Jump to content

NitroxicDemon

Senior Member
  • Content count

    1,089
  • Joined

  • Last visited

Community Reputation

1,419 Illuminati Confirmed

About NitroxicDemon

  • Rank
    Veni Vidi Vici

Profile Information

  • iOS Version
    8.1.2
  • Jailbroken
    No
  • Rooted
    No

Recent Profile Visitors

20,552 profile views
  1. Chmod 777 slap into game no thin, only if ur hacking armv7 no aslr remove if ur hacking armv7 using gdb or lldb
  2. I only tested one hack on my device, a critical ops mod menu for x64, and it works fine
  3. Same, my hacks always crash for other helix users. helix as in the 32 bit one double helix for 64 bit works fine
  4. I always did this lmao, some still take long time to load lel. For me, ARM64 loads bins load faster than 32 bit bins in ida 32
  5. Not sure you can try CMP W0, #1 or CMP W0, #0 Try one of them and see
  6. In this tutorial, I will just give a brief overview of some ARM64 You need to know ARMv7 first so this will be easier to understand. Let's Get Started So basically, instructions are the same, ARM64 has LDR, MOV, STR, etc., same from ARMv7. You will notice ARM64 has different registers, instead of R0, for example, ARM64 uses X0, OR W0. You can hack it the same way as you would ARMv7. Example: This is ammo in the game Forward Assault. The highlighted instruction is what I hacked, SUB W8, W8, #1 Subtract 1 from W8 and put the value back into W8, simply NOP it. OR You can hack the STR underneath it and instead of storing W8, change it to W20 or W29. It will result in making your ammo a very high number. why? Because you silly goose, W20/W29 is the equivalent of R7. OR you can use X20/X29 if the function has X But wait, are the W20/W29 both the same Father Nitro? Well, I'm glad you asked, I was just about to get to that you eager mcbeaver. You see here, the 20 has a high value, but 29 has a even more higher value. Sometimes 29 can make it go too high it can go negative, so use 20 instead. BOOLS Now let's talk about Booleans in ARM64. In ARMv7, to make something return TRUE or FALSE, we simply change it to MOV R0, #1 OR MOV R0, #0 ARM64 is no different, it's just X instead. MOV X0, #0 or MOV X0, #1 Example: Here is an example function. In case you didn't know, it's a BOOL since this function loads a byte, which have 0 or 1 value. So as you can see, this function gets my sexiness. Obviously, to hack it you will change it to MOV X0, #1 making it true, which it is.. This can NEVER be false :kappa: FLOATS So floats in ARM64 are similar in ARMv7, using FMOV instead of VMOV. So just hack the instruction the same way as you would in ARMv7. Example: You can change that FMOv S2, #0.5 to FMOV S2, #31.0. Now it's time to discuss something else. As you make know in ARM7, sometimes we want to hack the beginning of a function and make it return a float value. so we would do: VMOV S0, #31.0 VMOV R0, S0 BX LR So father Nitro, is it the same in ARM64? I know what you're thinking, you're thinking in ARM64 the equivalent would be: FMOV S0, #31.0 FMOV X0, S0 RET WRONG! Do that and watch the game crash. In arm64 the second instruction isn't needed. FMOV S0, #31.0 FMOV X0, S0 RET SO just replace the first 2 lines of the function with FMOV S0, #31.0 then RET that bad boy. Now let me get into another example why ARM64 is bae. Example: This function is from Critical Ops, which gets the bounciness from the grenade. As you will see, it's a LDR, you can hack it and change it from LDR to FMOV. Yes, in ARM64 you can hack LDR functions to FMOV's. So to hack the function, you can replace the LDR S0, [X0,#0xA0] with a FMOV S0, #31.0 This function made my grenades super bouncy, it was funny to troll in public matches. The grenades bounced like crazy! In ARMv7 I found the same function, it was a LDR followed by a BX LR (RET). So to hack it, I tried many things, MOV R0, R7 and such but every time I threw a grenade it crashed. A VMOV S0, #31.0 VMOV R0, S0 BX LR wouldn't work since there isn't enough space. Unless you wanted to write your own code to the unused part of the binary and make the function branch there, which I'm not entirely sure would have worked since I never tried. So I just hacked it in ARM64 instead That's it for this tutorial EDIT: Forgot to mention, this tutorial was written specially for Amuyea
  7. Set a watchpoint if you're trying to get the offset from something using a cheat engine, and make sure you did the image list thing
  8. I installed iTunes 12.0.1.26, make sure first you uninstall iTunes and all related programs from control panel, like bonjour, mobile device support, etc. Then download that iTunes version, and right click the installer and run as administrator.
  • Recently Browsing   0 members

    No registered users viewing this page.


    • Administrator |
    • Global Moderator  |
    • Moderator  |
    • ViP Plus |
    • ViP |
    • Cheater  |
    • Modder  |
    • Novice Cheater |
    • Rookie Modder |
    • Contributor |
    • Senior Member |
    • Member |
×

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.