2

I dont understand how people are finding offsets, So I want to know if there's a simple and easy method of just "patching values"

I've been surfing the internet looking for VERY in depth tutorials on editing Assembly for ios apps, but it seems that either the tutorials are too difficult and vague, or are broken and old.

for example, how can I patch this function so it returns true rather than false:

; bool __cdecl -[ScrollingListTradePortal everythingFree](ScrollingListTradePortal *self, SEL)
__ScrollingListTradePortal_everythingFree_
ADRP            X8, #_OBJC_IVAR_$_ScrollingListTradePortal.everythingFree@PAGE ; bool everythingFree;
LDRSW           X8, [X8,#_OBJC_IVAR_$_ScrollingListTradePortal.everythingFree@PAGEOFF] ; bool everythingFree;
LDRB            W8, [X0,X8]
AND             W0, W8, #1
RET
; End of function -[ScrollingListTradePortal everythingFree]
0

1 Answer 1

5

Open the binary in IDA View (assembly view). Place the cursor in the line that you want to patch. Click Edit in menu bar > Patch Program > Change bytes.

edit-patch-program-option

Switch to "Hex View". Match the assembly mnemonic with the HEX value. This vary with every instruction. For example, cmp [rbp-4], 4 (in X86_64) is shows as 83 7D FC 04.

Press F2 to edit in hex view. Edit the value. Press F2 another time to apply the change. Check the IDA view to review the change. Now go to Edit > Patch Program > Apply patches to input file.

apply-patches-to-input-file

You can also choose to create a backup.

Similar question: StackOverflow: Edit (patch) a binary file in IDA Pro Ask

1
  • thankyou, I will try this out later tonight, On my school pc during the daytime. Also, is there a way to identify which of the list of bytes represents the value? I know that this: "AND W0, W8, #1" represents TRUE if your on creative mode. But Im not entirely sure which one to patch if say I just want the value to ALWAYS return true. Commented Sep 3, 2019 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.