Jump to content

IDA + LLDB Tutorial [Noob Friendly]


95 posts in this topic

Recommended Posts

Posted (edited)

@Ted2

 

Damn this is a good ass tutorial, I'm gathering up some tuts for Drapes and I stumbled across this one. There's some errors though

 

LDR             R1, [R0,#0xAC] //Loads the value of R0,#0xAC into R1 (ammo)
SUB             R1, R1, #1 // Substracts the value of one from R1 (ammo) into R1 (ammo)
STR             R1, [R0,#0xAC] //Stores R1 (ammo) into R0,#0xAC]
LDR             R1, =(unk_C80D00 - 0x15281C) //I've no idea, it does load something into our ammo atleast.

The LDR R1, [R0, #0xAC] isn't loading the value of R0,#0xAC because that isn't a value. It's loading the value stored in R0+0xac. R0 is holding the address for some object, and R0+0xAC is the instance variable (or something similar) for ammo. The value held in R0 (0x1501c9c0) is the address for the object stored in memory. 0x1501c9c0 + 0xac (which is 0x1501CA6C) is the memory address for the instance variable of the object at 0x1501c9c0 that holds ammo. Same issue here with the STR R1, [R0, #0xac], its not putting ammo back into R0,#0xAC, its storing the updated value into R0(our object address)+0xac(our ammo instance variable).

 

Edit: go back to your watchpoints and check out the memory address for ammo. its 0x1501ca6c! again, you set a watchpoint on the instance variable for ammo :)

On September 9, 2017 at 8:58 PM, Ted2 said:

We can see in the 'register read' output we wrote down, R0 = 0x1501c9c0 in hex decimal, which is 352438720 in decimal value.
This is a big number & get's loaded into our ammo it says. 
This doesn't make sense to me, because  if that's true we had lots of ammo xD

You should update the comments in the assembly and this part with what I typed.

 

On September 9, 2017 at 8:58 PM, Ted2 said:

How we hack the LDR:


- LDR R1, [R0,#0xAC] to LDR R1, [R7,#0xAC] --> What this does is load R7 (803 million) into our ammo instead of what the normal value should be.

This is incorrect. R7 typically stores a large garbage number so if the game tries to access R7+0xAC, it 99.9% will crash because its trying to access memory that doesn't exist. Or maybe it won't crash, but it will fail to load the ammo, leaving ammo to be a large uninitialized garbage number when its stored back, making it infinite. Its the same concept as above. R0 is the correct address of our object, R7 is some random thing. R0+0xac = where our ammo instance variable is stored, R7+0xac = ???? And your description of the hacked LDR is wrong, its loading uninitialized memory into R1, and that's what makes it infinite.

 

 

Updated by Guest
Posted (edited)
5 hours ago, shmoo said:

@Ted2

 

Damn this is a good ass tutorial, I'm gathering up some tuts for Drapes and I stumbled across this one. There's some errors though

 


LDR             R1, [R0,#0xAC] //Loads the value of R0,#0xAC into R1 (ammo)
SUB             R1, R1, #1 // Substracts the value of one from R1 (ammo) into R1 (ammo)
STR             R1, [R0,#0xAC] //Stores R1 (ammo) into R0,#0xAC]
LDR             R1, =(unk_C80D00 - 0x15281C) //I've no idea, it does load something into our ammo atleast.

The LDR R1, [R0, #0xAC] isn't loading the value of R0,#0xAC because that isn't a value. It's loading the value stored in R0+0xac. R0 is holding the address for some object, and R0+0xAC is the instance variable (or something similar) for ammo. The value held in R0 (0x1501c9c0) is the address for the object stored in memory. 0x1501c9c0 + 0xac (which is 0x1501CA6C) is the memory address for the instance variable of the object at 0x1501c9c0 that holds ammo. Same issue here with the STR R1, [R0, #0xac], its not putting ammo back into R0,#0xAC, its storing the updated value into R0(our object address)+0xac(our ammo instance variable).

 

Edit: go back to your watchpoints and check out the memory address for ammo. its 0x1501ca6c! again, you set a watchpoint on the instance variable for ammo :)

You should update the comments in the assembly and this part with what I typed.

 

This is incorrect. R7 typically stores a large garbage number so if the game tries to access R7+0xAC, it 99.9% will crash because its trying to access memory that doesn't exist. Or maybe it won't crash, but it will fail to load the ammo, leaving ammo to be a large uninitialized garbage number when its stored back, making it infinite. Its the same concept as above. R0 is the correct address of our object, R7 is some random thing. R0+0xac = where our ammo instance variable is stored, R7+0xac = ???? And your description of the hacked LDR is wrong, its loading uninitialized memory into R1, and that's what makes it infinite.

 

 

Thanks, will read & fix when i'm on pc ??. Also, isnt the 0x AC in here [R0,#0xAC] some kind of variable, cause I thought it was, I've never really added it or never seen someone added it to the offset. In unity games, you can actually see what thess #0x.... numbers mean, not that I use that while hacking.

Updated by Ted2
Posted
3 hours ago, Ted2 said:

Thanks, will read & fix when i'm on pc ??. Also, isnt the 0x AC in here [R0,#0xAC] some kind of variable, cause I thought it was, I've never really added it or never seen someone added it to the offset. In unity games, you can actually see what thess #0x.... numbers mean, not that I use that while hacking.

read the LDR and STR locations as register+number. The LDR loads whatever is at R0+0xAC into R1

Posted

F*ck, iOS 11 is not supported, I guess, LLDB have to be rebuilt.

 

lldb
dyld: Library not loaded: @rpath/liblldb.3.8.dylib
  Referenced from: /usr/bin/lldb
  Reason: no suitable image found.  Did find:
    /usr/bin/../lib/liblldb.3.8.dylib: code signing blocked mmap() of '/usr/bin/../lib/liblldb.3.8.dylib'
    /usr/lib/liblldb.3.8.dylib: code signing blocked mmap() of '/usr/lib/liblldb.3.8.dylib'
Abort trap

Installed libffi, readline via dpkg and Python via cydia.radare

On latest Electra.

Posted
On 3/11/2018 at 7:29 AM, trumansh0tmail.de said:

F*ck, iOS 11 is not supported, I guess, LLDB have to be rebuilt.

 


lldb
dyld: Library not loaded: @rpath/liblldb.3.8.dylib
  Referenced from: /usr/bin/lldb
  Reason: no suitable image found.  Did find:
    /usr/bin/../lib/liblldb.3.8.dylib: code signing blocked mmap() of '/usr/bin/../lib/liblldb.3.8.dylib'
    /usr/lib/liblldb.3.8.dylib: code signing blocked mmap() of '/usr/lib/liblldb.3.8.dylib'
Abort trap

Installed libffi, readline via dpkg and Python via cydia.radare

On latest Electra.

ios 11 is supported 

Guest
This topic is now closed to further replies.
  • Our picks

    • Bridge Constructor Studio v1.0.65 +3 Jailed Cheats [ Unlocked ]
      Modded/Hacked App: Bridge Constructor Studio By Headup GmbH
      Bundle ID: com.headupgames.bridgeconstructorstudio
      App Store Link: https://apps.apple.com/us/app/bridge-constructor-studio/id6745402280?uo=4

       
       

      🤩 Hack Features

      - Freeze Bridge
      - No Build Costs
      -- Full Game Unlocked (will show as locked)
      • 0 replies
    • Bridge Constructor Studio v1.0.65 +3 Cheats [ Unlocked ]
      Modded/Hacked App: Bridge Constructor Studio By Headup GmbH
      Bundle ID: com.headupgames.bridgeconstructorstudio
      App Store Link: https://apps.apple.com/us/app/bridge-constructor-studio/id6745402280?uo=4

       
       

      🤩 Hack Features

      - Freeze Bridge
      - No Build Costs
      -- Full Game Unlocked (will show as locked)
      • 0 replies
    • SWAT: Squad Tactics v0.8.6 [+3 Cheats]
      Modded/Hacked App: SWAT: Squad Tactics By MAD PIXEL GAMES LTD
      Bundle ID: hero.shooter.alpha.game
      iTunes Store Link: https://apps.apple.com/us/app/swat-squad-tactics/id6670252311?uo=4


      🤩 Hack Features

      - Unlimited Skipits Ticket
      - Unlimited Currency (Enable before stage and finish stage)
      - Unlimited Blueprints (Enable before stage and finish stage)
      • 5 replies
    • SWAT: Squad Tactics v0.8.6 [+3 Jailed Cheats]
      Modded/Hacked App: SWAT: Squad Tactics By MAD PIXEL GAMES LTD
      Bundle ID: hero.shooter.alpha.game
      iTunes Store Link: https://apps.apple.com/us/app/swat-squad-tactics/id6670252311?uo=4



      🤩 Hack Features

      - Unlimited Skipits Ticket
      - Unlimited Currency (Enable before stage and finish stage)
      - Unlimited Blueprints (Enable before stage and finish stage)
      • 4 replies
    • Pal Go: Tower Defense TD v0.3.91 [+7 Cheats]
      Modded/Hacked App: Pal Go: Tower Defense TD By Playwind Ltd
      Bundle ID: com.playwindgames.freedefender
      iTunes Store Link: https://apps.apple.com/us/app/pal-go-tower-defense-td/id6479316663?uo=4


       

      🚀 Hack Features

      - [VIP] Freeze Currency (Currency will not decrease when used)

      - [VIP] Currency Always Enough (Buy even when you don't have enough currency)

      - [Free] Higher Recruit Energy (Gives 500 Recruit Energy Every Wave)

      - [Free] Always Can Drag Hero

      - [Free] Skip Ads

      - [Free] No Attack Cooldown

      - [Free] Global Speed Multiplier (Enable Inside Battle)

       

      Warning


      Do not use on main account. There is a chance of ban. Not responsible for any bans.

       


      🍏 For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/forum/79-no-jailbreak-section/
      🤖 Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      • 57 replies
    • Pal Go: Tower Defense TD v0.3.91 [+7 Jailed Cheats]
      Modded/Hacked App: Pal Go: Tower Defense TD By Playwind Ltd
      Bundle ID: com.playwindgames.freedefender
      iTunes Store Link: https://apps.apple.com/us/app/pal-go-tower-defense-td/id6479316663?uo=4


       

      Hack Features

      - [VIP] Freeze Currency (Currency will not decrease when used)

      - [VIP] Currency Always Enough (Buy even when you don't have enough currency)

      - [Free] Higher Recruit Energy (Gives 500 Recruit Energy Every Wave)

      - [Free] Always Can Drag Hero

      - [Free] Skip Ads

      - [Free] No Attack Cooldown

      - [Free] Global Speed Multiplier (Enable Inside Battle)

       

      Warning


      Do not use on main account. There is a chance of ban. Not responsible for any bans.

       

      Jailbreak required iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APKs: https://iosgods.com/forum/68-android-section/
      • 82 replies
    • Stand & Fight: Backpack Battle v0.9.5 Debug Menu [+10 Jailed Cheats]
      Modded/Hacked App: Stand & Fight: Backpack Battle By VERARIUM COM SERVICOS LDA ZFM
      Bundle ID: com.V.StandAndFight
      App Store Link: https://apps.apple.com/us/app/stand-fight-backpack-battle/id6740915182?uo=4



      🤩 Hack Features

      - Debug Menu

       
      • 12 replies
    • Stand & Fight: Backpack Battle v0.9.5 Debug Menu [+10 Cheats]
      Modded/Hacked App: Stand & Fight: Backpack Battle By VERARIUM COM SERVICOS LDA ZFM
      Bundle ID: com.V.StandAndFight
      App Store Link: https://apps.apple.com/us/app/stand-fight-backpack-battle/id6740915182?uo=4



      🤩 Hack Features

      - Debug Menu
      • 11 replies
    • Rupture: Immortal Slasher v0.15.6 [+3 Cheats]
      Modded/Hacked App: Rupture: Immortal Slasher By ALEKSEI KLIMOV
      Bundle ID: com.GOLEM.Immortal
      iTunes Store Link: https://apps.apple.com/us/app/rupture-immortal-slasher/id6738378630?uo=4

       

      🤩 Hack Features

      - God Mode/Never Die
      - Unlimited Currency (Add 50k every time you spend)
      - Always Can Upgrade Equipments

       
      • 12 replies
    • Rupture: Immortal Slasher v0.15.6 [+3 Jailed Cheats]
      Modded/Hacked App: Rupture: Immortal Slasher By ALEKSEI KLIMOV
      Bundle ID: com.GOLEM.Immortal
      iTunes Store Link: https://apps.apple.com/us/app/rupture-immortal-slasher/id6738378630?uo=4

       

      🚀 Hack Features

      - God Mode/Never Die
      - Unlimited Currency (Add 50k every time you spend)
      - Always Can Upgrade Equipments


      🍏 Jailbreak iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      🤖 Modded Android APKs: https://iosgods.com/forum/68-android-section/
      • 25 replies
    • Night Valley - Tower Defense v1.0.15 [+2 Jailed Cheats]
      Modded/Hacked App: Night Valley - Tower Defense By Pitaya Group, Inc, The
      Bundle ID: com.pitaya.natv
      App Store Link: https://apps.apple.com/us/app/night-valley-tower-defense/id6467846624?uo=4



      🤩 Hack Features

      - Never Die
      - Add Currency
      • 7 replies
    • Night Valley - Tower Defense v1.0.15 [+2 Cheats]
      Modded/Hacked App: Night Valley - Tower Defense By Pitaya Group, Inc, The
      Bundle ID: com.pitaya.natv
      App Store Link: https://apps.apple.com/us/app/night-valley-tower-defense/id6467846624?uo=4



      🤩 Hack Features

      - Never Die
      - Add Currency
       
      • 5 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines