Jump to content

Dump decrypted DLL file with IDA Pro


ThePianoGuy

5 posts in this topic

Recommended Posts

Note: This tutorial was created by xiaobaiyey and written in chinese. This tutorial is poorly translated from Google Translation but i have fixed some grammar to make it easier to understand.

 
reviously I read an article by hook decrypting the encrypted dll Unity3D, recently new to dynamic, so they can try the next through IDA, the same as the shelling, dump the decrypted dll file, try the next, it really can, in here to share under
 
Requirements:
Tools: ida6.6 millet 2s
Game: Monthly Dragon knife (just find a game)
Enable USB-debugging in Developer Options
 
Open lib in IDA:
Unzip lib folder from the APK, drag the file libmono.so to IDA
Several functions mainly in the upper and lower breakpoint (refer mono source )

mono_image_open_from_data_full
mono_image_open_from_data
mono_image_open_from_data_with_name

 
In a decryption process can about these function
 
View the final in front of a function call or mono_image_open_from_data_with_name,
 
Enable Developer Options:
If Developer Option does not show in settings, follow the steps below.
1. Open Settings > About
2. Then tap “Build number” seven times to enable Developer options....
3. Go back to Settings menu and now you'll be able to see “Developer options” there.
4. Tap it and turn on USB Debugging
 
Dynamic debugging:
If the app has anti-debugging, you need to skip meals to debug, the following brief dynamic debugging Preparations (there are many online tutorials dynamic debugging)
 
Get android_server file from IDA PRO 6.6\ida66\dbgsrv or download the file HERE!
 
Push android_server file to the phone
 
1:

adb push android_server /data/local/tmp/ 

2:

adb shell

3:

cd /data/data/tmp/ 

4:

chmod 777 android_server

5:

./android_server 

Port Forwarding:
 

adb forward tcp:23946 tcp:23946

 
Debug startup app:
 

adb shell am start -D -n com.huiguan.qinglong.taiqi.dl/com.huiguan.qlyyd.UnityPlayerNativeActivity

 
Check the app's PID:
 
1.

adb shell 

2.

ps | grep dl

 
Record the PID and Forwarding (pid can be seen in the ida)

adb forward tcp:8700 jdwp:PID

Setting ida (the main settings hostname: 127.0.0.1) and open the attach process (wait for the program to automatically break live, live off later)
 
Run app (in the f9 at ifa)
This time in the cmd window run jdb debugger:
 

jdb -connect com.sun.jdi.SocketAttach:hostname=127.0.0.1,port=8700 

This time can be debugged
Run app will break on the linker
 
NQa1Qvs.png
 
Then if the app is no anti-molestation: running directly f9
This window appears: same point
 
LJ0ND9m.png
 
Wait a moment, will end on Linker , directly connected to f9 op row
If this window appears, select "yes (pass to app)" without waiting
 
O32G2yG.png
 
Many may appear behind all this window select yes and then run f9
Finally broken in the mono_image_open_from_data_with_name, method
Loading is not the first time we want to skip dll
 
9UOufTB.png
 
If you can not read f5 look at the source code, source code demonstrate this direct f5, where he rewrote momo source

int __fastcall mono_image_open_from_data_with_name (int a1, char * haystack, int a3, int a4, char a5, char * haystacka)

 
Several key parameters

// NT A1 read dll file offset address
// Char * haystack, DLL file size
// Char * haystacka , file name

 
9MBWsmY.png
 
This time following the R1 register to see the encrypted DLL file address, indicating the DLL has not yet begun to decrypt, decryption may later. And laid down the road to change a single note of each register after a simple loop
 
The dll decrypted
This time it decrypted DLL in memory,
 
sJ21pCZ.png
 
This time it can have a dump,
 
Check Register Window: Find R6 and R11
The entire file offset start R6 = 7B95304C
End offset address R6 = R11 7B95304C + 3AF200 = 7BD0224C
 
Use; dump dex scripts
 

auto fp, dexAddress;
fp = fopen ( "D:\\Test.dll", "wb");
for (dexAddress = 0x7B95304C; dexAddress < 0x7BD0224C; dexAddress ++)
fputc (Byte(dexAddress), FP);

 
Under run on ok
Decryption out the effect,
 
Attach the original dll and decrypted dll
 
Credit:
xiaobaiyey

Link to comment
https://iosgods.com/topic/34440-dump-decrypted-dll-file-with-ida-pro/
Share on other sites

Archived

This topic is now archived and is closed to further replies.

  • Our picks

    • Zooba: Zoo Battle Royale Game v4.73.1 Jailed Cheats +2
      Modded/Hacked App: Zooba: Zoo Battle Royale Games By Wildlife Studios Limited
      Bundle ID: com.fungames.battleroyale
      iTunes Store Link: https://apps.apple.com/us/app/zooba-zoo-battle-royale-games/id1459402952?uo=4


      Hack Features:
      - Map Hacks
      - Allow Shoot in Water


      Jailbreak required hack(s): https://iosgods.com/topic/131104-arm64-zooba-zoo-battle-royale-game-cheats-all-versions-2/


      iOS Hack Download Link: https://iosgods.com/topic/131134-arm64-zooba-zoo-battle-royale-game-v320-jailed-cheats-2/
      • 1,230 replies
    • Hunt Royale: Action RPG Battle v3.3.1 +3 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Hunt Royale: Action RPG Battle By BoomBit, Inc.
      Bundle ID: com.hunt.royale
      iTunes Store Link: https://apps.apple.com/us/app/hunt-royale-action-rpg-battle/id1537379121?uo=4

       
       

      🚀 Hack Features

      - Dumb Enemies

      VIP
      - Damage Multiplier
      - Defence Multiplier


      🍏 Jailbreak iOS hacks: [Mod Menu Hack] Hunt Royale: Action RPG Battle v3.2.7 +3 Cheats [ Damage & Defence ] - Free Jailbroken Cydia Cheats - iOSGods
      🤖 Modded Android APKs: https://iosgods.com/forum/68-android-section/
      • 28 replies
    • Hunt Royale: Action RPG Battle v3.3.1 +3 Cheats [ Damage & Defence ]
      Modded/Hacked App: Hunt Royale: Action RPG Battle By BoomBit, Inc.
      Bundle ID: com.hunt.royale
      iTunes Store Link: https://apps.apple.com/us/app/hunt-royale-action-rpg-battle/id1537379121?uo=4

       
       

      🚀 Hack Features

      - Dumb Enemies

      VIP
      - Damage Multiplier
      - Defence Multiplier


      🍏 For Non-Jailbroken & No Jailbreak required hacks: [IPA Mod Menu] Hunt Royale: Action RPG Battle v3.2.7 +3 Jailed Cheats [ Damage & Defence ] - Free Non-Jailbroken IPA Cheats - iOSGods
      🤖 Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      • 24 replies
    • Loot Heroes v1.3.4 +8 Jailed Cheats [ Unlimited Currencies + More ]
      Modded/Hacked App: Loot Heroes: Fantasy RPG Games By BoomBit, Inc.
      Bundle ID: com.bbp.lootheroes
      iTunes Store Link: https://apps.apple.com/us/app/loot-heroes-fantasy-rpg-games/id6642699678?uo=4


      Hack Features:
      - Freeze Currencies
      - Unlimited Currencies [ VIP ]
      - God Mode -> Traps still cause damage.
      - One-Hit Kill
      - All Heroes Unlocked
      - Auto Win [ VIP ]
      - Battle Pass Unlocked [ VIP ]


      Jailbreak required hack(s): [Mod Menu Hack] Loot Heroes v1.1.5 +8 Cheats [ Unlimited Currencies + More ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 39 replies
    • Loot Heroes v1.3.4 +8 Cheats [ Unlimited Currencies + More ]
      Modded/Hacked App: Loot Heroes By BoomBit, Inc.
      Bundle ID: com.bbp.lootheroes
      iTunes Store Link: https://apps.apple.com/us/app/loot-heroes/id6642699678?uo=4


      Hack Features:
      - Freeze Currencies
      - Unlimited Currencies [ VIP ]
      - God Mode -> Traps still cause damage.
      - One-Hit Kill
      - All Heroes Unlocked
      - Auto Win [ VIP ]
      - Battle Pass Unlocked [ VIP ]


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 158 replies
    • Good Coffee, Great Coffee v1.0.1 +2 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Coffee, Great Coffee By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.coffeebusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-coffee-great-coffee/id1603584945?uo=4
       
       

      🤩 Hack Features

      - Unlimited Cash
      - Unlimited Gems
      • 3 replies
    • Good Coffee, Great Coffee v1.0.1 +2 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Coffee, Great Coffee By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.coffeebusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-coffee-great-coffee/id1603584945?uo=4

       
       

      🤩 Hack Features

      - Unlimited Cash
      - Unlimited Gems
      • 11 replies
    • Smashero.io - Hack N Slash RPG v1.13.0 +2 Jailed Cheats [ God / O-HK ]
      Modded/Hacked App: Smashero.io - Hack N Slash RPG By CANNON CRACKER, Inc.
      Bundle ID: com.cc.Smashero
      iTunes Store Link: https://apps.apple.com/us/app/smashero-io-hack-n-slash-rpg/id6505129091?uo=4


      Hack Features:
      - God Mode
      - One-Hit Kill


      Jailbreak required hack(s): [Mod Menu Hack] Smashero.io - Hack N Slash RPG v3.3 +2 Cheats [ God / O-HK ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 19 replies
    • Smashero.io - Hack N Slash RPG v1.13.0 +2 Cheats [ God / O-HK ]
      Modded/Hacked App: Smashero.io - Hack N Slash RPG By CANNON CRACKER, Inc.
      Bundle ID: com.cc.Smashero
      iTunes Store Link: https://apps.apple.com/us/app/smashero-io-hack-n-slash-rpg/id6505129091?uo=4


      Hack Features:
      - God Mode
      - One-Hit Kill


      Non-Jailbroken & No Jailbreak required hack(s): [No Jailbreak Required] Smashero.io - Hack N Slash RPG v3.3 +2 Jailed Cheats [ God / O-HK ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 49 replies
    • Modded/Hacked App: Hexapolis - Civilization game By NOXGAMES s.r.o.
      Bundle ID: com.noxgames.hex.polis.civilization.empire
      iTunes Store Link: https://apps.apple.com/us/app/hexapolis-civilization-game/id1559236448?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - IAP FREE [ Buy Anything Gems Gold ]

      - Max DMG [ Upgrade Trop ]

      - Max HP [ Upgrade Trop ]

      - Max DEF [ Upgrade Trop ]

      - ATK Range

      - Max Population

      - Silver Coins [ End Turn ]

      - No Fogg Map [ Just Move Trop ]

      - XP Reward + NO LVL POPUP [ Win Battle ]


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 31 replies
    • Hexapolis - Civilization game V2.3.0 [ +9 Jailed ] DMG
      Modded/Hacked App: Hexapolis - Civilization game By NOXGAMES s.r.o.
      Bundle ID: com.noxgames.hex.polis.civilization.empire
      iTunes Store Link: https://apps.apple.com/us/app/hexapolis-civilization-game/id1559236448?uo=4

       

       

      🔧 Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      🚀 Hack Features

      - IAP FREE [ Buy Anything Gems Gold ]

      - Max DMG [ Upgrade Trop ]

      - Max HP [ Upgrade Trop ]

      - Max DEF [ Upgrade Trop ]

      - ATK Range

      - Max Population

      - Silver Coins [ End Turn ]

      - No Fogg Map [ Just Move Trop ]

      - XP Reward + NO LVL POPUP [ Win Battle ]


      🍏 Jailbreak iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      🤖 Modded Android APKs: https://iosgods.com/forum/68-android-section/
      • 8 replies
    • Modded/Hacked App: Lollipop 3: Match 3 Puzzles By Puzzle1Studio,inc.
      Bundle ID: com.puzzle1studio.ap.lollipopsweetheroesmatch3
      iTunes Store Link: https://apps.apple.com/us/app/lollipop-3-match-3-puzzles/id1634326372?uo=4

       

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Coins

      - Lives

      - Booster

      - Moves

      - Auto Win 

       

      ⬇️ iOS Hack Download Link


      Hidden Content

      Download Hack
      • 0 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines