Jump to content

11 posts in this topic

Recommended Posts

Posted

HELLO AGAIN! 🙋🏻‍♀️ 

I’ve run into another issue during this learning journey and I’ve searched the forums to see whether someone’s had the same issue or not, one person did but it went unsolved.

Steps:

1. Grabbed ASLR — CE8000

Money: 3320 — CF8

 

2. Removed ASLR from WatchPoint Offsets.

•WatchPoint1 — 0X12C144674

Frame#0 — 10832D0F8

ASLR Removed — 1076450F8

 

•WatchPoint2 — 0X12C3C8BB0

Frame#0 — 10836CE58

ASLR Removed — 107684E58
 

3. Converted Decimal to Hex.

4. Searched in Register Read.

5. Made a match (x11 - 12C65CCF8)

6. Went to IDA.

7. Searched for 1076450F8 & 107684E58

8. Met with Command “JumpAsk” Failed.

 

Did I go wrong somewhere? Please educate me!

Posted
On 8/29/2021 at 2:33 AM, LEON... said:

 

 

1 hour ago, Mandu said:

HELLO AGAIN! 🙋🏻‍♀️ 

I’ve run into another issue during this learning journey and I’ve searched the forums to see whether someone’s had the same issue or not, one person did but it went unsolved.

Steps:

1. Grabbed ASLR — CE8000

Money: 3320 — CF8

 

2. Removed ASLR from WatchPoint Offsets.

•WatchPoint1 — 0X12C144674

Frame#0 — 10832D0F8

ASLR Removed — 1076450F8

 

•WatchPoint2 — 0X12C3C8BB0

Frame#0 — 10836CE58

ASLR Removed — 107684E58
 

3. Converted Decimal to Hex.

4. Searched in Register Read.

5. Made a match (x11 - 12C65CCF8)

6. Went to IDA.

7. Searched for 1076450F8 & 107684E58

8. Met with Command “JumpAsk” Failed.

 

Did I go wrong somewhere? Please educate me!

Hey can you provide screenshots on exactly what you are doing or a video, you might be grabbing offsets that might be from another process, sometimes games are weird and have stuff in a framework which can make things a little more difficult 

Posted (edited)
3 hours ago, ProGamerMoment said:

 

Hey can you provide screenshots on exactly what you are doing or a video, you might be grabbing offsets that might be from another process, sometimes games are weird and have stuff in a framework which can make things a little more difficult 

If you don’t mind, I’ll list everything in detailed steps.

Game:

• Zombie Shop V-0.21.1

 

Devices:

• iPhone X 13.3 UnC0Ver 7.0.0 JB

• ASUS ROG Laptop Win10 x64

 

Programs:

• IDA PRO 7.3

• iL2CPPDumper

• Notepad++

• LLDB

• 3uTools

• PuTTy

• iGameGod

• Filza

• NewTerm

• FlexDecrypt | CrackerXI

 

Sites:

• ArmConverter

• BinaryHexConverter

• Calculator-HexCalculator

——————————————

1. Gathering the necessary files.

• [iPhone] Launch CrackerXI —> Zombie Shop —> Full IPA

• [iPhone] Launch Filza (/var/mobile/Documents/CrackerXI) —> EXTRACT ZombieShop_0.21.1_Weiss
• Launch NewTerm —> flexdecrypt /var/mobile/Documents/CrackerXI/ZombieShop_0.21.1_Weiss/Payload/ZombieShop.app/Frameworks/UnityFramework.framework/UnityFramework

[[Cracked binary is in /tmp/UnityFramework]]

• [PC] — Launch 3uTools > Grab UnityFramework and place in Desktop Folder.

• [PC] Direct to ZombieShop.app > Data > Managed > Metadata > Grab global-metadata.dat and place in Desktop Folder.

——————————————

2. IDA Pro Portion

• [PC] Launch IDA Pro x64 > New > Select “UnityFramework” > Allow to fully load with “IDLE” is on the bottom left.

• [PC] Launch iL2CPPDumper > Select “UnityFramework” > Select “global-metadata.dat” > Allow to finish.

• [PC] Return to IDA Pro (Fully Loaded) > File > Script File... > IDA.py > Script.JSON

• [PC] Allow the script to fully finish until it says “IDLE” is on the bottom left.

——————————————

3. 3uTools / PuTTy / LLDB / Game Portion

• [iPhone] Open iGameGod and enable Zombie Shop.

• [iPhone] Launch Zombie Shop.

• [PC] Launch 3uTools > Toolbox > Open SSH Tunnel > SSH Client (PuTTy)

• [PC] In PuTTy > Type “lldb” > Type “attach ZombieShop”

• [PC] Game attaches successfully, the game freezes.

• [PC] In PuTTy > Type “image list ZombieShop” > Note the ASLR > Type “c” to continue process (unfreeze game).

• [iPhone] Use iGameGod to search values until I’m left with 1-2 (in my case, 3).

• [PC] In PuTTy > Type “process interrupt” (freezes game).

[[NOTE: Cannot create Watchpoints while the game’s running.]]

• [PC] Creates Watchpoints.

• [iPhone/PC] Changes the value > Trigger Watchpoints 1.

• [PC] In PuTTy > Type “register read” and copy the output into Notepad++ > Type “c” to proceed > Watchpoint 2 was trigger-ed > Type “register read” and copy the output into Notepad++.

• [PC] Acquired 2 IDA offsets > Removed ASLR using hex calculator.

• [PC/iPhone] Kept notes on money value and converted using decimal to hex.

• [PC] Searched for the converted value in the register read outputs and found a match in watchpoint 1.

• [PC] Returned to IDA > Press “G” > Inserts Address (ASLR REMOVED ONE)

——————————————
[[ENCOUNTERS ERROR]]
• Command “JumpAsk” Failed

——————————————

Hopefully you could help spot the issue this way!

 

Updated by 0xWeiss
Posted
5 hours ago, 0xWeiss said:

EDIT:

Possible Mistakes List:

- “image list UnityFramework” instead of “image list ZombieShop”? (3:23AM Thought)

That is correct, you must use UnityFramework, offsets will be in there and usually they don’t have the 0x10 in front so try it without and see if they match up, however when looking for the process you have to side Zombie shop since it loads the the frameworks once the binary has been loading, hence why the binary is small. Hope this helps

  • Like 1
Posted
7 hours ago, ProGamerMoment said:

That is correct, you must use UnityFramework, offsets will be in there and usually they don’t have the 0x10 in front so try it without and see if they match up, however when looking for the process you have to side Zombie shop since it loads the the frameworks once the binary has been loading, hence why the binary is small. Hope this helps

That solved a problem, but not the one I originally had. Haha. However, I realized I was able to find the address in the debug portion of IDA. The green play button thing. However it didn’t have anything next to it, so I exited and saw that the analysis thing wasn’t finished. So I’m gonna let that load and try again tonight.

Posted
On 10/27/2021 at 9:46 AM, 0xWeiss said:

If you don’t mind, I’ll list everything in detailed steps.

Game:

• Zombie Shop V-0.21.1

 

Devices:

• iPhone X 13.3 UnC0Ver 7.0.0 JB

• ASUS ROG Laptop Win10 x64

 

Programs:

• IDA PRO 7.3

• iL2CPPDumper

• Notepad++

• LLDB

• 3uTools

• PuTTy

• iGameGod

• Filza

• NewTerm

• FlexDecrypt | CrackerXI

 

Sites:

• ArmConverter

• BinaryHexConverter

• Calculator-HexCalculator

——————————————

1. Gathering the necessary files.

• [iPhone] Launch CrackerXI —> Zombie Shop —> Full IPA

• [iPhone] Launch Filza (/var/mobile/Documents/CrackerXI) —> EXTRACT ZombieShop_0.21.1_Weiss
• Launch NewTerm —> flexdecrypt /var/mobile/Documents/CrackerXI/ZombieShop_0.21.1_Weiss/Payload/ZombieShop.app/Frameworks/UnityFramework.framework/UnityFramework

[[Cracked binary is in /tmp/UnityFramework]]

• [PC] — Launch 3uTools > Grab UnityFramework and place in Desktop Folder.

• [PC] Direct to ZombieShop.app > Data > Managed > Metadata > Grab global-metadata.dat and place in Desktop Folder.

——————————————

2. IDA Pro Portion

• [PC] Launch IDA Pro x64 > New > Select “UnityFramework” > Allow to fully load with “IDLE” is on the bottom left.

• [PC] Launch iL2CPPDumper > Select “UnityFramework” > Select “global-metadata.dat” > Allow to finish.

• [PC] Return to IDA Pro (Fully Loaded) > File > Script File... > IDA.py > Script.JSON

• [PC] Allow the script to fully finish until it says “IDLE” is on the bottom left.

——————————————

3. 3uTools / PuTTy / LLDB / Game Portion

• [iPhone] Open iGameGod and enable Zombie Shop.

• [iPhone] Launch Zombie Shop.

• [PC] Launch 3uTools > Toolbox > Open SSH Tunnel > SSH Client (PuTTy)

• [PC] In PuTTy > Type “lldb” > Type “attach ZombieShop”

• [PC] Game attaches successfully, the game freezes.

• [PC] In PuTTy > Type “image list ZombieShop” > Note the ASLR > Type “c” to continue process (unfreeze game).

• [iPhone] Use iGameGod to search values until I’m left with 1-2 (in my case, 3).

• [PC] In PuTTy > Type “process interrupt” (freezes game).

[[NOTE: Cannot create Watchpoints while the game’s running.]]

• [PC] Creates Watchpoints.

• [iPhone/PC] Changes the value > Trigger Watchpoints 1.

• [PC] In PuTTy > Type “register read” and copy the output into Notepad++ > Type “c” to proceed > Watchpoint 2 was trigger-ed > Type “register read” and copy the output into Notepad++.

• [PC] Acquired 2 IDA offsets > Removed ASLR using hex calculator.

• [PC/iPhone] Kept notes on money value and converted using decimal to hex.

• [PC] Searched for the converted value in the register read outputs and found a match in watchpoint 1.

• [PC] Returned to IDA > Press “G” > Inserts Address (ASLR REMOVED ONE)

——————————————
[[ENCOUNTERS ERROR]]
• Command “JumpAsk” Failed

——————————————

Hopefully you could help spot the issue this way!

 

Im inestigating this issue because it just happening to me same. I think i have founded the solution , but not 100% sure, checking well before posting any bulsh!t and i will update here tomorrow ,

Posted (edited)
3 minutes ago, Max-- said:

Im investigating this issue because it just happening to me same. I think i have founded the solution , but not 100% sure, checking well before posting any bulsh!t and i will update here tomorrow ,

i can give a tip like the droping offset when watchpoint hits its not the real one, thats why when remove the aslr from it we get a ridiculous offset, that doesnt even exist in ida=Jump failed

Updated by Max--
Posted
7 hours ago, Max-- said:

i can give a tip like the droping offset when watchpoint hits its not the real one, thats why when remove the aslr from it we get a ridiculous offset, that doesnt even exist in ida=Jump failed

Please let me know. I'm currently trying to hack a game atm using LLDB.

I've searched values -> set watchpoints -> trigger watchpoints -> image lookup -a 0x00000000 (the watchpoint hit)

Posted

@0xWeiss Did you eventually find a solution? 
 

I hit very similar things when I am hacking Otherworld Legends. Unity Framework game, I can modify the memory of the arm code (with Xcode) but i can’t find the real offset for the UnityFramework Binary file.

also got “JumpAsk” failed

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Legend of Slime: Idle RPG War v4.2.1 Jailed Cheats +28
      Modded/Hacked App: Legend of Slime: Idle RPG By LoadComplete Co., Ltd
      Bundle ID: com.loadcomplete.slimeidle
      iTunes Store Link: https://apps.apple.com/us/app/legend-of-slime-idle-rpg/id1618701110?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:

      - High Attack (Upgrade Skill)<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- High Hp (Upgrade Skill)<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- High HP Recovery (Upgrade Skill)<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- High Critical Hit Chance (Upgrade Skill)<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- High Critical Hit Damage (Upgrade Skill)<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- High ASPD (Upgrade Skill)<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- High Double Shot (Upgrade Skill)<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- High Triple Shot (Upgrade Skill)


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download IPA Link:

      Hidden Content
      Download via the iOSGods App







      • 488 replies
    • Dummynation Cheats v3.4.1 +3
      Modded/Hacked App: Dummynation By ALEJANDRO HERNANDEZ FERRERO
      Bundle ID: ahf.dummynation
      iTunes Store Link: https://apps.apple.com/us/app/dummynation/id6444295551?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Cydia, Sileo or Zebra).

       

      🤩 Hack Features

      - Premium + No Ads
      - Infinite Research Point
      - Infinite Liquidity (Gold)


      🍏 For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/topic/191828-dummynation-v313-jailed-cheats-3/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/191829-dummynation-cheats-v313-3/
      • 21 replies
    • The Seven Deadly Sins: Idle Cheats v1.19.0 +4
      Modded/Hacked App: The Seven Deadly Sins: Idle By Netmarble Corporation
      Bundle ID: com.netmarble.nanarise
      iTunes Store Link: https://apps.apple.com/us/app/the-seven-deadly-sins-idle/id6469305531?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Multiply Attack
      - Multiply Defense
      - Modify Range
      - No Ads


      DO NOT BUY VIP FOR THIS CHEAT

      ONLY WORK in PvE so you can farm faster

      Non-Jailbroken Hack: https://iosgods.com/topic/185162-the-seven-deadly-sins-idle-v1120-jailed-cheats-3/

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/185131-the-seven-deadly-sins-idle-cheats-v1120-4/
      • 160 replies
    • Jurassic World™: The Game v1.85.3 +10 Cheats
      Modded/Hacked App: Jurassic World™: The Game By Jam City, Inc.
      Bundle ID: com.ludia.jurassicworld
      iTunes Store Link: https://apps.apple.com/us/app/jurassic-world-the-game/id791211390?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Unlimited DNA*
      - Unlimited Food*
      - Unlimited Coins*
      - Unlimited Cash*
      - Unlimited Loyalty Points*
      - Enable VIP
      - Able to Buy Unlimited Special Packs
      - Evolution Always Successful
      - Feed Instant Max Level
      - Free Speed Up Costs

      * Freeze when you spend

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/145523-jurassic-world%E2%84%A2-the-game-v1815-10-cheats/
      • 837 replies
    • AdVenture Capitalist Cheats v9.14.0 +1
      Modded/Hacked App: AdVenture Capitalist By Hyper Hippo Publishing Ltd.
      Bundle ID: com.kongregate.mobile.adventurecapitalist
      iTunes Store Link: https://apps.apple.com/us/app/adventure-capitalist/id927006017?uo=4


      Hack Features:
      - Freeze Currencies

       
      Free Non-Jailbroken Hack:  https://iosgods.com/topic/82751-adventure-capitalist-v940-jailed-cheats-1/


      Hack Download Link: https://iosgods.com/topic/78370-adventure-capitalist-cheats-v940-1/
      • 1,194 replies
    • Royal Kingdom v21296 +4 Jailed Cheats [ Coins + More ]
      Modded/Hacked App: Royal Kingdom By Dream Games
      Bundle ID: com.dreamgames.royalkingdom
      iTunes Store Link: https://apps.apple.com/ph/app/royal-kingdom/id1606549505
       

      Hack Features:
      - Freeze Coins
      - Freeze Lives
      - Freeze Boosters
      - Freeze Moves


      Jailbreak required hack(s): [Mod Menu Hack] Royal Kingdom v3987 +4 Cheats [ Unlimited Coins ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 152 replies
    • Royal Kingdom v21296 +4 Cheats [ Coins + More ]
      Modded/Hacked App: Royal Kingdom By Dream Games
      Bundle ID: com.dreamgames.royalkingdom
      iTunes Store Link: https://apps.apple.com/ph/app/royal-kingdom/id1606549505
       

      Hack Features:
      - Freeze Coins
      - Freeze Lives
      - Freeze Boosters
      - Freeze Moves


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Royal Kingdom v3987 +4 Jailed Cheats [ Unlimited Coins ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 108 replies
    • Pudgy Party - Battle Royale v0.12.2 +7 Jailed Cheats [ Speed, Gravity + More ]
      Modded/Hacked App: Pudgy Party - Battle Royale By Mythical, Inc.
      Bundle ID: com.mythical.pudgyparty
      App Store Link: https://apps.apple.com/us/app/pudgy-party-battle-royale/id6744258913?uo=4

       
       

      🤩 Hack Features

      - Jump Height Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Gravity Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Speed Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Friction Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Freeze Bots
      - Dumb Bots
      - Free In-App Purchases
      • 9 replies
    • Pudgy Party - Battle Royale v0.12.2 +7 Cheats [ Speed, Gravity + More ]
      Modded/Hacked App: Pudgy Party - Battle Royale By Mythical, Inc.
      Bundle ID: com.mythical.pudgyparty
      App Store Link: https://apps.apple.com/us/app/pudgy-party-battle-royale/id6744258913?uo=4

       


      🤩 Hack Features

      - Jump Height Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Gravity Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Speed Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Friction Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Freeze Bots
      - Dumb Bots
      - Free In-App Purchases
      • 20 replies
    • Subway Surfers City v1.26.0 +10 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Subway Surfers City By Sybo Games ApS
      Bundle ID: com.sybogames.subway.surfers.game
      iTunes Store Link: https://apps.apple.com/ca/app/subway-surfers-city/id6504188939?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - Unlimited Coins -> Earn or spend some.
      - Unlimited Keys -> Earn or spend some.
      - Unlimited Revives - Earn or spend some.
      - Unlimited Tokens -> Earn or spend some.
      - All Boards Unlocked
      - All Surfers Unlocked
      - Max Level -> Earn some XP.
      - God Mode
      - Unlimited Score
      - Unlimited Jumps


      Jailbreak required hack(s): [Mod Menu Hack] Subway Surfers City v1.13.2 +7 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 211 replies
    • Subway Surfers City v1.26.0 +10 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Subway Surfers City By Sybo Games ApS
      Bundle ID: com.sybogames.subway.surfers.game
      iTunes Store Link: https://apps.apple.com/ca/app/subway-surfers-city/id6504188939?uo=4


      Hack Features:
      - Unlimited Coins
      - Unlimited Keys
      - Unlimited Revives
      - All Boards Unlocked
      - All Surfers Unlocked
      - Max Level -> Earn some XP.
      - God Mode


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Subway Surfers City v1.13.2 +5 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 71 replies
    • City Of Survivors v1.5.3 [+6 Jailed Cheats]
      Modded/Hacked App: City Of Survivors By Chengdu Pengfei Network Technology Co., Ltd.
      Bundle ID: com.gatherfun.cityofsurvivors
      App Store Link: https://apps.apple.com/us/app/city-of-survivors/id6743288723?uo=4



      Important


      Do not enable feautures on loading screen or do not keep enabled if you leave game.

      If you leave game without disabling features or enable on loading screen game will be crash.

       

      🤩 Hack Features

      - Add Gold
      - Add Diamond
      - Add Wood
      - Add Plank 
      - Add Explore Token
      - Add Skip Ads Coupon
      • 20 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines