Jump to content

[Question] Can somebody give me an IDA assignment?


Go to solution Solved by Diversityy,

9 posts in this topic

Recommended Posts

Posted

Hello fellow IDA hackers,

 

Some weeks ago, I had posted a thread asking for help with IDA hacking, but the problem (although assumingly basic) still wasn't solved.

 

THREAD HERE: https://iosgods.com/topic/32534-ida-attempt-trouble-with-ida-hacking/?view=findpost&p=1109430

 

 

So, I'm asking an IDA hacker to give me an easy assignment.  Assign me an iOS app/game to hack.

 

All I require is for you to personally hack the binary first to prove that the hack works before giving me the assignment, as I want to reproduce the same results.

 

 

Thanks in advance! :)

 

Posted (edited)

Monkey City, I posted a cheat yesterday for it. You can also try PvZ2.

 

Hey Diversityy, thank you so much for taking the time to give me an IDA assignment! :)

 

I've tried to hack the game (Monkey City) with IDA Pro, but I can't seem to find any registers (the "R0, R1" etc.-type), I only see the "X0, X1," etc.-type, and I don't think I could just store (STR) an "R7" value into them because it doesn't work like that in x64 bit.  I searched for "currency" and found lots of functions.

 

 

Can you give me a hint on what I should do?

 

BTW, are you using GDB to find the offsets or are you purely using IDA Pro to view, read through, and find the the offsets/critical instructions in the functions manually?

Updated by TripMX
Posted

Hey Diversityy, thank you so much for taking the time to give me an IDA assignment! :)

 

I've tried to hack the game (Monkey City) with IDA Pro, but I can't seem to find any registers (the "R0, R1" etc.-type), I only see the "X0, X1," etc.-type, and I don't think I could just store (STR) an "R7" value into them because it doesn't work like that in x64 bit.  I searched for "currency" and found lots of functions.

 

 

Can you give me a hint on what I should do?

 

BTW, are you using GDB to find the offsets or are you purely using IDA Pro to view, read through, and find the the offsets/critical instructions in the functions manually?

You're seeing X1, because you're hacking the 64-bit portion of the binary. I modded 32-bit.

 

To get the 32-bit, you have to download the .ipa from iTunes. Install the .ipa via iFunBox. Crack the game via Rasticrac.

Posted (edited)

You're seeing X1, because you're hacking the 64-bit portion of the binary. I modded 32-bit.

 

To get the 32-bit, you have to download the .ipa from iTunes. Install the .ipa via iFunBox. Crack the game via Rasticrac.

Okay, thanks, I've tried to hack the 32-bit cracked binary, but still no success. Here's what I've done:

 

I've hacked the following in the Monkey City code:

 

 

SEARCHED FUNCTION: -[ADCV4VCCurrency addVideoCredit]

 

ORIGINAL OFFSET and INSTRUCTIONS:

_text:00617A3A                 ADDS            R3, #1

MODIFIED OFFSET and INSTRUCTION:

_text:00617A3A                 ADDS            R3, #0xC8

^: I had assumed that the original offset instructions meant that after you watch the video, you will receive 1 Bloonstone, which would be added to the R3 register, so I modified it to #0xC8 (200) instead of 1.....I thought this would give out 200 Bloonstones instead of 1 after watching the video. Didn't work.

 

 

 

SEARCHED FUNCTION: -[ADCV4VCCurrency checkReward]

 

ORIGINAL OFFSET and INSTRUCTIONS:

__text:00617AA0                 LDR             R1, [R1] ; int_ video_credit_balance

MODIFIED OFFSET and INSTRUCTION:

__text:00617AA0                 LDR             R1, [R7]

^: I figured that I could change the amount of Bloonstones received from watching a video with this function since the previous modification didn't work. I thought I could load (LDR) the R7 (high amount) register into R1....but still nothing happened.

 

 

 

 

Here's a list of searched functions that I've encountered that I *THINK* are hackable:

 

 

-[ADCV4VCCurrency addVideoCredit]

-[ADCV4VCCurrency checkReward]

-[ADCV4VCCurrency onReward]

-[ADCV4VCCurrency reward_name]

-[ADCV4VCCurrency videos_per_reward]

-[ADCV4VCCurrency video_credit_balance]

-[ADCV4VCCurrency reward_amount]

-[ADCV4VCCurrency balance]

-[ADCV4VCCurrency client_side]

 

 

Just to let you know, I'm not using GDB (are you?) and the iOS device that I'm using to test this hack is an iPad Air 2 (64-bit architecture, right?), so will hacking the 32-bit part of the binary work on my device as it is or do I also have to hack the 64-bit part?  Could you please lead me into the right direction so I could at least get something to work with hacking this game?  Sorry for the trouble, and thank you for your help thus far!

Updated by TripMX
Posted

Okay, thanks, I've tried to hack the 32-bit cracked binary, but still no success. Here's what I've done:

I've hacked the following in the Monkey City code:SEARCHED FUNCTION: -[ADCV4VCCurrency addVideoCredit]ORIGINAL OFFSET and INSTRUCTIONS:

 

_text:00617A3A                 ADDS            R3, #1
MODIFIED OFFSET and INSTRUCTION:

_text:00617A3A                 ADDS            R3, #0xC8
^: I had assumed that the original offset instructions meant that after you watch the video, you will receive 1 Bloonstone, which would be added to the R3 register, so I modified it to #0xC8 (200) instead of 1.....I thought this would give out 200 Bloonstones instead of 1 after watching the video. Didn't work.SEARCHED FUNCTION: -[ADCV4VCCurrency checkReward]ORIGINAL OFFSET and INSTRUCTIONS:

__text:00617AA0                 LDR             R1, [R1] ; int_ video_credit_balance
MODIFIED OFFSET and INSTRUCTION:

__text:00617AA0                 LDR             R1, [R7]
^: I figured that I could change the amount of Bloonstones received from watching a video with this function since the previous modification didn't work. I thought I could load (LDR) the R7 (high amount) register into R1....but still nothing happened.Here's a list of searched functions that I've encountered that I *THINK* are hackable:

 

 

 

 

Just to let you know, I'm not using GDB (are you?) and the iOS device that I'm using to test this hack is an iPad Air 2 (64-bit architecture, right?), so will hacking the 32-bit part of the binary work on my device as it is or do I also have to hack the 64-bit part?  Could you please lead me into the right direction so I could at least get something to work with hacking this game?  Sorry for the trouble, and thank you for your help thus far!

That isn't going to work. Look for the in-game currencies. You have to manually thin and replace the old binary with the thinned binary.

 

I don't think I will be able to guide you through the whole process, as it will take so long, but there are several tutorials posted on the Tut mortals section.

Posted

That isn't going to work. Look for the in-game currencies. You have to manually thin and replace the old binary with the thinned binary.

I don't think I will be able to guide you through the whole process, as it will take so long, but there are several tutorials posted on the Tut mortals section.

Okay, after taking a look at some of the tutorials here, I've discovered that I could manually thin the binary so that I could simply get rid of the 64-bit ARM portion AND somehow attempt to remove ASLR, supposedly making it "easier" to find the correct functions/memory addresses....so I'll try that.

 

When you hacked Monkey City, did you use GDB or purely used your eyes with IDA Pro?

Posted

Okay, after taking a look at some of the tutorials here, I've discovered that I could manually thin the binary so that I could simply get rid of the 64-bit ARM portion AND somehow attempt to remove ASLR, supposedly making it "easier" to find the correct functions/memory addresses....so I'll try that.

 

When you hacked Monkey City, did you use GDB or purely used your eyes with IDA Pro?

Strings with IDA, I haven't tried GDB/LLDB yet.

Posted

Strings with IDA, I haven't tried GDB/LLDB yet.

 

I see I see, so here's the new situation:

 

 

I have done these things:

  • Properly cracked Monkey City's binary
  • Thinned the binary
  • Removed ASLR

 

 

Now, I have two cracked binaries:

  • Monkey City binary CRACKED (ASLR removed)
  • Monkey City binary CRACKED + THINNED (ASLR removed)

 

 

My iOS device is an iPad Air 2 running iOS 8.3 [ARMv8 (64-bit)]

 

 

 

 

....so, what should I do next in IDA Pro?  From my above posts, you can see that I've failed to get results.  

What specific offset/function should I seek to alter to actually get some results on my current iOS device to prove that I'm at least capable of getting results?

 

 

 

To make things simple, could you just tell me which function to find and which offset to target (the same one you used)?  Also, it MUST be able to work on my current iOS device, so that's why I need to know if I'm going to be hacking the thinned cracked binary or original cracked binary for the sake of it working on my ARMv8 [64-bit] device.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Mob Control v2.89.4 +7 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Mob Control By Voodoo
      Bundle ID: com.vincentb.MobControl
      iTunes Store Link: https://apps.apple.com/us/app/mob-control/id1562817072?uo=4


      Hack Features:
      - Unlimited Coins -> Earn or spend some.
      - Unlimited Skip'Its -> Earn or spend some.
      - Unlimited Stars -> Earn some.
      - Unlimited Bricks
      - Unlimited Earnt Bricks
      - Unlimited Cards -> Will increase instead of decrease.
      - No Card Requirement


      Jailbreak required hack(s): [Mod Menu Hack] Mob Control v2.78.0 +7 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
      • 224 replies
    • Mob Control v2.89.4 +7 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Mob Control By Voodoo
      Bundle ID: com.vincentb.MobControl
      iTunes Store Link: https://apps.apple.com/us/app/mob-control/id1562817072?uo=4


      Hack Features:
      - Unlimited Coins -> Earn or spend some.
      - Unlimited Skip'Its -> Earn or spend some.
      - Unlimited Stars -> Earn some.
      - Unlimited Bricks
      - Unlimited Earnt Bricks
      - Unlimited Cards -> Will increase instead of decrease.
      - No Card Requirement


      Non-Jailbroken & No Jailbreak required hack(s): [IPA Mod Menu] Mob Control v2.78.0 +7 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
      • 128 replies
    • Grimguard Tactics: Fantasy RPG v1.14.0 +3 Jailed Cheats [ Auto Win ]
      Modded/Hacked App: Grimguard Tactics: Fantasy RPG By Outerdawn Limited
      Bundle ID: com.outerdawn.grimguard
      iTunes Store Link: https://apps.apple.com/us/app/grimguard-tactics-fantasy-rpg/id1496893856?uo=4


      Hack Features:
      - Auto Win
      - Unlimited Daily Rewards
      - No Stamina Cost


      Jailbreak required hack(s): [Mod Menu Hack] Grimguard Tactics: Fantasy RPG v1.1.10 +3 Cheats [ Auto Win ] - ViP Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Like
      • 123 replies
    • Grimguard Tactics: Fantasy RPG v1.14.0 +3 Cheats [ Auto Win ]
      Modded/Hacked App: Grimguard Tactics: Fantasy RPG By Outerdawn Limited
      Bundle ID: com.outerdawn.grimguard
      iTunes Store Link: https://apps.apple.com/us/app/grimguard-tactics-fantasy-rpg/id1496893856?uo=4


      Hack Features:
      - Auto Win
      - Unlimited Daily Rewards
      - No Stamina Cost


      Non-Jailbroken & No Jailbreak required hack(s): [IPA Mod Menu] Grimguard Tactics: Fantasy RPG v1.1.10 +3 Jailed Cheats [ Auto Win ] - ViP Non-Jailbroken Hacks & Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Like
      • 96 replies
    • Modern Community v1.17004.194765 +1++ Jailed Cheat [ Unlimited Everything ]
      Modded/Hacked App: Modern Community By Magic Tavern, Inc.
      Bundle ID: com.sts.vision
      iTunes Store Link: https://apps.apple.com/us/app/modern-community/id6447748647?uo=4


      Hack Features:
      - Unlimited Everything


      Jailbreak required hack(s): [Mod Menu Hack] Modern Community v1.1008.81088 +1++ Cheat [ Unlimited Everything ] - ViP Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Like
      • 102 replies
    • Modern Community v1.17004.194765 +1++ Cheat [ Unlimited Everything ]
      Modded/Hacked App: Modern Community By Magic Tavern, Inc.
      Bundle ID: com.sts.vision
      iTunes Store Link: https://apps.apple.com/us/app/modern-community/id6447748647?uo=4


      Hack Features:
      - Unlimited Everything


      Non-Jailbroken & No Jailbreak required hack(s): [No Jailbreak Required] Modern Community v1.1008.81088 +1++ Jailed Cheat [ Unlimited Everything ] - ViP Non-Jailbroken Hacks & Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Thanks
        • Like
      • 62 replies
    • MIST: Horror Idle Survival RPG v1.8.3 +4 Jailed Cheats [ Damage + More ]
      Modded/Hacked App: MIST: Horror Idle Survival RPG By Anton Nazarov
      Bundle ID: com.eg.mist.horror.idle.rpg
      iTunes Store Link: https://apps.apple.com/us/app/mist-horror-idle-survival-rpg/id6499312165?uo=4


      Hack Features:
      - God Mode
      - Damage Multiplier
      - Unlimited Resources/Currencies -> Will not decrease.
      - Unlock All Skill Slots -> Slots will cost nothing to unlock then after disable this feature to use the slots.


      Jailbreak required hack(s): [Mod Menu Hack] MIST: Horror Idle Survival RPG v1.2 +4 Cheats [ Damage Multiplier ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 19 replies
    • MIST: Horror Idle Survival RPG v1.8.3 +4 Cheats [ Damage + More ]
      Modded/Hacked App: MIST: Horror Idle Survival RPG By Anton Nazarov
      Bundle ID: com.eg.mist.horror.idle.rpg
      iTunes Store Link: https://apps.apple.com/us/app/mist-horror-idle-survival-rpg/id6499312165?uo=4


      Hack Features:
      - God Mode
      - Damage Multiplier
      - Unlimited Resources/Currencies -> Will not decrease.
      - Unlock All Skill Slots -> Slots will cost nothing to unlock then after disable this feature to use the slots.


      Non-Jailbroken & No Jailbreak required hack(s): [IPA Mod Menu] MIST: Horror Idle Survival RPG v1.2 +4 Jailed Cheats [ Damage Multiplier ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 47 replies
    • Nuclear Day Survival v0.139.7 +5 Jailed Cheats [ Unlimited Stats ]
      Modded/Hacked App: Nuclear Day Survival By APPWILL COMPANY LTD
      Bundle ID: com.somniumfabri.nuclearday
      iTunes Store Link: https://apps.apple.com/us/app/nuclear-day-survival/id1666266916?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - Unlimited Hunger
      - Unlimited Water
      - Unlimited Health
      - Unlimited Energy
      - No Radiation
      • 12 replies
    • Nuclear Day Survival v0.139.7 +5 Cheats [ Unlimited Stats ]
      Modded/Hacked App: Nuclear Day Survival By APPWILL COMPANY LTD
      Bundle ID: com.somniumfabri.nuclearday
      iTunes Store Link: https://apps.apple.com/us/app/nuclear-day-survival/id1666266916?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - Unlimited Hunger
      - Unlimited Water
      - Unlimited Health
      - Unlimited Energy
      - No Radiation
      • 14 replies
    • Lost Enders v1.9.6 +3 Jailed Cheats [ God / O-HK ]
      Modded/Hacked App: Lost Enders By makoto takeuchi
      Bundle ID: jp.co.kurukurugames.lostenders
      iTunes Store Link: https://apps.apple.com/us/app/lost-enders/id6502868763?uo=4


      Hack Features:
      - God Mode
      - One-Hit Kill


      Jailbreak required hack(s): [Mod Menu Hack] Lost Enders v1.0.4 +2 Cheats [ God / O-HK ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 37 replies
    • Lost Enders v1.9.6 +3 Cheats [ God / O-HK ]
      Modded/Hacked App: Lost Enders By makoto takeuchi
      Bundle ID: jp.co.kurukurugames.lostenders
      iTunes Store Link: https://apps.apple.com/us/app/lost-enders/id6502868763?uo=4


      Hack Features:
      - God Mode
      - One-Hit Kill


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Lost Enders v1.0.4 +2 Jailed Cheats [ God / O-HK ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 70 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines