Jump to content

Help with disabling _syscall


Go to solution Solved by Aswag1,

36 posts in this topic

Recommended Posts

Posted (edited)

I'm trying to hack NOVA 3: Freedom Edition, so obviously, being gameloft, they added in _syscall. I've attempted to remove it before but all that happens is that the app would freeze or crash. Here is what I NOP'ed:

 

 

__text:0055F054                 MOV             SP, R4
__text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
__text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
__text:0055F05E                 SUB.W           SP, SP, #0x250
__text:0055F062                 MOV             R10, R0
__text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
__text:0055F06C                 MOV             R8, R1
__text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
__text:0055F070                 MOVS            R5, #0
__text:0055F072                 MOVS            R1, #0x1F
__text:0055F074                 MOVS            R2, #0
__text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
__text:0055F078                 MOVS            R3, #0
__text:0055F07A                 LDR             R0, [R6]
__text:0055F07C                 STR             R0, [sP,#0x24C]
__text:0055F07E                 MOVS            R0, #0x1A
__text:0055F080                 STR             R5, [sP]
__text:0055F082                 BLX             _syscall
__text:0055F086                 ADD             R4, SP, #0x24
__text:0055F088                 MOV.W           R0, #0x1EC
__text:0055F08C                 STR             R0, [sP,#0x210]
__text:0055F08E                 MOVS            R1, #0
__text:0055F090                 MOV             R0, R4
__text:0055F092                 MOV.W           R2, #0x1EC
__text:0055F096                 BLX             _memset
__text:0055F09A                 MOVS            R0, #1
__text:0055F09C                 MOVS            R1, #0xE
__text:0055F09E                 STR             R0, [sP,#0x14]
__text:0055F0A0                 STR             R1, [sP,#0x18]
__text:0055F0A2                 STR             R0, [sP,#0x1C]
__text:0055F0A4                 BLX             _getpid
__text:0055F0A8                 STR             R0, [sP,#0x20]
__text:0055F0AA                 ADD             R0, SP, #0x14
__text:0055F0AC                 ADD             R3, SP, #0x210
__text:0055F0AE                 MOVS            R1, #4
__text:0055F0B0                 MOV             R2, R4
__text:0055F0B2                 STR             R5, [sP]
__text:0055F0B4                 STR             R5, [sP,#4]
__text:0055F0B6                 BLX             _sysctl
__text:0055F0BA                 MOV             R4, R0
 
After I NOP'ed that the app would crash upon startup. I then NOP'ed:
 
__text:0055F054                 MOV             SP, R4
__text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
__text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
__text:0055F05E                 SUB.W           SP, SP, #0x250
__text:0055F062                 MOV             R10, R0
__text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
__text:0055F06C                 MOV             R8, R1
__text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
__text:0055F070                 MOVS            R5, #0
__text:0055F072                 MOVS            R1, #0x1F
__text:0055F074                 MOVS            R2, #0
__text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
__text:0055F078                 MOVS            R3, #0
__text:0055F07A                 LDR             R0, [R6]
__text:0055F07C                 STR             R0, [sP,#0x24C]
__text:0055F07E                 MOVS            R0, #0x1A
__text:0055F080                 STR             R5, [sP]
__text:0055F082                 BLX             _syscall
__text:0055F086                 ADD             R4, SP, #0x24
__text:0055F088                 MOV.W           R0, #0x1EC
__text:0055F08C                 STR             R0, [sP,#0x210]
__text:0055F08E                 MOVS            R1, #0
__text:0055F090                 MOV             R0, R4
__text:0055F092                 MOV.W           R2, #0x1EC
__text:0055F096                 BLX             _memset
__text:0055F09A                 MOVS            R0, #1
__text:0055F09C                 MOVS            R1, #0xE
__text:0055F09E                 STR             R0, [sP,#0x14]
__text:0055F0A0                 STR             R1, [sP,#0x18]
__text:0055F0A2                 STR             R0, [sP,#0x1C]
__text:0055F0A4                 BLX             _getpid
__text:0055F0A8                 STR             R0, [sP,#0x20]
__text:0055F0AA                 ADD             R0, SP, #0x14
__text:0055F0AC                 ADD             R3, SP, #0x210
__text:0055F0AE                 MOVS            R1, #4
__text:0055F0B0                 MOV             R2, R4
__text:0055F0B2                 STR             R5, [sP]
__text:0055F0B4                 STR             R5, [sP,#4]
__text:0055F0B6                 BLX             _sysctl
__text:0055F0BA                 MOV             R4, R0
 
Again, same thing. It would crash. So the last thing I did was I changed 
 
__text:0055F072                 MOVS            R1, #0x1F
 
to
 
__text:0055F072                 MOVS            R1, #0x0
 
and the app did not crash this time, it only froze right at the gameloft logo. So I tried to attach it to GDB, because it is technically running if it is frozen, and it gave me segmentation fault: 11. Please, if any of you could help me solve this problem, I would be so happy, its been driving me crazy since the new year :/
 
Thanks!
Updated by Guest
Posted

 

I'm trying to hack NOVA 3: Freedom Edition, so obviously, being gameloft, they added in _syscall. I've attempted to remove it before but all that happens is that the app would freeze or crash. Here is what I NOP'ed:

 

 

__text:0055F054                 MOV             SP, R4
__text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
__text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
__text:0055F05E                 SUB.W           SP, SP, #0x250
__text:0055F062                 MOV             R10, R0
__text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
__text:0055F06C                 MOV             R8, R1
__text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
__text:0055F070                 MOVS            R5, #0
__text:0055F072                 MOVS            R1, #0x1F
__text:0055F074                 MOVS            R2, #0
__text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
__text:0055F078                 MOVS            R3, #0
__text:0055F07A                 LDR             R0, [R6]
__text:0055F07C                 STR             R0, [sP,#0x24C]
__text:0055F07E                 MOVS            R0, #0x1A
__text:0055F080                 STR             R5, [sP]
__text:0055F082                 BLX             _syscall
__text:0055F086                 ADD             R4, SP, #0x24
__text:0055F088                 MOV.W           R0, #0x1EC
__text:0055F08C                 STR             R0, [sP,#0x210]
__text:0055F08E                 MOVS            R1, #0
__text:0055F090                 MOV             R0, R4
__text:0055F092                 MOV.W           R2, #0x1EC
__text:0055F096                 BLX             _memset
__text:0055F09A                 MOVS            R0, #1
__text:0055F09C                 MOVS            R1, #0xE
__text:0055F09E                 STR             R0, [sP,#0x14]
__text:0055F0A0                 STR             R1, [sP,#0x18]
__text:0055F0A2                 STR             R0, [sP,#0x1C]
__text:0055F0A4                 BLX             _getpid
__text:0055F0A8                 STR             R0, [sP,#0x20]
__text:0055F0AA                 ADD             R0, SP, #0x14
__text:0055F0AC                 ADD             R3, SP, #0x210
__text:0055F0AE                 MOVS            R1, #4
__text:0055F0B0                 MOV             R2, R4
__text:0055F0B2                 STR             R5, [sP]
__text:0055F0B4                 STR             R5, [sP,#4]
__text:0055F0B6                 BLX             _sysctl
__text:0055F0BA                 MOV             R4, R0
 
After I NOP'ed that the app would crash upon startup. I then NOP'ed:
 
__text:0055F054                 MOV             SP, R4
__text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
__text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
__text:0055F05E                 SUB.W           SP, SP, #0x250
__text:0055F062                 MOV             R10, R0
__text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
__text:0055F06C                 MOV             R8, R1
__text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
__text:0055F070                 MOVS            R5, #0
__text:0055F072                 MOVS            R1, #0x1F
__text:0055F074                 MOVS            R2, #0
__text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
__text:0055F078                 MOVS            R3, #0
__text:0055F07A                 LDR             R0, [R6]
__text:0055F07C                 STR             R0, [sP,#0x24C]
__text:0055F07E                 MOVS            R0, #0x1A
__text:0055F080                 STR             R5, [sP]
__text:0055F082                 BLX             _syscall
__text:0055F086                 ADD             R4, SP, #0x24
__text:0055F088                 MOV.W           R0, #0x1EC
__text:0055F08C                 STR             R0, [sP,#0x210]
__text:0055F08E                 MOVS            R1, #0
__text:0055F090                 MOV             R0, R4
__text:0055F092                 MOV.W           R2, #0x1EC
__text:0055F096                 BLX             _memset
__text:0055F09A                 MOVS            R0, #1
__text:0055F09C                 MOVS            R1, #0xE
__text:0055F09E                 STR             R0, [sP,#0x14]
__text:0055F0A0                 STR             R1, [sP,#0x18]
__text:0055F0A2                 STR             R0, [sP,#0x1C]
__text:0055F0A4                 BLX             _getpid
__text:0055F0A8                 STR             R0, [sP,#0x20]
__text:0055F0AA                 ADD             R0, SP, #0x14
__text:0055F0AC                 ADD             R3, SP, #0x210
__text:0055F0AE                 MOVS            R1, #4
__text:0055F0B0                 MOV             R2, R4
__text:0055F0B2                 STR             R5, [sP]
__text:0055F0B4                 STR             R5, [sP,#4]
__text:0055F0B6                 BLX             _sysctl
__text:0055F0BA                 MOV             R4, R0
 
Again, same thing. It would crash. So the last thing I did was I changed 
 
__text:0055F072                 MOVS            R1, #0x1F
 
to
 
__text:0055F072                 MOVS            R1, #0x0
 
and the app did not crash this time, it only froze right at the gameloft logo. So I tried to attach it to GDB, because it is technically running if it is frozen, and it gave me segmentation fault: 11. Please, if any of you could help me solve this problem, I would be so happy, its been driving me crazy since the new year :/
 
Thanks!

 

bro GameLoft's game are not that easy lol u should learn save game hack then ms then ida then code inject :3 

Posted (edited)

bro GameLoft's game are not that easy lol u should learn save game hack then ms then ida then code inject :3

 

I know that already, this is one of the first forums I've signed up with. I know how to use GDB to find offsets in IDA and I know how to patch a binary. My first hack was a savegame for COD: BOZ for v1.3.3, I already learned MS, MSHook, and I'm doing IDA and code inject (writeData) right now and I'm working on Dead Trigger 2 but decided to take a break and do this because I get angry very easily lol

 

so im not really a beginner ;)

 

@ 

@

Updated by Guest
Posted

@

:facepalm: he already understands arm, no need to go through all that outdated crap

 

@@Shmoo419

hmmm... me and Swag had the same issue with Brothers In arms 3...

 

trying disabling calls to _dlsym

hmm Its work for me :/

Posted

@@Laxus

 

O.o really?, with syscall patched? try brothers in arms 3, me and Swag had it crash on our devices :/

Works fine on my iP5, not sure about 64 bit devices

Posted (edited)

@

:facepalm: he already understands arm, no need to go through all that outdated crap

 

@@Shmoo419

hmmm... me and Swag had the same issue with Brothers In arms 3...

 

trying disabling calls to _dlsym

OK, I'll try that. Thanks for an answer, I'll see what happenes once I do it. But who is Swag?

 

@

Updated by Guest

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Warhammer 40,000: Tacticus v1.30.116 +4 Cheats
      Modded/Hacked App: Warhammer 40,000: Tacticus By Snowprint Studios AB
      Bundle ID: com.snowprintstudios.tacticus
      iTunes Store Link: https://apps.apple.com/us/app/warhammer-40-000-tacticus/id1599937506?uo=4

      Hack Features:
      - Always Win [ even if all your characters die, you win ]
      - Custom Ability Stats
      - Ability Always Available
      - Game Speed Multiplier

      Note: Use characters that do ability attack to multiple enemies like Varro Tigurius & Bellator


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/163492-warhammer-40000-tacticus-v1133-3-cheats-for-jailed-idevices/


      iOS Hack Download Link: https://iosgods.com/topic/163377-warhammer-40000-tacticus-v1133-4-cheats/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 297 replies
    • Asphalt Legends Unite Cheats v24.6.1 +2
      Modded/Hacked App: Asphalt 9: Legends By Gameloft
      Bundle ID: com.gameloft.asphalt9
      iTunes Store Link: https://itunes.apple.com/us/app/asphalt-9-legends/id805603214


      Hack Features:
      - Unlimited Nitro Use / No Nitro Consumption
      - No Traffic / No Incoming Cars
      More to come!
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 8,651 replies
    • Music Wars Rockstar: Rap Life v1.3.3 Cheats +4
      Modded/Hacked App: Music Wars Rockstar: Rap Life By Music Wars LLC
      Bundle ID: com.mwcompany.MusicWarsRockstar
      iTunes Store Link: https://apps.apple.com/us/app/music-wars-rockstar-rap-life/id1623455289?uo=4

      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - Unlimited money
      - Unlimited creativity
      - Unlimited health
      - Unlimited happiness
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 305 replies
    • Groove Journey v5.2.0 Jailed Mod +1
      Modded/Hacked App: Groove Journey By Somtochukwu Mbala
      Bundle ID: com.kaipha.groovejourney
      iTunes Store Link: https://apps.apple.com/us/app/groove-journey/id6736345547?uo=4


      Hack Features:
      - PREMIUM


      iOS Hack Download IPA Link: https://iosgods.com/topic/190862-groove-journey-v311-jailed-mod-1/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 135 replies
    • Cooking Diary Restaurant Game v2.42.0 Jailed Cheats +3
      Modded/Hacked App: Cooking Diary® Restaurant Game by MyTona Pte Ltd
      Bundle ID: com.mytonallc.cookingdiary
      iTunes Store Link: https://apps.apple.com/us/app/cooking-diary-restaurant-game/id1214763610?uo=4&at=1010lce4


      Hack Features:
      - Infinite Currencies (Get some)
      - Freeze Boosters


      iOS Hack Download Link: https://iosgods.com/topic/110310-arm64-cooking-diary-restaurant-game-v1160-3/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 685 replies
    • Punch TV v2507.17 +5 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Punch TV By Four Fats Limited
      Bundle ID: com.fourfats.punchTV
      App Store Link: https://apps.apple.com/us/app/punch-tv/id6477147072?uo=4

       
       

      🤩 Hack Features

      - Freeze Coins

      VIP
      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Unlimited Coins -> Earn some.
        • Winner
        • Like
      • 4 replies
    • Punch TV v2507.17 +5 Cheats [ Damage & Defence ]
      Modded/Hacked App: Punch TV By Four Fats Limited
      Bundle ID: com.fourfats.punchTV
      App Store Link: https://apps.apple.com/us/app/punch-tv/id6477147072?uo=4

       
       

      🤩 Hack Features

      - Freeze Coins

      VIP
      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Unlimited Coins -> Earn some.
        • Winner
        • Like
      • 1 reply
    • [Hack] DRAGON BALL Z DOKKAN BATTLE v5.28.5 +3 Cheats! [iOS 18/26]
      Modded/Hacked App: DRAGON BALL Z DOKKAN BATTLE by BANDAI NAMCO Entertainment Inc.
      Bundle ID: jp.co.bandainamcogames.BNGI0221
      iTunes Store Link: https://itunes.apple.com/us/app/dragon-ball-z-dokkan-battle/id951627425


      Hack Features:
      - High Damage
      - High Defense
      - High HP

       

      Jailbroken hack: https://iosgods.com/topic/26098-updated-dragon-ball-z-dokkan-battle-v312-3-cheats/
      DRAGON BALL Z DOKKAN BATTLE Discussions Club: https://iosgods.com/clubs/23-dragon-ball-z-dokkan-battle-club/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,676 replies
    • DRAGON BALL Z DOKKAN BATTLE Japan v5.28.5 +3 Cheats for Non-Jailbroken!
      Modded/Hacked App: ドラゴンボールZ ドッカンバトル by BANDAI NAMCO Entertainment Inc.
      Bundle ID: jp.co.bandainamcogames.BNGI0211
      iTunes Store Link: https://itunes.apple.com/jp/app/%E3%83%89%E3%83%A9%E3%82%B4%E3%83%B3%E3%83%9C%E3%83%BC%E3%83%ABz-%E3%83%89%E3%83%83%E3%82%AB%E3%83%B3%E3%83%90%E3%83%88%E3%83%AB/id951627670?mt=8&uo=4&at=1010lce4

      Hack Features
      - Unlimited HP
      - Unlimited Defense
      - Unlimited Attack


      Jailbroken version of this hack: https://iosgods.com/topic/26099-draon-ball-z-dokkan-battle-japan-ドラゴンボールz-ドッカンバトル-v351-7-cheats/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 544 replies
    • DRAGON BALL Z DOKKAN BATTLE Japan (ドラゴンボールZ ドッカンバトル) v5.28.5 +7 Cheats!
      Modded/Hacked App: ドラゴンボールZ ドッカンバトル By BANDAI NAMCO Entertainment Inc.
      Bundle ID: jp.co.bandainamcogames.BNGI0211
      iTunes Link: https://itunes.apple.com/jp/app/ドラゴンボールz-ドッカンバトル/id951627670


      Hack Features
      - Unlimited HP  -  (Put .0 at the back of your value: 1000.0)
      - Unlimited Damage  -  (Put .0 at the back of your value: 1000.0)
      - Unlimited Defense  -  (Put .0 at the back of your value: 1000.0)
      - Dice Hack -  [ONLY RANGE BETWEEN 1 - 6 or it will crash]  -  (Put .0 at the back of your value: 4.0)
      - Dice Hack 1, 2, 3
      - Dice Hack 4, 5, 6
      - Auto Win Battles -> Disable if you get errors.
      PUT .0 at the back of all values!
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 7,988 replies
    • DRAGON BALL Z DOKKAN BATTLE v5.28.5 +3 Cheats!
      [Updated] DRAGON BALL Z DOKKAN BATTLE Cheats!
      Modded/Hacked App: DRAGON BALL Z DOKKAN BATTLE By BANDAI NAMCO Entertainment Inc.
      Bundle ID: jp.co.bandainamcogames.BNGI0221
      iTunes Link: https://itunes.apple.com/us/app/dragon-ball-z-dokkan-battle/id951627425


      Hack Features:
      - Unlimited HP - (Put .0 at the back of your value: 1111.0)
      - Unlimited Damage - (Put .0 at the back of your value: 1111.0)
      - Unlimited Defense - (Put .0 at the back of your value: 1111.0)
      - Dice Hack
      - Auto Win Battles
      PUT .0 at the back of all values!

      Dice hack doesn't work for tournaments, not recommended to use during one
      Auto Win HIGH RISK OF BAN when used in tournaments

      ViP Version: https://iosgods.com/topic/48201-dragon-ball-z-dokkan-battle-v311-5-cheats-ips4-celebration/
      Non-Jailbroken Version: https://iosgods.com/forum/78-vip-non-jailbroken-hacks-cheats/
      DRAGON BALL Z DOKKAN BATTLE Discussions Club: https://iosgods.com/clubs/23-dragon-ball-z-dokkan-battle-club/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 13,256 replies
    • DRAGON BALL Z DOKKAN BATTLE v5.28.5 +7 Cheats [ iOS 17/18/26 Support ]
      Modded/Hacked App: DRAGON BALL Z DOKKAN BATTLE By BANDAI NAMCO Entertainment Inc.
      Bundle ID: jp.co.bandainamcogames.BNGI0221
      iTunes Link: https://itunes.apple.com/us/app/dragon-ball-z-dokkan-battle/id951627425


      Hack Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate (from Cydia).
      - PreferenceLoader (from Cydia).


      Hack Features:
      - Unlimited HP  -  (Put .0 at the back of your value: 1000.0)<br style="color:#555555">- Unlimited Damage  -  (Put .0 at the back of your value: 1000.0)<br style="color:#555555">- Unlimited Defense  -  (Put .0 at the back of your value: 1000.0)<br style="color:#555555">- Dice Hack -  [ONLY RANGE BETWEEN 1 - 6 or it will crash]  -  (Put .0 at the back of your value: 4.0)
      - Dice Hack 1, 2, 3
      - Dice Hack 4, 5, 6
      - Auto Win Battles

      Non-Jailbroken version of this hack: https://iosgods.com/topic/37875-hack-dragon-ball-z-dokkan-battle-v2120-3-cheats-ios-10/
      Free version of this hack: https://iosgods.com/topic/26098-updated-dragon-ball-z-dokkan-battle-v330-3-cheats/
      DRAGON BALL Z DOKKAN BATTLE Discussions Club: https://iosgods.com/clubs/23-dragon-ball-z-dokkan-battle-club/


      Hack Download Link:
      https://iosgods.com/topic/48201-dragon-ball-z-dokkan-battle-v331-7-cheats-ips4-celebration/

      Credits:
      - @ZahirSher
      - @DiDA
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 2,417 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines