Help/Support General iOS Hacking Help Needed

BigDaddy284 · August 20, 2017

Background-

I have spent the last week building my JB Devices and Mac with apps needed to hack iOS apps/games.

I have since: "Cracked an app" "Thinned the binary" "Transferred binary to Mac" "Removed ASLR" "Loaded Binary into IDA"

I have seen so many different apps and tweaks listed on this site and the web on a whole, i'm now confused as to wether i have missed a part or if i should just crack on with with trying to locate bits IDA now?

Questions-

So far i have used the following apps on JB Device- MTerminal, Clutch, Lipo, iFunbox. On Mac- Website to remove ASLR and IDA (with Parallels to run on Mac)

Do i still need to install/Use:

Hopper
Theos
Burp
SSH
CyberDuck
GNU-Debugger or LLDB (I have xcode on mac and saw somewhere this has a debugger but have no idea what to here)

Then comes all the MS hooking and generating and code injectors, online HEX to ARM and ARM to HEX convertors

I understand all the info is on iosgod somewhere but i feel i getting lost it research and maybe even mixing tools and processes up.

Could someone also tell me what i've missed, whats not needed, whats needed and whats next and to come from the process in BLUE TEXT please.

Reading up a bit more- Do i need to put the binary back in the IPA file a compile, then run in simulator in xcode to debug?

Updated August 20, 2017 by BigDaddy284
Update at bottom

NoHax · August 20, 2017

You need to use lldb on your mac to find the offsets you need to hack (lldb requires SSH).

Read this (the lldb tut is for windows but it's the exact same thing for mac)

Before you've done that get your binary and put it in the app in your phone (var/containers/bundle/application/appname/appname.app/appname

Updated August 20, 2017 by NoHax

NoHax · August 20, 2017

Here's all the stuff from Zimons hacking starter pack you'll need

Tutorial: https://iosgods.com/topic/852-tutorial-how-to-hack-using-ida/

Tutorial: https://iosgods.com/topic/4668-ida-tutorialhow-to-know-what-to-change-in-ida-in-order-to-make-your-hack-work/

How to Hack Using LLDB: https://iosgods.com/topic/5380-working-on-ios-9-how-to-get-lldb-working-on-windows/#comment-127530

How to Hack with Strings: https://iosgods.com/topic/26584-ida-tutorialhow-to-hack-with-strings/

How to Hack Vectors: https://iosgods.com/topic/7885-ida-tutorialhow-to-deal-withhack-vectors/#comment-211260

How to Disable Anti-Debugging Protection: https://iosgods.com/topic/26721-breaking-securityhow-to-disable-syscall-anti-debugging-protection/

How to Disable Memory Checks: https://iosgods.com/topic/6995-ida-tutorialhow-to-disable-memory-checks/

How to Hack Floats (ARM64): https://iosgods.com/topic/39081-ida-tutorial-how-to-hack-floats-in-arm64/

BigDaddy284 · August 20, 2017

21 minutes ago, NoHax said:

Before you've done that get your binary and put it in the app in your phone (var/containers/bundle/application/appname/appname.app/appname

Ok so...

After i have thinned binary from cracked ipa and removed ASLR, i now put the binary in the original game folder on device and not the cracked version.

Then move on to the lldb and ssh bits?

Cheers @NoHax

Fadexz · August 20, 2017

Well CyberDuck is just useful and Theos isn't to hard if you convert a flex tweak.

NoHax · August 20, 2017

17 minutes ago, TheArmPrincess said:

Well CyberDuck is just useful and Theos isn't to hard if you convert a flex tweak.

Yeah I use cyberduck for lldb

BigDaddy284 · August 20, 2017

1 minute ago, NoHax said:

Yeah I use cyberduck for lldb

Cool, getting to that part now. My thinned and de-ASLRed binary just launched the game on iOS device

That my first win, and like a quarter of the way there now lol

Fadexz · August 20, 2017

3 minutes ago, NoHax said:

Yeah I use cyberduck for lldb

I'm sort of a noob so I don't know what "lldb", i've only used Theos to create 1 hack so far. I haven't used much else, they all seem complicated.

Updated August 20, 2017 by TheArmPrincess

BigDaddy284 · August 20, 2017

Just now, TheArmPrincess said:

I'm sort of a noob so I don't not what "lldb", i've only used Theos to create 1 hack so far. I haven't used much else, they all seem complicated.

Tell me about it.

I've now got to work out, how to use Cyberduck, how i get lldb and use in.

is Cyber duck for the ssh connection? I'm a total noob, work in IT support but all front end and program issues. Not coding and developer apps

Fadexz · August 20, 2017

1 minute ago, BigDaddy284 said:

Tell me about it.

I've now got to work out, how to use Cyberduck, how i get lldb and use in.

is Cyber duck for the ssh connection? I'm a total noob, work in IT support but all front end and program issues. Not coding and developer apps

Yeah that's why I got it but I used it for SSH for file browsing so far. I used Terminal for SSH instead of CyberDuck because I forgot it was for that purpose.