5l1v3r1 / IDA-PRO-IDC-iPhone-iOS-5.X.X

IDA < 6.2 IDC iOS 5 LLVM

Home Page:http://www.letsunlockiphone.com/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Apple is not standing still and in iOS 5 the default compiler is LLVM instead of GCC. It produces somewhat different code and IDA < 6.2 fail to resolve references which are now relative to PC.

Here is an example of code dissasembled with IDA :

__text:00001000 MOV R4, 0x12344
__text:00001008 ADD R4, PC

After executing this IDC script :

__text:00001000 MOV R4, 0x12344
__text:00001008 ADD R4, PC ; off_13350

(if the address is named, the name will appear instead of off_xxx)

The xref is also added so that when you type X on address 0x13350 you'll see where it is used.

Thanks to
~pod2g

About

IDA < 6.2 IDC iOS 5 LLVM

http://www.letsunlockiphone.com/