Jump to content

HEX editing, dissassembled binary HEX values and binary HEX values different...wt#


5 posts in this topic

Recommended Posts

Posted (edited)

i guess i could have choose something easier for my first start ^^, but thats that one i want to hack...

so i have a problem, when i dissassemble the binary as arm7 in ida (arm proc), he show a different hex view... as just to open the binary as raw...

i tried to open the binary with several Hex editors, they never match with the hex values from ida

i was thinking to edit the binary inside my iphone with a hexeditor and test it straight away... 

binary of assassin creed unity, thinned and alsr removed

HEX value from binary

Spoiler

003D08E0  252B 447D 7828 BBE0 F641 0088 F235 DB2C F649 31C0 F2C0 2104 4479 6809 6008 F641
003D0900  300A F235 DB21 F64B 4136 F2C0 2104 4479 6809 6008 F641 300E F235 DB16 F64B 4180
003D0920  F2C0 2104 4479 6809 6008 F241 305A F2C8 0000 F235 DB07 F64B 41AE F2C0 2104 4479

HEX value from dissassembled binary in IDA

Spoiler

003D08E0  D193 4605 A801 212A 4622 F239 DB37 9A02 4629 9801 6813 4798 B003 BDF0 6880 4770
003D0900  6087 4770 B580 466F B082 4602 4668 2118 F239 DB24 E89D 0003 680A 4790 B002 BD80
003D0920  B590 AF01 B082 460C 4602 4668 2119 F239 DB15 E89D 0005 4621 6813 4798 B002 BD90

the watchpoint is health going down in 32b float

lldb watchpoint

Spoiler

Watchpoint 1 hit:
old value: 1134626297
new value: 1133971717
Process 766 stopped
* thread #1: tid = 0x1898, 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2
acier`___lldb_unnamed_function18218$$acier:
->  0x3d0902 <+2>: bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>: push   {r7, lr}
    0x3d0906 <+2>: mov    r7, sp
    0x3d0908 <+4>: sub    sp, #0x8
(lldb) dis -c 20
acier`___lldb_unnamed_function18218$$acier:
    0x3d0900 <+0>:  str    r1, [r0, #0x8]
->  0x3d0902 <+2>:  bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>:  push   {r7, lr}
    0x3d0906 <+2>:  mov    r7, sp
    0x3d0908 <+4>:  sub    sp, #0x8
    0x3d090a <+6>:  mov    r2, r0
    0x3d090c <+8>:  mov    r0, sp
    0x3d090e <+10>: movs   r1, #0x18
    0x3d0910 <+12>: bl     0xe09f5c                  ; ___lldb_unnamed_function81925$$acier
    0x3d0914 <+16>: ldm.w  sp, {r0, r1}
    0x3d0918 <+20>: ldr    r2, [r1]
    0x3d091a <+22>: blx    r2
    0x3d091c <+24>: add    sp, #0x8
    0x3d091e <+26>: pop    {r7, pc}

acier`___lldb_unnamed_function18220$$acier:
    0x3d0920 <+0>:  push   {r4, r7, lr}
    0x3d0922 <+2>:  add    r7, sp, #0x4
    0x3d0924 <+4>:  sub    sp, #0x8
    0x3d0926 <+6>:  mov    r4, r1
    0x3d0928 <+8>:  mov    r2, r0
    0x3d092a <+10>: mov    r0, sp

 

IDA view-A

Spoiler


__text:003D08FC ; =============== S U B R O U T I N E =======================================
__text:003D08FC
__text:003D08FC
__text:003D08FC sub_3D08FC                              ; DATA XREF: __const:024C77F0o
__text:003D08FC                 LDR             R0, [R0,#8]
__text:003D08FE                 BX              LR
__text:003D08FE ; End of function sub_3D08FC
__text:003D08FE
__text:003D0900
__text:003D0900 ; =============== S U B R O U T I N E =======================================
__text:003D0900
__text:003D0900
__text:003D0900 sub_3D0900                              ; DATA XREF: __const:024C77F4o
__text:003D0900                 STR             R7, [R0,#8]
__text:003D0902                 BX              LR
__text:003D0902 ; End of function sub_3D0900
__text:003D0902
__text:003D0904
__text:003D0904 ; =============== S U B R O U T I N E =======================================
__text:003D0904
__text:003D0904
__text:003D0904 sub_3D0904                              ; DATA XREF: __const:024C77F8o
__text:003D0904                 PUSH            {R7,LR}
__text:003D0906                 MOV             R7, SP
__text:003D0908                 SUB             SP, SP, #8
__text:003D090A                 MOV             R2, R0
__text:003D090C                 MOV             R0, SP
__text:003D090E                 MOVS            R1, #0x18
__text:003D0910                 BL.W            sub_E09F5C
__text:003D0914                 LDMFD.W         SP, {R0,R1}
__text:003D0918                 LDR             R2, [R1]
__text:003D091A                 BLX             R2
__text:003D091C                 ADD             SP, SP, #8
__text:003D091E                 POP             {R7,PC}
__text:003D091E ; End of function sub_3D0904

 

when i convert arm to hex or hex to arm... nothing is matching with the value i find when i open the binary in a hex editor..

why is that so, a protection?

all the tuto i have red or watched dont have that issue...

thanks

 

Updated by Anonymonk
Posted
5 minutes ago, Anonymonk said:

i guess i could have choose something easier for my first start ^^, but thats that one i want to hack...

so i have a problem, when i dissassemble the binary as arm7 in ida (arm proc), he show a different hex view... as just to open the binary as raw...

i tried to open the binary with several Hex editors, they never match with the hex values from ida

i was thinking to edit the binary inside my iphone with a hexeditor and test it straight away... 

binary of assassin creed unity, thinned and alsr removed

HEX value from binary

  Hide contents

003D08E0  252B 447D 7828 BBE0 F641 0088 F235 DB2C F649 31C0 F2C0 2104 4479 6809 6008 F641
003D0900  300A F235 DB21 F64B 4136 F2C0 2104 4479 6809 6008 F641 300E F235 DB16 F64B 4180
003D0920  F2C0 2104 4479 6809 6008 F241 305A F2C8 0000 F235 DB07 F64B 41AE F2C0 2104 4479

HEX value from dissassembled binary in IDA

  Hide contents

003D08E0  D193 4605 A801 212A 4622 F239 DB37 9A02 4629 9801 6813 4798 B003 BDF0 6880 4770
003D0900  6087 4770 B580 466F B082 4602 4668 2118 F239 DB24 E89D 0003 680A 4790 B002 BD80
003D0920  B590 AF01 B082 460C 4602 4668 2119 F239 DB15 E89D 0005 4621 6813 4798 B002 BD90

the watchpoint is health going down in 32b float

lldb watchpoint

  Hide contents

Watchpoint 1 hit:
old value: 1134626297
new value: 1133971717
Process 766 stopped
* thread #1: tid = 0x1898, 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2, queue = 'com.apple.main-thread', stop reason = watchpoint 1
    frame #0: 0x003d0902 acier`___lldb_unnamed_function18218$$acier + 2
acier`___lldb_unnamed_function18218$$acier:
->  0x3d0902 <+2>: bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>: push   {r7, lr}
    0x3d0906 <+2>: mov    r7, sp
    0x3d0908 <+4>: sub    sp, #0x8
(lldb) dis -c 20
acier`___lldb_unnamed_function18218$$acier:
    0x3d0900 <+0>:  str    r1, [r0, #0x8]
->  0x3d0902 <+2>:  bx     lr

acier`___lldb_unnamed_function18219$$acier:
    0x3d0904 <+0>:  push   {r7, lr}
    0x3d0906 <+2>:  mov    r7, sp
    0x3d0908 <+4>:  sub    sp, #0x8
    0x3d090a <+6>:  mov    r2, r0
    0x3d090c <+8>:  mov    r0, sp
    0x3d090e <+10>: movs   r1, #0x18
    0x3d0910 <+12>: bl     0xe09f5c                  ; ___lldb_unnamed_function81925$$acier
    0x3d0914 <+16>: ldm.w  sp, {r0, r1}
    0x3d0918 <+20>: ldr    r2, [r1]
    0x3d091a <+22>: blx    r2
    0x3d091c <+24>: add    sp, #0x8
    0x3d091e <+26>: pop    {r7, pc}

acier`___lldb_unnamed_function18220$$acier:
    0x3d0920 <+0>:  push   {r4, r7, lr}
    0x3d0922 <+2>:  add    r7, sp, #0x4
    0x3d0924 <+4>:  sub    sp, #0x8
    0x3d0926 <+6>:  mov    r4, r1
    0x3d0928 <+8>:  mov    r2, r0
    0x3d092a <+10>: mov    r0, sp

 

IDA view-A

  Reveal hidden contents

__text:003D08F4 ; End of function sub_3D0854
__text:003D08F4
__text:003D08F6                 BLX             R3
__text:003D08F8                 ADD             SP, SP, #0xC
__text:003D08FA                 POP             {R4-R7,PC}
__text:003D08FC ; ---------------------------------------------------------------------------
__text:003D08FC                 LDR             R0, [R0,#8]
__text:003D08FE                 BX              LR
__text:003D0900 ; ---------------------------------------------------------------------------
__text:003D0900                 STR             R0, [R0,#8]
__text:003D0902                 BX              LR
__text:003D0904
__text:003D0904 ; =============== S U B R O U T I N E =======================================
__text:003D0904
__text:003D0904
__text:003D0904 sub_3D0904
__text:003D0904                 PUSH            {R7,LR}
__text:003D0906                 MOV             R7, SP
__text:003D0908                 SUB             SP, SP, #8
__text:003D090A                 MOV             R2, R0
__text:003D090C                 MOV             R0, SP
__text:003D090E                 MOVS            R1, #0x18
__text:003D0910                 BL.W            sub_E09F5C
__text:003D0914                 LDMFD.W         SP, {R0,R1}
__text:003D0918                 LDR             R2, [R1]
__text:003D091A                 BLX             R2
__text:003D091C                 ADD             SP, SP, #8
__text:003D091E                 POP             {R7,PC}
__text:003D091E ; End of function sub_3D0904
__text:003D091E
__text:003D0920

 

when i convert arm to hex or hex to arm... nothing is matching with the value i find when i open the binary in a hex editor..

why is that so, a protection?

all the tuto i have red or watched dont have that issue...

thanks

 

1 - did you disable aslr? if never disable aslr, watchpoint offset from lldb is not correct.

2 - if you done disable aslr, when you find hex from hex editor , it must be -4000 from the IDA offset.

Posted
7 minutes ago, xiaov said:

1 - did you disable aslr? if never disable aslr, watchpoint offset from lldb is not correct.

2 - if you done disable aslr, when you find hex from hex editor , it must be -4000 from the IDA offset.

i disabled the alsr, and i guess its proper as the lldb display show the same instruction than Ida

 

9 minutes ago, Amuyea said:

IDA and Hex are at different address

ItbTaac.png

Left is Hex address  and right is IDA address

i see... thank you both for your help, i will give a try right now

Posted

yep.. thats it.. i can now try...

but it seems really hard  to begin to learn instruction in that assassin creed unity

i made a try and everyone became immortal, and all attribute to max.... big mess

seems like i will have to spend time to learn all that...

if someone feel to tell me what to edit ... i welcome everyone, hihihi

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Westland Survival - Cowboy RPG v10.4.0 +7 [ Items Cheat ]
      Modded/Hacked App: Westland Survival - Cowboy RPG By HELIO LTD
      Bundle ID: com.heliogames.a1
      iTunes Store Link: https://apps.apple.com/us/app/westland-survival-cowboy-rpg/id1339238576?uo=4


      Hack Features:
      - Unlimited Energy / Instant Energy Refills
      - Unlock All Blueprints
      - Items Duplicate When Split / Items Hack
      - Unlimited Consumable Items
      - Unlimited Item Durability
      - God Mode / Never Die -> Linked with enemies. Useful for looting.
      - One Hit Kill / High Damage -> Linked with enemies. Use with caution.


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 448 replies
    • Chef & Friends: Cooking Game Cheats v1.35.5 +1
      Modded/Hacked App: Chef & Friends: Cooking Game By MYTONA Ltd.
      Bundle ID: com.mytona.cheftales
      iTunes Store Link: https://apps.apple.com/us/app/chef-friends-cooking-game/id1586951898?uo=4


      Hack Features:
      - Infinite Currencies (Hats, Coins, Gems)

      NOTE: May bug out the game so better try on your throw away account first 


      iOS Hack Download Link: https://iosgods.com/topic/178904-chef-friends-cooking-game-cheats-v141-1/
        • Thanks
        • Winner
        • Like
      • 32 replies
    • Cooking Diary Restaurant Game v2.44.2 Jailed Cheats +3
      Modded/Hacked App: Cooking Diary® Restaurant Game by MyTona Pte Ltd
      Bundle ID: com.mytonallc.cookingdiary
      iTunes Store Link: https://apps.apple.com/us/app/cooking-diary-restaurant-game/id1214763610?uo=4&at=1010lce4


      Hack Features:
      - Infinite Currencies (Get some)
      - Freeze Boosters


      iOS Hack Download Link: https://iosgods.com/topic/110310-arm64-cooking-diary-restaurant-game-v1160-3/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 697 replies
    • [ViP Hack] WarFriends v6.0.0 +6 Cheats
      Modded/Hacked App: WarFriends: PvP Shooter Game By Chillingo Ltd
      Bundle ID: com.chillingo.warfriends
      iTunes Link: https://itunes.apple.com/us/app/warfriends-pvp-shooter-game/id979873043


      Hack Features:
      - Debug Menu -> Most/Everything from previous hack has been patched/removed. However, it will still show you some in-game stuff.
      - Free Weapon Upgrades. Instant Weapon Upgrade Delivery Times!
      - Unlimited Clips/Ammo -> Works online & offline
      - No Weapon Reload / Unlimited Ammo in Clip -> Works online & offline
      - One Hit Kill Enemies / High Damage -> Buggy Online, works well offline. Linked with enemy, so hit them first.
      - Gun Fire Rate x1000 -> Shoot bullets really, really fast. Works online too, linked to enemy. One Hit Kill Alternative if you can aim.
      This hack is an In-Game Mod Menu (iGMM). In order to activate the Mod Menu, tap your screen with 3 fingers simultaneously.

       

      Non-Jailbroken Version of this hack: https://iosgods.com/topic/44193-warfriends-v140-3-cheats-ios-10/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,771 replies
    • Towerlands - tower defense TD v3.7.5 +2 Cheats
      Modded/Hacked App: Towerlands - tower defense TD By CHERNYE MEDVEDI, OOO
      Bundle ID: mobi.blackbears.ios.towerlands
      iTunes Store Link: https://apps.apple.com/us/app/towerlands-tower-defense-td/id1491901979?uo=4



      Hack Features:
      - Unlimited Gold
      - Unlimited Gems


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 349 replies
    • Fishing Clash v1.0.398 +3 Cheats
      Modded/Hacked App: Fishing Clash: Fish Game 2019 by Ten Square Games S.A.
      Bundle ID: com.tensquaregames.letsfish2
      iTunes Store Link: https://apps.apple.com/us/app/fishing-clash-fish-game-2019/id1151811380


      Hack Features:
      - Combo Always Active
      - Centered Line -> The line is always in the center zone. I didn't test enough but worked for 20 games. Duels too.
      - Line Never Breaks
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,345 replies
    • Legend of Solgard v2.53.0 - [ x Player Damage & More ]
      Modded/Hacked App: Legend of Solgard By King
      Bundle ID: com.midasplayer.apps.solgard
      iTunes Store Link: https://apps.apple.com/us/app/legend-of-solgard/id1281263906

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate or Substitute.
      - PreferenceLoader (from Cydia).


      Hack Features:
      - x Player Damage - x1 - 30
      - God Mode

      All features are unlinked and only for player, you!
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 587 replies
    • Legend of Solgard v2.53.0 +3 Cheat [God Mode & Damage]
      Modded/Hacked App: Legend of Solgard By King
      Bundle ID: com.midasplayer.apps.solgard
      iTunes Store Link: https://itunes.apple.com/us/app/legend-of-solgard/id1281263906?mt=8&uo=4&at=1010lce4


      Mod Requirements:
      - Jailbroken or Non-Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly.
      - A Computer Running Windows/Mac/Linux.


      Hack Features:
      - x Player Damage - x1 - 30
      - God Mode / Never Die
      - Auto Kill Enemies

      All features are unlinked and only for player, you!
        • Agree
        • Thanks
        • Like
      • 199 replies
    • Hempire - Weed Growing Game [ Auto Updating ] - Unlimited Everything!
      Modded/Hacked App: Hempire - Weed Growing Game By LBC Studios Inc.
      Bundle ID: ca.lbcstudios.hempire
      iTunes Store Link: https://itunes.apple.com/us/app/hempire-weed-growing-game/id1139379843


      Hack Features:
      - Unlimited Currency - Currency Hack
      - Unlimited Storage
      -- Buy anything
      -- Free Rushing/Skipping

      This hack is an In-Game Mod Menu (iGMM). In order to activate the Mod Menu, tap on the iOSGods button found inside the app.
      This hack is using the new iOSGods Auto Updater. The hack will automatically update itself to the current app version you have installed on your iDevice.
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,047 replies
    • We Are Warriors! v1.55.0 Cheats +3
      Modded/Hacked App: We Are Warriors! By Lessmore UG haftungsbeschraenkt
      Bundle ID: com.vjsjlqvlmp.wearewarriors
      iTunes Store Link: https://apps.apple.com/us/app/we-are-warriors/id6466648550?uo=4

       

      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - Unlimited everything
      - Auto complete task
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 164 replies
    • We Are Warriors! v1.55.0 Cheats +3
      Modded/Hacked App: We Are Warriors! By Lessmore UG haftungsbeschraenkt
      Bundle ID: com.vjsjlqvlmp.wearewarriors
      iTunes Store Link: https://apps.apple.com/us/app/we-are-warriors/id6466648550?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - Unlimited everything
      - Auto complete task
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 93 replies
    • Hempire - Weed Growing Game v2.42.3 Jailed Cheats +5
      Modded/Hacked App: Hempire - Weed Growing Game By LBC Studios Inc.
      Bundle ID: ca.lbcstudios.hempire
      iTunes Store Link: https://itunes.apple.com/us/app/hempire-weed-growing-game/id1139379843


      Hack Features:
      - Cash (increase not decrease)
      - Diamonds (increase not decrease )
      - Fertilizer (increase not decrease)
      - VIP 
      -Items (increase not decrease )
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 330 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines