Jump to content
  • 0
Sign in to follow this  
Curtain

Help/Support How to deal with fixed value in memory with LLDB

5 posts in this topic

Question

I want to find IDA address by LLDB.
New puzzle. Convert memory address to IDA address in any way
I found the correct memory address through other ways, but the value of this memory address does not change through the game, so the watchpoint will not be HIT when i set watchpoint, finally unable to find the IDA address.
I have tried to change the memory data, but watchpoint still does not HIT
I am grateful for any help

Edit:The Game Name is "Knives Out By NetEase Games"

Features::Characters become larger(easy to shoot)

search for 0.78(F64) with IGG ,then tap "neaby" and search for 1(auto or F64,in my case search use auto type),then search for 1.000(F64) ,you will get four or five results, change the last one(1.0000) to 5.000, characters will 5 times the size compared to the original.

 @DiDA 

 @shmoo 

 @xiaov 

 @Mayaxaya 

 @Joka 

Edited by Curtain
  • Like 1
  • Haha 1

Share this post


Link to post
Share on other sites

4 answers to this question

Recommended Posts

  • 0
19 hours ago, jayvee said:

modify it using memory editor? im sure your watchpoint hits as long as there is changes made

In general, the conditions of breakpoints triggered by the operation of the game changes, so modify the memory value can not trigger a breakpoint ,I have already tried.

Share this post


Link to post
Share on other sites
  • 0

but watchpoint triggers as long as theres a changes on that address. watchpoint and breakpoint are different thing

Share this post


Link to post
Share on other sites
  • 0
9 hours ago, Curtain said:

In general, the conditions of breakpoints triggered by the operation of the game changes, so modify the memory value can not trigger a breakpoint ,I have already tried.

I understand what you're saying. I've had this happen to me before, but it hasn't happened in a long time.

 

Player size must be held in some instance variable of the player class. Since your watchpoint isn't hitting because the value never changes, I believe your best bet would be to find any function that is apart of the player class, and find the register where the this/self pointer is stored. Set a breakpoint on any LDR or STR instruction with the register where the this pointer is stored, and let it hit. Then you can examine the instance variables of that object by doing

<register>+0xnumber

. Lets say you find R0 as the register thats holding the this pointer. In GDB, you would do

x/i $r0+0x4

to access the first instance variable, then

x/i $r0+0x8

to access the second, and so on. Keep counting by 0x4. You want to keep doing this until GDB spits out 1.0. The great thing about GDB is that you can tell what kind of format you want it to put the number in. In your case it would be a float, so you would do

x/f $r0+0x4

and so on until you see 1.0.

 

You can also see strings this way :D Just do

x/s $r0+0x4

. It doesn't apply to what you're doing right now, but its just a tip for things later on. GDB is amazing. Its like a weapon

 

Once you do find the register/number combination that gives back 1.0, write it down. Do a hex search in IDA for

LDR Rx, [<your register/number combination>

, for 0<=x<=12. Then if you dont come up with any results, do

VLDR Sx, [<your register/number combination>]

, for 0<=x<=18.

 

Its very far fetched but it may work. Good luck! And great idea about changing player size.

Edited by shmoo
additional info

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
Sign in to follow this  

  • Similar Content

    • By yFroZeN
      Hello @DiDA, slider grass for vip users don't work in my iphone 6, jailbreak 11.3.1, my game frozen in loading page, in the blue screen, sugestion ? thank you, sorry for my bad english, i'm braziliam
    • By Reth3
      Hi! I recently jailbroke my iPhone 8 using Electra 11.3.1. Jailbreak worked fine, but when I entered Cydia I kept getting errors that were relating to files not being found. 
      I.e. “DPKG Locked”, “Some index filed weren’t found” and other errors. I went to update Cydia under the “Changes” tab, and clicked refresh. But when I tried to install the updates, it acted like I didn’t have the package manager installed, and important files were missing. 
       
      https://gyazo.com/fe6df9a2d62f9022d0de1dd6a18d66ff
      https://gyazo.com/2941193e0753da341850e5d59c61212b
      https://gyazo.com/8d5004b37c12ef83d12e2fad6162262e
      I’m not able to connect to my iPhone, because I can’t install OpenSSH. 
       
      Anyone know why the dependencies weren’t installed, and how I can fix them?
       
      P.S. I’m pretty pissed right now, please be helpful or go away :D
    • By Crumpetz_
      Hello All. I downloaded the Filza non-jailbroken IPA. I'm on IOS 11, however, whenever I click on the app it just shows me a white screen. Ive trusted the email in the settings and the app is verified so I don't understand. 
    • By Fnaferm
      Cydia Source^ new term 2?
    • By Brandond23
      Someone walk me through this
  • Recently Browsing   0 members

    No registered users viewing this page.


    • Administrator |
    • Global Moderator  |
    • Moderator  |
    • ViP Plus |
    • ViP |
    • Cheater  |
    • Modder  |
    • Novice Cheater |
    • Rookie Modder |
    • Contributor |
    • Senior Member |
    • Member |
×

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.