5l1v3r1 / ida-pro-idc-iphone-ios-5.x.x Goto Github PK

Apple is not standing still and in iOS 5 the default compiler is LLVM instead of GCC. It produces somewhat different code and IDA < 6.2 fail to resolve references which are now relative to PC.

Here is an example of code dissasembled with IDA :

__text:00001000 MOV R4, 0x12344
__text:00001008 ADD R4, PC

After executing this IDC script :

__text:00001000 MOV R4, 0x12344
__text:00001008 ADD R4, PC ; off_13350

(if the address is named, the name will appear instead of off_xxx)

The xref is also added so that when you type X on address 0x13350 you'll see where it is used.

Thanks to
~pod2g