Jump to content
Community Announcements, Giveaways & More!

Help with disabling _syscall

Guest

By Guest
in Help & Support

 Share
Go to solution Solved by Aswag1,

36 posts in this topic

Recommended Posts

Guest

Guest

Posted
Posted (edited)

I'm trying to hack NOVA 3: Freedom Edition, so obviously, being gameloft, they added in _syscall. I've attempted to remove it before but all that happens is that the app would freeze or crash. Here is what I NOP'ed:

 

 

__text:0055F054                 MOV             SP, R4
__text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
__text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
__text:0055F05E                 SUB.W           SP, SP, #0x250
__text:0055F062                 MOV             R10, R0
__text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
__text:0055F06C                 MOV             R8, R1
__text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
__text:0055F070                 MOVS            R5, #0
__text:0055F072                 MOVS            R1, #0x1F
__text:0055F074                 MOVS            R2, #0
__text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
__text:0055F078                 MOVS            R3, #0
__text:0055F07A                 LDR             R0, [R6]
__text:0055F07C                 STR             R0, [sP,#0x24C]
__text:0055F07E                 MOVS            R0, #0x1A
__text:0055F080                 STR             R5, [sP]
__text:0055F082                 BLX             _syscall
__text:0055F086                 ADD             R4, SP, #0x24
__text:0055F088                 MOV.W           R0, #0x1EC
__text:0055F08C                 STR             R0, [sP,#0x210]
__text:0055F08E                 MOVS            R1, #0
__text:0055F090                 MOV             R0, R4
__text:0055F092                 MOV.W           R2, #0x1EC
__text:0055F096                 BLX             _memset
__text:0055F09A                 MOVS            R0, #1
__text:0055F09C                 MOVS            R1, #0xE
__text:0055F09E                 STR             R0, [sP,#0x14]
__text:0055F0A0                 STR             R1, [sP,#0x18]
__text:0055F0A2                 STR             R0, [sP,#0x1C]
__text:0055F0A4                 BLX             _getpid
__text:0055F0A8                 STR             R0, [sP,#0x20]
__text:0055F0AA                 ADD             R0, SP, #0x14
__text:0055F0AC                 ADD             R3, SP, #0x210
__text:0055F0AE                 MOVS            R1, #4
__text:0055F0B0                 MOV             R2, R4
__text:0055F0B2                 STR             R5, [sP]
__text:0055F0B4                 STR             R5, [sP,#4]
__text:0055F0B6                 BLX             _sysctl
__text:0055F0BA                 MOV             R4, R0
 
After I NOP'ed that the app would crash upon startup. I then NOP'ed:
 
__text:0055F054                 MOV             SP, R4
__text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
__text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
__text:0055F05E                 SUB.W           SP, SP, #0x250
__text:0055F062                 MOV             R10, R0
__text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
__text:0055F06C                 MOV             R8, R1
__text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
__text:0055F070                 MOVS            R5, #0
__text:0055F072                 MOVS            R1, #0x1F
__text:0055F074                 MOVS            R2, #0
__text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
__text:0055F078                 MOVS            R3, #0
__text:0055F07A                 LDR             R0, [R6]
__text:0055F07C                 STR             R0, [sP,#0x24C]
__text:0055F07E                 MOVS            R0, #0x1A
__text:0055F080                 STR             R5, [sP]
__text:0055F082                 BLX             _syscall
__text:0055F086                 ADD             R4, SP, #0x24
__text:0055F088                 MOV.W           R0, #0x1EC
__text:0055F08C                 STR             R0, [sP,#0x210]
__text:0055F08E                 MOVS            R1, #0
__text:0055F090                 MOV             R0, R4
__text:0055F092                 MOV.W           R2, #0x1EC
__text:0055F096                 BLX             _memset
__text:0055F09A                 MOVS            R0, #1
__text:0055F09C                 MOVS            R1, #0xE
__text:0055F09E                 STR             R0, [sP,#0x14]
__text:0055F0A0                 STR             R1, [sP,#0x18]
__text:0055F0A2                 STR             R0, [sP,#0x1C]
__text:0055F0A4                 BLX             _getpid
__text:0055F0A8                 STR             R0, [sP,#0x20]
__text:0055F0AA                 ADD             R0, SP, #0x14
__text:0055F0AC                 ADD             R3, SP, #0x210
__text:0055F0AE                 MOVS            R1, #4
__text:0055F0B0                 MOV             R2, R4
__text:0055F0B2                 STR             R5, [sP]
__text:0055F0B4                 STR             R5, [sP,#4]
__text:0055F0B6                 BLX             _sysctl
__text:0055F0BA                 MOV             R4, R0
 
Again, same thing. It would crash. So the last thing I did was I changed 
 
__text:0055F072                 MOVS            R1, #0x1F
 
to
 
__text:0055F072                 MOVS            R1, #0x0
 
and the app did not crash this time, it only froze right at the gameloft logo. So I tried to attach it to GDB, because it is technically running if it is frozen, and it gave me segmentation fault: 11. Please, if any of you could help me solve this problem, I would be so happy, its been driving me crazy since the new year :/
 
Thanks!
Updated by Guest
  • Replies 35
  • Created
  • Last Reply

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Popular Posts

Aswag1
Aswag1

Well after laying dormant for quite awhile, I thought I might add a couple of pointers....   It seems that for 64-bit devices, there are certain additional checks in the binary in most GameLoft game

Diversityy
Diversityy

shmoo, you have to do this: %hook GameloftSoSecured -(bool) syscallgtfo { return TRUE; } %end

sn0wqt Apprentice

sn0wqt 42.5k
  •   iPhone X 
  •   13.3

    • Posted
    Posted

     

    I'm trying to hack NOVA 3: Freedom Edition, so obviously, being gameloft, they added in _syscall. I've attempted to remove it before but all that happens is that the app would freeze or crash. Here is what I NOP'ed:

     

     

    __text:0055F054                 MOV             SP, R4
    __text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
    __text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
    __text:0055F05E                 SUB.W           SP, SP, #0x250
    __text:0055F062                 MOV             R10, R0
    __text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
    __text:0055F06C                 MOV             R8, R1
    __text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
    __text:0055F070                 MOVS            R5, #0
    __text:0055F072                 MOVS            R1, #0x1F
    __text:0055F074                 MOVS            R2, #0
    __text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
    __text:0055F078                 MOVS            R3, #0
    __text:0055F07A                 LDR             R0, [R6]
    __text:0055F07C                 STR             R0, [sP,#0x24C]
    __text:0055F07E                 MOVS            R0, #0x1A
    __text:0055F080                 STR             R5, [sP]
    __text:0055F082                 BLX             _syscall
    __text:0055F086                 ADD             R4, SP, #0x24
    __text:0055F088                 MOV.W           R0, #0x1EC
    __text:0055F08C                 STR             R0, [sP,#0x210]
    __text:0055F08E                 MOVS            R1, #0
    __text:0055F090                 MOV             R0, R4
    __text:0055F092                 MOV.W           R2, #0x1EC
    __text:0055F096                 BLX             _memset
    __text:0055F09A                 MOVS            R0, #1
    __text:0055F09C                 MOVS            R1, #0xE
    __text:0055F09E                 STR             R0, [sP,#0x14]
    __text:0055F0A0                 STR             R1, [sP,#0x18]
    __text:0055F0A2                 STR             R0, [sP,#0x1C]
    __text:0055F0A4                 BLX             _getpid
    __text:0055F0A8                 STR             R0, [sP,#0x20]
    __text:0055F0AA                 ADD             R0, SP, #0x14
    __text:0055F0AC                 ADD             R3, SP, #0x210
    __text:0055F0AE                 MOVS            R1, #4
    __text:0055F0B0                 MOV             R2, R4
    __text:0055F0B2                 STR             R5, [sP]
    __text:0055F0B4                 STR             R5, [sP,#4]
    __text:0055F0B6                 BLX             _sysctl
    __text:0055F0BA                 MOV             R4, R0
     
    After I NOP'ed that the app would crash upon startup. I then NOP'ed:
     
    __text:0055F054                 MOV             SP, R4
    __text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
    __text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
    __text:0055F05E                 SUB.W           SP, SP, #0x250
    __text:0055F062                 MOV             R10, R0
    __text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
    __text:0055F06C                 MOV             R8, R1
    __text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
    __text:0055F070                 MOVS            R5, #0
    __text:0055F072                 MOVS            R1, #0x1F
    __text:0055F074                 MOVS            R2, #0
    __text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
    __text:0055F078                 MOVS            R3, #0
    __text:0055F07A                 LDR             R0, [R6]
    __text:0055F07C                 STR             R0, [sP,#0x24C]
    __text:0055F07E                 MOVS            R0, #0x1A
    __text:0055F080                 STR             R5, [sP]
    __text:0055F082                 BLX             _syscall
    __text:0055F086                 ADD             R4, SP, #0x24
    __text:0055F088                 MOV.W           R0, #0x1EC
    __text:0055F08C                 STR             R0, [sP,#0x210]
    __text:0055F08E                 MOVS            R1, #0
    __text:0055F090                 MOV             R0, R4
    __text:0055F092                 MOV.W           R2, #0x1EC
    __text:0055F096                 BLX             _memset
    __text:0055F09A                 MOVS            R0, #1
    __text:0055F09C                 MOVS            R1, #0xE
    __text:0055F09E                 STR             R0, [sP,#0x14]
    __text:0055F0A0                 STR             R1, [sP,#0x18]
    __text:0055F0A2                 STR             R0, [sP,#0x1C]
    __text:0055F0A4                 BLX             _getpid
    __text:0055F0A8                 STR             R0, [sP,#0x20]
    __text:0055F0AA                 ADD             R0, SP, #0x14
    __text:0055F0AC                 ADD             R3, SP, #0x210
    __text:0055F0AE                 MOVS            R1, #4
    __text:0055F0B0                 MOV             R2, R4
    __text:0055F0B2                 STR             R5, [sP]
    __text:0055F0B4                 STR             R5, [sP,#4]
    __text:0055F0B6                 BLX             _sysctl
    __text:0055F0BA                 MOV             R4, R0
     
    Again, same thing. It would crash. So the last thing I did was I changed 
     
    __text:0055F072                 MOVS            R1, #0x1F
     
    to
     
    __text:0055F072                 MOVS            R1, #0x0
     
    and the app did not crash this time, it only froze right at the gameloft logo. So I tried to attach it to GDB, because it is technically running if it is frozen, and it gave me segmentation fault: 11. Please, if any of you could help me solve this problem, I would be so happy, its been driving me crazy since the new year :/
     
    Thanks!

     

    bro GameLoft's game are not that easy lol u should learn save game hack then ms then ida then code inject :3 

    Guest

    Guest

    Posted
    Posted (edited)

    bro GameLoft's game are not that easy lol u should learn save game hack then ms then ida then code inject :3

     

    I know that already, this is one of the first forums I've signed up with. I know how to use GDB to find offsets in IDA and I know how to patch a binary. My first hack was a savegame for COD: BOZ for v1.3.3, I already learned MS, MSHook, and I'm doing IDA and code inject (writeData) right now and I'm working on Dead Trigger 2 but decided to take a break and do this because I get angry very easily lol

     

    so im not really a beginner ;)

     

    @ 

    @

    Updated by Guest
    Laxus iOS God

    Laxus 811.7k
  •   iPhone 5s 
  •   10.3.3

    • Posted
    Posted

    @

    :facepalm: he already understands arm, no need to go through all that outdated crap

     

    @@Shmoo419

    hmmm... me and Swag had the same issue with Brothers In arms 3...

     

    trying disabling calls to _dlsym

    hmm Its work for me :/

    Laxus iOS God

    Laxus 811.7k
  •   iPhone 5s 
  •   10.3.3

    • Posted
    Posted

    @@Laxus

     

    O.o really?, with syscall patched? try brothers in arms 3, me and Swag had it crash on our devices :/

    Works fine on my iP5, not sure about 64 bit devices

    Guest

    Guest

    Posted
    Posted (edited)

    @

    :facepalm: he already understands arm, no need to go through all that outdated crap

     

    @@Shmoo419

    hmmm... me and Swag had the same issue with Brothers In arms 3...

     

    trying disabling calls to _dlsym

    OK, I'll try that. Thanks for an answer, I'll see what happenes once I do it. But who is Swag?

     

    @

    Updated by Guest

    Create an account or sign in to comment

    You need to be a member in order to leave a comment

    Create an account

    Sign up for a new account in our community. It's easy!

    Register a new account

    Sign in

    Already have an account? Sign in here.

    Sign In Now
     Share
    Go to topic listing

    • Our picks

      • Soccer Manager 2026 - Football v3.2.6 +2 Cheats [ Unlimited Currencies ]

        Soccer Manager 2026 - Football v3.2.6 +2 Cheats [ Unlimited Currencies ]

        Puddin posted a topic in Free Jailbreak Cheats,

        Modded/Hacked App: Soccer Manager 2026 - Football By INVINCIBLES STUDIO LTD
        Bundle ID: com.invinciblesstudioltd.soccermanager2025
        App Store Link: https://apps.apple.com/us/app/soccer-manager-2026-football/id6449935779?uo=4


        Hack Features:
        - Unlimited Cash -> Accept a Sponsorship.
        - Unlimited Cash v2 -> Create a Club.
        - 1 Gold Cost -> Making purchases with gold will only use 1 gold. Make sure you have enough gold first! DO NOT USE IN THE SHOP!
        • 248 replies
        Puddin

        Picked By

        Puddin,
      • Midnight Dreamers | Novels v1.4.5 +2 Jailed Cheats [ Unlimited Currencies ]

        Midnight Dreamers | Novels v1.4.5 +2 Jailed Cheats [ Unlimited Currencies ]

        Puddin posted a topic in Free Non-Jailbroken IPA Cheats,

        Modded/Hacked App: Midnight Dreamers | Novels By Valeriia Saveleva
        Bundle ID: com.ArcaneChronicles.MidnightDreamers
        App Store Link: https://apps.apple.com/us/app/midnight-dreamers-novels/id6739806903?uo=4

         
         

        🤩 Hack Features

        - Unlimited Gems -> Earn some.
        - Unlimited Keys -> Spend some.
        • 15 replies
        Puddin

        Picked By

        Puddin,
      • Chrome Valley Customs v31.0.0 +1 Jailed Cheat [ Freeze Moves ]

        Chrome Valley Customs v31.0.0 +1 Jailed Cheat [ Freeze Moves ]

        Puddin posted a topic in Free Non-Jailbroken IPA Cheats,

        Modded/Hacked App: Chrome Valley Customs By Space Ape Ltd
        Bundle ID: com.spaceapegames.carsuperstar
        iTunes Store Link: https://apps.apple.com/us/app/chrome-valley-customs/id6444042518
         

        Hack Features:
        - Freeze Moves


        Jailbreak required hack(s): https://iosgods.com/topic/173179-chrome-valley-customs-v400-1-cheat-unlimited-moves/
        Modded Android APK(s): https://iosgods.com/forum/68-android-section/
        For more fun, check out the Club(s): https://iosgods.com/clubs/
        • 115 replies
        Puddin

        Picked By

        Puddin,
      • OnceWorld v1.4.7 +2 Jailed Cheats [ Damage + More ]

        OnceWorld v1.4.7 +2 Jailed Cheats [ Damage + More ]

        Puddin posted a topic in Free Non-Jailbroken IPA Cheats,

        Modded/Hacked App: OnceWorld By PONIX LLC
        Bundle ID: work.ponix.onceworld
        App Store Link: https://apps.apple.com/us/app/onceworld/id6753948618?uo=4

         


        🤩 Hack Features

        - Damage Multiplier
        - God Mode
        • 59 replies
        Puddin

        Picked By

        Puddin,
      • Hellsquad Rrrush! v1.5.2 +3 Jailed Cheats [ Damage & Defence ]

        Hellsquad Rrrush! v1.5.2 +3 Jailed Cheats [ Damage & Defence ]

        Puddin posted a topic in Free Non-Jailbroken IPA Cheats,

        Modded/Hacked App: Hellsquad Rrrush! By Wemade Max Co., Ltd.
        Bundle ID: com.wemademax.projectsc
        App Store Link: https://apps.apple.com/us/app/hellsquad-rrrush/id6737409896?uo=4

         


        🤩 Hack Features

        - Damage Multiplier
        - Defence Multiplier
        - God Mode
          • Like
        • 45 replies
        Puddin

        Picked By

        Puddin,
      • Kingdom Rush Battles: TD Game v1.6.1 +4 Jailed Cheats [ No Tower Cost ]

        Kingdom Rush Battles: TD Game v1.6.1 +4 Jailed Cheats [ No Tower Cost ]

        Puddin posted a topic in Free Non-Jailbroken IPA Cheats,

        Modded/Hacked App: Kingdom Rush Battles: TD Game By Ironhide S.A.
        Bundle ID: com.ironhidegames.kingdomrush.mp
        App Store Link: https://apps.apple.com/ph/app/kingdom-rush-battles-td-game/id6746510979?uo=4

         
         

        🤩 Hack Features

        - Dumb Enemy -> Disables your enemy from buying towers.
        - No Tower Build Cost -> Use with Dumb Enemy.
        - No Tower Upgrade Cost -> Use with Dumb Enemy.
        - No Tower Skill Upgrade Cost -> Use with Dumb Enemy.
          • Like
        • 56 replies
        Puddin

        Picked By

        Puddin,
      • Dawn of Ages: Medieval Games v2.7.3 +5 Jailed Cheats [ Damage & Defence ]

        Dawn of Ages: Medieval Games v2.7.3 +5 Jailed Cheats [ Damage & Defence ]

        Puddin posted a topic in Secret ViP,

        Modded/Hacked App: Dawn of Ages: total war battle By BoomBit, Inc.
        Bundle ID: com.stratospheregames.dawnofages
        App Store Link: https://apps.apple.com/us/app/dawn-of-ages-total-war-battle/id6477473268?uo=4

         


        🤩 Hack Features

        - Damage Multiplier
        - Defence Multiplier
        - God Mode
        - Dumb Enemy
        - Premium Enabled
        • 124 replies
        Puddin

        Picked By

        Puddin,
      • Dungeon Sisters : IDLE RPG v1.6.0 +4 Jailed Cheats [ Damage & Defence ]

        Dungeon Sisters : IDLE RPG v1.6.0 +4 Jailed Cheats [ Damage & Defence ]

        Puddin posted a topic in Free Non-Jailbroken IPA Cheats,

        Modded/Hacked App: Dungeon Sisters : IDLE RPG By Lobstar Games Corp.
        Bundle ID: com.lobstargames.dungeon.idle.rpg
        App Store Link: https://apps.apple.com/us/app/dungeon-sisters-idle-rpg/id6737465125?uo=4

         


        🤩 Hack Features

        - Damage Multiplier
        - Defence Multiplier
        - God Mode
        - No Skill Cooldown
        • 56 replies
        Puddin

        Picked By

        Puddin,
      • Star2 Random Defense(S2RD) v1.0.11 +10 Jailed Cheats [ Unlimited Currencies ]

        Star2 Random Defense(S2RD) v1.0.11 +10 Jailed Cheats [ Unlimited Currencies ]

        Puddin posted a topic in Free Non-Jailbroken IPA Cheats,

        Modded/Hacked App: Star2 Random Defense(S2RD) By Springcomes Co., Ltd.
        Bundle ID: com.gaimstudio.s2rd
        App Store Link: https://apps.apple.com/us/app/star2-random-defense-s2rd/id6739694467?uo=4

         

        🤩 Hack Features

        - Freeze Food
        - Freeze Silver
        - Freeze Essence
        - Freeze Either
        - Freeze Gold
        - Freeze Diamonds
        - Freeze Energy

        VIP
        - Unlimited Gold -> Will increase instead of decrease.
        - Unlimited Diamonds -> Will increase instead of decrease.
        - Unlimited Energy -> Will increase instead of decrease.
        • 15 replies
        Puddin

        Picked By

        Puddin,
      • MU: Pocket Knights v1.4.17 +3 Jailed Cheats [ Damage + More ]

        MU: Pocket Knights v1.4.17 +3 Jailed Cheats [ Damage + More ]

        Puddin posted a topic in Free Non-Jailbroken IPA Cheats,

        Modded/Hacked App: MU: Pocket Knights By WEBZEN INC.
        Bundle ID: com.webzen.muidle.ios
        App Store Link: https://apps.apple.com/ph/app/mu-pocket-knights/id6742208743?uo=4

         
         

        🤩 Hack Features

        - Damage Multiplier
        - God Mode
        - Speed Multiplier
        • 141 replies
        Puddin

        Picked By

        Puddin,
      • Eterspire - Fantasy MMORPG v67.1 +3 Jailed Cheats [ Damage & Defence ]

        Eterspire - Fantasy MMORPG v67.1 +3 Jailed Cheats [ Damage & Defence ]

        Puddin posted a topic in Free Non-Jailbroken IPA Cheats,

        Modded/Hacked App: Eterspire - Fantasy MMORPG By Stonehollow Workshop LLC
        Bundle ID: com.stonehollow-workshop.Eterspire
        iTunes Store Link: https://apps.apple.com/us/app/eterspire-fantasy-mmorpg/id1658183817?uo=4

         
         

        🤩 Hack Features

        - Damage Multiplier
        - Defence Multiplier
        - God Mode
        • 77 replies
        Puddin

        Picked By

        Puddin,
      • Rapid Reload v4.11.0 +100 Jailed Cheats [ Debug Menu ]

        Rapid Reload v4.11.0 +100 Jailed Cheats [ Debug Menu ]

        Puddin posted a topic in Free Non-Jailbroken IPA Cheats,

        Modded/Hacked App: Rapid Reload By Rollic Games Oyun Yazilim ve Pazarlama Anonim Sirketi
        Bundle ID: com.gibygames.rapidreload
        iTunes Store Link: https://apps.apple.com/us/app/rapid-reload/id6474667725?uo=4


        Hack Features:
        - Debug Menu -> Head into Settings and toggle the Sound button.

        -> Add Cash
        -> Add Diamond
        -> Add Energy
        -> Teleport Settings
        -> Skip Levels
        -> Camera Settings
        -> Skill Modifers
        -> Gear Modifiers

        + More!


        Jailbreak required hack(s): [Mod Menu Hack] Rapid Reload v2.7.3 +100 Cheats [ Debug Menu ] - Free Jailbroken Cydia Cheats - iOSGods
        Modded Android APK(s): https://iosgods.com/forum/68-android-section/
        For more fun, check out the Club(s): https://iosgods.com/clubs/
        • 16 replies
        Puddin

        Picked By

        Puddin,
      View All
    ×
    ×
    • Create New...

    Important Information

    We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines