TuT GDB Cheating

[Zahir 392.2k iPad Mini 4 13.6]

Requirements:
- GNU DEBUGGER - [ from http://cydia.radare.org ]
- GamePlayer/iGameGuardian [ from http://yuan.duowan.com ]‎
- ASLR Remover
- SSH

Instructions:
1. Remove ASLR from the game

 

2. Open the app your are hacking

 

3. Search the value in GP or iGameGuardian

 

4. Find the true value in GP or iGameGuardian

 

5. If you have 2, then try to make them different number and see which one is right

 

6. Write down the GP or iGameGuardian Number in one place [you will need it later]

 

7. Dont close the app yet, go to your PC or MAC and Open SSH [PUTTY]

 

8. You will need to log in as root in your device so type this inside SSH [PUTTY]:

ssh root@iPAddressThatYourDeviceUses

9. Then it will ask for the password .. If you havent changed it, it will be alpine
 

10. Now lets go to GDB commands! First of all before you start GDB hacking, you will need to on gbs so type this inside SSH [PUTTY]

gdb

11. Now GDB is On and next step is to attach the game, which will make the app to freeze [NO WORRIES] So type this:

attach BINARYNAME

12. Now you will need the GP or iGameGiardian Offsets you found, so type this in:

watch *0xTheAddressinGPoriGameGuardian

13. Then you will need to unfreeze the app and use the currency/thing u r trying to hack, so this in:
continue
 

14. And the app will unfreeze now and you will need to use/gain some currency/thing u r trying to hack
 

15. When it increases or decreases the app will freeze again and this time it will show the OFFSET IN IDA
 

16. If u want you can load up the IDA and go to that offset and Hack it directly if u know how to or if u wish to find out more, u can try this!
 

17. If you wish to continue type this command to see the function in that offset

x/i 0xADDRESSYOUFOUNDJUSTNOW

18. The offset you have found might not be the one u can actually hack so you can try to change the adress by one or two [ex: SUB r1, r0]
 

19. Now after you have found the hackable offset, you need to see the hex address for that, so type this in:

x/x 0xADDRESSWHICHISTHEHACKABLEONE

20. Now go to http://armconverter.tk to convert the ARM-TO-HEX
 

21. Go there and change the function u want to do [ex: 39 1C]
 

22. Now you are done! but if you would like to test it, type this:

set *0xADDRESWHICHISHACKABLE = 0xTHEHEXNUMBERYOUWANT

Continue

23. As you will see the currency/thing will be the amount you have chosen

 

24. Good Luck

Updated May 8, 2014 by ZahirSher

[SUPERGIU 464]

Nice one! Really useful

[Zahir 392.2k iPad Mini 4 13.6]

Nice one! Really useful

 

Thanks

[K3NNNY 7.4k iPhone 7 Plus 11.2.1]

Thanks

Time to learn this

[AnotherLurker 1.5k]

where is rmaslr???

[Rook 547.4k iPad Pro (2nd gen) 17.4 Donor]

Time to learn this

 

A bit of IDA knowledge really comes in handy here!

 

where is rmaslr???

On the first step?

[Oxytyramine 42.3k iPhone X 13.3]

its saying acess denied when im trynig to login with alpine pass

[Rook 547.4k iPad Pro (2nd gen) 17.4 Donor]

its saying acess denied when im trynig to login with alpine pass

alpine with all small characters?

 

If that's not it then you've probably changed it.

[ThePianoGuy 2.9k 14]

is there a way to do gdb hacking without Gameplayer or other hack tool? because i want to hack a not human readable games like Gameloft games and GLU games.

[Tokyo_Ghoul 2.1k 8 7.1.2]

ASLR Remover？？？？   Where can I download it