Convert Mach-O VM Address To File Offset

Question

this maybe total no brainer but i'm really new to this and i'd really appreciate some help!

Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully decrypted it and i'm able to disassemble it with otool. Needless to say the original application was stripped so no structure in the disassembly.

I then heard about class-dump-z which is modified version of class dump with the ability to give you the VM Address of a given Function Implementation.

Output of class-dump-z -A:

#import <XXUnknownSuperclass.h> // Unknown library
#import "SomeHeader.h"

@class NSString;

__attribute__((visibility("hidden")))
@interface CensoredClassName : XXUnknownSuperclass <SomeDelegate> {
}
@property(readonly, copy) NSString* debugDescription;
@property(readonly, copy) NSString* description;
@property(readonly, assign) Class superclass;
@property(readonly, assign) unsigned hash;
-(void)showJailbreakAlert;  // 0x1498d <--Patch this Method
@end

My Question: How to translate the given Implementation VM Address to binary File Offset which I can patch? Or even better how can i find the Method in the TEXT Disassembly? Simply Searching for the offset inside the disassembly generated with the otool -tV command does not return any result.

Thank you very much in Advance

Malte

P.S. Link to Class-Dump-Z Google code Page:here

Answer 1

you need to find the segment (LC_SEGMENT) load command which covers the address, then do something like this:

fle_off = (address-seg.address)+ seg.offset

Answer 2

file_offset= address - segment.address + segment.offset + fat_arch.offset

If does not contain Fat headers then fat_arch.offset = 0

Check if fat: otool -fh or lipo -detailed_info

Architectures in the fat file: MyBinary are: x86_64 arm64

Fat headers
fat_magic 0xcafebabe
nfat_arch 2
architecture 0
    ...
    offset 16384    <== fat_arch.offset for x86_64
    size 58720
architecture 1
    ...
    offset 81920    <== fat_arch.offset for arm64
    size 73072

Assume we need x86_64 offset for 0000000100001921

$ otool -tVj -arch x86_64 -function_offsets MyBinary | head -3
   +0 0000000100001920  55                  pushq   %rbp
=> +1 0000000100001921  4889e5              movq    %rsp, %rbp
   +4 0000000100001924  53                  pushq   %rbx

then

$ otool -l -arch x86_64 MyBinary | grep __text -A 5
sectname __text
 segname __TEXT
   addr 0x0000000100001920    <== segment.address
   size 0x000000000000160a
 offset 6432                  <== segment.offset
  align 2^4 (16) 

$ printf '0x%x\n' $(( 0x0000000100001921 - 0x0000000100001920 + 6432 + 16384 ))

0x5921

$ xxd -s 0x5921  -l 32 -c 16 MyBinary
=> 00005921: 4889 e553 5048 8b3d 5b2d 0000 e8ca 1600  H..SPH.=[-......
   00005931: 0048 8b35 ff2c 0000 4889 c7e8 6116 0000  .H.5.,..H...a...