Jump to content

Dump decrypted DLL file with IDA Pro


ThePianoGuy

5 posts in this topic

Recommended Posts

Note: This tutorial was created by xiaobaiyey and written in chinese. This tutorial is poorly translated from Google Translation but i have fixed some grammar to make it easier to understand.

 
reviously I read an article by hook decrypting the encrypted dll Unity3D, recently new to dynamic, so they can try the next through IDA, the same as the shelling, dump the decrypted dll file, try the next, it really can, in here to share under
 
Requirements:
Tools: ida6.6 millet 2s
Game: Monthly Dragon knife (just find a game)
Enable USB-debugging in Developer Options
 
Open lib in IDA:
Unzip lib folder from the APK, drag the file libmono.so to IDA
Several functions mainly in the upper and lower breakpoint (refer mono source )

mono_image_open_from_data_full
mono_image_open_from_data
mono_image_open_from_data_with_name

 
In a decryption process can about these function
 
View the final in front of a function call or mono_image_open_from_data_with_name,
 
Enable Developer Options:
If Developer Option does not show in settings, follow the steps below.
1. Open Settings > About
2. Then tap “Build number” seven times to enable Developer options....
3. Go back to Settings menu and now you'll be able to see “Developer options” there.
4. Tap it and turn on USB Debugging
 
Dynamic debugging:
If the app has anti-debugging, you need to skip meals to debug, the following brief dynamic debugging Preparations (there are many online tutorials dynamic debugging)
 
Get android_server file from IDA PRO 6.6\ida66\dbgsrv or download the file HERE!
 
Push android_server file to the phone
 
1:

adb push android_server /data/local/tmp/ 

2:

adb shell

3:

cd /data/data/tmp/ 

4:

chmod 777 android_server

5:

./android_server 

Port Forwarding:
 

adb forward tcp:23946 tcp:23946

 
Debug startup app:
 

adb shell am start -D -n com.huiguan.qinglong.taiqi.dl/com.huiguan.qlyyd.UnityPlayerNativeActivity

 
Check the app's PID:
 
1.

adb shell 

2.

ps | grep dl

 
Record the PID and Forwarding (pid can be seen in the ida)

adb forward tcp:8700 jdwp:PID

Setting ida (the main settings hostname: 127.0.0.1) and open the attach process (wait for the program to automatically break live, live off later)
 
Run app (in the f9 at ifa)
This time in the cmd window run jdb debugger:
 

jdb -connect com.sun.jdi.SocketAttach:hostname=127.0.0.1,port=8700 

This time can be debugged
Run app will break on the linker
 
NQa1Qvs.png
 
Then if the app is no anti-molestation: running directly f9
This window appears: same point
 
LJ0ND9m.png
 
Wait a moment, will end on Linker , directly connected to f9 op row
If this window appears, select "yes (pass to app)" without waiting
 
O32G2yG.png
 
Many may appear behind all this window select yes and then run f9
Finally broken in the mono_image_open_from_data_with_name, method
Loading is not the first time we want to skip dll
 
9UOufTB.png
 
If you can not read f5 look at the source code, source code demonstrate this direct f5, where he rewrote momo source

int __fastcall mono_image_open_from_data_with_name (int a1, char * haystack, int a3, int a4, char a5, char * haystacka)

 
Several key parameters

// NT A1 read dll file offset address
// Char * haystack, DLL file size
// Char * haystacka , file name

 
9MBWsmY.png
 
This time following the R1 register to see the encrypted DLL file address, indicating the DLL has not yet begun to decrypt, decryption may later. And laid down the road to change a single note of each register after a simple loop
 
The dll decrypted
This time it decrypted DLL in memory,
 
sJ21pCZ.png
 
This time it can have a dump,
 
Check Register Window: Find R6 and R11
The entire file offset start R6 = 7B95304C
End offset address R6 = R11 7B95304C + 3AF200 = 7BD0224C
 
Use; dump dex scripts
 

auto fp, dexAddress;
fp = fopen ( "D:\\Test.dll", "wb");
for (dexAddress = 0x7B95304C; dexAddress < 0x7BD0224C; dexAddress ++)
fputc (Byte(dexAddress), FP);

 
Under run on ok
Decryption out the effect,
 
Attach the original dll and decrypted dll
 
Credit:
xiaobaiyey

Link to comment
https://iosgods.com/topic/34440-dump-decrypted-dll-file-with-ida-pro/
Share on other sites

Archived

This topic is now archived and is closed to further replies.

  • Our picks

    • Kingdom Clash:Medieval Defense v2.5.2 +3 cheats
      Modded/Hacked App: Kingdom Clash: Legions Battle By AI GAMES FZ LLC
      Bundle ID: azurgames.kingdom.clash
      iTunes Store Link: https://apps.apple.com/us/app/kingdom-clash-legions-battle/id1611722542?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - Damage Multiplier
      - Defense Multiplier
      - VIP Enabled


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download Link:

      Hidden Content
      Download Hack







      Installation Instructions:
      STEP 1: Download the .deb Cydia hack file from the link above. Use Safari/Google Chrome or other iOS browsers to download.
      STEP 2: Once the file has downloaded, tap on it and then you will be prompted on whether you want to open the deb with iGameGod or copy it to Filza.
      STEP 3: If necessary, tap on the downloaded file, and then, you will need to press 'Install' from the options on your screen.
      STEP 4: Let iGameGod/Filza finish the cheat installation. Make sure it successfully installs, otherwise see the note below.
      STEP 5: If the hack is a Mod Menu — which is usually the case nowadays — the cheat features can be toggled in-game. Some cheats have options that can be enabled from your iDevice settings.
      STEP 6: Turn on the features you want and play the game. You may need to follow further instructions inside the hack's popup in-game.

       

      NOTE: If you have any questions or problems, read our Troubleshooting topic & Frequently Asked Questions & Answers topic. If you still haven't found a solution, post your issue down below and we'll do our best to help! If the hack does work for you, please post your feedback below and help out other fellow members that are encountering issues.


      Credits:
      - iNME


      Cheat Video/Screenshots:

      N/A
      • 235 replies
    • Fortress Saga: AFK RPG Cheats v1.7.11 +5
      Modded/Hacked App: Fortress Saga: AFK RPG By cookapps
      Bundle ID: com.cookapps.bm.fortresssaga
      iTunes Store Link: https://apps.apple.com/us/app/fortress-saga-afk-rpg/id6446308106?uo=4


      Hack Features:
      - Damage Multiplier
      - Defense Multiplier
      - Free Store (not Free iAP)


      iOS Hack Download Link: https://iosgods.com/topic/178933-fortress-saga-afk-rpg-cheats-v1405-3/
      • 323 replies
    • The Elder Scrolls: Castles v1.5.4 +2 Jailed Cheats
      Modded/Hacked App: The Elder Scrolls: Castles By Bethesda Softworks LLC
      Bundle ID: com.bethsoft.stronghold
      iTunes Store Link: https://apps.apple.com/us/app/the-elder-scrolls-castles/id1594657136?uo=4

       

       

      📌 Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      🤩 Hack Features

      - Damage Multiplier
      - Never Die


      🍏 Jailbreak iOS hacks: 

       

      ⬇️ iOS Hack Download IPA Link


      Hidden Content

      Download via the iOSGods App







       

      📖 PC Installation Instructions

      STEP 1: Download the pre-hacked .IPA file from the link above to your computer. To download from the iOSGods App, see our iOSGods App IPA Download Tutorial which includes a video example.
      STEP 2: Download Sideloadly and install it on your Windows or Mac.
      STEP 3: Open Sideloadly on your computer, connect your iOS device, and wait until your device name appears in Sideloadly.
      STEP 4: Once your iDevice is recognized, drag the modded .IPA file you downloaded and drop it into the Sideloadly application.
      STEP 5: Enter your Apple Account email when prompted, then press “Start.” You’ll then be asked to enter your password. Go ahead and provide the required information.
      STEP 6: Wait for Sideloadly to finish sideloading/installing the hacked IPA. If there are issues during installation, please read the note below.
      STEP 7: Once the installation is complete and you see the app on your Home Screen, you will need to go to Settings -> General -> Profiles / VPN & Device Management. Once there, tap on the email you entered from step 6, and then tap on 'Trust [email protected]'.
      STEP 8: Now go to your Home Screen and open the newly installed app and everything should work fine. You may need to follow further per app instructions inside the hack's popup in-game.

      NOTE: iOS/iPadOS 16 and later, you must enable Developer Mode. For free Apple Developer accounts, you will need to repeat this process every 7 days. If you have any questions or problems, read our Sideloadly FAQ section of the topic and if you don't find a solution, please post your issue below and we'll do our best to help! If the hack does work for you, post your feedback below and help out other fellow members that are encountering issues.

       

      🙌 Credits

      - AlyssaX64

       

      📷 Cheat Video/Screenshots

      N/A
      • 0 replies
    • The Elder Scrolls: Castles v1.5.4 +2 Cheats
      Modded/Hacked App: The Elder Scrolls: Castles By Bethesda Softworks LLC
      Bundle ID: com.bethsoft.stronghold
      iTunes Store Link: https://apps.apple.com/us/app/the-elder-scrolls-castles/id1594657136?uo=4

       

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Cydia, Sileo or Zebra).

       

      🤩 Hack Features

      - Damage Multiplier
      - Never Die


      🍏 For Non-Jailbroken & No Jailbreak required hacks: 

       

      ⬇️ iOS Hack Download Link


      Hidden Content

      Download Hack







       

      📖 iOS Installation Instructions

      STEP 1: Download the .deb hack file from the link above. Use Safari, Google Chrome or other iOS browsers to download.
      STEP 2: Once the file has downloaded, tap on it and then you will be prompted on whether you want to open the deb with iGameGod or copy it to Filza.
      STEP 3: If needed, tap on the downloaded file again, then select ‘Normal Install’ from the options on your screen.
      STEP 4: Let iGameGod/Filza finish the cheat installation. If it doesn’t install successfully, see the note below.
      STEP 5: Open the game, log in to your iOSGods account when asked, then toggle on the features you want and enjoy!

       

      NOTE: If you have any questions or problems, read our Jailbreak iOS Hack Troubleshooting & Frequently Asked Questions & Answers topic. If you still haven't found a solution, post your issue below and we'll do our best to help! If the hack does work for you, please post your feedback below and help out other fellow members that are encountering issues.

       

      🙌 Credits

      - AlyssaX64

       

      📷 Cheat Video/Screenshots

      N/A

       

      🔗 More iOS App Hacks & Android Modded APKs

      If you’re looking for Non-Jailbroken & No Jailbreak required iOS IPA hacks, visit the iOSGods No Jailbreak Section for a variety of modded games and apps for non-jailbroken iOS devices.

      Need Modded Android APKs too? Head over to the iOSGods Android Section for custom APK mods, cheats, and more.
      • 3 replies
    • BitLife - Life Simulator Cheats v3.17.8 +2
      Modded/Hacked App: BitLife - Life Simulator by Candywriter, LLC
      Bundle ID: com.wtfapps.apollo16
      iTunes Store Link: https://apps.apple.com/us/app/bitlife-life-simulator/id1374403536?uo=4&at=1010lce4


      Hack Features:
      - Infinite Cash
      - Free Bitizen Purchase (Press Cancle) - Work for All Versions


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/84167-arm64-bitlife-life-simulator-v1412-jailed-cheats-2/


      Hack Download Link: https://iosgods.com/topic/84223-arm64-bitlife-life-simulator-cheats-all-versions-2/
        • Thanks
        • Like
      • 3,446 replies
    • Kick the Buddy: Forever Cheats (All Versions) +3
      Modded/Hacked App: Kick the Buddy: Forever by Playgendary GmbH
      Bundle ID: com.playgendary.ktb2
      iTunes Store Link: https://apps.apple.com/us/app/kick-the-buddy-forever/id1435346021?uo=4&at=1010lce4


      Hack Features:
      - Inifnite Currencies
      - No Ads
      - Blood Mode


      Hack Download Link: https://iosgods.com/topic/85558-arm64-kick-the-buddy-forever-cheats-all-versions-3/
      • 125 replies
    • Kick The Buddy Cheats (All Versions) +5
      Modded/Hacked App: Kick the Buddy By Playgendary Limited
      Bundle ID: com.chillfleet.buddy
      iTunes Store Link: https://apps.apple.com/us/app/kick-the-buddy/id1278869953?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Cydia, Sileo or Zebra).

       

      🤩 Hack Features

      - Infinite Golds (Spend some/ Get some)
      - Infinite Bucks (Spend some/ Get some)
      - All Items Owned
      - No Ads
      - Premium


      🍏 For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/topic/84162-kick-the-buddy-v1212-jailed-cheats-5/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/84121-kick-the-buddy-cheats-all-versions-5/
      • 267 replies
    • Gran Saga Idle:KNIGHTSxKNIGHTS Cheats v1.25.0 +2
      Modded/Hacked App: Gran Saga Idle:KNIGHTSxKNIGHTS By Kakao Games Corp.
      Bundle ID: com.piedpixels.gransagaidle
      iTunes Store Link: https://apps.apple.com/us/app/gran-saga-idle-knightsxknights/id6482985104?uo=4


      Hack Features:
      - Multiply Attack
      - Multiply Defense


      iOS Hack Download Link: https://iosgods.com/topic/182761-gran-saga-idleknightsxknights-cheats-v101-2/
        • Winner
      • 255 replies
    • Dummynation Cheats v3.2.3 +3
      Modded/Hacked App: Dummynation By ALEJANDRO HERNANDEZ FERRERO
      Bundle ID: ahf.dummynation
      iTunes Store Link: https://apps.apple.com/us/app/dummynation/id6444295551?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Cydia, Sileo or Zebra).

       

      🤩 Hack Features

      - Premium + No Ads
      - Infinite Research Point
      - Infinite Liquidity (Gold)


      🍏 For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/topic/191828-dummynation-v313-jailed-cheats-3/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/191829-dummynation-cheats-v313-3/
      • 5 replies
    • The Crown Saga: Pi’s Adventure Cheats v1.0.16 +6
      Modded/Hacked App: The Crown Saga: Pi’s Adventure By SuperPlanet corp.
      Bundle ID: com.superplanet.crown
      iTunes Store Link: https://apps.apple.com/us/app/the-crown-saga-pis-adventure/id6636483923?uo=4


      Hack Features:
      - Multiply Attack
      - Multiply Defense
      - God Mode
      - Instant Skills
      - Infinite MP
      - Custom Move Speed


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
       


      iOS Hack Download Link: https://iosgods.com/topic/188573-the-crown-saga-pi%E2%80%99s-adventure-cheats-v107-6/
      • 61 replies
    • Cafeland - World Kitchen Cheats v2.41.7 +1
      Modded/Hacked App: Cafeland - World Kitchen by Gamegos Internet Teknolojileri Ltd Sti.
      Bundle ID: com.gamegos.mobile.cafeland
      iTunes Store Link: https://apps.apple.com/us/app/cafeland-world-kitchen/id1147665432?uo=4&at=1010lce4



      Hack Features:
      - Freeze Currencies


      iOS Hack Download Link: https://iosgods.com/topic/100701-arm64-cafeland-world-kitchen-cheats-v2023-1/
      • 399 replies
    • Sushi Bar Idle Cheats v2.8.4 +2
      Modded/Hacked App: Sushi Bar Idle by GREEN PANDA
      Bundle ID: com.gangame.sushibar
      iTunes Store Link: https://itunes.apple.com/us/app/sushi-bar-idle/id1438089337?mt=8&uo=4&at=1010lce4



      Hack Features:
      - Infinite Coins
      - No Ads


      Hack Download Link: https://iosgods.com/topic/87577-arm64-sushi-bar-idle-cheats-v115-2/
      • 92 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines