Request Infinite Galaxy

dupluM · December 16, 2021

Name of the game you want hacked: Infinite Galaxy
Version of the game: 2.9.2
iTunes Link for the app: https://apps.apple.com/us/app/infinite-galaxy/id1465097065
Jailbroken or Non-Jailbroken: JB and Non-JB

Requested Features:

Resources;

Inventory items don’t decrease upon use;

Campaign battles god mode;

Campaign battles one hit kill;

Experience hack;

Campaign resources hack;

Updated December 18, 2021 by dupluM
Update

xrayactual · March 2, 2022

Just gonna leave this here....

Watchpoints for memory addresses that store premium currency (there are two and they share a value):

Spoiler

Process 4053 resuming
---------------------------------------------------------------------------------[regs]
  R0:  0x00000000  R1:  0x00000000  R2:  0x00000000  R3:  0x00000000 n z C v q j e a i f t
  R4:  0x00000000  R5:  0x00000000  R6:  0x00000000  R7:  0x00000000
  R8:  0x00000000  R9:  0x00000000  R10: 0x00000000  R11: 0x00000000
  R12: 0x00000000  SP:  0x16B1D4980  LR:  0x10A1D5714  PC:  0x10A1D57C4
---------------------------------------------------------------------------------[code]
luaV_settable @ /Users/xray/desktop/HACKING/infinitegalaxy/UnityFramework:
->  0x10a1d57c4 (0x12917c4): 88 0a 40 b9  ldr    w8, [x20, #0x8]
    0x10a1d57c8 (0x12917c8): 48 0b 00 b9  str    w8, [x26, #0x8]
    0x10a1d57cc (0x12917cc): 1f 2b 00 39  strb   wzr, [x24, #0xa]
    0x10a1d57d0 (0x12917d0): 88 0a 40 b9  ldr    w8, [x20, #0x8]
    0x10a1d57d4 (0x12917d4): 1f 11 00 71  cmp    w8, #0x4 ; =0x4
    0x10a1d57d8 (0x12917d8): ab 05 00 54  b.lt   0x10a1d588c ; <+468>
    0x10a1d57dc (0x12917dc): 88 02 40 f9  ldr    x8, [x20]
    0x10a1d57e0 (0x12917e0): 08 25 40 39  ldrb   w8, [x8, #0x9]
-----------------------------------------------------------------------------------------------------------------------------


Watchpoint 3 hit:
old value: 4654369059817652224
new value: 4654281098887430144
---------------------------------------------------------------------------------[regs]
  R0:  0x00000000  R1:  0x00000000  R2:  0x00000000  R3:  0x00000000 n z C v q j e a i f t
  R4:  0x00000000  R5:  0x00000000  R6:  0x00000000  R7:  0x00000000
  R8:  0x00000000  R9:  0x00000000  R10: 0x00000000  R11: 0x00000000
  R12: 0x00000000  SP:  0x16B1D4980  LR:  0x10A1D5714  PC:  0x10A1D57C4
---------------------------------------------------------------------------------[code]
luaV_settable @ /Users/xray/desktop/HACKING/infinitegalaxy/UnityFramework:
->  0x10a1d57c4 (0x12917c4): 88 0a 40 b9  ldr    w8, [x20, #0x8]
    0x10a1d57c8 (0x12917c8): 48 0b 00 b9  str    w8, [x26, #0x8]
    0x10a1d57cc (0x12917cc): 1f 2b 00 39  strb   wzr, [x24, #0xa]
    0x10a1d57d0 (0x12917d0): 88 0a 40 b9  ldr    w8, [x20, #0x8]
    0x10a1d57d4 (0x12917d4): 1f 11 00 71  cmp    w8, #0x4 ; =0x4
    0x10a1d57d8 (0x12917d8): ab 05 00 54  b.lt   0x10a1d588c ; <+468>
    0x10a1d57dc (0x12917dc): 88 02 40 f9  ldr    x8, [x20]
    0x10a1d57e0 (0x12917e0): 08 25 40 39  ldrb   w8, [x8, #0x9]
-----------------------------------------------------------------------------------------------------------------------------

Process 4053 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 3
    frame #0: 0x000000010a1d57c4 UnityFramework`luaV_settable + 268
Target 0: (galaxy) stopped.

20 instructions disassembled, 12/7 instructions before/after watchpoint:

Spoiler

    0x10a1d5794: str    w8, [sp, #0x8]
    0x10a1d5798: add    w27, w27, #0x1            ; =0x1
    0x10a1d579c: mov    x22, sp
    0x10a1d57a0: cmp    w27, #0x64                ; =0x64
    0x10a1d57a4: b.lo   0x10a1d56f8               ; <+64>
    0x10a1d57a8: adrp   x1, 6131
    0x10a1d57ac: add    x1, x1, #0xae7            ; =0xae7
    0x10a1d57b0: mov    x0, x19
    0x10a1d57b4: bl     0x10a1c03d4               ; luaG_runerror
    0x10a1d57b8: b      0x10a1d588c               ; <+468>
    0x10a1d57bc: ldr    x8, [x20]
    0x10a1d57c0: str    x8, [x26]
->  0x10a1d57c4: ldr    w8, [x20, #0x8]
    0x10a1d57c8: str    w8, [x26, #0x8]
    0x10a1d57cc: strb   wzr, [x24, #0xa]
    0x10a1d57d0: ldr    w8, [x20, #0x8]
    0x10a1d57d4: cmp    w8, #0x4                  ; =0x4
    0x10a1d57d8: b.lt   0x10a1d588c               ; <+468>
    0x10a1d57dc: ldr    x8, [x20]
    0x10a1d57e0: ldrb   w8, [x8, #0x9]

General registers:

Spoiler

        x0 = 0x0000000132770fb0
        x1 = 0x000000012ea7b390
        x2 = 0x000000012ea7b390
        x3 = 0x000000012ea7b3a0
        x4 = 0x0000000000000000
        x5 = 0x00000000000000e9
        x6 = 0x00000000000000fd
        x7 = 0x000000001f554800
        x8 = 0x4097540000000000
        x9 = 0x0000000000000003
       x10 = 0x0000000000000028
       x11 = 0x0000000001b367bc
       x12 = 0x00000000ffffffff
       x13 = 0x0000000000000004
       x14 = 0x000000012ea7b3d8
       x15 = 0x0000000000000000
       x16 = 0x0000000000000002
       x17 = 0x0000000000000000
       x18 = 0x000000014c3614dc
       x19 = 0x000000011929b620
       x20 = 0x000000012ea7b3a0
       x21 = 0x000000012ea7b390
       x22 = 0x000000012ea7b380
       x23 = 0x000000010b91e6c3  "index"
       x24 = 0x000000028451b640
       x25 = 0x0000000119eb73b8
       x26 = 0x0000000132770fb0
       x27 = 0x0000000000000000
       x28 = 0x0000000119eb3800
        fp = 0x000000016b1d49e0
        lr = 0x000000010a1d5714  UnityFramework`luaV_settable + 92
        sp = 0x000000016b1d4980
        pc = 0x000000010a1d57c4  UnityFramework`luaV_settable + 268
      cpsr = 0x20000000

Updated March 3, 2022 by xrayactual
Organization

dupluM · March 3, 2022

6 hours ago, xrayactual said:

Just gonna leave this here....

Watchpoints for memory addresses that store premium currency (there are two and they share a value):

Process 4053 resuming
---------------------------------------------------------------------------------[regs]
  R0:  0x00000000  R1:  0x00000000  R2:  0x00000000  R3:  0x00000000 n z C v q j e a i f t
  R4:  0x00000000  R5:  0x00000000  R6:  0x00000000  R7:  0x00000000
  R8:  0x00000000  R9:  0x00000000  R10: 0x00000000  R11: 0x00000000
  R12: 0x00000000  SP:  0x16B1D4980  LR:  0x10A1D5714  PC:  0x10A1D57C4
---------------------------------------------------------------------------------[code]
luaV_settable @ /Users/xray/desktop/HACKING/infinitegalaxy/UnityFramework:
->  0x10a1d57c4 (0x12917c4): 88 0a 40 b9  ldr    w8, [x20, #0x8]
    0x10a1d57c8 (0x12917c8): 48 0b 00 b9  str    w8, [x26, #0x8]
    0x10a1d57cc (0x12917cc): 1f 2b 00 39  strb   wzr, [x24, #0xa]
    0x10a1d57d0 (0x12917d0): 88 0a 40 b9  ldr    w8, [x20, #0x8]
    0x10a1d57d4 (0x12917d4): 1f 11 00 71  cmp    w8, #0x4 ; =0x4
    0x10a1d57d8 (0x12917d8): ab 05 00 54  b.lt   0x10a1d588c ; <+468>
    0x10a1d57dc (0x12917dc): 88 02 40 f9  ldr    x8, [x20]
    0x10a1d57e0 (0x12917e0): 08 25 40 39  ldrb   w8, [x8, #0x9]
-----------------------------------------------------------------------------------------------------------------------------


Watchpoint 3 hit:
old value: 4654369059817652224
new value: 4654281098887430144
---------------------------------------------------------------------------------[regs]
  R0:  0x00000000  R1:  0x00000000  R2:  0x00000000  R3:  0x00000000 n z C v q j e a i f t
  R4:  0x00000000  R5:  0x00000000  R6:  0x00000000  R7:  0x00000000
  R8:  0x00000000  R9:  0x00000000  R10: 0x00000000  R11: 0x00000000
  R12: 0x00000000  SP:  0x16B1D4980  LR:  0x10A1D5714  PC:  0x10A1D57C4
---------------------------------------------------------------------------------[code]
luaV_settable @ /Users/xray/desktop/HACKING/infinitegalaxy/UnityFramework:
->  0x10a1d57c4 (0x12917c4): 88 0a 40 b9  ldr    w8, [x20, #0x8]
    0x10a1d57c8 (0x12917c8): 48 0b 00 b9  str    w8, [x26, #0x8]
    0x10a1d57cc (0x12917cc): 1f 2b 00 39  strb   wzr, [x24, #0xa]
    0x10a1d57d0 (0x12917d0): 88 0a 40 b9  ldr    w8, [x20, #0x8]
    0x10a1d57d4 (0x12917d4): 1f 11 00 71  cmp    w8, #0x4 ; =0x4
    0x10a1d57d8 (0x12917d8): ab 05 00 54  b.lt   0x10a1d588c ; <+468>
    0x10a1d57dc (0x12917dc): 88 02 40 f9  ldr    x8, [x20]
    0x10a1d57e0 (0x12917e0): 08 25 40 39  ldrb   w8, [x8, #0x9]
-----------------------------------------------------------------------------------------------------------------------------

Process 4053 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = watchpoint 3
    frame #0: 0x000000010a1d57c4 UnityFramework`luaV_settable + 268
Target 0: (galaxy) stopped.

20 instructions disassembled, 12/7 instructions before/after watchpoint:

    0x10a1d5794: str    w8, [sp, #0x8]
    0x10a1d5798: add    w27, w27, #0x1            ; =0x1
    0x10a1d579c: mov    x22, sp
    0x10a1d57a0: cmp    w27, #0x64                ; =0x64
    0x10a1d57a4: b.lo   0x10a1d56f8               ; <+64>
    0x10a1d57a8: adrp   x1, 6131
    0x10a1d57ac: add    x1, x1, #0xae7            ; =0xae7
    0x10a1d57b0: mov    x0, x19
    0x10a1d57b4: bl     0x10a1c03d4               ; luaG_runerror
    0x10a1d57b8: b      0x10a1d588c               ; <+468>
    0x10a1d57bc: ldr    x8, [x20]
    0x10a1d57c0: str    x8, [x26]
->  0x10a1d57c4: ldr    w8, [x20, #0x8]
    0x10a1d57c8: str    w8, [x26, #0x8]
    0x10a1d57cc: strb   wzr, [x24, #0xa]
    0x10a1d57d0: ldr    w8, [x20, #0x8]
    0x10a1d57d4: cmp    w8, #0x4                  ; =0x4
    0x10a1d57d8: b.lt   0x10a1d588c               ; <+468>
    0x10a1d57dc: ldr    x8, [x20]
    0x10a1d57e0: ldrb   w8, [x8, #0x9]

General registers:

        x0 = 0x0000000132770fb0
        x1 = 0x000000012ea7b390
        x2 = 0x000000012ea7b390
        x3 = 0x000000012ea7b3a0
        x4 = 0x0000000000000000
        x5 = 0x00000000000000e9
        x6 = 0x00000000000000fd
        x7 = 0x000000001f554800
        x8 = 0x4097540000000000
        x9 = 0x0000000000000003
       x10 = 0x0000000000000028
       x11 = 0x0000000001b367bc
       x12 = 0x00000000ffffffff
       x13 = 0x0000000000000004
       x14 = 0x000000012ea7b3d8
       x15 = 0x0000000000000000
       x16 = 0x0000000000000002
       x17 = 0x0000000000000000
       x18 = 0x000000014c3614dc
       x19 = 0x000000011929b620
       x20 = 0x000000012ea7b3a0
       x21 = 0x000000012ea7b390
       x22 = 0x000000012ea7b380
       x23 = 0x000000010b91e6c3  "index"
       x24 = 0x000000028451b640
       x25 = 0x0000000119eb73b8
       x26 = 0x0000000132770fb0
       x27 = 0x0000000000000000
       x28 = 0x0000000119eb3800
        fp = 0x000000016b1d49e0
        lr = 0x000000010a1d5714  UnityFramework`luaV_settable + 92
        sp = 0x000000016b1d4980
        pc = 0x000000010a1d57c4  UnityFramework`luaV_settable + 268
      cpsr = 0x20000000

Son of a 🐕, you’re in!

Now leaving it at that, you mean dead end? I am illiterate when it comes to the backbone of a game... I mean, a simple memory editor sure but what you shared is beyond my comprehension 🦧

Please let me know in other words what you meant.

Thank you for actually looking into this. ❤️

xrayactual · March 3, 2022

I'm fairly new to this but I wanted to put my findings for the latest version here in case someone else notices something I haven't yet.

Edit: Here's a folder with everything included, from the decrypted ipa to the lldbinit.py script. I have neatly organized everything in labeled folders indicative of their contents (binary and global-metadata are copied directly from the included unzipped IPA payload). Everything was included so others may pickup at any step of the hacking process, whether it's in the middle or from the very beginning, in case someone needs additional references for deciphering this games' functions, memory checks or any other anti-jailbreak/anti-hacking countermeasures

Process I went through:

Since the game does not obfuscate all memory values(to my knowledge), I was able to locate my khorium value within 2 memory addresses (that change every start-up).
1. I was able to change the memory values, however the developers have incorporated a memory check against the server's database (or something similar)
2. I also identified 3 separate checks for isJailbroken in the il2cpp dump
I created a debugserver on my phone and attached it to the galaxy process, Using my Mac (with XCode installed) I was able to connect to the debugserver, hosted on my phone, through LLDB, allowing me to set watchpoints at the memory addresses (which may help reveal their actual address, for creating a menu) where kohrium is stored/checked.
Using LLDB again, I was able to display instructions that precede the set watchpoints (when the memory value is updated) to catch what happens behind the scenes when you spend khorium. This snippet of 20 instructions (12 preceding the watchpoint, and 7 succeeding the watchpoint) do not indicate any instruction set to subtract, which leads me to believe they could possibly be using only "add" and variations of it and using negative integers to avoid revealing where korium is removed (preventing hackers from replacing it with add, essentially spend to gain, or nop, ignoring the subtraction).
To better analyze the instruction sets, I also needed the general register of "assembly variables" (for a lack of better words)

Addendum:

@dupluM, in theory, the features you requested could be found in memory, the same steps I took could locate where in the assembly values are being changed, its slightly more difficult as some values may be obfuscated using offsets or combination of memory values, or the values change too quickly to isolate them from similar values, in order to identify a memory address to recall instructions in LLDB. However, the first step is proving the concept with the most useful semi-static value, khorium (premium currency). Khorium can facilitate a majority of the features you requested, to an extent (Inventory items and resources can be purchased from VIP, ~~Alliance~~, or Trade Center Shop using khorium; Khorium can be used to improve outfitting for flagships, decreasing the campaign difficulty, possibly to a factor significant enough to make your ship invulnerable, or one-shot enemy ships; Khorium can be used to refill exploration energy, granting additional power module experience for investigations and exploration).

Updated March 3, 2022 by xrayactual
Added link to resources

dupluM · March 5, 2022

On 3/3/2022 at 10:14 AM, xrayactual said:

I'm fairly new to this but I wanted to put my findings for the latest version here in case someone else notices something I haven't yet.

Edit: Here's a folder with everything included, from the decrypted ipa to the lldbinit.py script. I have neatly organized everything in labeled folders indicative of their contents (binary and global-metadata are copied directly from the included unzipped IPA payload). Everything was included so others may pickup at any step of the hacking process, whether it's in the middle or from the very beginning, in case someone needs additional references for deciphering this games' functions, memory checks or any other anti-jailbreak/anti-hacking countermeasures

Process I went through:

Since the game does not obfuscate all memory values(to my knowledge), I was able to locate my khorium value within 2 memory addresses (that change every start-up).
I was able to change the memory values, however the developers have incorporated a memory check against the server's database (or something similar)

I also identified 3 separate checks for isJailbroken in the il2cpp dump

I created a debugserver on my phone and attached it to the galaxy process, Using my Mac (with XCode installed) I was able to connect to the debugserver, hosted on my phone, through LLDB, allowing me to set watchpoints at the memory addresses (which may help reveal their actual address, for creating a menu) where kohrium is stored/checked.

Using LLDB again, I was able to display instructions that precede the set watchpoints (when the memory value is updated) to catch what happens behind the scenes when you spend khorium. This snippet of 20 instructions (12 preceding the watchpoint, and 7 succeeding the watchpoint) do not indicate any instruction set to subtract, which leads me to believe they could possibly be using only "add" and variations of it and using negative integers to avoid revealing where korium is removed (preventing hackers from replacing it with add, essentially spend to gain, or nop, ignoring the subtraction).

To better analyze the instruction sets, I also needed the general register of "assembly variables" (for a lack of better words)

Addendum:

@dupluM, in theory, the features you requested could be found in memory, the same steps I took could locate where in the assembly values are being changed, its slightly more difficult as some values may be obfuscated using offsets or combination of memory values, or the values change too quickly to isolate them from similar values, in order to identify a memory address to recall instructions in LLDB. However, the first step is proving the concept with the most useful semi-static value, khorium (premium currency). Khorium can facilitate a majority of the features you requested, to an extent (Inventory items and resources can be purchased from VIP, ~~Alliance~~, or Trade Center Shop using khorium; Khorium can be used to improve outfitting for flagships, decreasing the campaign difficulty, possibly to a factor significant enough to make your ship invulnerable, or one-shot enemy ships; Khorium can be used to refill exploration energy, granting additional power module experience for investigations and exploration).