Jump to content
  • Sky
  • Mint
  • Azure
  • Indigo
  • Blueberry
  • Blackcurrant
  • Watermelon
  • Strawberry
  • Pomegranate
  • Ruby Red
  • Orange
  • Banana
  • Apple
  • Emerald
  • Teal
  • Chocolate
  • Slate
  • Midnight
  • Maastricht
  • Charcoal
  • Matte Black
Guest

Guide [IDA Tutorial]How to hack with strings

519 posts in this topic

Recommended Posts

Guest

I've really been wanting to make this tutorial for a long time but have never gotten around to it. But it's 11:09 and my parents are in bed so I can make this now :p

 

I'm going to be providing the site with more things, like tutorials and templates, but not so much hacks. Hacking has gotten so dull recently it's the same thing over and over and over again and I'm done with the stress.

 

I will be using Blitz Brigade for this tutorial because it is a great game for beginners to start learning strings. I know this binary is not the current version, but the strings are the same and the functions look more or less the same.

 

Requirements:

- A good grip on arm assembly. Do NOT go into this knowing nothing and then expect me to help you.

- IDA Pro

- Blitz Brigade

- A freaking brain and an IQ of at least 50

 

For this tutorial, we will be hacking ammo and invisible actions.

 

Hidden Content

    To hack with strings you have to know how to open the strings subview in IDA. Go to View -> Open Subviews -> Strings.

     

    t0HjIJh.png

     

    IDA will take a few seconds to get that loaded up, and after it loads, you'll want to sort them in alphabetical order.

     

    2VryjQj.png

     

    Then create a quick filter so that you can search. To create a quick filter, right click and then click "quick filter". I don't think you guys need a picture for that :p

     

    Now you'll search for ammo. Type "ammo" (without the quotes, always type everything without the quotes) and you should see a ton of results pop up.

     

    XNAcavI.png

     

    Don't be scared. It's normal for that many to pop up. When you first heard strings, did you think that we actually mod the string itself? No we don't. If it was that easy, everyone would be able to hack like this. Instead, the strings in a game are either useful or useless. Useful strings point to useful functions that actually handle what the string describes. Useless strings don't relate to anything and usually point to functions that I like to call "essential NPC's". Or they will point to completely different functions than what you wanted to hack. Anyway, an NPC is a character in a video game that NEEDS to be there or else the whole game breaks. Can you see where I am going from here? If you get a string that points to an essential NPC, and you mod that NPC, the game will crash.

     

    Let's try some of these results!

     

    In some cases, the most useless-looking strings are the useful ones, always remember that. Try every single string because you never can truly know if it will be useful or not.

     

    To select a string, double click on it. You will then be presented with a window that has a ton of strings listed. Thankfully for us, IDA will highlight the one that you just double clicked. After that, you want to right-click on the highlighted string and then click "jump to xref to operand". When you click that, you'll see a box with however many times the string occurs in the binary. It could be anywere from one to one thousand times the string occurs in the binary.

     

    The first string I tried was POPOUT_AMMO. POPOUT to me could mean the ammo label popping out from the background of the game into the foreground so that you can actually see how much ammo you have once the level loads.

     

    I right clicked and xref'ed to where the string was occuring and wow, this does not look useful at all.

     

    OycT8yi.png

     

    These strings have no useful functions near them, and not only that, they have NO functions near them. Plus, they are all the way out in the 0xAyyyyy (y being a variable) range. If you see any string that goes to a spot in the binary that looks like this, its useless.

     

    Let's try another string. This time we will be doing Ammopack.

     

    Ammopack could refer to an item that you can buy that gives ammo, the amount of an item that you have that gives ammo, or just simply your ammo. Double click on the string and bring up the xref dialouge box. 

     

    SWUH1BZ.png

     

    Huh, looks like there are two occurences! "But wait shmoo, aren't there four? Are you blind?" Yes, you are right, there are four separate spots where it occurs. But in reality, there is only two. Why? Because, if the same string has two places where it shows up that are eight or ten bytes away from each other, you count that as one whole occurence of that particular string. As you can see in the picture above, each occurence of the string has an eight byte differences between the two.

     

    In hex, A=10 and 2=2. What is 10-2? 8.

     

    In the second occurence, what is 8-0? 8.

     

    You see what I am saying.

     

    Let's try the first occurence.

     

    EhrWzUN.png

     

    Alright, stuff we can work with! Like I said in the beginning of the tutorial, hacking with strings means that you hack the functions near the string, not the string itself. You should know by now that functions always start with sub_, but they can also rarely start with loc_.

     

    Let's try the two that occur above the string, sub_2AB7B8. Double click on it so that IDA will bring you to it.

     

    5mfAmkL.png

     

    Oh no. This doesn't look good. This function is far too small to actually do anything useful and it has 569 xrefs. That means that the game uses sub_2AB7B8 569 times for 569 different things. Looks like an essential NPC to me. To see how many xrefs a function has, you right click the function name (it is highlighted in the picture above) and then you click "jump to xref to operand".

     

    JIP8YRL.png

     

    Let's try the function directly below it, sub_2AC254. Double click on it to bring it up. Let's check how many xrefs this function has. It has 127. That's a little high, but let's look at it some more. Oh no. This function calls strcmp two times to do something. Everytime you see a function that calls strcmp, srand, time, rand, etc, will be useless, at least in my experience. rand might be useful, but the only time it was useful for me was when I was hacking Modern Combat 3 and every useful function had it.

     

    So that function is a no.

     

    WFujhio.png

     

    Go back to where the string was, and little bit below it, there is a function called sub_2ADCD0. Double click it to bring it up. Right off the bat we see that this function calls time. It's a useless function.

     

    Finally, before calling it quits with this string, try the one a little bit below sub_2ADCD0, sub_50070.

     

    wL9CvK8.png

     

    Wow, holy crap that is an ugly function. As always, let's check the amount of xrefs before we do anything. There are 1104 xrefs to this function. This games uses this function 1104 times for 1104 different things. No way this is useful to us.

     

    The second occurence to Ammopack has only two functions near it: sub_2BEBA4, which looks exactily like sub_50070, and sub_2C00E8, which calls two of the functions that we previously determined useless.

     

    Ammopack is a useless string.

     

    Go back to the strings window. Let's try ammo_server. Double click the string and xref it.

     

    IJrU5B1.png

     

    There is no way this could ever be useful. For starters, this function contains many other strings such as speed, ammo_client, cheat_type, map, etc. Then it calls not only the same function, sub_81788 over and over again, but it also branches to "that very long function in the blue text" over and over again. I call it "the very long function in the blue text" because I don't know what else to call it :p

     

    ammo_server is a useless string.

     

    Go back to the strings window. Let's try ammo_clipsize. Xref it.

     

    QIRFApA.png

     

    I want to first make something clear before we continue. Any function that starts with sub_7 is useless. Don't even think about modding it, because the game will crash.

     

    But look, in between all of the useless functions, there is a function called sub_3094A4. Huh, why would that be there? Let's check it out.

     

    x3Tqwq3.png

     

    As always, check how many xrefs there are. Only 27! A good sign. A useful function will generally have about 3-40 xrefs. And this function also looks very distinct from all the others that we have looked at, and the functions around it look similar and they all call the same function. Size looks great too!

     

    Guess what, this function is the ammo function, meaning that the string ammo_clipsize is a useful string! When you BX LR this function, and reload the level, you ammo will become infinite. Also, if you mod the function being called inside of it, you'll get the ultrahack.

     

    Congradulations, you have just modded Blitz Brigade ammo without the need for watchpoints or iGameGuardian!

     

    I'd like to point out that sometimes developers will leave messages in their games that they use to troubleshoot problems with. One example could be "CHelicopterPhysicsComponent::Update - playerId not found!!" or "GameMpManager::GetClassFromPlayerDetails player %d not found". Stuff like that. The functions that contain the strings are the ones you want to mod because that function would be printing that error message if you were a Gameloft employee making and debugging the game.

     

    Gameloft, with the genius that it is, left a string that allows you to be invisible on multiplayer. They left in a string called "MP_ClientSendPositionsMessage: m_playerPositions memory overflow". Why they left that in is beyond me but it allows invisibility.

     

    Xref to that string, and the function you will be in is sub_22C63C. To achieve invisible actions, you have to BX LR that function. Why? Read the string. "SendPositions". When you BX LR that function, your device won't be able to send you position to the multiplayer server that would normally allow other people to see you. 

     

    You have just gotten an invisibility hack on Blitz Brigade!

     

    Blitz Brigade is by far the best game to practice with if you want to learn strings. No other Gameloft game is like this. If you've mastered this game, don't think that you can go hack MC5 or DH5 because while those do have strings, it's much more complex than this. This is as basic as it gets.

     

    -----------

     

    Hacking with strings is an incredibly efficient way to hack once you get good at it. Practice some more with Blitz Brigade, and see how many features of the 16 that I got in my hack for 2.1.0 that you can get. I got all those features with strings. Good luck! And I hope you found this helpful. Expect more tutorials. :)

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic... Posting Guidelines

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Our picks

    • Yu-Gi-Oh! Duel Links v3.10.0 - [ Auto-Play & More ]
      Modded/Hacked App: Yu-Gi-Oh! Duel Links By KONAMI
      Bundle ID: jp.konami.yugiohmobile
      iTunes Store Link: https://itunes.apple.com/us/app/yu-gi-oh-duel-links/id1068378177?mt=8&uo=4&at=1010lce4
       

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate (from Cydia).
      - PreferenceLoader (from Cydia).


      Hack Features:
      - Auto-Play - Don't Work In PVP 
      -- Always The Best Tactics
      - Face Up Card
      -- Enemies Hand Card Show
      - Show Monster And Status
      -- Enemies Deck Card Shows
        • Winner
        • Informative
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 410 replies
    • Darkness Rises: Adventure RPG v1.27.0 - [ x5 Attack & More ]
      Modded/Hacked App: Darkness Rises: Adventure RPG By NEXON Company
      Bundle ID: com.nexon.da3.global
      iTunes Store Link: https://itunes.apple.com/us/app/darkness-rises-adventure-rpg/id1321309284?mt=8&uo=4&at=1010lce4
       

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate (from Cydia).
      - PreferenceLoader (from Cydia).


      Hack Features:
      - x5 Attack
      - x5 HP
      - One Hit Kill - Works PVP
      - God Mode - Works PVP
      - No Skills CoolDown - Works PVP
        • Winner
        • Informative
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 484 replies
    • [ARM64] Tanks A Lot - 3v3 Brawls v2.22 Jailed Cheats +2
      Modded/Hacked App: Tanks A Lot - 3v3 Brawls by BoomBit, Inc.
      Bundle ID: com.boombitgames.TanksALot
      iTunes Store Link: https://itunes.apple.com/us/app/tanks-a-lot-3v3-brawls/id1344713773?mt=8&uo=4&at=1010lce4


      Hack Features:
      - Infinite Ammo
      - No Reload


      Hack Download Link: https://iosgods.com/topic/77155-arm64-tanks-a-lot-3v3-brawls-v143-jailed-cheats-3/
        • Winner
        • Informative
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 545 replies
    • [ARM64] Tanks A Lot - 3v3 Brawls Cheats v2.22 +6
      Modded/Hacked App: Tanks A Lot - 3v3 Brawls by BoomBit, Inc.
      Bundle ID: com.boombitgames.TanksALot
      iTunes Store Link: https://apps.apple.com/us/app/tanks-a-lot-3v3-brawls/id1344713773?uo=4&at=1010lce4


      Hack Features:
      - God Mode
      - Infinite Ammo
      - No Reload
      - Speed Hacks
      - Disable Enemy Shield
      - No Skill Cooldown


      Hack Download Link: https://iosgods.com/topic/76001-arm64-tanks-a-lot-3v3-brawls-cheats-v190-6/
        • Winner
        • Informative
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 698 replies
    • [ARM64] Vlogger Go Viral - Tube Star v2.17 Jailed Cheats +1
      Modded/Hacked App: Vlogger Go Viral - Tube Star by Tapps Tecnologia da Informacao LTDA.
      Bundle ID: br.com.tapps.vloggergoviral
      iTunes Store Link: https://itunes.apple.com/us/app/vlogger-go-viral-tube-star/id1045165396?mt=8&uo=4&at=1010lce4



      Hack Features:
      - Free iAP


      Hack Download Link: https://iosgods.com/topic/84125-arm64-vlogger-go-viral-tube-star-v211-jailed-cheats-1/
        • Informative
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 31 replies
    • [ARM64]Gears POP! v1.1 Cheat
      Modded/Hacked App: Gears POP! By Microsoft Corporation
      Bundle ID: com.microsoft.gearspop
      iTunes Store Link: https://apps.apple.com/us/app/gears-pop/id1437301951?uo=4&at=1010lce4

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate or Substitute.
      - PreferenceLoader (from Cydia or Sileo).


      Hack Features:
      - Ultimate Skill Always Ready


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download Link:

      Hidden Content
      https://iosddl.net/fd12d93262752f48/com.k.gearspop_1.1+iOSGods.com_iphoneos-arm.deb







      Installation Instructions:
      STEP 1: Download the .deb Cydia hack file from the link above.
      STEP 2: Copy the file over to your iDevice using any of the file managers mentioned above or skip this step if you're downloading from your iDevice.
      STEP 3: Using iFile or Filza, browse to where you saved the downloaded .deb file and tap on it.
      STEP 4: Once you tap on the file, you will then need to press on 'Installer' or 'Install' from the options on your screen.
      STEP 5: Let iFile / Filza finish the cheat installation. Make sure it successfully installs, otherwise see the note below.
      STEP 6: Now open your iDevice settings and scroll down until you see the settings for this cheat and tap on it. If the hack is a Mod Menu, the cheat features can be toggled in-game.
      STEP 7: Turn on the features you want and play the game. You may need to follow further instructions inside the hack's popup in-game.

       

      NOTE: If you have any questions or problems, read our Troubleshooting topic & Frequently Asked Questions topic. If you still haven't found a solution, post your issue down below and we'll do our best to help! If the hack does work for you, post your feedback below and help out other fellow members that are encountering issues.


      Credits:
      - K_K


      Cheat Video/Screenshots:

      N/A
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 16 replies
    • [ARM64] Simply Piano v7.1 Jailed Mod +1
      Modded/Hacked App: Simply Piano by JoyTunes By JoyTunes
      Bundle ID: com.joytunes.asla
      iTunes Store Link: https://itunes.apple.com/us/app/simply-piano-by-joytunes/id1019442026?mt=8&uo=4&at=1010lce4



      Hack Features:
      - Unlocked All Courses 


      Hack Download Link: https://iosgods.com/topic/68652-arm64-simply-piano-by-joytunes-v62-jailed-mod/
        • Winner
        • Informative
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 1,046 replies
    • [ARM64] VivaVideo - Best Video Editor Modded (All Versions) +1
      Modded/Hacked App: VivaVideo - Best Video Editor by QuVideo Inc.
      Bundle ID: com.quvideo.XiaoYing
      iTunes Store Link: https://itunes.apple.com/us/app/vivavideo-best-video-editor/id738897668?mt=8&uo=4&at=1010lce4



      Hack Features:
      - PREMIUM


      Hack Download Link: https://iosgods.com/topic/86497-arm64-vivavideo-best-video-editor-mod-v771-1/
        • Winner
        • Informative
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 98 replies
    • [ARM64] Spotify++ v8.5.19 Jailed Mod +6
      Modded/Hacked App: Spotify - Music and Podcasts by Spotify
      Bundle ID: com.spotify.client
      iTunes Store Link: https://itunes.apple.com/us/app/spotify-music-and-podcasts/id324684580?mt=8&uo=4&at=1010lce4



      Hack Features:
      - Streaming Without Ads
      - Unlimited Skips
      - Better Sound Quality
      - You can scrub number of tracks you wants


      Hack Download Link: https://iosgods.com/topic/94585-arm64-spotify-v851-jailed-mod-1/

      #Hack #Jailbreak #Cydia #Cheat #Apple #Android #iOSGods
        • Winner
        • Informative
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 848 replies
    • [ARM64] Rocket for Instagram v107.0 Jailed Mod +4
      Modded/Hacked App: Instagram by Instagram, Inc.
      Bundle ID: com.burbn.instagram
      iTunes Store Link: https://apps.apple.com/us/app/instagram/id389801252?uo=4&at=1010lce4


      Hack Features:
      - Anonymous Viewer. View other users' stories and messages without notifying them that you've seen their media.
      - Save Posts to Gallery. With Rocket for Instagram, you can save any photo or video posted on Instagram to your device
      - Grid Feed Layout. Rocket for Instagram brings the much-beloved grid layout for the home feed.
      - Friendship Status. Check whether other users follow you or not by simply visiting their own profile.


      iOS Hack Download Link: https://iosgods.com/topic/107179-arm64-rocket-for-instagram-v1070-jailed-mod-4/
        • Thanks
        • Like
      • 3 replies
    • Cercube 5 for Youtube v14.33.4 Jailed Mod +6
      Modded/Hacked App: YouTube: Watch, Listen, Stream by Google LLC
      Bundle ID: com.google.ios.youtube
      iTunes Store Link: https://itunes.apple.com/us/app/youtube-watch-listen-stream/id544007664?mt=8&uo=4&at=1010lce4


      Hack Features:
      - Background Playback
      - No Ads
      - No Age Restrict
      - Download High Quality Videos
      - Dark Theme
      - And More ...

      NOTE: You need to login to Cercube server in order to download Videos


      Hack Download Link: https://iosgods.com/topic/98720-cercube-5-for-youtube-v1419-jailed-mod-1/
        • Winner
        • Informative
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 435 replies
    • [ARM64] Smule Sing! v7.8.3 Jailed Mod +1
      Modded/Hacked App: Smule - The #1 Singing App By Smule
      Bundle ID: com.smule.sing
      iTunes Store Link: https://itunes.apple.com/us/app/smule-the-1-singing-app/id509993510?mt=8&uo=4&at=1010lce4



      Hack Features:
      - PREMIUM
       


      Hack Download Link: https://iosgods.com/topic/80348-arm64-smule-sing-v725-jailed-mod-1/
        • Winner
        • Informative
        • Agree
        • Upvote
        • Haha
        • Thanks
        • Like
      • 937 replies
  • Recently Browsing   0 members

    No registered users viewing this page.


    • Administrator |
    • Special Rank |
    • ViP Plus |
    • ViP Jailed |
    • ViP |
    • Cheater  |
    • Modder  |
    • Novice Cheater |
    • Rookie Modder |
    • Contributor |
    • Senior Member |
    • Member |
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue. Privacy Policy - Guidelines