortress-saga-afk-rpg/id6446308106?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Damage Multiplier
      - Defense Multiplier
      - Freeze Currencies
      - PREMIUM
      - No Ads

       

      Non-Jailbroken Hack: https://iosgods.com/topic/184193-fortress-saga-afk-rpg-v1800-jailed-cheats-3/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/178933-fortress-saga-afk-rpg-cheats-v1801-5/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 364 replies
    • Prison Empire Tycoon-Idle Game Cheats v3.9.2 +2
      Modded/Hacked App: Prison Empire Tycoon-Idle Game by Digital Things Sociedad Limitada
      Bundle ID: com.codigames.idle.prison.empire.manager.tycoon
      iTunes Store Link: https://apps.apple.com/us/app/prison-empire-tycoon-idle-game/id1508490923?uo=4&at=1010lce4


      Hack Features:
      - Infinite Cash
      - No Ads


      Non-Jailbroken & No Jailbreak required hack(s):  https://iosgods.com/topic/128324-arm64-prison-empire-tycoon%EF%BC%8Didle-game-v102-jailed-cheats-2/

       
      iOS Hack Download Link: https://iosgods.com/topic/128322-arm64-prison-empire-tycoon%EF%BC%8Didle-game-cheats-all-versions-2/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,161 replies
    • Left to Survive: Zombie Games Cheats v7.6.0 +10 Hacks
      Modded/Hacked App: Left to Survive: Zombie TPS By MY COM
      Bundle ID: com.glu.zbs
      iTunes Store Link: https://apps.apple.com/us/app/left-to-survive-zombie-tps/id1090501422

      Hack Features:
      - No Bullet Disperse 
      - Unlimited Ammo
      - No Recoil
      - Increased Fire-rate 

      - One Hit Campaign 
      - Grenades and Med-kits Dont Subtract
      - God Mode
      - God Mode PVP

      - Unlock Chapters early 
      - Weapons Unlocked Ready to buy 


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/

        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,592 replies
    • [ Seven Deadly Sins KR ] 일곱 개의 대죄: GRAND CROSS Cheats v8.6.72 +5
      Modded/Hacked App: 일곱 개의 대죄: GRAND CROSS By Netmarble Corporation
      Bundle ID: com.netmarble.nanakr
      iTunes Store Link: https://apps.apple.com/kr/app/%EC%9D%BC%EA%B3%B1-%EA%B0%9C%EC%9D%98-%EB%8C%80%EC%A3%84-grand-cross/id1449552940?uo=4


      Hack Features:
      - God Mode
      - One Hit Kill
      - Multiply Attack
      - Multiply Defense
      - Make Enemies God Mode for some quests


      iOS Hack Download Link: https://iosgods.com/topic/154899-seven-deadly-sins-kr-%EC%9D%BC%EA%B3%B1-%EA%B0%9C%EC%9D%98-%EB%8C%80%EC%A3%84-grand-cross-cheats-v750-5/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 177 replies
    • Zooba: Zoo Battle Royale Game v5.19.0 Jailed Cheats +2
      Modded/Hacked App: Zooba: Zoo Battle Royale Games By Wildlife Studios Limited
      Bundle ID: com.fungames.battleroyale
      iTunes Store Link: https://apps.apple.com/us/app/zooba-zoo-battle-royale-games/id1459402952?uo=4


      Hack Features:
      - Map Hacks
      - Allow Shoot in Water


      Jailbreak required hack(s): https://iosgods.com/topic/131104-arm64-zooba-zoo-battle-royale-game-cheats-all-versions-2/


      iOS Hack Download Link: https://iosgods.com/topic/131134-arm64-zooba-zoo-battle-royale-game-v320-jailed-cheats-2/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,301 replies
    • The Seven Deadly Sins Cheats v2.81.0 +5
      Modded/Hacked App: The Seven Deadly Sins by Netmarble Corporation
      Bundle ID: com.netmarble.nanagb
      iTunes Store Link: https://apps.apple.com/us/app/the-seven-deadly-sins/id1475440231?uo=4&at=1010lce4


      Hack Features:
      - God Mode
      - OHK
      - Infinite MP


      iOS Hack Download Link: https://iosgods.com/topic/131686-arm64-the-seven-deadly-sins-cheats-v117-3/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 2,051 replies
    • Zombastic: Time to Survive v1.12.4 [ +1+++ Jailed ] Currency Max
      Modded/Hacked App: Zombastic: Time to Survive By Playmotional Limited
      Bundle ID: com.playmotional.survival
      iTunes Store Link: https://apps.apple.com/us/app/zombastic-time-to-survive/id6475173073?uo=4


      Hack Features:
      - Currency & Resources Unlimited [ Disable When Playing ] 





      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Thanks
        • Winner
        • Like
      • 52 replies
    • Zombastic: Time to Survive v1.12.4 [ +1+++ Cheats ] Currency Max
      Modded/Hacked App: Zombastic: Time to Survive By Playmotional Limited
      Bundle ID: com.playmotional.survival
      iTunes Store Link: https://apps.apple.com/us/app/zombastic-time-to-survive/id6475173073?uo=4


      Hack Features:
      - Currency & Resources Unlimited [ Disable When Playing ] 





      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 50 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines