3

this maybe total no brainer but i'm really new to this and i'd really appreciate some help!

Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully decrypted it and i'm able to disassemble it with otool. Needless to say the original application was stripped so no structure in the disassembly.

I then heard about class-dump-z which is modified version of class dump with the ability to give you the VM Address of a given Function Implementation.

Output of class-dump-z -A:

#import <XXUnknownSuperclass.h> // Unknown library
#import "SomeHeader.h"

@class NSString;

__attribute__((visibility("hidden")))
@interface CensoredClassName : XXUnknownSuperclass <SomeDelegate> {
}
@property(readonly, copy) NSString* debugDescription;
@property(readonly, copy) NSString* description;
@property(readonly, assign) Class superclass;
@property(readonly, assign) unsigned hash;
-(void)showJailbreakAlert;  // 0x1498d <--Patch this Method
@end

My Question: How to translate the given Implementation VM Address to binary File Offset which I can patch? Or even better how can i find the Method in the TEXT Disassembly? Simply Searching for the offset inside the disassembly generated with the otool -tV command does not return any result.

Thank you very much in Advance

Malte

P.S. Link to Class-Dump-Z Google code Page:here

2 Answers 2

1

you need to find the segment (LC_SEGMENT) load command which covers the address, then do something like this:

fle_off = (address-seg.address)+ seg.offset
1
  • That was indeed the answer. Took me a while to figure out the function was stored in the _TEXT segment though. Thank you very much!
    – Malte
    Feb 9, 2015 at 20:04
1

file_offset= address - segment.address + segment.offset + fat_arch.offset

If does not contain Fat headers then fat_arch.offset = 0

Check if fat: otool -fh or lipo -detailed_info

Architectures in the fat file: MyBinary are: x86_64 arm64

Fat headers
fat_magic 0xcafebabe
nfat_arch 2
architecture 0
    ...
    offset 16384    <== fat_arch.offset for x86_64
    size 58720
architecture 1
    ...
    offset 81920    <== fat_arch.offset for arm64
    size 73072

Assume we need x86_64 offset for 0000000100001921

$ otool -tVj -arch x86_64 -function_offsets MyBinary | head -3
   +0 0000000100001920  55                  pushq   %rbp
=> +1 0000000100001921  4889e5              movq    %rsp, %rbp
   +4 0000000100001924  53                  pushq   %rbx

then

$ otool -l -arch x86_64 MyBinary | grep __text -A 5
sectname __text
 segname __TEXT
   addr 0x0000000100001920    <== segment.address
   size 0x000000000000160a
 offset 6432                  <== segment.offset
  align 2^4 (16) 

$ printf '0x%x\n' $(( 0x0000000100001921 - 0x0000000100001920 + 6432 + 16384 ))

0x5921

$ xxd -s 0x5921  -l 32 -c 16 MyBinary
=> 00005921: 4889 e553 5048 8b3d 5b2d 0000 e8ca 1600  H..SPH.=[-......
   00005931: 0048 8b35 ff2c 0000 4889 c7e8 6116 0000  .H.5.,..H...a...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.