-
Posts
569 -
Joined
-
Last visited
Everything posted by ThePianoGuy
-
Android Tutorial How to fix parse error (APK modding)
ThePianoGuy posted a topic in Android Tutorials
I have spent a week trying to fix parse error. I decompiled the APK and i just found out that the minimum version of Android system was not given If the apk does not work on your device running Android 4.1.1 or below and it work on other Android version, that means the game developer forgot to give the minimum version of Android system in the APK file or they make it unsupported In this tutorial, i will show you how to fix parse error on Minecraft PE 0.14.3 and make it installable on any devices running Android 4.1.1 and below. It is very easy to fix it so let's get started Tools that we need on computer: Notepad++ Any apktool. You can try my GUI tool: APK Easy Tool Step by step: 1. Backup your APK from your device or download the APK fron the internet. Read more about backup APK file 2. On your PC, download APK Easy Tool and Notepad++ and install them. 3. Open Apk Easy Tool, select the APK and decompile it 4. Navigate to the path where you decompile the APK. Right-click on Android manifext.xml and select "Edit with Notepad++" 5. The Notepad++ will open. Find the tag "<uses-sdk..." . if it does not exist, add the tag: <uses-sdk android:minSdkVersion="integer" /> between other tags. Don't put it inside the tags. Replace "integer" with a number of API level. See the list below Note: If you still getting parse error, please add the property targetSdkVersion and maxSdkVersion <uses-sdk android:minSdkVersion="integer" android:targetSdkVersion="integer" android:maxSdkVersion="integer" /> for older devices running 4.0.x - 4.4.x, use this tag <uses-sdk android:minSdkVersion="14" android:targetSdkVersion="23" /> for Marshmallow 6.0.x, use this tag <uses-sdk android:minSdkVersion="14" android:targetSdkVersion="23" android:maxSdkVersion="23" /> In my example, I'll take the API level "16" as the minimum version of Android 4.1.1. 6. Save the file and Recompile + sign the APK with Apktool. 7. Copy the modded APK to your device, and install it. Enjoy gaming Proof of me playing Minecraft PE on Android 4.1.1: Proof of me playing Pokémon Go on Android 4.2.2 i CANNOT guarante that it will work for all devices! Credits: AndnixSH -
The Unity3D engine now have an ability to remove the function names, encrypt the code and put the encrypted function in the A section, and make the DLL into a obfuscated DLL file. This is similar to IDA string hacking, but now we try DLL string hacking The DLL i'm modding was ReRave. Coins is visual, and not possible to hack, but it is useful to learn modding obfuscated DLL file https://play.google.com/store/apps/details?id=com.steprevolution.rerave.plus&hl=en 1. Open the APK file with Winrar, and extract the Managed file from the APK file. 2. Download code search here for Reflector: http://www.mediafire.com/download/l1tgvwjb9k44ugz/Reflector.CodeSearch.dll 3. Open the Reflector. Click "Tools" -> "Add-Ins..." 4. Click "+" button 5. Go to the path where you had downloaded the "Reflector.CodeSearch.dll" file, and click "Open" 6. Click "Close", close the Reflector, and open it again 7. You will see the Code Search icon on the toolbar. Click in it, or click "Tools" -> "Code Search" 8. Open the "Assembly-Csharp.dll" file 9. IMPORTANT! Make sure the "Assembly-Csharp.dll" file is selected. Select the DLL else where will give you the wrong search results 10. Now search the string you want to find. Instead, "coin", search what you want 11. After searching, you will see the result. Ignore the void functions, and find the useful function (in Int32, Int64, double, float, etc.) you want to mod. I was looking for coins function in UInt32 (Same as Int32) 12. When you open it, you will see the code above. In this screenshot, I found a "coins" string 13. Click the Reflexil icon on the toolbar, , or click "Tools" -> "Reflexil 2.0" 14. Right click and select "Delete all" 15. Right click and select "Create new" 16. Do the following: OpCode: ldc.i4 Operand type: Int32 Operand: 999999 and click "Append" 17. Right click and select "Create new" 18. In OpCode, select "ret" and click "Insert after selection" 19. Your instruction should look like this 20. Save your DLL 21. Replace the DLL file in the APK file, run it, and enjoy I repeat, coins is visual and not possible to hack in ReRave game Note: Some function does not have the strings in it. If you can't find the function you are looking for, try search another keywords. You can search for Player or SaveData classes, and try mod the function (in Int32, Int64, double, float, etc.) one by one. Credit: AndnixSH
-
Hello dear community, Today, i will teach you how to mod x86 libs. x86 is not that hard to understand because the instruction are almost the same as ARM. In this tutorial, i mod the game called The Sandbox 2. You don't really need to mod x86 at all since I never heard any problem with ARM translating to x86, and it's too hard to change instruction without code caving. Just wanna make tutorial lol Now let's start modding. In this tutorial, I'll show you how to mod The Sandbox Evolution very easy in x86. First of all, you need IDA PRO and Hex Workshop installed on your computer. If you already have them installed, go to next step Open the APK file with WinRar and extract the lib folder (In case you want to mod both x86 and ARM) Open the x86 .so file in IDA. You will see the dialog box similar to the following: In x86, you don't need to change anything. MetaPC is fine. Click OK to disassemble the lib file, and let it fully load. After that, press CTRL + F, search "isElementUnlocked" and double click on the function to open it Remember the offset (9869E0) of first instruction. we need to use it later. Note: The offset will change each update. Open Hex Workshop or other hex editing program, and search the offset. I'm using Hex Workshop Here is the offset of isElementUnlocked The function isElementUnlocked is a boolean function, which means it can return true or false. If you want unlock everything, replace it with b8 01 00 00 00 c3, which will return true. True is: b8 01 00 00 00 (mov eax, 1) False is: b8 00 00 00 00 (mov eax, 0) And return is: c3 (retn) When you open the modded .so file in IDA, your modded instruction will look like: Isn't that easy? You can also do the same on hasBoughtPromoPack to unlock premium If you want to hack mana like 9999999, search getManaBalance and giveMana, and replace it with any values you want b8 7f 96 98 00 (mov eax, 9999999) c3 (ret) You can use online x86 Assembly to get raw hex https://defuse.ca/online-x86-assembler.htm#disassembly Open the APK with WinRAR and replace the modded .so file. Re-sign the APK, install it and run the game. [/IMG] Credits: AndnixSH# Tutorial updated (May 2018)
-
Android Tutorial Dump decrypted DLL file with IDA Pro
ThePianoGuy posted a topic in Android Tutorials
Note: This tutorial was created by xiaobaiyey and written in chinese. This tutorial is poorly translated from Google Translation but i have fixed some grammar to make it easier to understand. reviously I read an article by hook decrypting the encrypted dll Unity3D, recently new to dynamic, so they can try the next through IDA, the same as the shelling, dump the decrypted dll file, try the next, it really can, in here to share under Requirements: Tools: ida6.6 millet 2s Game: Monthly Dragon knife (just find a game) Enable USB-debugging in Developer Options Open lib in IDA: Unzip lib folder from the APK, drag the file libmono.so to IDA Several functions mainly in the upper and lower breakpoint (refer mono source ) mono_image_open_from_data_full mono_image_open_from_data mono_image_open_from_data_with_name In a decryption process can about these function View the final in front of a function call or mono_image_open_from_data_with_name, Enable Developer Options: If Developer Option does not show in settings, follow the steps below. 1. Open Settings > About 2. Then tap “Build number” seven times to enable Developer options.... 3. Go back to Settings menu and now you'll be able to see “Developer options” there. 4. Tap it and turn on USB Debugging Dynamic debugging: If the app has anti-debugging, you need to skip meals to debug, the following brief dynamic debugging Preparations (there are many online tutorials dynamic debugging) Get android_server file from IDA PRO 6.6\ida66\dbgsrv or download the file HERE! Push android_server file to the phone 1: adb push android_server /data/local/tmp/ 2: adb shell 3: cd /data/data/tmp/ 4: chmod 777 android_server 5: ./android_server Port Forwarding: adb forward tcp:23946 tcp:23946 Debug startup app: adb shell am start -D -n com.huiguan.qinglong.taiqi.dl/com.huiguan.qlyyd.UnityPlayerNativeActivity Check the app's PID: 1. adb shell 2. ps | grep dl Record the PID and Forwarding (pid can be seen in the ida) adb forward tcp:8700 jdwp:PID Setting ida (the main settings hostname: 127.0.0.1) and open the attach process (wait for the program to automatically break live, live off later) Run app (in the f9 at ifa) This time in the cmd window run jdb debugger: jdb -connect com.sun.jdi.SocketAttach:hostname=127.0.0.1,port=8700 This time can be debugged Run app will break on the linker Then if the app is no anti-molestation: running directly f9 This window appears: same point Wait a moment, will end on Linker , directly connected to f9 op row If this window appears, select "yes (pass to app)" without waiting Many may appear behind all this window select yes and then run f9 Finally broken in the mono_image_open_from_data_with_name, method Loading is not the first time we want to skip dll If you can not read f5 look at the source code, source code demonstrate this direct f5, where he rewrote momo source int __fastcall mono_image_open_from_data_with_name (int a1, char * haystack, int a3, int a4, char a5, char * haystacka) Several key parameters // NT A1 read dll file offset address // Char * haystack, DLL file size // Char * haystacka , file name This time following the R1 register to see the encrypted DLL file address, indicating the DLL has not yet begun to decrypt, decryption may later. And laid down the road to change a single note of each register after a simple loop The dll decrypted This time it decrypted DLL in memory, This time it can have a dump, Check Register Window: Find R6 and R11 The entire file offset start R6 = 7B95304C End offset address R6 = R11 + 7B95304C + 3AF200 = 7BD0224C Use; dump dex scripts auto fp, dexAddress; fp = fopen ( "D:\\Test.dll", "wb"); for (dexAddress = 0x7B95304C; dexAddress < 0x7BD0224C; dexAddress ++) fputc (Byte(dexAddress), FP); Under run on ok Decryption out the effect, Attach the original dll and decrypted dll Credit: xiaobaiyey -
Android Tool APK Easy Tool Windows (GUI apktool)
ThePianoGuy replied to ThePianoGuy's topic in Android Tools
Thanks! I don't know if it is better because i never tried it before, but GUI tool is much faster and quicker than the CMD version. I don't include wipe folder functions in my tool for security reason but i can include it if many users request it you can try. it should be better and faster. if you have any ideas, feel free to request features here -
iOSgods now support Android? oh well, i will share all my tutorial about android modding soon!
-
Requirements: Windows 7 or newer (This tool will not work for Windows XP) .NET Framework 4.5.2 or newer Java SE/JDK is required for decompile, compile, and sign APK. If you don't have Java installed, you can only use Zipalign or Install APK. Download and install Java SE/JDK now Features: 7z Compression-level 0-9 APK infomation with icon by aapt dump badging Background workers to get rid of lags Remember window position (SHIFT + Q to reset window position) Advanced log viewer, with .txt file selection Extract APK / Zip APK Switch between apksigner.jar by Google and signapk.jar by bootstraponline Quick help Full environment path support Adb process kill Apktool.jar version selections Decompile APK Compile APK Sign APK after compile Sign seletected APK (It will clone the selected APK, and sign it) Sign compiled APK (If you forgot to sign your compiled APK, you can sign it) SignAPK (signapk.jar v1.0) Remember path when closed (config will reset if EXE file was moved to somewere else) Framework installer (uses apktool.jar's commands) Logs tab Drag and drop file support Full options of decompile and compile Cancel button in waiting dialog box Clear logs when exit Allow path changes in textbox Java heap option. Default 512m ZipAlign Options to rename the apk file Options to select apktool version. Tooltips Enable/Disable check for updates Enable/Disable tips and ToolTips and more... How to use: Download .msi or zip file, If you download .msi, open it and simply install it. If you download portable version .zip, extract to the portable drive you like to. Launch APK Easy Tool, directory are automatically set Select the APK file you want to work with or drop the APK to perform an action Do some work and good luck You do not need to select APK and set the directory if you do drag and drop actions. Framework are for ROM developers and System App modder only It works the same way as the command line version Download links: Dropbox link Mediafire link Android File Host link Baidu link (For peoples who live in china that can't access any other websites above) Credits: Evildog1 (Creator of this tool) ibotpeaches (Creator of apktool.jar) Google (adb, aapt, apksigner and zipalign) bootstraponline (signapk) Igor Pavlov (7zip) Changelogs: 1.41 (2017-12-01) - Added News tab. It requires an internet connection - Added options to change path of signing keys .pem and .pk8 - Added donation button - Added Full APK Infomation. - Added options to select your own .pk8 and .pem file for signing - Improved apktool version check. - Fixed wrong directory when the program auto create them - Removed changelogs from the tool. You can see them in news and online - Removed WS_EX_COMPOSITED to get rid of some UI glitches. Weird UI drawing may occur but looks cool for me :). - Changed transparent BackColor to write to improve UI performance a bit - .NET framework target is 4.6 - Some UI changes - Some fixes Full changelogs Screenshots:
-
Clash of Clans Bot 30-Day Code Giveaway ($40 value)
ThePianoGuy replied to Ky1e's topic in Community Giveaways
i want this -
[1x] Overwatch Account Giveaway! ~~~ Real ~~~
ThePianoGuy replied to Crypto's topic in Community Giveaways
damn i'm late -
Clash of Clans Bot 30-Day Code Giveaway ($40 value)
ThePianoGuy replied to Ky1e's topic in Community Giveaways
im in -
you mean that i should try ask Siri for that?
-
keep hacking. Gameloft already ruined MC5 by making it free, add limitations and annoyance ads
-
I know APple stopped signed iOS 9.1. My iPad 2 is running iOS 8.3 so is it possible to upgrade my iPad 2 from iOS 8.3 to 9.1?
-
[CONTEST]Try and win a free copy of the Modern Combat 5 hack!
ThePianoGuy replied to a topic in Community Giveaways
free 2 play version of MC5 sucks and ruined the game so i want this hack -
Any steam game you can find worth 30€ [GA By Myself]
ThePianoGuy replied to Kesi's topic in Community Giveaways
ok. too namy good games cost more than 30 so i would like to win Counter-Strike: Global Offensive -
thanks. i want this
-
I am giving away tidal account [premium] 30 days [close]
ThePianoGuy replied to STRINGCEIL's topic in Community Giveaways
yeah -
Any steam game you can find worth 30€ [GA By Myself]
ThePianoGuy replied to Kesi's topic in Community Giveaways
i wanna win big games like CoD. not small india games or ship war crap game. -
5 iTunes songs of your choice giveaway
ThePianoGuy replied to AlephDegree's topic in Community Giveaways
i'm in -
Grammarly premium giveaway *Lifetime Premium*
ThePianoGuy replied to 2nDimension's topic in Community Giveaways
i want to have this to improve my english -
Guide How to access iOSGods.com when Leecher's tweaks were installed
ThePianoGuy replied to DeathScripts's topic in Tutorials
didn't iOSGods made a deb file that blocks iOSleecher first? just asking