Help/Support Whats this Function? LLDB

[Goran 1.9k]

i just got one address from iGG, then i w s e over LLDB, and got this

* thread #1: tid = 0x36f39, 0x00425cb4 covetHome, stop reason = breakpoint 1.1
    frame #0: 0x00425cb4 covetHome
-> 0x425cb4:  andlo  r6, r1, r0, lsr r11
    0x425cb8:  andlt  r6, r7, r0, lsr r3
    0x425cbc:  stceq  p8, c14, [r0, #-756]

 

what i need to do next???

to watch or breakpoint what???

[Ted2 39.2k iPhone 13 Pro 16.0 Donor]

stop reason = breakpoint 1.1

your breakpoint is hit, type in 'register read' to know the values.

[Goran 1.9k]

Just now, Ted2 said:

stop reason = breakpoint 1.1

your breakpoint is hit, type in 'register read' to know the values.

I know that R1 hold value, but how the hell i find in ida when this dont exist

[Goran 1.9k]

this is what i got in IDA PRO

sub_331CA6
PUSH            {R4-R7,LR} ; Push registers
ADD             R7, SP, #0xC ; Rd = Op1 + Op2
MOV             R4, R1  ; Rd = Op2
MOV             R5, R0  ; Rd = Op2
LDR             R0, [R4,#0xC] ; Load from Memory
LDR             R0, [R0,#0x54] ; Load from Memory
LDR.W           R6, [R0,#0xD0] ; Load from Memory
MOV             R0, R6  ; Rd = Op2
BL.W            sub_FB2FC8 ; Branch with Link
MOV             R0, R6  ; Rd = Op2
BL.W            sub_FC5A74 ; Branch with Link
MOV             R6, R0  ; Rd = Op2
LDR             R0, [R4,#0xC] ; Load from Memory
MOV             R1, R5  ; Rd = Op2
LDR             R0, [R0,#0x54] ; Load from Memory
LDR.W           R2, [R0,#0xD4] ; Load from Memory
MOV             R0, R6  ; Rd = Op2
LDR             R3, [R2] ; Load from Memory
BLX             R3      ; Branch with Link and Exchange (register indirect)
MOV             R0, R6  ; Rd = Op2
POP             {R4-R7,PC} ; Pop registers

[Ted2 39.2k iPhone 13 Pro 16.0 Donor]

Dude, you ALWAYS say R1 holds the value, I think you never even checked for real. It can be R4 etc either, CHECK IT.

[Goran 1.9k]

2 minutes ago, Ted2 said:

Dude, you ALWAYS say R1 holds the value, I think you never even checked for real. It can be R4 etc either, CHECK IT.

thats the case, it is now always, but i just post here and it says R1...

that is not important in this case, important is WHAT TO DO NEXT....

TRIED TO WATCH

    0x425cb4:  andlo  r6, r1, r0, lsr r11
    0x425cb8:  andlt  r6, r7, r0, lsr r3
    0x425cbc:  stceq  p8, c14, [r0, #-756]

BUT NOTHING HAPPENED...

[Ted2 39.2k iPhone 13 Pro 16.0 Donor]

Show me R1 holds ur value 

Also why are you doing watch points on ida offsets, thats useless

[Joka 4k iPhone X 12.4]

3 minutes ago, Ted2 said:

Show me R1 holds ur value 

Also why are you doing watch points on ida offsets, thats useless

 because why not loool

[Goran 1.9k]

@Ted2 man where did you got that i do watch on ida ADDRESS??? that is not offset that is ADDRESS....

i just gave you example where that lead me in ida... in which function....

man, you dont get the point what i ask...

I JUST ASKED WHAT TO DO NEXT, SINCE THIS CAN BE IDA FUNCTION, THAT IDA FUNCTION NOT EXIST....

SO WHAT IS NEXT STEP, ALSO THERE IS NO OTHER IGG ADRESS TO WATCH JUST ONE THAT...

Updated September 7, 2017 by Goran

[sn0wqt 42.6k iPhone X 13.3]

i'll ask you one question, do u know what's aslr?

 

Updated September 7, 2017 by Mr Cub3s