OPCODE 0XED HOW TO

The opcode for CMP R0, #0x2A is 0A 28 so we to patch that to the opcode of CMP R0, R0 Highlight the line we want to patch and hit the Hex-View-A button. Now we need to find the ARM opcode and patch it in our hex editor. We need to patch that to BEQ loc_2B28 so it will skip the part where the protection kicks in. The last 2 lines are CMP R0, #0xA and BGT loc_2B28.Д¬MP R0, #0xA compares the two variables so we need to patch it to CMP R0, R0 so that it wil always be trueД«GT loc_2B28 checks if R0 is greater than #0x1A and jumps to loc_2B28 if it's true. The first segment checks some stuff about the bundle but that doesn't matter. Next, we go to the first occurrence where THIS = TOOT was logged Oct 27 18:19:23 ttwj-iPad SpellChecker: logevent: CAUGHT_IT, params So, we now search for CAUGHT_IT in IDA I've created a MobileSubstrate tweak that hooks onto the logging system the app uses to find out where the protection is. Parse obj-c methods and let IDA load the binary. Choose the armv6 portion as it's easier to patch (we'll discuss about armv7 portions in another part)ДЄrmv7 may use some functions which opcodes are more complicated, I suggest you thin your binary using lipo and just play with the armv6 portion You can download the binary here ( ), unpatched IPAs are available on apptrackr, grab them before they are removed!ДЇirst, open the app in IDA and remember to choose the correct processor type. We shall be patching SpellChecker by Enfour Inc, which is notorious for it's protection. This tutorial is heavily based on THIS ONE Also, DOWNLOAD PDF TUTORIAL HERE

OPCODE 0XED HOW TO

Knowledge on how to create simple MobileSubstrate tweaks Hex Editor (I'm using 0ењЋD on Mac for this)

More and more apps are beginning to implement anti-piracy methods and have managed to circumvent protections such as Overdrive.Д«rought to you by Kim Jong CracksRequirements: Edit: can some mod move this into the tutorials section? I can't start a topic there.