gdb debugger script for searching registers in binaries on jailbroken iOS devices

gdb register search

define find
dont-repeat
set $_count=0
while ($_count < $arg1)
if (($r0 == $arg0) || ($r1 == $arg0) || ($r2 == $arg0) || ($r3 == $arg0) || ($r4 == $arg0) || ($r5 == $arg0) || ($r6 == $arg0) || ($r7 == $arg0) || ($r8 == $arg0) || ($r9 == $arg0) || ($r10 == $arg0) || ($r11 == $arg0) || ($r12 == $arg0))
break
set $_count=$arg1
else
si
set $_count++
end
end
end

1. open gdb

gdb

2. enter script

3. attach to proccess
   attach X (X is binary name-not same as app name)
   eg:

attach Game

-use if crashing-

handle SIGKILL stop
b ptrace

-set a breakpoint-

b *0xYYYYYYYY (where Y.. is address)
or
b FunctionName()
example
b *0x25CA0
delete # (delete breakpoint #)
clear (clear all breakpoints)
-continue-
c
(c to continue)

-get information-

info r
into break

-script usage-
find X Y (X is value to search and Y is how many lines to search)
eg:

find 33 100

-change value-

set $rX=Y (X is register and Y is value)
eg:
set $r0=99

Some of my old(2010-212) iOS hacks. Of use to no one today but for my own nostalgia and documentation.

[Game Title] [Version] [Architecture]
[Cheat Name]: [Symbol]
[Offset] == [old value] > [new value]

---

Dead Space 1.0.2 Arm7
Infinite Health: GameObjectPlayable::onDamageReceived(HitEvent &)
0x00B174C0 == F040 2DE9 > 1EFF 2FE1
Infinite Ammo: Weapon::reduceAmmo(void)
0x00B3B930 == B040 2DE9 > 1EFF 2FE1

---

Inotia 2 1.1.5 Arm6 :NOTE-works 1.1.6:
Infinite Stat: _Char_PutSkillPoint
0x00020F00 == 013B 0360 > 003B 0360

No Stat Restrictions: _Char_PutSkillPoint
0x00020E70 == 4AD0 > 0000
0x00020E7E == 43D0 > 0000
0x00020E94 == 38DD > 0000
0x00020EC8 == 23F0 6AFF 0028 04D1 > 0000 0000 0128 04D1

---

Tiny Tower 1.0 Arm7
coins: TTGameData_addCoins
0x004AD1F4 == 6F46 > FF32
bux: TTGameData_addBux
0x004AD190 == 6F46 > FF32

Tiny Tower 1.2.1 Arm7
coins: TTGameData_addCoins
0x004B1E20 == 6F46 > FF32
bux: TTGameData_addBux
0x004B1E84 == 6F46 > FF32

Fruit Ninja 1.6 Arm7
Score: AddToCurrentScore(int, int, bool, bool)
0x004EA02C == 2030 93E5 > FF30 8DE2
~Update~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fruit Ninja 1.6.1 Arm7
Score: AddToCurrentScore(int, int, bool, bool)
0x004AA1BC == 2030 93E5 > FF30 8DE2

---

iFighter 1.6 Arm6
Infinite Health: CProfile::IncHP(int)
0x000546D0 == 0310 81E0 > 0310 8DE2
Infinit Bombs: CProfile::IncCurrBomb(int)
0X00054730 == 0310 81E0 > 0310 8DE2

---

Inotia 3 1.1.2 Arm7
Infinite Stat: _SKILLMENU_LearnSkill
0x0001D2BC == 0110 40E2 > 0010 40E2
~Update 1.1.9~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Infinite Stat: _SKILLMENU_LearnSkill
0x003CE558 == 411E > 0146
Fast level up: _CHAR_AddExperience (main character only) [extra 255]
0x003E484A == 03AF > FF31
Fast mana gain: _CHAR_AddMana [extra 255]
0x003DE2E4 == 02AF > FF31

---

Zenonia 2 1.7 Arm7
Infinite Health: CMvPlayer::OnDamaged
0x00385F0C == F040 2DE9 > 1EFF 2FE1
Infinite Skill: CMvSkillMenu::OnLearnSkill
0x003959F8 == 0130 4312 > 0030 4312
Infinite Stat: CMvPlayer::UseStatPoint
0x003815A0 == 0240 A0E1 > 0000 0000

Zenonia 2 1.9 Arm6
Infinite Health: CMvPlayer::OnDamaged
0x000FA7E8 == F040 2DE9 > 1EFF 2FE1
Infinite Skill: CMvSkillMenu::OnLearnSkill
0x0010A2A0 == 0130 4312 > 0030 4312
Infinite Stat: CMvPlayer::UseStatPoint
0x000F5E58 == 0240 A0E1 > 0000 0000

---

geoDefenseSwarm 1.6 Arm7
Infinite Lives: _GameSession_loseLife
0x00468EE0 == B040 2DE9 > 1EFF 2FE1
Infinite Money:
0x003959F8 == 0600 52E1 > 0060 A0E3

---

Gun Bros 1.5 Arm7
Infinite Health: CBrother::HandleDamage(float)
0x00775078 == F040 2DE9 > 1EFF 2FE1

---

Men vs Machines 1.1.2 Arm7
Infinite Health: CBrother::HandleDamage(float)
0x00790508 == F040 2DE9 > 1EFF 2FE1

---

Star Blitz 1.0.2 Arm7
Infinite Health: CBrother::HandleDamage(float, float)
0x0075E178 == F040 2DE9 > 1EFF 2FE1

---

Zenonia 3 1.0.1 Arm7
Infinite Health: CMvPlayer::OnDamaged(int, CMvObject *, bool, EnumElementType, bool, bool)
0x0035E520 == F0B5 > 7047
Infinite Stat: CMvPlayer::UseStatPoint(EnumStat, int)
0x0035E7EE == 0446 > 0000
Infinite Skill: CMvSkillMenu::OnLearnSkill(CMvSkill *)
0x0036E2F0 == 53E1 > 0000

---

Plants vs Zombies 1.5.1 Arm6
Infinite Sun: Board::TakeSunMoney(int)
0x00093CAC == F040 2DE9 > 1EFF 2FE1

Plants vs Zombies 1.6 Arm6
Infinite Sun: Board::TakeSunMoney(int)
0x0019653B == 0020 83E5 > FF30 A0E3

---

DinoCap 2 1.0 Arm6
Infinite Health: DinoCap::dinosaurClass::Attack(void)
0x0000E1CC == 90B5 > 7047

DinoCap 2 1.1 Arm6
Infinite Health: DinoCap::dinosaurClass::Attack(void)
0x0000D2A8 == 90B5 > 7047

---

Monster Hunter Dynamic 1.00.00 Arm6
Infinite Health: layer::damage(Sphere *, int, float, int, int, eElement2, int, int)
0x000BCE44 == F040 2DE9 > 1EFF 2FE1

---

Contract Killer 1.1.2 Arm7
Infinite Health: CBH_Player::ReduceHp(int)
0x005D8E2 == 5B1A > 0000
Infinite Money: CBH_Player::ReduceMoney(int)
0x005ADAF2 == 5B1A > 0000
Infinite Credits: CBH_Player::ReduceCredits(int)
0x005AD882 == 5B1A > 0000
Infinite Energy: CBH_Player::ReduceEnergy(int)
0x005913EA == 5B1A > 0000

Contract Killer 1.2.3 Arm7
Infinite Health: CBH_Player::ReduceHp(int)
0x0066259E == 5B1A > 0000
Infinite Money: CBH_Player::ReduceMoney(int)
0x0066291A == 5B1A > 0000
Infinite Credits: CBH_Player::ReduceCredits(int)
0x0066251A == 5B1A > 0000
Infinite Energy: CBH_Player::ReduceEnergy(int)
0x006624BA == 5B1A > 0000

---

Anomaly Warzone Earth 1.0.1 Arm7
Infinite Health: Tower::StartAttack(void)
0x0001CF74 == F0B5 > 7047

---

Modern Combat 2: Black Pegasus 1.1.2
Infinite ammo: Weapon::Shoot(void)
0x008F008 == 0130 43E2 > 0030 43E2

Modern Combat 2: Black Pegasus 1.2.6
Infinite ammo: Weapon::Shoot(void)
0x00902E8 == 0130 43E2 > 0030 43E2

---

NOVA 2: 1.1.7
Infinite ammo: CWeaponComponent::DoFire(bool)
0x006E668C == 0130 C3E2 > 0030 43C2