Jump to content

[Breaking Security]How to disable syscall (anti-debugging protection)


Guest

287 posts in this topic

Recommended Posts

I made this tutorial in April of 2015 for the cheaters here and after almost a year of it being private I decided to post it to the public.

 

Gameloft always uses syscall on their games, and while this was written in April, MC5 still has removable syscall and you can use MC5 to practice :)

 

Requirements:

- IDA Pro

- Modern Combat 5

- GNU Debugger from cydia.radare.org (repo)

- OpenSSH

- Clutch 1.4.7-2

- armv7 binary of MC5, crack it on a 32 bit device for it to be armv7. I won't post one here because of copyright issues.

 

Below this line is the exact text I wrote on April 10, 2015. Enjoy :)

 

------

Hidden Content

    What is syscall? Syscall is anti-debugging protection. This is what causes the Segmentation Fault: 11 when trying to attach to an app. But as hackers we need to attach to an app, and thats why I made this tutorial :snoop:

     

    Again, I'm using MC5.

     

    Let's get started :p

     

    1. Open up the binary in IDA and wait like four to five minutes so that you can actually xref.

     

    2. Once you have waited, click on the "Imports" tab and search for syscall.

    nvzZIjL.jpg

     

    3. Double click it and xref to syscall's location in the binary. Here is the function that you are looking for:

    nuc5Cfj.jpg

     

    It should have _getpid, _memset, and _sysctl there.

     

    4. Highlight the BLX _syscall (or BLX.W _syscall sometimes), and click "Hex View 1". The hex should be highlighted. Now right click before the beginning of the highlighted hex and click "edit".

    fLfnXh3.jpg

     

    5. Now type "C046C046". This means NOP, or no instruction/operation. Basically it makes the app ignore the instruction. The edited hex should have turned orange.

    Wpp9SuU.jpg

     

    6. Save your changes. Right click on the orange edited hex and click "Apply changes".

    0oIyscA.jpg

     

    7. After that, go back to IDA View A and confirm that the BLX _syscall and the instruction below it is NOP'ed.

     

    8. Apply your changes to the binary. Go to Edit --> Patch program --> Apply patches to input file. Create a backup if you want to.

    9Hrh8Xv.jpg

     

    9. Replace the original binary with the hacked binary and set the permissions to:

    Owner: mobile

    Group: mobile

     

    User: read, write, execute

    Group: read, write, execute

    World: read, write, execute

     

    Now you are done! Try to attach and it should work! :)

Proof: (me attaching to Modern Combat 5 in GDB)

 

xrLa6qY.jpg

Link to comment
Share on other sites

Thanks for sharing ! ;)

One question.

when the app do not use _syscall what it could be ?

i searched for all methods that check if they had Cydia or etc.

 

Thanks.

 

It's ptrace. Try searching imports for ptrace

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below. For more information, please read our Posting Guidelines.
Reply to this topic... Posting Guidelines

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Our picks

    • Jurassic World Alive v3.5.29 - [ Dino Don't Move & More ]
      Modded/Hacked App: Jurassic World Alive By Ludia
      Bundle ID: com.ludia.jw2
      iTunes Store Link: https://apps.apple.com/us/app/jurassic-world-alive/id1231085864

      Hack Features:
      - Dino Don't Move
      - Inf.Battery
      - VIP Enabled

      This hack works on the latest x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, SE, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.


      Jailbreak required hack(s): https://iosgods.com/topic/103431-jurassic-world-alive-v1829-dino-dont-move-more/?tab=comments#comment-3107135
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,525 replies
    • Jurassic World Alive v3.5.29 - [ Dino Don't Move & More ]
      Modded/Hacked App: Jurassic World Alive By Ludia
      Bundle ID: com.ludia.jw2
      iTunes Store Link: https://apps.apple.com/us/app/jurassic-world-alive/id1231085864


      Hack Features:
      - Dino Don't Move
      - Inf. Battery
      - VIP Enabled

      This hack is an In-Game Mod Menu (iGMM). In order to activate the Mod Menu, tap on the iOSGods button found inside the app. This hack works on the latest x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, SE, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,460 replies
    • Idle Cinema Empire: Idle Games v2.13.01 +3 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Idle Cinema Empire: Idle Games By 书涛 刘
      Bundle ID: com.idle.cinema.empire.sim.tycoon
      iTunes Store Link: https://apps.apple.com/us/app/idle-cinema-empire-idle-games/id1660507282?uo=4


      Hack Features:
      - Unlimited Cash -> Earn some.
      - Unlimited Gold Coins -> Earn some.
      - Unlimited Diamonds -> Earn some.


      Jailbreak required hack(s): [Mod Menu Hack] Idle Cinema Empire: Idle Games ( All Versions ) +3 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Haha
        • Thanks
        • Winner
        • Like
      • 42 replies
    • Idle Cinema Empire: Idle Games ( All Versions ) +3 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Idle Cinema Empire: Idle Games By 书涛 刘
      Bundle ID: com.idle.cinema.empire.sim.tycoon
      iTunes Store Link: https://apps.apple.com/us/app/idle-cinema-empire-idle-games/id1660507282?uo=4


      Hack Features:
      - Unlimited Cash -> Earn some.
      - Unlimited Gold Coins -> Earn some.
      - Unlimited Diamonds -> Earn some.


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Idle Cinema Empire: Idle Games v2.11.03 +3 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Thanks
        • Like
      • 12 replies
    • Dark Slayer : AFK RPG v1.1.4 +2 Cheats [ God Mode ]
      Modded/Hacked App: Dark Slayer : AFK RPG By Gamepub CO., LTD
      Bundle ID: com.gamepub.zhteam
      iTunes Store Link: https://apps.apple.com/us/app/dark-slayer-afk-rpg/id6446265751?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - God Mode
      - Attack Speed Multiplier
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 170 replies
    • Longleaf Valley: Merge & Plant v1.15.58 +1++ Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Longleaf Valley: Merge & Plant By TreesPlease Games Ltd
      Bundle ID: com.treespleasegames.merge1
      iTunes Store Link: https://apps.apple.com/us/app/longleaf-valley-merge-plant/id1573565989?uo=4


      Hack Features:
      - Unlimited Currencies -> Will increase instead of decrease.


      Jailbreak required hack(s): [Mod Menu Hack] Longleaf Valley: Merge & Plant ( All Versions ) +1++ Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Haha
        • Winner
        • Like
      • 14 replies
    • Longleaf Valley: Merge & Plant ( All Versions ) +1++ Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Longleaf Valley: Merge & Plant By TreesPlease Games Ltd
      Bundle ID: com.treespleasegames.merge1
      iTunes Store Link: https://apps.apple.com/us/app/longleaf-valley-merge-plant/id1573565989?uo=4


      Hack Features:
      - Unlimited Currencies -> Will increase instead of decrease.


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Longleaf Valley: Merge & Plant v1.10.48 +1++ Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Winner
        • Like
      • 2 replies
    • Idle Mushroom Hero : AFK RPG v1.02.067 +4 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Idle Mushroom Hero : AFK RPG By Ndolphin Connect
      Bundle ID: com.nextall.mushroomhero.apple
      iTunes Store Link: https://apps.apple.com/us/app/idle-mushroom-hero-afk-rpg/id6475755018?uo=4


      Hack Features:
      - God Mode
      - One-Hit Kill
      - Unlimited Gold -> Will increase instead of decrease.
      - Unlimited Diamonds -> Spend some.


      Jailbreak required hack(s): [Mod Menu Hack] Idle Mushroom Hero : AFK RPG v1.02.066 +5 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Winner
        • Like
      • 14 replies
    • Idle Mushroom Hero : AFK RPG v1.02.067 +5 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Idle Mushroom Hero : AFK RPG By Ndolphin Connect
      Bundle ID: com.nextall.mushroomhero.apple
      iTunes Store Link: https://apps.apple.com/us/app/idle-mushroom-hero-afk-rpg/id6475755018?uo=4


      Hack Features:
      - God Mode
      - One-Hit Kill
      - Unlimited Gold -> Will increase instead of decrease.
      - Unlimited Diamonds -> Spend some.
      - Auto Win


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Idle Mushroom Hero : AFK RPG v1.02.066 +4 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Haha
        • Thanks
        • Winner
        • Like
      • 36 replies
    • Good Pizza, Great Pizza v5.8.1 +2 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Pizza, Great Pizza By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.pizzabusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-pizza-great-pizza/id911121200?uo=4


      Hack Features:
      - Unlimited Cash
      - Unlimited Diamonds


      Jailbreak required hack(s): [Mod Menu Hack] Good Pizza, Great Pizza v5.5.6 +2 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 24 replies
    • Good Pizza, Great Pizza v5.8.1 +2 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Pizza, Great Pizza By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.pizzabusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-pizza-great-pizza/id911121200?uo=4


      Hack Features:
      - Unlimited Cash
      - Unlimited Diamonds


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Good Pizza, Great Pizza v5.5.6 +2 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Winner
        • Like
      • 16 replies
    • Merge Lion v2.2.0 +8 Jailed Cheats [ Unlimited Everything ]
      Modded/Hacked App: Merge Lion By GOMBLE GAMES PTE. LTD.
      Bundle ID: com.gomble.ios.mergelion
      iTunes Store Link: https://apps.apple.com/us/app/merge-lion/id6472009816?uo=4


      Hack Features:
      - Unlimited Gold
      - Unlimited Lives
      - Unlimited Boosters
      - Unlimited In-Game Boosters
      - Unlimited Bingo Lions
      - Unlimited Energy
      - Unlimited Pushes
      - Unlimited Capsules


      Jailbreak required hack(s): [Mod Menu Hack] Merge Lion v2.1.9 +9 Cheats [ Unlimited Everything ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Thanks
        • Like
      • 7 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines