Reverse a program, found that the program was setuid (0), Setgid (0) thus causing the program to run in root mode (specifically can be searched in iosre), so I would like to take this instruction to nop off.
I looked up some methods on the Internet, such as:
1, xx A0 E1 NOP
I tried the next, in 32 bits, that ARM7 seems to be MOV r0 r0 (two weeks ago tried, remember not very clear.) Well, this also works. But under 64 bits, it becomes garbled, and Ida is all changed.
2, with Hopper and IDA combination to change
In Ida, you can only change the hex directly, and in hopper it is possible to modify the instruction-nop directly, but only another executable file is generated.
So I changed the hopper directly into NOP, and then I generated 32-bit and 64-bit executables, then I used IDA to view the specific hex from these two files, and then I changed the FAT file with Ida to the hexadecimal corresponding to NOP.
Found 32-bit and 64-bit NOP corresponding hexadecimal different, 32-bit under NOP accounted for two bytes, xx BF. 64 bit under NOP takes 4 bytes, 1F D5. Why is this?
Is this a stupid method of mine? Understand the expert guidance under, grateful can't help.
About the reverse of iOS app modified into NOP instructions ...