Ok this will only work on mac os
If you don't own a mac use VMware there are lots a tuts for getting Vmware set up with mac even if u have a amd processor like me :p
ok 1st download this debugger and place in /usr/bin/ set permission 775
[Hidden Content]
Ok now to begin
1st Make sure you have xcode installed to be able to use lldb.
1. You will have to install usbmuxed and iproxy. To do this open a terminal in mac and type
brew install usbmuxd
when it's downloades and installed open another terminal and type
iproxy 2222 22 &
When it's opened new port at 2222
close terminal and open another
type
iproxy 6666 6666 &
It will say waiting for connection leave terminal open just minimize it
2. Connect your phone via usb cable make sure you set up VMware usb config so you can connect.
Open 2 new teminals and
Type
ssh -p 2222 root@localhost
In both to connect to your device,When connected
In 1 terminal Type
debugserver device ip
debugserver will start
in the other terminal Type
ps ax
this will show you pid of debugserver
now type
/electra/jailbreakd_client <debugserver pid> 1
Now u can close debugserver terminal and stay in pid 1
Type
/usr/bin/debugserver localhost:6666 -a <game pid or game binary name>
either 1 will work
game will now attach
open new terminal for lldb
type lldb
when lldb is ready type
process connect connect://localhost:6666
now it will connect give it a bit sometimes lldb take long than others all depends on game. Once it have
type image list
Go right to the top to very 1st call you will see game name example
Var/container/bundle/gamename 0x0000000100fa4000
this is the aslr slide take a note of it as it changes every time you detach and re-attach game
now you have you offset from igg ect
type in lldb w s e -- 0xiggadress
then
c to continue
when you a hit it will show like below
value will be here:
0x101703d78 <+7732600>: ldr x20, [x19, #0x30] 0x <+7732604>: adrp x24, 9017 0x101703d80 <+7732608>: add x24, x24, #0xeb8 ; =0xeb8 0x101703d84 <+7732612>: ldr x0, [x24] TropicThunderDev`_mh_execute_header: -> 0x101c1be88 <+13074056>: ldr w8, [x19, #0x50] 0x101c1be8c add w8, w8, #0x1 ; =0x1 0x101c1be90 <+13074064>: str w8, [x19, #0x50] 0x101c1be94 <+13074068>: ldp x29, x30, [sp, #0x70]
now remember your aslr
example 0x0000000100fa4000
now subtract fa4000 from the offsets you got.
0x101c1be8c - fa4000
Use the new offset in ida that's all to it :p