Fairguard reversal (Free Fire)

[sasd1g 0]

This is a post for people that beg for Free Fire IPA cheats, or wanna make one themself (any questions PM me or give me a tele)

Here u will find all the sideloading + simulator detections so let’s get started.

1. Official fingerprints (App Store):
Team - 98573T3W6L
App id. - 98573T3W6L.com.dts.freefireth
Bundle id - com.dts.freefireth
Free Fire CDHash SHA256-20 - 1208f25f6e25499a3a03ccaec74967f97cb89149
Free Fire CDHash SHA1 - d9cf9ae60f2433bf47fe33a29d7122bb1bcc5965
UnityFramework CDHash SHA256-20 - 6eccef487246d3f8e55d5abb0b34a6d47c3c02e7
h function return that needs to be hooked so it will be App Store identified - 00770007d45fe15664db57df30274f5c49daaa04f276be030f20686e673c833b
MD5(com.dts.freefireth_98573T3W6L) - 75ead73659249cdb3a0eee33e86c003a


2. What Garena actually bans on?


local ui -> Using a modifier -> Calls -> POST https://gin.freefiremobile.com/ios/d...rtIosPv/create plus App Attest

A debugger (P_TRACED) can also be a modifier ban for some reason ��

Do not hook GOT libc. Fairguard loads GOT._syscall / _dlsym and checks function bytes (+4 == 0x31, +7 == 0x91) plus CFF checker at offset 0x9457f6c (34 callers). Replacing GOT or software-BPing results in a modifier ban.


CGP Crypto (login / clientbp bodies)

HTTP bodies for MajorLogin / Ping / CheckHack / etc. are not raw protobuf on the wire. They are:

AES-128-CBC PKCS7
KEY Yg&tc%DEuh6%Zc^8
IV 6oyZDr22E3ychjM%

Implemented in GCommon.HttpManager::Encrypt at offset 0x6bb2c2c. Plaintext is an IL2CPP byte[] in x1 (length +0x18, payload +0x20).

CCCrypt never sees the 688/704/432 sizes because Encrypt already produced ciphertext (all sizes 16-multiples).

3. Who actually calls Encrypt

CreateRequest - 0x7452768 - Logs LR at 0x745276c
HttpManager.CreateRequest - 0x6bb64fc - Logs LR at 0x6bb6500

Vtable slot for Encrypt at 0xbab3db0. A vtable blr would produce a different LR theoretically but It did not.

Live log (veneer preserves original x30 with B, not BL):

ENCRYPT lr=745276c

Call chain for MajorLogin:

COW.UIModelLogin::RequestLogin 0x462fa58
new proto.Login.GNBLGPDAPEF 0x3f5dac0
CreateLoginReqInfoData 0x4630910
bl generic RequestPost 0x745385c @ 0x462ff18 (Empty, w5=2)
bl generic RequestPost 0x745385c @ 0x46301bc (MajorLogin, w5=4)
OverrideChannel 0x6bb2558
generic CreateRequest 0x7452410 @ 0x7453940
bl Encrypt 0x6bb2c2c @ 0x7452768 ← live LR

0x745385c is generic HttpManager.RequestPost (pointer 0). Same wrapper is used by RequestGenerateNickname, RequestPlatformRegister, RequestSetNewbieVeteranChoose.

Non-generic RequestPostStream 0x6bb60d0, UGC BLs 0x52b18c8, 1cfc, 20d4 never ran for MajorLogin.

Inside 0x7452410, w23 is reqDataType:

- 1 - protobuf helper 0x74d0a48 @ 0x7452670
- 2 - LitJson.JsonMapper::ToJson 0x1e9e994 @ 0x7452708
- else - skip serialize, Encrypt existing req.Data

RequestLogin passes w7=0, so rdt is loaded from HttpManager+0x30.

4. MajorLogin protobuf

Decrypted body around 687–696 bytes (icl I don’t remember).

Field 22 - b2 01 20 + 32 ASCII hex - Not team MD5. After Empty RequestPost, RequestLogin stores GarenaMSDKMgr +0x38 at proto +0xa8. This is an MSDK token.
Field 29 - ea 01 40 + 64 ASCII hex - Not __TEXT SHA256. GarenaMSDKMgr +0x40 -> proto +0xe0. MSDK token. Changes every new guest.
Field 94 - f2 05 48 + 72 ASCII base64 - GOP token. Decode = 52 bytes: magic 2aab074f + 48-byte MAC (HMAC-SHA384-shaped).

FairGuard gets the data from MANGENBPGKL lands at proto +0x220 and is only 14 bytes (fP@@$DXUq…), not a SHA256.

5. CheckHackBehavior

POST https://clientbp.ppmainecoonghj.com/CheckHackBehavior

Built in COW.UIModelSkinModCheck::RequestHackerWarningInfo 0x48e08cc.

CSCheckHackBehaviorReq has one field: client_info = MatchClientInfo.

proto (after GGP decrypt):
Field 1 - tpsdk_str - iOS uid
Field 2 - start_time - varint
Field 3 - file_exception - XOR via GCommon.Checker.COIFGGAINCK::PEPHNHOLMAK 0x6ce9e24 with uid decimal as repeating key
Field 4 - lib_result - same XOR, and it’s 13 bytes
Field 6 - scan_count - on sim. It was 11
Field 7 - native_result - same as field 4
Field 8 - client_version - 1.132.11
Field 9 - channel_type - 3
Field 10 - architectual_type - 1


No GOP on this packet server replies empty (n=0).

PEPHNHOLMAK is literally:
 

Code:

out[i] = data_utf8[i] XOR key_utf8[i % keylen]

1.  

Key for f3 was the decimal uid (18746603516), not the IOS… prefix.

6. FairGuard score / gin report


Score object getters 0x9711d80–0x97121bc.
JSON keys (decrypted strings): nRoot, nSimu, nAccel, nDebug, nModify, nRepack, nResign, thSigMatch, defense.

Gin POST: https://gin.freefiremobile.com/ios/d...rtIosPv/create
JSON: jb, fg_ver, ig1, ig2, pid, h, path, s, bd, cpu, sv, gv, dm, gm, cd plus the n* flags.

h is SHA256 of __TEXT. Sending the live patched TEXT hash as h is a ban. Official h is the constant above.

FairGuard cmds:
0xf2 0xf3 0xf4 0xf6 0xf9 0xfa - app attest
0xed 0xee 0x79 0x7b 0x7c - attest adjacent
0x65–0x70 - native probes

Skipping 0x65 and 0x70 results in a lobby stuck game


7. Provision / CD / team

FairGuard compares:

- TeamName / Entitlements / application-identifier via CFDictionary (0xa19ce40 and 0xa19ce10). AND PLEASEE DO NOT replace the CFString object with a new NSString, calls JSON builder at `0x9289a94` then executes that object (EXC_BAD_ACCESS).
- On-disk Mach-O %@/Frameworks/UnityFramework.framework/UnityFramework.
- CC_MD5 of com.dts.freefireth_<TEAM> (29 bytes) at 0x9381f90. (tips: you need to do code caving to switch to 98573T3W6L)
- CodeDirectory magic fade0c02.

8. Make sideloaded IPAs work on MacOS iPhone Simulator

 

#import <Foundation/Foundation.h>
#import <objc/runtime.h>
#import <objc/message.h>
#include <string.h>
#include <stdlib.h>
#include <errno.h>
#include <dlfcn.h>
#include <sys/sysctl.h>
#include <sys/utsname.h>
#include <limits.h>
#include <sys/mman.h>
#include <mach-o/dyld.h>
#include <mach-o/loader.h>
#include <mach-o/nlist.h>
 
static char *kept[32];
static int nkept;
static IMP oldGpu;
static IMP oldEnv;
static IMP oldBp, oldEp, oldBu, oldEu;
static int busy;
static int (*sysn0)(const char *, void *, size_t *, void *, size_t);
static int (*sysc0)(int *, u_int, void *, size_t *, void *, size_t);
static int (*una0)(struct utsname *);
static char *(*gete0)(const char *);
static const char *(*iname0)(uint32_t);
static uint32_t (*icnt0)(void);
static char *(*rpath0)(const char *, char *);
static int (*nspath0)(char *, uint32_t *);
 
static const char *keep(const char *s) {
    int i;
    for (i = 0; i < nkept; i++) {
        if (strcmp(kept[i], s) == 0) return kept[i];
    }
    if (nkept >= 32) return kept[0];
    kept[nkept] = strdup(s);
    return kept[nkept++];
}
 
static void unslash(const char *in, char *out, size_t n) {
    size_t j = 0;
    size_t i;
    for (i = 0; in[i] && j + 1 < n; i++) {
        if (in[i] == '\\' && in[i + 1] == '/') {
            out[j++] = '/';
            i++;
        } else {
            out[j++] = in[i];
        }
    }
    out[j] = 0;
}
 
static const char *reslash(const char *in) {
    char buf[1400];
    size_t j = 0;
    size_t i;
    for (i = 0; in[i] && j + 2 < sizeof(buf); i++) {
        if (in[i] == '/') {
            buf[j++] = '\\';
            buf[j++] = '/';
        } else {
            buf[j++] = in[i];
        }
    }
    buf[j] = 0;
    return keep(buf);
}
 
static const char *fixpath(const char *in) {
    int esc;
    char norm[1200];
    char tmp[1200];
    const char *bundle;
    const char *data;
    if (!in || !strstr(in, "CoreSimulator")) return in;
    esc = strstr(in, "\\/") != NULL;
    unslash(in, norm, sizeof(norm));
    bundle = strstr(norm, "Containers/Bundle/Application/");
    data = strstr(norm, "Containers/Data/Application/");
    if (bundle) {
        snprintf(tmp, sizeof(tmp), "/private/var/containers/Bundle/Application/%s",
                 bundle + strlen("Containers/Bundle/Application/"));
    } else if (data) {
        snprintf(tmp, sizeof(tmp), "/var/mobile/Containers/Data/Application/%s",
                 data + strlen("Containers/Data/Application/"));
    } else {
        snprintf(tmp, sizeof(tmp), "/private/var/containers/Bundle/Application");
    }
    if (esc) return reslash(tmp);
    return keep(tmp);
}
 
static NSString *gpuName(id self, SEL cmd) {
    (void)self;
    (void)cmd;
    return @"Apple A19 Pro GPU";
}
 
static const char *hwfake(const char *name) {
    if (!name) return NULL;
    if (strcmp(name, "hw.machine") == 0) return "iPhone18,1";
    if (strcmp(name, "hw.model") == 0) return "V53AP";
    if (strcmp(name, "hw.product") == 0) return "V53AP";
    if (strcmp(name, "hw.targettype") == 0) return "V53AP";
    if (strcmp(name, "kern.osproductversion") == 0) return "26.2";
    if (strcmp(name, "kern.osversion") == 0) return "23C54";
    return NULL;
}
 
static int putstr(const char *rep, void *dst, size_t *dn) {
    size_t need = strlen(rep) + 1;
    if (!dst) {
        if (dn) *dn = need;
        return 0;
    }
    if (!dn || *dn < need) {
        if (dn) *dn = need;
        errno = ENOMEM;
        return -1;
    }
    memcpy(dst, rep, need);
    *dn = need;
    return 0;
}
 
static void bind(void) {
    if (gete0 || busy) return;
    busy = 1;
    gete0 = dlsym(RTLD_NEXT, "getenv");
    sysn0 = dlsym(RTLD_NEXT, "sysctlbyname");
    sysc0 = dlsym(RTLD_NEXT, "sysctl");
    una0 = dlsym(RTLD_NEXT, "uname");
    busy = 0;
}
 
static char *gete(const char *name) {
    char *v;
    bind();
    if (!name || !gete0) return NULL;
    if (strncmp(name, "SIMULATOR_", 10) == 0) return NULL;
    if (strcmp(name, "IPHONE_SIMULATOR_ROOT") == 0) return NULL;
    v = gete0(name);
    if (v && strstr(v, "CoreSimulator")) return (char *)fixpath(v);
    return v;
}
 
static int sysn(const char *name, void *dst, size_t *dn, void *src, size_t sn) {
    const char *rep = hwfake(name);
    if (rep) return putstr(rep, dst, dn);
    bind();
    return sysn0(name, dst, dn, src, sn);
}
 
static int sysc(int *name, u_int nlen, void *dst, size_t *dn, void *src, size_t sn) {
    if (name && nlen >= 2 && name[0] == CTL_HW && (name[1] == HW_MACHINE || name[1] == HW_MODEL)) {
        const char *rep = name[1] == HW_MACHINE ? "iPhone18,1" : "V53AP";
        return putstr(rep, dst, dn);
    }
    bind();
    return sysc0(name, nlen, dst, dn, src, sn);
}
 
static int una(struct utsname *u) {
    int rc;
    bind();
    rc = una0(u);
    if (rc == 0 && u) {
        memset(u->machine, 0, sizeof(u->machine));
        strncpy(u->machine, "iPhone18,1", sizeof(u->machine) - 1);
    }
    return rc;
}
 
static const char *iname(uint32_t idx) {
    const char *nm;
    if (!iname0) return NULL;
    nm = iname0(idx);
    return nm ? fixpath(nm) : nm;
}
 
static uint32_t icnt(void) {
    return icnt0 ? icnt0() : _dyld_image_count();
}
 
static char *rpath(const char *path, char *resolved) {
    char *r = rpath0 ? rpath0(path, resolved) : NULL;
    const char *sp;
    if (!r) return r;
    sp = fixpath(r);
    if (sp != r && resolved) {
        strncpy(resolved, sp, PATH_MAX - 1);
        resolved[PATH_MAX - 1] = 0;
        return resolved;
    }
    return (char *)sp;
}
 
static int nspath(char *buf, uint32_t *sz) {
    int rc = nspath0 ? nspath0(buf, sz) : -1;
    if (rc == 0 && buf) {
        const char *sp = fixpath(buf);
        if (sp != buf && sz && *sz > strlen(sp)) memcpy(buf, sp, strlen(sp) + 1);
    }
    return rc;
}
 
static void patch(const struct mach_header *mh, intptr_t slide) {
    const struct mach_header_64 *header;
    const struct symtab_command *symtab = NULL;
    const struct dysymtab_command *dysym = NULL;
    const struct segment_command_64 *linkedit = NULL;
    const struct section_64 *gots[16];
    int ngot = 0;
    const struct load_command *lc;
    uint32_t i;
    uintptr_t base;
    const struct nlist_64 *syms;
    const char *strs;
    const uint32_t *indirect;
    int g;
    if (mh->magic != MH_MAGIC_64) return;
    header = (const struct mach_header_64 *)mh;
    lc = (const struct load_command *)(header + 1);
    for (i = 0; i < header->ncmds; i++) {
        if (lc->cmd == LC_SEGMENT_64) {
            const struct segment_command_64 *seg = (const struct segment_command_64 *)lc;
            const struct section_64 *sec;
            uint32_t s;
            if (strcmp(seg->segname, "__LINKEDIT") == 0) linkedit = seg;
            sec = (const struct section_64 *)(seg + 1);
            for (s = 0; s < seg->nsects && ngot < 16; s++) {
                uint32_t typ = sec[s].flags & SECTION_TYPE;
                if (typ == S_LAZY_SYMBOL_POINTERS || typ == S_NON_LAZY_SYMBOL_POINTERS)
                    gots[ngot++] = &sec[s];
            }
        } else if (lc->cmd == LC_SYMTAB) {
            symtab = (const struct symtab_command *)lc;
        } else if (lc->cmd == LC_DYSYMTAB) {
            dysym = (const struct dysymtab_command *)lc;
        }
        lc = (const struct load_command *)((const char *)lc + lc->cmdsize);
    }
    if (!symtab || !dysym || !linkedit) return;
    base = (uintptr_t)slide + linkedit->vmaddr - linkedit->fileoff;
    syms = (const struct nlist_64 *)(base + symtab->symoff);
    strs = (const char *)(base + symtab->stroff);
    indirect = (const uint32_t *)(base + dysym->indirectsymoff);
    for (g = 0; g < ngot; g++) {
        void **slots = (void **)(gots[g]->addr + slide);
        uint32_t count = (uint32_t)(gots[g]->size / sizeof(void *));
        uint32_t j;
        for (j = 0; j < count; j++) {
            uint32_t idx = indirect[gots[g]->reserved1 + j];
            const char *nm;
            void *repl = NULL;
            uintptr_t page;
            if (idx & (INDIRECT_SYMBOL_ABS | INDIRECT_SYMBOL_LOCAL)) continue;
            nm = strs + syms[idx].n_un.n_strx;
            if (nm[0] == '_') nm++;
            if (strcmp(nm, "getenv") == 0) repl = (void *)gete;
            else if (strcmp(nm, "sysctlbyname") == 0) repl = (void *)sysn;
            else if (strcmp(nm, "sysctl") == 0) repl = (void *)sysc;
            else if (strcmp(nm, "uname") == 0) repl = (void *)una;
            else if (strcmp(nm, "dyld_get_image_name") == 0) repl = (void *)iname;
            else if (strcmp(nm, "dyld_image_count") == 0) repl = (void *)icnt;
            else if (strcmp(nm, "realpath") == 0) repl = (void *)rpath;
            else if (strcmp(nm, "_NSGetExecutablePath") == 0) repl = (void *)nspath;
            if (!repl || slots[j] == repl) continue;
            if (strcmp(nm, "getenv") == 0 && !gete0) gete0 = slots[j];
            if (strcmp(nm, "sysctlbyname") == 0 && !sysn0) sysn0 = slots[j];
            if (strcmp(nm, "sysctl") == 0 && !sysc0) sysc0 = slots[j];
            if (strcmp(nm, "uname") == 0 && !una0) una0 = slots[j];
            if (strcmp(nm, "dyld_get_image_name") == 0 && !iname0) iname0 = slots[j];
            if (strcmp(nm, "dyld_image_count") == 0 && !icnt0) icnt0 = slots[j];
            if (strcmp(nm, "realpath") == 0 && !rpath0) rpath0 = slots[j];
            if (strcmp(nm, "_NSGetExecutablePath") == 0 && !nspath0) nspath0 = slots[j];
            page = (uintptr_t)&slots[j] & ~(uintptr_t)0x3fff;
            mprotect((void *)page, 0x4000, PROT_READ | PROT_WRITE);
            slots[j] = repl;
        }
    }
}
 
static void loaded(const struct mach_header *mh, intptr_t slide) {
    patch(mh, slide);
}
 
static NSDictionary *envHook(id self, SEL cmd) {
    NSDictionary *orig = ((NSDictionary *(*)(id, SEL))oldEnv)(self, cmd);
    NSMutableDictionary *m = [orig mutableCopy];
    for (NSString *k in orig.allKeys) {
        NSString *val;
        if ([k hasPrefix:@"SIMULATOR_"] || [k isEqualToString:@"IPHONE_SIMULATOR_ROOT"]) {
            [m removeObjectForKey:k];
            continue;
        }
        val = m[k];
        if ([val isKindOfClass:[NSString class]] && [val containsString:@"CoreSimulator"]) {
            const char *sp = fixpath(val.UTF8String);
            m[k] = [NSString stringWithUTF8String:sp];
        }
    }
    return m;
}
 
static BOOL sayNo(id self, SEL cmd) {
    (void)self;
    (void)cmd;
    return NO;
}
 
static NSString *bpHook(id self, SEL cmd) {
    NSString *s = ((NSString *(*)(id, SEL))oldBp)(self, cmd);
    const char *p;
    if (!s) return s;
    p = fixpath(s.UTF8String);
    return p == s.UTF8String ? s : [NSString stringWithUTF8String:p];
}
 
static NSString *epHook(id self, SEL cmd) {
    NSString *s = ((NSString *(*)(id, SEL))oldEp)(self, cmd);
    const char *p;
    if (!s) return s;
    p = fixpath(s.UTF8String);
    return p == s.UTF8String ? s : [NSString stringWithUTF8String:p];
}
 
static NSURL *buHook(id self, SEL cmd) {
    NSURL *u = ((NSURL *(*)(id, SEL))oldBu)(self, cmd);
    const char *p;
    if (!u) return u;
    p = fixpath(u.path.UTF8String);
    if (p == u.path.UTF8String) return u;
    return [NSURL fileURLWithPath:[NSString stringWithUTF8String:p]];
}
 
static NSURL *euHook(id self, SEL cmd) {
    NSURL *u = ((NSURL *(*)(id, SEL))oldEu)(self, cmd);
    const char *p;
    if (!u) return u;
    p = fixpath(u.path.UTF8String);
    if (p == u.path.UTF8String) return u;
    return [NSURL fileURLWithPath:[NSString stringWithUTF8String:p]];
}
 
static void fake[removed]gpiu(void) {
    Class c = objc_getClass("MTLSimDevice");
    Method m;
    if (!c) return;
    m = class_getInstanceMethod(c,    @Selector(name));
    if (!m) return;
    oldGpu = method_setImplementation(m, (IMP)gpuName);
}
 
__attribute__((constructor(0)))
static void boot(void) {
    Class b;
    Class p;
    Method m;
    gete0 = dlsym(RTLD_DEFAULT, "getenv");
    sysn0 = dlsym(RTLD_DEFAULT, "sysctlbyname");
    sysc0 = dlsym(RTLD_DEFAULT, "sysctl");
    una0 = dlsym(RTLD_DEFAULT, "uname");
    _dyld_register_func_for_add_image(loaded);
    b = objc_getClass("NSBundle");
    if (b) {
        m = class_getInstanceMethod(b,    @Selector(bundlePath));
        if (m) oldBp = method_setImplementation(m, (IMP)bpHook);
        m = class_getInstanceMethod(b,    @Selector(executablePath));
        if (m) oldEp = method_setImplementation(m, (IMP)epHook);
        m = class_getInstanceMethod(b,    @Selector(bundleURL));
        if (m) oldBu = method_setImplementation(m, (IMP)buHook);
        m = class_getInstanceMethod(b,    @Selector(executableURL));
        if (m) oldEu = method_setImplementation(m, (IMP)euHook);
    }
    p = objc_getClass("NSProcessInfo");
    if (p) {
        Method env = class_getInstanceMethod(p,    @Selector(environment));
        if (env) oldEnv = method_setImplementation(env, (IMP)envHook);
        m = class_getInstanceMethod(p, sel_registerName("isiOSAppOnMac"));
        if (m) method_setImplementation(m, (IMP)sayNo);
        m = class_getInstanceMethod(p, sel_registerName("isMacCatalystApp"));
        if (m) method_setImplementation(m, (IMP)sayNo);
    }
    fake[removed]gpiu();
}

And vuala: https://imgur.com/kTyH5V0


8.1 ObjC / Foundation

identifierForVendor, advertisingIdentifier, NSBundle path, environment, Hide the dylib your injecting, spoof CoreSimulator (/private/var/containers/), NSURLSession dataTask / upload / config , Log, clean_report, skip deliveryFlagIos, deliveryFeatureIos, setHTTPBody, NSJSONSerialization write and parse, sanitize_obj, h param, the official cd, thSigMatch to return 1, path to go to store, NSMutableString, getFFSecurityInfo (spoof json and team if present)

8.2 Crypto (UnityFramework, not GOT libc)
0xa19cc78 CC_MD5 - here u can switch from your sideloaded id to 98573T3W6L
0xa19cca8 CC_SHA1 - SHA1 CDHASH
0xa19ccc0 CC_SHA256

I decided to not put the IL2CPP Text patches and path + dylib hide, this you can figure it out by yourself (as a anti-paste gift to whoever may try to remake and sell this as a cheat)


I will update this soon, and try to post a ipa cheat too on iOS section but that will be probably next month if someone got any questions feel free to PM me this will be updated soon with more informations.