Jump to content

HEX editing, dissassembled binary HEX values and binary HEX values different...wt#


5 posts in this topic

Recommended Posts

Posted (edited)

i guess i could have choose something easier for my first start ^^, but thats that one i want to hack...

so i have a problem, when i dissassemble the binary as arm7 in ida (arm proc), he show a different hex view... as just to open the binary as raw...

i tried to open the binary with several Hex editors, they never match with the hex values from ida

i was thinking to edit the binary inside my iphone with a hexeditor and test it straight away... 

binary of assassin creed unity, thinned and alsr removed

HEX value from binary

Spoiler

003D08E0  252B 447D 7828 BBE0 F641 0088 F235 DB2C F649 31C0 F2C0 2104 4479 6809 6008 F641
003D0900  300A F235 DB21 F64B 4136 F2C0 2104 4479 6809 6008 F641 300E F235 DB16 F64B 4180
003D0920  F2C0 2104 4479 6809 6008 F241 305A F2C8 0000 F235 DB07 F64B 41AE F2C0 2104 4479

HEX value from dissassembled binary in IDA

Spoiler

003D08E0  D193 4605 A801 212A 4622 F239 DB37 9A02 4629 9801 6813 4798 B003 BDF0 6880 4770
003D0900  6087 4770 B580 466F B082 4602 4668 2118 F239 DB24 E89D 0003 680A 4790 B002 BD80
003D0920  B590 AF01 B082 460C 4602 4668 2119 F239 DB15 E89D 0005 4621 6813 4798 B002 BD90

the watchpoint is health going down in 32b float

lldb watchpoint

Spoiler

Watchpoint 1 hit:
old value: 1134626297
new value: 1133971717
Process 766 stopped
* thread #1: tid = 0x1898, 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2
acier`___lldb_unnamed_function18218$$acier:
->  0x3d0902 <+2>: bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>: push   {r7, lr}
    0x3d0906 <+2>: mov    r7, sp
    0x3d0908 <+4>: sub    sp, #0x8
(lldb) dis -c 20
acier`___lldb_unnamed_function18218$$acier:
    0x3d0900 <+0>:  str    r1, [r0, #0x8]
->  0x3d0902 <+2>:  bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>:  push   {r7, lr}
    0x3d0906 <+2>:  mov    r7, sp
    0x3d0908 <+4>:  sub    sp, #0x8
    0x3d090a <+6>:  mov    r2, r0
    0x3d090c <+8>:  mov    r0, sp
    0x3d090e <+10>: movs   r1, #0x18
    0x3d0910 <+12>: bl     0xe09f5c                  ; ___lldb_unnamed_function81925$$acier
    0x3d0914 <+16>: ldm.w  sp, {r0, r1}
    0x3d0918 <+20>: ldr    r2, [r1]
    0x3d091a <+22>: blx    r2
    0x3d091c <+24>: add    sp, #0x8
    0x3d091e <+26>: pop    {r7, pc}

acier`___lldb_unnamed_function18220$$acier:
    0x3d0920 <+0>:  push   {r4, r7, lr}
    0x3d0922 <+2>:  add    r7, sp, #0x4
    0x3d0924 <+4>:  sub    sp, #0x8
    0x3d0926 <+6>:  mov    r4, r1
    0x3d0928 <+8>:  mov    r2, r0
    0x3d092a <+10>: mov    r0, sp

 

IDA view-A

Spoiler


__text:003D08FC ; =============== S U B R O U T I N E =======================================
__text:003D08FC
__text:003D08FC
__text:003D08FC sub_3D08FC                              ; DATA XREF: __const:024C77F0o
__text:003D08FC                 LDR             R0, [R0,#8]
__text:003D08FE                 BX              LR
__text:003D08FE ; End of function sub_3D08FC
__text:003D08FE
__text:003D0900
__text:003D0900 ; =============== S U B R O U T I N E =======================================
__text:003D0900
__text:003D0900
__text:003D0900 sub_3D0900                              ; DATA XREF: __const:024C77F4o
__text:003D0900                 STR             R7, [R0,#8]
__text:003D0902                 BX              LR
__text:003D0902 ; End of function sub_3D0900
__text:003D0902
__text:003D0904
__text:003D0904 ; =============== S U B R O U T I N E =======================================
__text:003D0904
__text:003D0904
__text:003D0904 sub_3D0904                              ; DATA XREF: __const:024C77F8o
__text:003D0904                 PUSH            {R7,LR}
__text:003D0906                 MOV             R7, SP
__text:003D0908                 SUB             SP, SP, #8
__text:003D090A                 MOV             R2, R0
__text:003D090C                 MOV             R0, SP
__text:003D090E                 MOVS            R1, #0x18
__text:003D0910                 BL.W            sub_E09F5C
__text:003D0914                 LDMFD.W         SP, {R0,R1}
__text:003D0918                 LDR             R2, [R1]
__text:003D091A                 BLX             R2
__text:003D091C                 ADD             SP, SP, #8
__text:003D091E                 POP             {R7,PC}
__text:003D091E ; End of function sub_3D0904

 

when i convert arm to hex or hex to arm... nothing is matching with the value i find when i open the binary in a hex editor..

why is that so, a protection?

all the tuto i have red or watched dont have that issue...

thanks

 

Updated by Anonymonk
Posted

IDA and Hex are at different address

ItbTaac.png

Left is Hex address  and right is IDA address

Posted
5 minutes ago, Anonymonk said:

i guess i could have choose something easier for my first start ^^, but thats that one i want to hack...

so i have a problem, when i dissassemble the binary as arm7 in ida (arm proc), he show a different hex view... as just to open the binary as raw...

i tried to open the binary with several Hex editors, they never match with the hex values from ida

i was thinking to edit the binary inside my iphone with a hexeditor and test it straight away... 

binary of assassin creed unity, thinned and alsr removed

HEX value from binary

  Hide contents

003D08E0  252B 447D 7828 BBE0 F641 0088 F235 DB2C F649 31C0 F2C0 2104 4479 6809 6008 F641
003D0900  300A F235 DB21 F64B 4136 F2C0 2104 4479 6809 6008 F641 300E F235 DB16 F64B 4180
003D0920  F2C0 2104 4479 6809 6008 F241 305A F2C8 0000 F235 DB07 F64B 41AE F2C0 2104 4479

HEX value from dissassembled binary in IDA

  Hide contents

003D08E0  D193 4605 A801 212A 4622 F239 DB37 9A02 4629 9801 6813 4798 B003 BDF0 6880 4770
003D0900  6087 4770 B580 466F B082 4602 4668 2118 F239 DB24 E89D 0003 680A 4790 B002 BD80
003D0920  B590 AF01 B082 460C 4602 4668 2119 F239 DB15 E89D 0005 4621 6813 4798 B002 BD90

the watchpoint is health going down in 32b float

lldb watchpoint

  Hide contents

Watchpoint 1 hit:
old value: 1134626297
new value: 1133971717
Process 766 stopped
* thread #1: tid = 0x1898, 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2
acier`___lldb_unnamed_function18218$$acier:
->  0x3d0902 <+2>: bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>: push   {r7, lr}
    0x3d0906 <+2>: mov    r7, sp
    0x3d0908 <+4>: sub    sp, #0x8
(lldb) dis -c 20
acier`___lldb_unnamed_function18218$$acier:
    0x3d0900 <+0>:  str    r1, [r0, #0x8]
->  0x3d0902 <+2>:  bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>:  push   {r7, lr}
    0x3d0906 <+2>:  mov    r7, sp
    0x3d0908 <+4>:  sub    sp, #0x8
    0x3d090a <+6>:  mov    r2, r0
    0x3d090c <+8>:  mov    r0, sp
    0x3d090e <+10>: movs   r1, #0x18
    0x3d0910 <+12>: bl     0xe09f5c                  ; ___lldb_unnamed_function81925$$acier
    0x3d0914 <+16>: ldm.w  sp, {r0, r1}
    0x3d0918 <+20>: ldr    r2, [r1]
    0x3d091a <+22>: blx    r2
    0x3d091c <+24>: add    sp, #0x8
    0x3d091e <+26>: pop    {r7, pc}

acier`___lldb_unnamed_function18220$$acier:
    0x3d0920 <+0>:  push   {r4, r7, lr}
    0x3d0922 <+2>:  add    r7, sp, #0x4
    0x3d0924 <+4>:  sub    sp, #0x8
    0x3d0926 <+6>:  mov    r4, r1
    0x3d0928 <+8>:  mov    r2, r0
    0x3d092a <+10>: mov    r0, sp

 

IDA view-A

  Reveal hidden contents

__text:003D08F4 ; End of function sub_3D0854
__text:003D08F4
__text:003D08F6                 BLX             R3
__text:003D08F8                 ADD             SP, SP, #0xC
__text:003D08FA                 POP             {R4-R7,PC}
__text:003D08FC ; ---------------------------------------------------------------------------
__text:003D08FC                 LDR             R0, [R0,#8]
__text:003D08FE                 BX              LR
__text:003D0900 ; ---------------------------------------------------------------------------
__text:003D0900                 STR             R0, [R0,#8]
__text:003D0902                 BX              LR
__text:003D0904
__text:003D0904 ; =============== S U B R O U T I N E =======================================
__text:003D0904
__text:003D0904
__text:003D0904 sub_3D0904
__text:003D0904                 PUSH            {R7,LR}
__text:003D0906                 MOV             R7, SP
__text:003D0908                 SUB             SP, SP, #8
__text:003D090A                 MOV             R2, R0
__text:003D090C                 MOV             R0, SP
__text:003D090E                 MOVS            R1, #0x18
__text:003D0910                 BL.W            sub_E09F5C
__text:003D0914                 LDMFD.W         SP, {R0,R1}
__text:003D0918                 LDR             R2, [R1]
__text:003D091A                 BLX             R2
__text:003D091C                 ADD             SP, SP, #8
__text:003D091E                 POP             {R7,PC}
__text:003D091E ; End of function sub_3D0904
__text:003D091E
__text:003D0920

 

when i convert arm to hex or hex to arm... nothing is matching with the value i find when i open the binary in a hex editor..

why is that so, a protection?

all the tuto i have red or watched dont have that issue...

thanks

 

1 - did you disable aslr? if never disable aslr, watchpoint offset from lldb is not correct.

2 - if you done disable aslr, when you find hex from hex editor , it must be -4000 from the IDA offset.

Posted
7 minutes ago, xiaov said:

1 - did you disable aslr? if never disable aslr, watchpoint offset from lldb is not correct.

2 - if you done disable aslr, when you find hex from hex editor , it must be -4000 from the IDA offset.

i disabled the alsr, and i guess its proper as the lldb display show the same instruction than Ida

 

9 minutes ago, Amuyea said:

IDA and Hex are at different address

ItbTaac.png

Left is Hex address  and right is IDA address

i see... thank you both for your help, i will give a try right now

Posted

yep.. thats it.. i can now try...

but it seems really hard  to begin to learn instruction in that assassin creed unity

i made a try and everyone became immortal, and all attribute to max.... big mess

seems like i will have to spend time to learn all that...

if someone feel to tell me what to edit ... i welcome everyone, hihihi

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Project Makeover v2.116.1 +4 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Project Makeover By Magic Tavern, Inc.
      Bundle ID: com.bgg.jump
      App Store Link: https://apps.apple.com/us/app/project-makeover/id1483058899?uo=4

       
       

      🤩 Hack Features

      - Unlimited Cash
      - Unlimited Coins
      - Unlimited Gems
      - Unlimited Lives

      This hack was made by @Cashlaz. Give him all your love & appreciation! ❤️
        • Thanks
        • Like
      • 5 replies
    • Heroes vs. Hordes: Survivor v5.0.2 [ +11 Cheats ] Currency Max
      Modded/Hacked App: Heroes vs. Hordes: Survivor By Swift Games GmbH
      Bundle ID: com.swiftgames.roguelikesurvival
      iTunes Store Link: https://apps.apple.com/us/app/heroes-vs-hordes-survivor/id1608898173?uo=4

       
      Hack Features

      - Currency

      - Resource

      - Gold Unlimited [ Bonus Wave ]

      - Ch Unlocked [ Play All Off ]

      - Always Last Wave

      - Talents Cost 0

      - Hero DMG Only

      - HP & DMG [ Just Equip & Unequip ]

      - Enemy Freeze

      - Enemy ATK NO

       
      For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
        • Agree
        • Thanks
        • Winner
        • Like
      • 67 replies
    • Heroes vs. Hordes: Survivor v5.0.2 [ +11 Jailed ] Currency Max
      Modded/Hacked App: Heroes vs. Hordes: Survivor By Swift Games GmbH
      Bundle ID: com.swiftgames.roguelikesurvival
      iTunes Store Link: https://apps.apple.com/us/app/heroes-vs-hordes-survivor/id1608898173?uo=4

       

       

      Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      Hack Features

      - Currency

      - Resource

      - Gold Unlimited [ Bonus Wave ]

      - Ch Unlocked [ Play All Off ]

      - Always Last Wave

      - Talents Cost 0

      - Hero DMG Only

      - HP & DMG [ Just Equip & Unequip ]

      - Enemy Freeze

      - Enemy ATK NO


      Jailbreak required iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APKs: https://iosgods.com/forum/68-android-section/

       

      iOS Hack Download IPA Link


      Hidden Content

      Download via the iOSGods App
        • Agree
        • Thanks
        • Winner
        • Like
      • 83 replies
    • Virtual Villagers 6 v1.8.6 +100 Jailed Cheats [ Cheats Menu ]
      Modded/Hacked App: Virtual Villagers 6 By LDW Software, LLC
      Bundle ID: com.ldw.vv6
      iTunes Store Link: https://apps.apple.com/us/app/virtual-villagers-6/id6566193928?uo=4

       
       

      Hack Features

      - Cheats Menu -> Head into Settings, toggle the Help button, close settings then re-open to show a Cheats button.*
      - Unlimited Food*
      - Unlimited Wood*
      - Unlimited Stone*
      - Unlimited Tech Points*
      - Unlimited Lavastone*

      * - Head into Settings and toggle the Help button. Only enable 1 feature at a time.


      Jailbreak required iOS hacks: [Mod Menu Hack] Virtual Villagers 6 v1.3.23 +100 Cheats [ Cheats Menu ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APKs: https://iosgods.com/forum/68-android-section/
        • Agree
        • Like
      • 5 replies
    • Virtual Villagers 6 v1.8.6 +100 Cheats [ Cheats Menu ]
      Modded/Hacked App: Virtual Villagers 6 By LDW Software, LLC
      Bundle ID: com.ldw.vv6
      iTunes Store Link: https://apps.apple.com/us/app/virtual-villagers-6/id6566193928?uo=4

       


      Hack Features

      - Cheats Menu -> Head into Settings, toggle the Help button, close settings then re-open to show a Cheats button.*
      - Unlimited Food*
      - Unlimited Wood*
      - Unlimited Stone*
      - Unlimited Tech Points*
      - Unlimited Lavastone*

      * - Head into Settings and toggle the Help button. Only enable 1 feature at a time.


      For Non-Jailbroken & No Jailbreak required hacks: [IPA Mod Menu] Virtual Villagers 6 v1.3.23 +100 Jailed Cheats [ Cheats Menu ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
        • Haha
        • Like
      • 2 replies
    • Project Makeover ( All Versions ) +4 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Project Makeover By Magic Tavern, Inc.
      Bundle ID: com.bgg.jump
      App Store Link: https://apps.apple.com/us/app/project-makeover/id1483058899?uo=4

       
       

      🤩 Hack Features

      - Unlimited Cash
      - Unlimited Coins
      - Unlimited Gems
      - Unlimited Lives

      This hack was made by @Cashlaz. Give him all your love & appreciation! ❤️
        • Thanks
      • 7 replies
    • Galaxiga - Classic 80s Arcade V10.88 [ +7 Jailed ] Energy Max
      Modded/Hacked App: Galaxiga - Classic 80s Arcade By ONESOFT GLOBAL PTE. LTD.
      Bundle ID: com.os.space.force.galaxy.alien
      iTunes Store Link: https://apps.apple.com/us/app/galaxiga-classic-80s-arcade/id1519367184?uo=4


      Hack Features:

      - Premium Pass [ Rewards Only ]

      - Energy Unlimited [ Linked Premium Pass ]

      - Plane Unlocked [ Tire 1 Tire 2 ] 

      - Drone Unlocked [ Tire 1 Tire 2 ]

      - Stone Unlocked [ Tire 1 Tire 2 ] 

      - Unlock Gem Cost 0 [ Plane Drone Stone ]

      - Easy Kill [ Only SP - No PVP ] 

      - Win PvP Select Higher Rank [ Plane Drone Stone ] Easy To Win PvP NO Bannnn


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Winner
        • Like
      • 45 replies
    • Galaxiga - Classic 80s Arcade V10.88 [ +7 Cheats ] Energy Max
      Modded/Hacked App: Galaxiga - Classic 80s Arcade By ONESOFT GLOBAL PTE. LTD.
      Bundle ID: com.os.space.force.galaxy.alien
      iTunes Store Link: https://apps.apple.com/us/app/galaxiga-classic-80s-arcade/id1519367184?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - Premium Pass [ Rewards Only ]

      - Energy Unlimited [ Linked Premium Pass ]

      - Plane Unlocked [ Tire 1 Tire 2 ] 

      - Drone Unlocked [ Tire 1 Tire 2 ]

      - Stone Unlocked [ Tire 1 Tire 2 ] 

      - Unlock Gem Cost 0 [ Plane Drone Stone ] Maybe Effect PvP 

      - Easy Kill [ Only SP - No PVP ] 

      - Win PvP Select Higher Rank [ Plane Drone Stone ]

      Not3:- Don't Abuse The Hack Incase Banned Lower Chances Maybe


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download Link:

      Hidden Content

      Download Hack
        • Informative
        • Agree
        • Haha
        • Winner
        • Like
      • 77 replies
    • Pocket Necro v1.5.3 [ +11 Cheats ] Gold Unlimited
      Modded/Hacked App: Pocket Necromancer By Sandsoft Publishing Company
      Bundle ID: com.quicksand.pocketnecromancer
      iTunes Store Link: https://apps.apple.com/us/app/pocket-necromancer/id6450004790?uo=4


      Hack Features:
      - ADS NO [ Reward Fee ]

      - Premium Active

      - Energy Cost 0

      - Energy Increaser

      - Gold Unlimited [ Win Battle ] Rewards

      - Stage Unlocked

      - Chapter Unlocked +2

      - Play Any [ Stage & Ch ]

      - Never Die

      - DMG

      - Speed Mov

      - Bullet Max [ Works With Weapon Only Just Equip ]


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Haha
        • Winner
        • Like
      • 51 replies
    • Pocket Necro v1.5.3 [ +11 Jailed ] Gold Unlimited
      Modded/Hacked App: Pocket Necromancer By Sandsoft Publishing Company
      Bundle ID: com.quicksand.pocketnecromancer
      iTunes Store Link: https://apps.apple.com/us/app/pocket-necromancer/id6450004790?uo=4


      Hack Features:

      - ADS NO [ Reward Fee ]

      - Premium Active

      - Energy Cost 0

      - Energy Increaser

      - Gold Unlimited [ Win Battle ] Rewards

      - Stage Unlocked

      - Chapter Unlocked +2

      - Play Any [ Stage & Ch ]

      - Never Die

      - DMG

      - Speed Mov

      - Bullet Max [ Works With Weapon Only Just Equip ]

       
      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download IPA Link:

      Hidden Content

      Download via the iOSGods App
        • Informative
        • Agree
        • Haha
        • Winner
        • Like
      • 55 replies
    • Merge & Blast: Dream Island v2.21.0 [ +2 Cheats ] Auto Win
      Modded/Hacked App: Merge & Blast: Dream Island By Dreamo, Inc.
      Bundle ID: com.dreamo.woodyblast
      iTunes Store Link: https://apps.apple.com/us/app/merge-blast-dream-island/id1668748189?uo=4


      🤩 Hack Features

      - Auto Win
      - Coin + Moves [ Disable After Get ]




      🍏 For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/forum/79-no-jailbreak-section/
      🤖 Modded Android APKs: https://iosgods.com/forum/68-android-section/
        • Like
      • 11 replies
    • Merge & Blast: Dream Island v2.21.0 [ +2 Jailed ] Auto Win
      Modded/Hacked App: Merge & Blast: Dream Island By Dreamo, Inc.
      Bundle ID: com.dreamo.woodyblast
      iTunes Store Link: https://apps.apple.com/us/app/merge-blast-dream-island/id1668748189?uo=4

       

      🤩 Hack Features

      - Auto Win
      - Coin + Moves [ Disable After Get ]




      🍏 Jailbreak iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      🤖 Modded Android APKs: https://iosgods.com/forum/68-android-section/
      • 16 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines