Ted2

Hi! This tutorial is gonne be hacking with GDB Breakpoints. Read & study this tutorial by @shmoo about strings first, cause it's really necessarily. https://iosgods.com/topic/26584-ida-tutorialhow-to-hack-with-strings/ Breakpoints are extremely useful, once your breakpoint gets hit the game will freeze. You probably think, why the f*** is that useful you stupid b**** Well, now you can read which registers hold what value, you can see back traces (functions/places that are also called once breakpoint was hit), you can read memory & allot more. They are also useful if you aren't sure if you're at the right place, for example you had a string called Coins & did some xReffing & you end up somewhere but you're not sure if it's anything useful. What you can do now, is set a breakpoint on the offset you are in IDA & make a change in the coins. If the place where you were in IDA has anything to do with coins, the game should freeze when you make a change in coins. Requirements - GDB, repo: https://shmoo419.github.io/ - IDA, get it from the forum. - A Game (or use my example game): https://itunes.apple.com/nz/app/war-heroes-top-strategy-games/id1142744199?mt=8 - Some experience with strings & ARM Crack the binary & load the binary into IDA & wait till it's done. This game I'm hacking is some sort of game like Clash Of Royale. You have 3 towers, or whatever they're called. The middle one, is the most important one. If that one is broken aka dead, you win. You have 4 cards you can make use of, each has it's own damage amount. So, what we're going to try is hack the damage of a card. There's not really a specific way of finding such a thing. Some games have obvious strings & some games have not. To open strings window in IDA, you go to: View - Open Sub Views - Strings If I search for the word "damage", I'm getting 50 results, not that much but still a struggle to read. I like to click on the "Length" button in IDA, so it sorts the results & it's much cleaner: I like to go from top through bottom, so let's double click the first string & xRef it: If you don't know what xRef means, please read shmoo's tutorial on strings & come back later. When I click the first result, I've some sub_x functions around the string The ones with a straight red line are from the damageReduction string, the other are from damage string: I like to think sub_x functions with more than 70 xRefs are useless. (XRefs is just to see where the function is getting used by other functions) However, sometimes function look interesting & you might want to try them out anyways. It's really just experience that will tell your brain whether the function can be useful or no. The sub_10000F7F0 & sub_100012158 have too many xRefs, first one above 300 & the other above 900. You don't wanna modify a function that is getting used/called in another 300 functions. Neither would a developer code a damage function that is getting used in another 300 functions, cause that would likely cause instability. However, the sub_100190A78 has only one xRef & sub_100190A8C has only one xRef too. sub_100190A8C seems to be for the damage_reduction string (sounds useful too tho). But let's focus on sub_100190A78: It's a really short function. STR W1, [X0,#0x2C] // Store whatever value W1 is holding into X0+0x2C RET // RETurn the function (end it). Alright, we aren't sure whether this function is the right one for damage or not. We have two options: 1. Try modify the function & see what happens 2. Set a breakpoint on the function & see if it hits. While some people may recommend option 1 because they don't know how to use a debugger, I don't. Cause if you keep trying without debugging it CAN be a LONG LONG night, however sometimes you just find it in the first try So we are going to set a breakpoint on the function. First you need to know this about arm64 binaries: arm64 binaries have a ASLR Slide which can't be removed. You have to make calculations in order to get the right offset. IDA Offset + ASLR Slide with a Hex Calculator would do. But since Shmoo has it's built in feature in gdb, you don't have to make any calculations. Just this command in GDB & it will do it for you: set add-aslr-bp on We need to actually start GDB first, open Putty & SSH into your device. Then type "gdb" & hit enter & it should start. Then you have to attach to the game, I recommend attaching with the PID but I think binary names are also supported. How to find your PID: You can find it with GamePlayer, iGameGuardian etc or type this into your putty window: "ps ax | grep 'binary name'" Attach command: attach "PID" It will attach, it may show scary lines of "code" but that's normal. Aslong as your game froze, it's fine. Type "continue" or "c" in short to unfreeze the game. How to set a breakpoint: Before you do, enter this command first: set add-aslr-bp on Breakpoint command: break *0xoffset / b *0xofffset For me that would be: break *0x100190A78. (see picture above, the sub_x functions is 100190A78) Now let me play a match & see whether it hits or no. So the game froze when the tower was hit, this is a good thing! From here you can do multiply things: - you can read registers (reading what for example W0, W1, W20 is holding at the time of the breakpoint being hit) - you can read back traces to see which places where also called when the breakpoint was hit - you can read memory So let's read the registers by typing this command: "info registers" --> this will show all normal registers, "info all-registers" will also show float values. Remember: X & W is basically the same, they'll hold the same value. My X1 shows me it's 162, which is correct cause the enemies tower's health went down with 162. Alright, so now we have to hack the damage amount. If you may know, W23 & W29 hold huge ass values that never change. If we store that value instead of our orignal value X1, we'll have a One Hit Kill // ------- Original: ------- STR W1, [X0,#0x2C] RET // ------- Hacked: ------ STR W23, [X0,#0x2C] RET So I'm going to do this with code injection, I assumed you know how to do that, if not do research on the forum. I compiled it with theos, installed it & I got a One Hit Kill However, this function had only one instruction that could be hacked, so the part where we read the register wasn't really needed. I'll make a video soon enough with an longer function example. I hope you learned how to work with breakpoints & how you can read the registers. Understand that this tutorial is absolutely noob, some games require allot of back tracing etc etc Useful GDB Commands: Auto Add Aslr To Breakpoint: add aslr-bp on Breakpoint: break *0xIDAOffset or b *0xIDAOffset Reading Normal Registers: info registers Reading All Registers: info all-registers (usefull for floats, damage, health etc are most of times float) Find more here: https://lldb.llvm.org/lldb-gdb.html

Ios 11 can't run it

Yes, I did it in bloons td 6

See shmoo's variables & function pointers tutorial

It's function, aimatbestenemy, u can call it with MM button

Nope

Yes you could have also typed make clean package & then install it with filza. But why bother the extra work

Type in terminal: "make clean package install" instead of "make package install"

Oh

@K_K

I think you should be able to purchase it without changing your email or creating a new account. Display name shouldn't matter. @DiDA ?

You think "?" is a valid color? Don't think so. I think there's an actual example how to fill those things in in the template.

You didn't hook anything. You just have: "%hook" It's supposed to be something like: %hook AppDelegate or %hook UnityAppController & since I assume it's a unity game #il2cpp you have to do: %hook UnityAppController if not, search this "applicationDidBecomeActive" & take the delegate.

Boiiii

You haven't extracted it correctly then

Install plutil from this repo: repo.bingner.com

You are missing all files in: SdkFolder/System/Libary/PrivateFrameworks Use this SDK: https://www90.zippyshare.com/v/u7FJ5AKX/file.html Or copy all files from the PrivateFrameworks into your current SDK.

Server sided

https://iosgods.com/topic/74049-life-is-strange-all-versions-1-cheat-all-episodes-unlocked/?do=findComment&comment=2229072

Ayyy

I can't remember. But the errors are the same when I had the theos problem (That was fixed by just using your theos)

@DiDA

Nein

My Cydia got f***ed by some tweak. So I tried installing it with SSH & Filza. I'm getting this sh!tty error: dpkg -i /var/mobile/cydia.deb (Reading database ... 21536 files and directories currently installed.) Preparing to unpack /var/mobile/cydia.deb ... Unpacking cydia (1.1.30) ... dyld: lazy symbol binding failed: Symbol not found: _clock_gettime Referenced from: /usr/bin/lzma Expected in: dyld shared cache dyld: Symbol not found: _clock_gettime Referenced from: /usr/bin/lzma Expected in: dyld shared cache dpkg-deb (subprocess): subprocess decompressing archive member was killed by signal (Trace/BPT trap: 5) dpkg-deb: error: subprocess <decompress> returned error exit status 2 dpkg: error processing archive /var/mobile/cydia.deb (--install): subprocess dpkg-deb --fsys-tarfile returned error exit status 2 Errors were encountered while processing: /var/mobile/cydia.deb Anyone knows how to fix?

Sick