2

this maybe total no brainer but i'm really new to this and i'd really appreciate some help!

Basically i'm trying to patch(out aka nop) a obj-c function inside an iOS Application. I've successfully decrypted it and i'm able to disassemble it with otool. Needless to say the original application was stripped so no structure in the disassembly.

I then heard about class-dump-z which is modified version of class dump with the ability to give you the VM Address of a given Function Implementation.

Output of class-dump-z -A:

#import <XXUnknownSuperclass.h> // Unknown library
#import "SomeHeader.h"

@class NSString;

__attribute__((visibility("hidden")))
@interface CensoredClassName : XXUnknownSuperclass <SomeDelegate> {
}
@property(readonly, copy) NSString* debugDescription;
@property(readonly, copy) NSString* description;
@property(readonly, assign) Class superclass;
@property(readonly, assign) unsigned hash;
-(void)showJailbreakAlert;  // 0x1498d <--Patch this Method
@end

My Question: How to translate the given Implementation VM Address to binary File Offset which I can patch? Or even better how can i find the Method in the TEXT Disassembly? Simply Searching for the offset inside the disassembly generated with the otool -tV command does not return any result.

Thank you very much in Advance

Malte

P.S. Link to Class-Dump-Z Google code Page:here

1

you need to find the segment (LC_SEGMENT) load command which covers the address, then do something like this:

fle_off = (address-seg.address)+ seg.offset
  • That was indeed the answer. Took me a while to figure out the function was stored in the _TEXT segment though. Thank you very much! – Malte Feb 9 '15 at 20:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.