[ SOLVED ] Classdump Error: Cannot find offset for address XXXXX in stringAtAddress:

English Only
1

Hi everyone,

What I want

I’m trying to dump WhatsApp Messenger app’s headers.
After hours and hours I’m still stuck on this task.

My config:

I’ve tried the following on:

  • iPhone 5C with iOS 8.2
  • iPhone 6 with iOS 9.3.2
  • and my computer is running on MacOS Sierra

What I’ve tried

I’ve tried to decrypt the bundle app using both Clutch2 and dumpdecrypted.
It worked only with Clutch2
After the binary is decrypted it’s impossible for me to get class-dump working.
I always have the same error:

$ ./class-dump WhatsAppClutched-ios8-v3\ 2/Payload/WhatsApp.app/WhatsApp -o ./headers
2018-01-03 17:46:00.994 class-dump[22529:4570161] Error: Cannot find offset for address 0x6800f3c2 in stringAtAddress:
$

Note that I’ve tried to decrypt the binary either by running Clutch -b <bundleId> or Clutch -d <bundleId. Both commands give me an output without error but after that, class-dump does not work at all.

I’m using the latest release of class-dump, I’ve tried to directly use the source code and build it but I have other issues by doing this.

Please, could someone solve my issue OR at least dump up to date headers for me ?

PS: note that it work perfectly when I do this operation with another app like Snapchat for instance…

Bests,

Babbu

2

Usually this is caused by swift code embedded with ObjC code.
Try this fork https://github.com/BlueCocoa/class-dump
or use runtime-dump https://github.com/limneos/classdump-dyld

3

Zhang thanks for your fast answer !

Unfortunately it does not seem to work with the BlueCocoa’s repository too.

What I’ve done:

git clone <path-to-the-repo>
cd repo-dir
xcodebuild clean build

After the build (with success status), I use the file located at repo-dir/build/Release/classdump

Error :

I’ve got the following error

Capture d’écran 2018-01-03 à 20.04.06.png1255×357 58.7 KB

Do I do something wrong ? Thanks for your help !

PS: I did not tested the classdump-dydl yet.

4

Then your best bet is runtime dump then. Or someone else might be able to point out their fork is fully working?

5

You can try this

2 个赞
6

Thank you, this class-dump binary was definitely my best bet ! It worked like a charm !

7

Zhang, thank you for your time, the other version of class-dump given by AloneMonkey solved my issue. So I did not tried the runtime dump yet.

Thanks again for your time.

1 个赞
8

I still don’t work , How did you reinstall class-dump ?

9

I still don’t work , How did you reinstall class-dump ? thank you

10

You don’t really have ton install class dump per say. I’ve just downloaded the class-dump binary at link given by AloneMonkey (here: https://github.com/AloneMonkey/MonkeyDev/blob/master/bin/class-dump).

Then, I’ve juste used it as any other binary.

11

I just tried it, but also successfully dumped a mixture of Mach-O files,3q

12

尝试用它来获取dyld_shared_cache_arm64中库的头文件，还是会报类似的错误。

Cannot find offset for address 0x1b2595898 in dataOffsetForAddress
13

I can not read your message since I’m english speaker only, but have you tried to decrypt the App first and dump headers then?