Jump to content

[Question] Can somebody give me an IDA assignment?


Go to solution Solved by Diversityy,

9 posts in this topic

Recommended Posts

Posted

Hello fellow IDA hackers,

 

Some weeks ago, I had posted a thread asking for help with IDA hacking, but the problem (although assumingly basic) still wasn't solved.

 

THREAD HERE: https://iosgods.com/topic/32534-ida-attempt-trouble-with-ida-hacking/?view=findpost&p=1109430

 

 

So, I'm asking an IDA hacker to give me an easy assignment.  Assign me an iOS app/game to hack.

 

All I require is for you to personally hack the binary first to prove that the hack works before giving me the assignment, as I want to reproduce the same results.

 

 

Thanks in advance! :)

 

Posted (edited)

Monkey City, I posted a cheat yesterday for it. You can also try PvZ2.

 

Hey Diversityy, thank you so much for taking the time to give me an IDA assignment! :)

 

I've tried to hack the game (Monkey City) with IDA Pro, but I can't seem to find any registers (the "R0, R1" etc.-type), I only see the "X0, X1," etc.-type, and I don't think I could just store (STR) an "R7" value into them because it doesn't work like that in x64 bit.  I searched for "currency" and found lots of functions.

 

 

Can you give me a hint on what I should do?

 

BTW, are you using GDB to find the offsets or are you purely using IDA Pro to view, read through, and find the the offsets/critical instructions in the functions manually?

Updated by TripMX
Posted

Hey Diversityy, thank you so much for taking the time to give me an IDA assignment! :)

 

I've tried to hack the game (Monkey City) with IDA Pro, but I can't seem to find any registers (the "R0, R1" etc.-type), I only see the "X0, X1," etc.-type, and I don't think I could just store (STR) an "R7" value into them because it doesn't work like that in x64 bit.  I searched for "currency" and found lots of functions.

 

 

Can you give me a hint on what I should do?

 

BTW, are you using GDB to find the offsets or are you purely using IDA Pro to view, read through, and find the the offsets/critical instructions in the functions manually?

You're seeing X1, because you're hacking the 64-bit portion of the binary. I modded 32-bit.

 

To get the 32-bit, you have to download the .ipa from iTunes. Install the .ipa via iFunBox. Crack the game via Rasticrac.

Posted (edited)

You're seeing X1, because you're hacking the 64-bit portion of the binary. I modded 32-bit.

 

To get the 32-bit, you have to download the .ipa from iTunes. Install the .ipa via iFunBox. Crack the game via Rasticrac.

Okay, thanks, I've tried to hack the 32-bit cracked binary, but still no success. Here's what I've done:

 

I've hacked the following in the Monkey City code:

 

 

SEARCHED FUNCTION: -[ADCV4VCCurrency addVideoCredit]

 

ORIGINAL OFFSET and INSTRUCTIONS:

_text:00617A3A                 ADDS            R3, #1

MODIFIED OFFSET and INSTRUCTION:

_text:00617A3A                 ADDS            R3, #0xC8

^: I had assumed that the original offset instructions meant that after you watch the video, you will receive 1 Bloonstone, which would be added to the R3 register, so I modified it to #0xC8 (200) instead of 1.....I thought this would give out 200 Bloonstones instead of 1 after watching the video. Didn't work.

 

 

 

SEARCHED FUNCTION: -[ADCV4VCCurrency checkReward]

 

ORIGINAL OFFSET and INSTRUCTIONS:

__text:00617AA0                 LDR             R1, [R1] ; int_ video_credit_balance

MODIFIED OFFSET and INSTRUCTION:

__text:00617AA0                 LDR             R1, [R7]

^: I figured that I could change the amount of Bloonstones received from watching a video with this function since the previous modification didn't work. I thought I could load (LDR) the R7 (high amount) register into R1....but still nothing happened.

 

 

 

 

Here's a list of searched functions that I've encountered that I *THINK* are hackable:

 

 

-[ADCV4VCCurrency addVideoCredit]

-[ADCV4VCCurrency checkReward]

-[ADCV4VCCurrency onReward]

-[ADCV4VCCurrency reward_name]

-[ADCV4VCCurrency videos_per_reward]

-[ADCV4VCCurrency video_credit_balance]

-[ADCV4VCCurrency reward_amount]

-[ADCV4VCCurrency balance]

-[ADCV4VCCurrency client_side]

 

 

Just to let you know, I'm not using GDB (are you?) and the iOS device that I'm using to test this hack is an iPad Air 2 (64-bit architecture, right?), so will hacking the 32-bit part of the binary work on my device as it is or do I also have to hack the 64-bit part?  Could you please lead me into the right direction so I could at least get something to work with hacking this game?  Sorry for the trouble, and thank you for your help thus far!

Updated by TripMX
Posted

Okay, thanks, I've tried to hack the 32-bit cracked binary, but still no success. Here's what I've done:

I've hacked the following in the Monkey City code:SEARCHED FUNCTION: -[ADCV4VCCurrency addVideoCredit]ORIGINAL OFFSET and INSTRUCTIONS:

 

_text:00617A3A                 ADDS            R3, #1
MODIFIED OFFSET and INSTRUCTION:

_text:00617A3A                 ADDS            R3, #0xC8
^: I had assumed that the original offset instructions meant that after you watch the video, you will receive 1 Bloonstone, which would be added to the R3 register, so I modified it to #0xC8 (200) instead of 1.....I thought this would give out 200 Bloonstones instead of 1 after watching the video. Didn't work.SEARCHED FUNCTION: -[ADCV4VCCurrency checkReward]ORIGINAL OFFSET and INSTRUCTIONS:

__text:00617AA0                 LDR             R1, [R1] ; int_ video_credit_balance
MODIFIED OFFSET and INSTRUCTION:

__text:00617AA0                 LDR             R1, [R7]
^: I figured that I could change the amount of Bloonstones received from watching a video with this function since the previous modification didn't work. I thought I could load (LDR) the R7 (high amount) register into R1....but still nothing happened.Here's a list of searched functions that I've encountered that I *THINK* are hackable:

 

 

 

 

Just to let you know, I'm not using GDB (are you?) and the iOS device that I'm using to test this hack is an iPad Air 2 (64-bit architecture, right?), so will hacking the 32-bit part of the binary work on my device as it is or do I also have to hack the 64-bit part?  Could you please lead me into the right direction so I could at least get something to work with hacking this game?  Sorry for the trouble, and thank you for your help thus far!

That isn't going to work. Look for the in-game currencies. You have to manually thin and replace the old binary with the thinned binary.

 

I don't think I will be able to guide you through the whole process, as it will take so long, but there are several tutorials posted on the Tut mortals section.

Posted

That isn't going to work. Look for the in-game currencies. You have to manually thin and replace the old binary with the thinned binary.

I don't think I will be able to guide you through the whole process, as it will take so long, but there are several tutorials posted on the Tut mortals section.

Okay, after taking a look at some of the tutorials here, I've discovered that I could manually thin the binary so that I could simply get rid of the 64-bit ARM portion AND somehow attempt to remove ASLR, supposedly making it "easier" to find the correct functions/memory addresses....so I'll try that.

 

When you hacked Monkey City, did you use GDB or purely used your eyes with IDA Pro?

Posted

Okay, after taking a look at some of the tutorials here, I've discovered that I could manually thin the binary so that I could simply get rid of the 64-bit ARM portion AND somehow attempt to remove ASLR, supposedly making it "easier" to find the correct functions/memory addresses....so I'll try that.

 

When you hacked Monkey City, did you use GDB or purely used your eyes with IDA Pro?

Strings with IDA, I haven't tried GDB/LLDB yet.

Posted

Strings with IDA, I haven't tried GDB/LLDB yet.

 

I see I see, so here's the new situation:

 

 

I have done these things:

  • Properly cracked Monkey City's binary
  • Thinned the binary
  • Removed ASLR

 

 

Now, I have two cracked binaries:

  • Monkey City binary CRACKED (ASLR removed)
  • Monkey City binary CRACKED + THINNED (ASLR removed)

 

 

My iOS device is an iPad Air 2 running iOS 8.3 [ARMv8 (64-bit)]

 

 

 

 

....so, what should I do next in IDA Pro?  From my above posts, you can see that I've failed to get results.  

What specific offset/function should I seek to alter to actually get some results on my current iOS device to prove that I'm at least capable of getting results?

 

 

 

To make things simple, could you just tell me which function to find and which offset to target (the same one you used)?  Also, it MUST be able to work on my current iOS device, so that's why I need to know if I'm going to be hacking the thinned cracked binary or original cracked binary for the sake of it working on my ARMv8 [64-bit] device.

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Jurassic World Alive v3.14.53 - [ Dino Don't Move & More ]
      Modded/Hacked App: Jurassic World Alive By Ludia
      Bundle ID: com.ludia.jw2
      iTunes Store Link: https://apps.apple.com/us/app/jurassic-world-alive/id1231085864


      Hack Features:
      - Dino Don't Move
      - Inf. Battery
      - VIP Enabled

      This hack is an In-Game Mod Menu (iGMM). In order to activate the Mod Menu, tap on the iOSGods button found inside the app. This hack works on the latest x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, SE, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,686 replies
    • June’s Journey: Hidden Objects v3.37.2 Jailed Cheats +2
      Modded/Hacked App: June’s Journey: Hidden Objects By wooga gmbh
      Bundle ID: net.wooga.junes-journey-hidden-object-mystery-game
      iTunes Store Link: https://apps.apple.com/us/app/junes-journey-hidden-objects/id1200391796?uo=4


      Hack Features:
      - Infinite Currencies
      - Instant Hint


      iOS Hack Download IPA Link: https://iosgods.com/topic/176104-june%E2%80%99s-journey-hidden-objects-v2946-jailed-cheats-2/
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 46 replies
    • Frost World v1.0.2 +8 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Frost World By Estoty LLC
      Bundle ID: com.winter.breaker
      App Store Link: https://apps.apple.com/us/app/frost-world/id6738846199?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Unlimited Everything -> Will increase instead of decrease.
      - Tool Damage Multiplier
      - Speed Multiplier
      - Freeze Temperature
      - Free In-App Purchases
        • Like
      • 2 replies
    • Frost World v1.0.2 +8 Cheats [ Damage & Defence ]
      Modded/Hacked App: Frost World By Estoty LLC
      Bundle ID: com.winter.breaker
      App Store Link: https://apps.apple.com/us/app/frost-world/id6738846199?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Unlimited Everything -> Will increase instead of decrease.
      - Tool Damage Multiplier
      - Speed Multiplier
      - Freeze Temperature
      - Free In-App Purchases
      • 3 replies
    • Loot Heroes v1.6.9 +10 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Loot Heroes: Fantasy RPG Games By BoomBit, Inc.
      Bundle ID: com.bbp.lootheroes
      iTunes Store Link: https://apps.apple.com/us/app/loot-heroes-fantasy-rpg-games/id6642699678?uo=4


      Hack Features:
      - Freeze Currencies
      - God Mode -> Traps still cause damage.
      - One-Hit Kill
      - All Heroes Unlocked
      - All Skins Unlocked
      - No Skill Cooldown
      - No Ads

      VIP
      - Unlimited Currencies -> Earn some.
      - Auto Win
      - Battle Pass Unlocked
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 114 replies
    • Loot Heroes v1.6.9 +10 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Loot Heroes By BoomBit, Inc.
      Bundle ID: com.bbp.lootheroes
      iTunes Store Link: https://apps.apple.com/us/app/loot-heroes/id6642699678?uo=4


      Hack Features:
      - Freeze Currencies
      - God Mode -> Traps still cause damage.
      - One-Hit Kill
      - All Heroes Unlocked
      - All Skins Unlocked
      - No Skill Cooldown
      - No Ads

      VIP
      - Unlimited Currencies -> Earn some.
      - Auto Win
      - Battle Pass Unlocked
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 256 replies
    • Nightfall: Kingdom Frontier TD v1.0.404 +8 Jailed Cheats [ Currencies ]
      Modded/Hacked App: Nightfall: Kingdom Frontier TD By Fansipan Limited
      Bundle ID: com.fansipan.nightfall.tower.simulation.strategy.td.game
      iTunes Store Link: https://apps.apple.com/us/app/nightfall-kingdom-frontier-td/id6621272416?uo=4


      Hack Features:
      - God Mode
      - Unlimited In-Game Coins -> Will increase instead of decrease.
      - Unlimited Currencies -> Will increase instead of decrease.
      - No Ads
      - Add 1K Currency -> Head over to Settings and toggle the Discord button. [ VIP ]
      - Unlock All Features -> Head over to Settings and toggle the Discord button. [ VIP ]
      - Unlock All / Everything ->  Head over to Settings and toggle the Discord button. [ VIP ]
      - Complete Tutorial -> Head over to Settings and toggle the Discord button. [ VIP ]


      Jailbreak required hack(s): [Mod Menu Hack] Nightfall: Kingdom Frontier TD v1.0.41 +8 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 95 replies
    • Dawn of Ages: Medieval Games v2.0.5 +5 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Dawn of Ages: total war battle By BoomBit, Inc.
      Bundle ID: com.stratospheregames.dawnofages
      App Store Link: https://apps.apple.com/us/app/dawn-of-ages-total-war-battle/id6477473268?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Dumb Enemy
      - Premium Enabled
        • Agree
        • Like
      • 54 replies
    • Dawn of Ages: Medieval Games v2.0.5 +5 Cheats [ Damage & Defence ]
      Modded/Hacked App: Dawn of Ages: total war battle By BoomBit, Inc.
      Bundle ID: com.stratospheregames.dawnofages
      App Store Link: https://apps.apple.com/us/app/dawn-of-ages-total-war-battle/id6477473268?uo=4

       
       

      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Dumb Enemy
      - Premium Enabled
        • Thanks
        • Winner
        • Like
      • 32 replies
    • Goblins Wood: Tycoon Idle Sim v2.49.1 +1++ Jailed Cheat [ Unlimited Currencies ]
      Modded/Hacked App: Goblins Wood: Tycoon Idle Sim By ProGamesLab LTD
      Bundle ID: idle.goblins.wood.tycoon
      iTunes Store Link: https://apps.apple.com/us/app/goblins-wood-tycoon-idle-sim/id6446766326?uo=4


      Hack Features:
      - Unlimited Currencies -> Will increase instead of decrease.


      Jailbreak required hack(s): [Mod Menu Hack] Goblins Wood: Tycoon Idle Sim v2.42.0 +1++ Cheat [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Thanks
        • Winner
        • Like
      • 26 replies
    • Goblins Wood: Tycoon Idle Sim v2.49.1 +1++ Cheat [ Unlimited Currencies ]
      Modded/Hacked App: Goblins Wood: Tycoon Idle Sim By ProGamesLab LTD
      Bundle ID: idle.goblins.wood.tycoon
      iTunes Store Link: https://apps.apple.com/us/app/goblins-wood-tycoon-idle-sim/id6446766326?uo=4


      Hack Features:
      - Unlimited Currencies -> Will increase instead of decrease.


      Non-Jailbroken & No Jailbreak required hack(s): [IPA Mod Menu] Goblins Wood: Tycoon Idle Sim v2.42.0 +1++ Jailed Cheat [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Winner
        • Like
      • 33 replies
    • Nightfall: Kingdom Frontier TD v1.0.404 +8 Cheats [ Currencies ]
      Modded/Hacked App: Nightfall: Kingdom Frontier TD By Fansipan Limited
      Bundle ID: com.fansipan.nightfall.tower.simulation.strategy.td.game
      iTunes Store Link: https://apps.apple.com/us/app/nightfall-kingdom-frontier-td/id6621272416?uo=4


      Hack Features:
      - God Mode
      - Unlimited In-Game Coins -> Will increase instead of decrease.
      - Unlimited Currencies -> Will increase instead of decrease.
      - No Ads
      - Add 1K Currency -> Head over to Settings and toggle the Discord button. [ VIP ]
      - Unlock All Features -> Head over to Settings and toggle the Discord button. [ VIP ]
      - Unlock All / Everything ->  Head over to Settings and toggle the Discord button. [ VIP ]
      - Complete Tutorial -> Head over to Settings and toggle the Discord button. [ VIP ]


      Non-Jailbroken & No Jailbreak required hack(s): [IPA Mod Menu] Nightfall: Kingdom Frontier TD v1.0.41 +8 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 106 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines