TuT GDB Cheating

Zahir · May 8, 2014

Requirements:
- GNU DEBUGGER - [ from http://cydia.radare.org ]
- GamePlayer/iGameGuardian [ from http://yuan.duowan.com ]‎
- ASLR Remover
- SSH

Instructions:
1. Remove ASLR from the game

2. Open the app your are hacking

3. Search the value in GP or iGameGuardian

4. Find the true value in GP or iGameGuardian

5. If you have 2, then try to make them different number and see which one is right

6. Write down the GP or iGameGuardian Number in one place [you will need it later]

7. Dont close the app yet, go to your PC or MAC and Open SSH [PUTTY]

8. You will need to log in as root in your device so type this inside SSH [PUTTY]:

ssh root@iPAddressThatYourDeviceUses

9. Then it will ask for the password .. If you havent changed it, it will be alpine

10. Now lets go to GDB commands! First of all before you start GDB hacking, you will need to on gbs so type this inside SSH [PUTTY]

gdb

11. Now GDB is On and next step is to attach the game, which will make the app to freeze [NO WORRIES] So type this:

attach BINARYNAME

12. Now you will need the GP or iGameGiardian Offsets you found, so type this in:

watch *0xTheAddressinGPoriGameGuardian

13. Then you will need to unfreeze the app and use the currency/thing u r trying to hack, so this in:
continue

14. And the app will unfreeze now and you will need to use/gain some currency/thing u r trying to hack

15. When it increases or decreases the app will freeze again and this time it will show the OFFSET IN IDA

16. If u want you can load up the IDA and go to that offset and Hack it directly if u know how to or if u wish to find out more, u can try this!

17. If you wish to continue type this command to see the function in that offset

x/i 0xADDRESSYOUFOUNDJUSTNOW

18. The offset you have found might not be the one u can actually hack so you can try to change the adress by one or two [ex: SUB r1, r0]

19. Now after you have found the hackable offset, you need to see the hex address for that, so type this in:

x/x 0xADDRESSWHICHISTHEHACKABLEONE

20. Now go to http://armconverter.tk to convert the ARM-TO-HEX

21. Go there and change the function u want to do [ex: 39 1C]

22. Now you are done! but if you would like to test it, type this:

set *0xADDRESWHICHISHACKABLE = 0xTHEHEXNUMBERYOUWANT

Continue

23. As you will see the currency/thing will be the amount you have chosen

24. Good Luck

Updated May 8, 2014 by ZahirSher

SUPERGIU · May 8, 2014

Nice one! Really useful

Zahir · May 8, 2014

Nice one! Really useful

Thanks

K3NNNY · June 30, 2014

Thanks

Time to learn this

AnotherLurker · June 30, 2014

where is rmaslr???

Rook · June 30, 2014

Time to learn this

A bit of IDA knowledge really comes in handy here!

where is rmaslr???

On the first step?

Oxytyramine · July 18, 2014

its saying acess denied when im trynig to login with alpine pass

Rook · July 18, 2014

its saying acess denied when im trynig to login with alpine pass

alpine with all small characters?

If that's not it then you've probably changed it.

ThePianoGuy · September 11, 2014

is there a way to do gdb hacking without Gameplayer or other hack tool? because i want to hack a not human readable games like Gameloft games and GLU games.