Microsoft Word - iOSAppReverseEngineering.docx

(Romina) #1
* thread #1: tid = 0x9265, 0x2db7647e ChatKit`__71-[CKPendingConversation
refreshStatusForAddresses:withCompletionBlock:]_block_invoke + 58, queue =
'com.apple.main-thread, stop reason = instruction step over
frame #0: 0x2db7647e ChatKit`__71-[CKPendingConversation
refreshStatusForAddresses:withCompletionBlock:]_block_invoke + 58
ChatKit`__71-[CKPendingConversation
refreshStatusForAddresses:withCompletionBlock:]_block_invoke + 58:




  • 0x2db7647e: tst.w r1, #255
    0x2db76482: movt r0, #2535
    0x2db76486: add r0, pc
    0x2db76488: ldr r0, [r0]
    (lldb) p $r1
    (unsigned int) $30 = 1





The output verifies our analysis, the 14th data source A is 0 and 12th data source B is 1.


Next, we need to focus on IMCore to keep looking for 15th data source A and 13th data source


B. Let’s get started from the 15th data source A.


The 15th data source A is presented in figure 10-40 intuitively.


Figure 10- 40 15th data source A


It comes either from "MOVS R1, #1" or "MOVS R1, #0". In other words, the 15th data


source A is either 0 or 1. Things are getting interesting.


If I remember correctly, since the 11th data source A, the value of data source A has never


changed, the values of 11th, 12th, 13th, 14th and 15th data source A are all the same, which are


either 0 or 1. However, the previous pseudo code is like this:



  • (BOOL)supportIMessage
    {
    if (11thDataSourceA == 2 || 11thDataSourceB!= 0) return YES;
    return NO;
    }


Because the 11th data source A is either 0 or 1, under no circumstance can it be 2. In that


case, data source A becomes meaningless in our tracing, right? Hence the pseudo code can be


simplified as follows:



  • (BOOL)supportIMessage

Free download pdf