Help/Support IDA v7.2.x - Need Help to locate the right Function to change in gamefile.so

5torm · August 8, 2019

Hello together,

I need a little Helphand to solve some sleepless Nights.
I want to modify Shopitems in an Online mobile Game because the Developers are on an Pay2Win Course and i hate these things...

In this Ingame-Shop you can buy some Gameboosts like "infinite Tickets" for 15min that Cost 10 Diamonds, or perhaps you can get "X2 Coins" for 15min that cost 4 Diamonds.
I don't want to hack the real InApp Purchase.. i think its harder to do, right?

So i first want to ask if it is possible to modify the "Item-Shop" in a way when i click on a Boost that i will get the Boost and get 10 Diamonds and not -10 Diamonds from my existing Diamonds?

I load the ".so" file in IDA and searched a little bit around to find the right path.?

I thought i get the Right Function Window(s). As you can see there is on the right Functions with CountDiamondSpend & CountEmeraldSpend
Under these there is the PurchaseBoost Windows.

In the Second Image it goes all to the Clickbutton.

My Question now is where to find the Function with the Diamond and Emerald that will Sub from my existing Diamonds & Emeralds?
Im a little bit confused.

There must be an SUB or how does this work?

Hope you Guys can help me to solve this Problem... Cheers from Germany / 5torm

=======================================================================

P.S.: how to find out what exactly describes X9, W8, W2, X20 and so on.
I look into many Tuts and Videos but most Tuts on modding Ammo etc and those values different,
i hadn't found any similiar Tut or Vid.

Everytime i think "Now i got it, i failed because i miss SUBS or other things...

5torm · August 8, 2019

Sry for DoublePost, here the same in TextView, if it is better ?

.text:0000000000735EB8 ; =============== S U B R O U T I N E =======================================
.text:0000000000735EB8
.text:0000000000735EB8 ; Attributes: bp-based frame
.text:0000000000735EB8
.text:0000000000735EB8 ; ButtonDetail::setActionType(std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char>>)
.text:0000000000735EB8                 WEAK _ZN12ButtonDetail13setActionTypeENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE
.text:0000000000735EB8 _ZN12ButtonDetail13setActionTypeENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE
.text:0000000000735EB8                                         ; CODE XREF: ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+C↑j
.text:0000000000735EB8                                         ; DATA XREF: LOAD:000000000009D5E8↑o ...
.text:0000000000735EB8
.text:0000000000735EB8 var_10          = -0x10
.text:0000000000735EB8 var_s0          =  0
.text:0000000000735EB8
.text:0000000000735EB8 ; FUNCTION CHUNK AT .text:00000000007360E0 SIZE 00000014 BYTES
.text:0000000000735EB8
.text:0000000000735EB8 ; __unwind {
.text:0000000000735EB8                 STP             X20, X19, [SP,#-0x10+var_10]!
.text:0000000000735EBC                 STP             X29, X30, [SP,#0x10+var_s0]
.text:0000000000735EC0                 ADD             X29, SP, #0x10
.text:0000000000735EC4                 LDRB            W8, [X1]
.text:0000000000735EC8                 LDR             X9, [X1,#8]
.text:0000000000735ECC                 LSR             X10, X8, #1
.text:0000000000735ED0                 TST             W8, #1
.text:0000000000735ED4                 CSEL            X9, X10, X9, EQ
.text:0000000000735ED8                 SUB             X9, X9, #8
.text:0000000000735EDC                 CMP             X9, #0x14
.text:0000000000735EE0                 B.HI            loc_7360A0
.text:0000000000735EE4                 ADRP            X10, #unk_103DB16@PAGE
.text:0000000000735EE8                 ADD             X10, X10, #unk_103DB16@PAGEOFF
.text:0000000000735EEC                 ADR             X11, loc_735F00
.text:0000000000735EF0                 LDRB            W12, [X10,X9]
.text:0000000000735EF4                 ADD             X11, X11, X12,LSL#2
.text:0000000000735EF8                 MOV             X19, X0
.text:0000000000735EFC                 BR              X11
.text:0000000000735F00 ; ---------------------------------------------------------------------------
.text:0000000000735F00
.text:0000000000735F00 loc_735F00                              ; DATA XREF: ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+34↑o
.text:0000000000735F00                 LDR             X9, [X1,#0x10]
.text:0000000000735F04                 TST             W8, #1
.text:0000000000735F08                 CSINC           X8, X9, X1, NE
.text:0000000000735F0C                 LDR             X8, [X8]
.text:0000000000735F10                 MOV             X9, #0x6E6957746E756F63
.text:0000000000735F20                 CMP             X8, X9
.text:0000000000735F24                 B.NE            loc_7360A0
.text:0000000000735F28                 B               loc_73608C
.text:0000000000735F2C ; ---------------------------------------------------------------------------
.text:0000000000735F2C                 LDR             X9, [X1,#0x10]
.text:0000000000735F30                 TST             W8, #1
.text:0000000000735F34                 MOV             W2, #9  ; n
.text:0000000000735F38                 CSINC           X0, X9, X1, NE ; s1
.text:0000000000735F3C                 ADRP            X1, #aCountgoal@PAGE ; "countGoal"
.text:0000000000735F40                 ADD             X1, X1, #aCountgoal@PAGEOFF ; "countGoal"
.text:0000000000735F44                 B               loc_736084
.text:0000000000735F48 ; ---------------------------------------------------------------------------
.text:0000000000735F48                 LDR             X9, [X1,#0x10]
.text:0000000000735F4C                 TST             W8, #1
.text:0000000000735F50                 MOV             W2, #0xA ; n
.text:0000000000735F54                 CSINC           X20, X9, X1, NE
.text:0000000000735F58                 ADRP            X1, #aCountmatch@PAGE ; "countMatch"
.text:0000000000735F5C                 ADD             X1, X1, #aCountmatch@PAGEOFF ; "countMatch"
.text:0000000000735F60                 MOV             X0, X20 ; s1
.text:0000000000735F64                 BL              .memcmp
.text:0000000000735F68                 CBZ             W0, loc_73608C
.text:0000000000735F6C                 ADRP            X1, #aCountpoint@PAGE ; "countPoint"
.text:0000000000735F70                 ADD             X1, X1, #aCountpoint@PAGEOFF ; "countPoint"
.text:0000000000735F74                 MOV             W2, #0xA
.text:0000000000735F78                 MOV             X0, X20
.text:0000000000735F7C                 B               loc_736084
.text:0000000000735F80 ; ---------------------------------------------------------------------------
.text:0000000000735F80                 LDR             X9, [X1,#0x10]
.text:0000000000735F84                 TST             W8, #1
.text:0000000000735F88                 MOV             W2, #0xE ; n
.text:0000000000735F8C                 CSINC           X20, X9, X1, NE
.text:0000000000735F90                 ADRP            X1, #aCountteammatch@PAGE ; "countTeamMatch"
.text:0000000000735F94                 ADD             X1, X1, #aCountteammatch@PAGEOFF ; "countTeamMatch"
.text:0000000000735F98                 MOV             X0, X20 ; s1
.text:0000000000735F9C                 BL              .memcmp
.text:0000000000735FA0                 CBZ             W0, loc_73608C
.text:0000000000735FA4                 ADRP            X1, #aCountsupporter@PAGE ; "countSupporter"
.text:0000000000735FA8                 ADD             X1, X1, #aCountsupporter@PAGEOFF ; "countSupporter"
.text:0000000000735FAC                 MOV             W2, #0xE ; n
.text:0000000000735FB0                 MOV             X0, X20 ; s1
.text:0000000000735FB4                 BL              .memcmp
.text:0000000000735FB8                 CBZ             W0, loc_73608C
.text:0000000000735FBC                 ADRP            X1, #aCountgoldspend@PAGE ; "countGoldSpend"
.text:0000000000735FC0                 ADD             X1, X1, #aCountgoldspend@PAGEOFF ; "countGoldSpend"
.text:0000000000735FC4                 MOV             W2, #0xE ; n
.text:0000000000735FC8                 MOV             X0, X20 ; s1
.text:0000000000735FCC                 BL              .memcmp
.text:0000000000735FD0                 CBNZ            W0, loc_7360A0
.text:0000000000735FD4                 ADRP            X1, #aPurchasesuperp@PAGE ; "purchaseSuperPowerUpgrade"
.text:0000000000735FD8                 ADD             X0, X19, #0x18
.text:0000000000735FDC                 ADD             X1, X1, #aPurchasesuperp@PAGEOFF ; "purchaseSuperPowerUpgrade"
.text:0000000000735FE0                 MOV             W2, #0x19
.text:0000000000735FE4                 B               loc_73609C
.text:0000000000735FE8 ; ---------------------------------------------------------------------------
.text:0000000000735FE8                 LDR             X9, [X1,#0x10]
.text:0000000000735FEC                 TST             W8, #1
.text:0000000000735FF0                 MOV             W2, #0x11 ; n
.text:0000000000735FF4                 CSINC           X20, X9, X1, NE
.text:0000000000735FF8                 ADRP            X1, #aCountdiamondsp@PAGE ; "countDiamondSpend"
.text:0000000000735FFC                 ADD             X1, X1, #aCountdiamondsp@PAGEOFF ; "countDiamondSpend"
.text:0000000000736000                 MOV             X0, X20 ; s1
.text:0000000000736004                 BL              .memcmp
.text:0000000000736008                 CBZ             W0, loc_7360E0
.text:000000000073600C                 ADRP            X1, #aCountemeraldsp@PAGE ; "countEmeraldSpend"
.text:0000000000736010                 ADD             X1, X1, #aCountemeraldsp@PAGEOFF ; "countEmeraldSpend"
.text:0000000000736014                 MOV             W2, #0x11 ; n
.text:0000000000736018                 MOV             X0, X20 ; s1
.text:000000000073601C                 BL              .memcmp
.text:0000000000736020                 CBNZ            W0, loc_7360A0
.text:0000000000736024                 ADRP            X1, #aPurchaseboost@PAGE ; "purchaseBoost"
.text:0000000000736028                 ADD             X0, X19, #0x18
.text:000000000073602C                 ADD             X1, X1, #aPurchaseboost@PAGEOFF ; "purchaseBoost"
.text:0000000000736030                 MOV             W2, #0xD
.text:0000000000736034                 B               loc_73609C
.text:0000000000736038 ; ---------------------------------------------------------------------------
.text:0000000000736038                 LDR             X9, [X1,#0x10]
.text:000000000073603C                 TST             W8, #1
.text:0000000000736040                 MOV             W2, #0x14 ; n
.text:0000000000736044                 CSINC           X0, X9, X1, NE ; s1
.text:0000000000736048                 ADRP            X1, #aCountopenscrat@PAGE ; "countOpenScratchCard"
.text:000000000073604C                 ADD             X1, X1, #aCountopenscrat@PAGEOFF ; "countOpenScratchCard"
.text:0000000000736050                 BL              .memcmp
.text:0000000000736054                 CBNZ            W0, loc_7360A0
.text:0000000000736058                 ADRP            X1, #aPurchasescratc@PAGE ; "purchaseScratchCard"
.text:000000000073605C                 ADD             X0, X19, #0x18
.text:0000000000736060                 ADD             X1, X1, #aPurchasescratc@PAGEOFF ; "purchaseScratchCard"
.text:0000000000736064                 MOV             W2, #0x13
.text:0000000000736068                 B               loc_73609C
.text:000000000073606C ; ---------------------------------------------------------------------------
.text:000000000073606C                 LDR             X9, [X1,#0x10]
.text:0000000000736070                 TST             W8, #1
.text:0000000000736074                 MOV             W2, #0x16
.text:0000000000736078                 CSINC           X0, X9, X1, NE
.text:000000000073607C                 ADRP            X1, #aCountspecialpo@PAGE ; "countSpecialPowerUsage"
.text:0000000000736080                 ADD             X1, X1, #aCountspecialpo@PAGEOFF ; "countSpecialPowerUsage"
.text:0000000000736084
.text:0000000000736084 loc_736084                              ; CODE XREF: ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+8C↑j
.text:0000000000736084                                         ; ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+C4↑j
.text:0000000000736084                 BL              .memcmp
.text:0000000000736088                 CBNZ            W0, loc_7360A0
.text:000000000073608C
.text:000000000073608C loc_73608C                              ; CODE XREF: ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+70↑j
.text:000000000073608C                                         ; ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+B0↑j ...
.text:000000000073608C                 ADRP            X1, #aPlaymatch@PAGE ; "playMatch"
.text:0000000000736090                 ADD             X0, X19, #0x18
.text:0000000000736094                 ADD             X1, X1, #aPlaymatch@PAGEOFF ; "playMatch"
.text:0000000000736098                 MOV             W2, #9
.text:000000000073609C
.text:000000000073609C loc_73609C                              ; CODE XREF: ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+12C↑j
.text:000000000073609C                                         ; ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+17C↑j ...
.text:000000000073609C                 BL              ._ZNSt6__ndk112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6assignEPKcm ; std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>::assign(char const*,ulong)
.text:00000000007360A0
.text:00000000007360A0 loc_7360A0                              ; CODE XREF: ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+28↑j
.text:00000000007360A0                                         ; ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+6C↑j ...
.text:00000000007360A0                 LDP             X29, X30, [SP,#0x10+var_s0]
.text:00000000007360A4                 LDP             X20, X19, [SP+0x10+var_10],#0x20
.text:00000000007360A8                 RET
.text:00000000007360A8 ; End of function ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)
.text:00000000007360A8
.text:00000000007360AC ; ---------------------------------------------------------------------------
.text:00000000007360AC                 LDR             X9, [X1,#0x10]
.text:00000000007360B0                 TST             W8, #1
.text:00000000007360B4                 MOV             W2, #0x1C
.text:00000000007360B8                 CSINC           X0, X9, X1, NE
.text:00000000007360BC                 ADRP            X1, #aCountdiamondob@PAGE ; "countDiamondObtainedPurchase"
.text:00000000007360C0                 ADD             X1, X1, #aCountdiamondob@PAGEOFF ; "countDiamondObtainedPurchase"
.text:00000000007360C4                 BL              .memcmp
.text:00000000007360C8                 CBNZ            W0, loc_7360A0
.text:00000000007360CC                 ADRP            X1, #aPurchasediamon@PAGE ; "purchaseDiamond"
.text:00000000007360D0                 ADD             X0, X19, #0x18
.text:00000000007360D4                 ADD             X1, X1, #aPurchasediamon@PAGEOFF ; "purchaseDiamond"
.text:00000000007360D8                 MOV             W2, #0xF
.text:00000000007360DC                 B               loc_73609C
.text:00000000007360E0 ; ---------------------------------------------------------------------------
.text:00000000007360E0 ; START OF FUNCTION CHUNK FOR _ZN12ButtonDetail13setActionTypeENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE
.text:00000000007360E0
.text:00000000007360E0 loc_7360E0                              ; CODE XREF: ButtonDetail::setActionType(std::__ndk1::basic_string<char,std::__ndk1::char_traits<char>,std::__ndk1::allocator<char>>)+150↑j
.text:00000000007360E0                 ADRP            X1, #aPurchasegachap@PAGE ; "purchaseGachaPackage"
.text:00000000007360E4                 ADD             X0, X19, #0x18
.text:00000000007360E8                 ADD             X1, X1, #aPurchasegachap@PAGEOFF ; "purchaseGachaPackage"
.text:00000000007360EC                 MOV             W2, #0x14
.text:00000000007360F0                 B               loc_73609C
.text:00000000007360F0 ; } // starts at 735EB8
.text:00000000007360F0 ; END OF FUNCTION CHUNK FOR _ZN12ButtonDetail13setActionTypeENSt6__ndk112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE
.text:00000000007360F4