Jump to content

Help with disabling _syscall


Go to solution Solved by Aswag1,

36 posts in this topic

Recommended Posts

Posted (edited)

I'm trying to hack NOVA 3: Freedom Edition, so obviously, being gameloft, they added in _syscall. I've attempted to remove it before but all that happens is that the app would freeze or crash. Here is what I NOP'ed:

 

 

__text:0055F054                 MOV             SP, R4
__text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
__text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
__text:0055F05E                 SUB.W           SP, SP, #0x250
__text:0055F062                 MOV             R10, R0
__text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
__text:0055F06C                 MOV             R8, R1
__text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
__text:0055F070                 MOVS            R5, #0
__text:0055F072                 MOVS            R1, #0x1F
__text:0055F074                 MOVS            R2, #0
__text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
__text:0055F078                 MOVS            R3, #0
__text:0055F07A                 LDR             R0, [R6]
__text:0055F07C                 STR             R0, [sP,#0x24C]
__text:0055F07E                 MOVS            R0, #0x1A
__text:0055F080                 STR             R5, [sP]
__text:0055F082                 BLX             _syscall
__text:0055F086                 ADD             R4, SP, #0x24
__text:0055F088                 MOV.W           R0, #0x1EC
__text:0055F08C                 STR             R0, [sP,#0x210]
__text:0055F08E                 MOVS            R1, #0
__text:0055F090                 MOV             R0, R4
__text:0055F092                 MOV.W           R2, #0x1EC
__text:0055F096                 BLX             _memset
__text:0055F09A                 MOVS            R0, #1
__text:0055F09C                 MOVS            R1, #0xE
__text:0055F09E                 STR             R0, [sP,#0x14]
__text:0055F0A0                 STR             R1, [sP,#0x18]
__text:0055F0A2                 STR             R0, [sP,#0x1C]
__text:0055F0A4                 BLX             _getpid
__text:0055F0A8                 STR             R0, [sP,#0x20]
__text:0055F0AA                 ADD             R0, SP, #0x14
__text:0055F0AC                 ADD             R3, SP, #0x210
__text:0055F0AE                 MOVS            R1, #4
__text:0055F0B0                 MOV             R2, R4
__text:0055F0B2                 STR             R5, [sP]
__text:0055F0B4                 STR             R5, [sP,#4]
__text:0055F0B6                 BLX             _sysctl
__text:0055F0BA                 MOV             R4, R0
 
After I NOP'ed that the app would crash upon startup. I then NOP'ed:
 
__text:0055F054                 MOV             SP, R4
__text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
__text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
__text:0055F05E                 SUB.W           SP, SP, #0x250
__text:0055F062                 MOV             R10, R0
__text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
__text:0055F06C                 MOV             R8, R1
__text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
__text:0055F070                 MOVS            R5, #0
__text:0055F072                 MOVS            R1, #0x1F
__text:0055F074                 MOVS            R2, #0
__text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
__text:0055F078                 MOVS            R3, #0
__text:0055F07A                 LDR             R0, [R6]
__text:0055F07C                 STR             R0, [sP,#0x24C]
__text:0055F07E                 MOVS            R0, #0x1A
__text:0055F080                 STR             R5, [sP]
__text:0055F082                 BLX             _syscall
__text:0055F086                 ADD             R4, SP, #0x24
__text:0055F088                 MOV.W           R0, #0x1EC
__text:0055F08C                 STR             R0, [sP,#0x210]
__text:0055F08E                 MOVS            R1, #0
__text:0055F090                 MOV             R0, R4
__text:0055F092                 MOV.W           R2, #0x1EC
__text:0055F096                 BLX             _memset
__text:0055F09A                 MOVS            R0, #1
__text:0055F09C                 MOVS            R1, #0xE
__text:0055F09E                 STR             R0, [sP,#0x14]
__text:0055F0A0                 STR             R1, [sP,#0x18]
__text:0055F0A2                 STR             R0, [sP,#0x1C]
__text:0055F0A4                 BLX             _getpid
__text:0055F0A8                 STR             R0, [sP,#0x20]
__text:0055F0AA                 ADD             R0, SP, #0x14
__text:0055F0AC                 ADD             R3, SP, #0x210
__text:0055F0AE                 MOVS            R1, #4
__text:0055F0B0                 MOV             R2, R4
__text:0055F0B2                 STR             R5, [sP]
__text:0055F0B4                 STR             R5, [sP,#4]
__text:0055F0B6                 BLX             _sysctl
__text:0055F0BA                 MOV             R4, R0
 
Again, same thing. It would crash. So the last thing I did was I changed 
 
__text:0055F072                 MOVS            R1, #0x1F
 
to
 
__text:0055F072                 MOVS            R1, #0x0
 
and the app did not crash this time, it only froze right at the gameloft logo. So I tried to attach it to GDB, because it is technically running if it is frozen, and it gave me segmentation fault: 11. Please, if any of you could help me solve this problem, I would be so happy, its been driving me crazy since the new year :/
 
Thanks!
Updated by Guest
Posted

 

I'm trying to hack NOVA 3: Freedom Edition, so obviously, being gameloft, they added in _syscall. I've attempted to remove it before but all that happens is that the app would freeze or crash. Here is what I NOP'ed:

 

 

__text:0055F054                 MOV             SP, R4
__text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
__text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
__text:0055F05E                 SUB.W           SP, SP, #0x250
__text:0055F062                 MOV             R10, R0
__text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
__text:0055F06C                 MOV             R8, R1
__text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
__text:0055F070                 MOVS            R5, #0
__text:0055F072                 MOVS            R1, #0x1F
__text:0055F074                 MOVS            R2, #0
__text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
__text:0055F078                 MOVS            R3, #0
__text:0055F07A                 LDR             R0, [R6]
__text:0055F07C                 STR             R0, [sP,#0x24C]
__text:0055F07E                 MOVS            R0, #0x1A
__text:0055F080                 STR             R5, [sP]
__text:0055F082                 BLX             _syscall
__text:0055F086                 ADD             R4, SP, #0x24
__text:0055F088                 MOV.W           R0, #0x1EC
__text:0055F08C                 STR             R0, [sP,#0x210]
__text:0055F08E                 MOVS            R1, #0
__text:0055F090                 MOV             R0, R4
__text:0055F092                 MOV.W           R2, #0x1EC
__text:0055F096                 BLX             _memset
__text:0055F09A                 MOVS            R0, #1
__text:0055F09C                 MOVS            R1, #0xE
__text:0055F09E                 STR             R0, [sP,#0x14]
__text:0055F0A0                 STR             R1, [sP,#0x18]
__text:0055F0A2                 STR             R0, [sP,#0x1C]
__text:0055F0A4                 BLX             _getpid
__text:0055F0A8                 STR             R0, [sP,#0x20]
__text:0055F0AA                 ADD             R0, SP, #0x14
__text:0055F0AC                 ADD             R3, SP, #0x210
__text:0055F0AE                 MOVS            R1, #4
__text:0055F0B0                 MOV             R2, R4
__text:0055F0B2                 STR             R5, [sP]
__text:0055F0B4                 STR             R5, [sP,#4]
__text:0055F0B6                 BLX             _sysctl
__text:0055F0BA                 MOV             R4, R0
 
After I NOP'ed that the app would crash upon startup. I then NOP'ed:
 
__text:0055F054                 MOV             SP, R4
__text:0055F056                 VST1.64         {D8-D11}, [R4@128]!
__text:0055F05A                 VST1.64         {D12-D15}, [R4@128]
__text:0055F05E                 SUB.W           SP, SP, #0x250
__text:0055F062                 MOV             R10, R0
__text:0055F064                 MOV             R0, #(___stack_chk_guard_ptr - 0x55F072)
__text:0055F06C                 MOV             R8, R1
__text:0055F06E                 ADD             R0, PC ; ___stack_chk_guard_ptr
__text:0055F070                 MOVS            R5, #0
__text:0055F072                 MOVS            R1, #0x1F
__text:0055F074                 MOVS            R2, #0
__text:0055F076                 LDR             R6, [R0] ; ___stack_chk_guard
__text:0055F078                 MOVS            R3, #0
__text:0055F07A                 LDR             R0, [R6]
__text:0055F07C                 STR             R0, [sP,#0x24C]
__text:0055F07E                 MOVS            R0, #0x1A
__text:0055F080                 STR             R5, [sP]
__text:0055F082                 BLX             _syscall
__text:0055F086                 ADD             R4, SP, #0x24
__text:0055F088                 MOV.W           R0, #0x1EC
__text:0055F08C                 STR             R0, [sP,#0x210]
__text:0055F08E                 MOVS            R1, #0
__text:0055F090                 MOV             R0, R4
__text:0055F092                 MOV.W           R2, #0x1EC
__text:0055F096                 BLX             _memset
__text:0055F09A                 MOVS            R0, #1
__text:0055F09C                 MOVS            R1, #0xE
__text:0055F09E                 STR             R0, [sP,#0x14]
__text:0055F0A0                 STR             R1, [sP,#0x18]
__text:0055F0A2                 STR             R0, [sP,#0x1C]
__text:0055F0A4                 BLX             _getpid
__text:0055F0A8                 STR             R0, [sP,#0x20]
__text:0055F0AA                 ADD             R0, SP, #0x14
__text:0055F0AC                 ADD             R3, SP, #0x210
__text:0055F0AE                 MOVS            R1, #4
__text:0055F0B0                 MOV             R2, R4
__text:0055F0B2                 STR             R5, [sP]
__text:0055F0B4                 STR             R5, [sP,#4]
__text:0055F0B6                 BLX             _sysctl
__text:0055F0BA                 MOV             R4, R0
 
Again, same thing. It would crash. So the last thing I did was I changed 
 
__text:0055F072                 MOVS            R1, #0x1F
 
to
 
__text:0055F072                 MOVS            R1, #0x0
 
and the app did not crash this time, it only froze right at the gameloft logo. So I tried to attach it to GDB, because it is technically running if it is frozen, and it gave me segmentation fault: 11. Please, if any of you could help me solve this problem, I would be so happy, its been driving me crazy since the new year :/
 
Thanks!

 

bro GameLoft's game are not that easy lol u should learn save game hack then ms then ida then code inject :3 

Posted (edited)

bro GameLoft's game are not that easy lol u should learn save game hack then ms then ida then code inject :3

 

I know that already, this is one of the first forums I've signed up with. I know how to use GDB to find offsets in IDA and I know how to patch a binary. My first hack was a savegame for COD: BOZ for v1.3.3, I already learned MS, MSHook, and I'm doing IDA and code inject (writeData) right now and I'm working on Dead Trigger 2 but decided to take a break and do this because I get angry very easily lol

 

so im not really a beginner ;)

 

@ 

@

Updated by Guest
Posted

@

:facepalm: he already understands arm, no need to go through all that outdated crap

 

@@Shmoo419

hmmm... me and Swag had the same issue with Brothers In arms 3...

 

trying disabling calls to _dlsym

hmm Its work for me :/

Posted

@@Laxus

 

O.o really?, with syscall patched? try brothers in arms 3, me and Swag had it crash on our devices :/

Works fine on my iP5, not sure about 64 bit devices

Posted (edited)

@

:facepalm: he already understands arm, no need to go through all that outdated crap

 

@@Shmoo419

hmmm... me and Swag had the same issue with Brothers In arms 3...

 

trying disabling calls to _dlsym

OK, I'll try that. Thanks for an answer, I'll see what happenes once I do it. But who is Swag?

 

@

Updated by Guest

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Lollipop 3: Match 3 Puzzles v25.0619.00 [ +5 Cheats ] Auto Win
      Modded/Hacked App: Lollipop 3: Match 3 Puzzles By Puzzle1Studio,inc.
      Bundle ID: com.puzzle1studio.ap.lollipopsweetheroesmatch3
      iTunes Store Link: https://apps.apple.com/us/app/lollipop-3-match-3-puzzles/id1634326372?uo=4
       

      🤩 Hack Features

      - Coins

      - Lives

      - Booster

      - Moves

      - Auto Win 
      • 6 replies
    • Lollipop 3: Match 3 Puzzles v25.0619.00 [ +5 Jailed ] Auto Win
      Modded/Hacked App: Lollipop 3: Match 3 Puzzles By Puzzle1Studio,inc.
      Bundle ID: com.puzzle1studio.ap.lollipopsweetheroesmatch3
      iTunes Store Link: https://apps.apple.com/us/app/lollipop-3-match-3-puzzles/id1634326372?uo=4

       

       

      📌 Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      🤩 Hack Features

      - Coins

      - Lives

      - Booster

      - Moves

      - Auto Win 

       

      ⬇️ iOS Hack Download IPA Link


      Hidden Content

      Download via the iOSGods App
      • 10 replies
    • Arena Heroes: Online RPG v1.10.30 [ +2 Cheats ] Skill CD
      Modded/Hacked App: Arena Heroes: Online RPG By INFUSION GAMES OU
      Bundle ID: com.infusiongames.fighting.rpg.adventure.multiplayer.wars.pvp.battles.arena.heroes
      iTunes Store Link: https://apps.apple.com/us/app/arena-heroes-online-rpg/id6448993010?uo=4
       

      🤩 Hack Features

      - DMG [ When Enemy Turn Disable ]
      - Skill CD



      DMG Not Tested With Dungeon & Arena 
      • 22 replies
    • Arena Heroes: Online RPG v1.10.30 [ +2 Jailed ] Skill CD
      Modded/Hacked App: Arena Heroes: Online RPG By INFUSION GAMES OU
      Bundle ID: com.infusiongames.fighting.rpg.adventure.multiplayer.wars.pvp.battles.arena.heroes
      iTunes Store Link: https://apps.apple.com/us/app/arena-heroes-online-rpg/id6448993010?uo=4


      🤩 Hack Features

      - DMG [ When Enemy Turn Disable ]
      - Skill CD



      DMG Not Tested With Dungeon & Arena 
      • 14 replies
    • 20 Minutes Till Dawn v6.6.2 [ +12+++ Cheats ] Coins Freeze
      Modded/Hacked App: 20 Minutes Till Dawn By QI YU SG. PTE. LTD.
      Bundle ID: com.flanne.erabit.20minutes.tilldawn.shooting.roguelike.iap.ios
      iTunes Store Link: https://apps.apple.com/us/app/20-minutes-till-dawn/id1635123906?uo=4


      Hack Features:
      - Coins Freeze 

      - Hero Unlocked 

      - Guns Unlocked 

      - Never Die 

      - Ammo Max 

      - No Reload 

      - Rune Unlocked

      - Rune LvL Max

      - Pickup Range [ Linked Rune ] Just Equip

      - DMG Easy Kill [ Linked Rune ] Just Equip

      - Skill CD [ Linked Rune ] Just Equip

      - HP Drop [ Linked Rune ] Just Equip

      - Knockback [ Linked Rune ] Just Equip

      + More Read Status Rune


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 31 replies
    • 20 Minutes Till Dawn v6.6.2 [ +12+++ Jailed ] Coins Freeze
      Modded/Hacked App: 20 Minutes Till Dawn By QI YU SG. PTE. LTD.
      Bundle ID: com.flanne.erabit.20minutes.tilldawn.shooting.roguelike.iap.ios
      iTunes Store Link: https://apps.apple.com/us/app/20-minutes-till-dawn/id1635123906?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:

      - Coins Freeze 

      - Hero Unlocked 

      - Guns Unlocked 

      - Never Die 

      - Ammo Max 

      - No Reload 

      - Rune Unlocked

      - Rune LvL Max

      - Pickup Range [ Linked Rune ] Just Equip

      - DMG Easy Kill [ Linked Rune ] Just Equip

      - Skill CD [ Linked Rune ] Just Equip

      - HP Drop [ Linked Rune ] Just Equip

      - Knockback [ Linked Rune ] Just Equip

      + More Read Status Rune

       
      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download IPA Link:

      Hidden Content

      Download via the iOSGods App
      • 17 replies
    • Stick Cricket Clash v1.9.7 [ +3 Jailed ] Currency Freeze
      Modded/Hacked App: Stick Cricket Clash By Stick Sports Ltd
      Bundle ID: com.sticksports.stickcricketclash
      iTunes Store Link: https://apps.apple.com/us/app/stick-cricket-clash/id6444344271?uo=4


      Hack Features:
      - Currency Freeze
      - Score [ Win All Match ]
      - Ads Reward 


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 13 replies
    • Stick Cricket Clash v1.9.7 [ +3 Cheats ] Currency Freeze
      Modded/Hacked App: Stick Cricket Clash By Stick Sports Ltd
      Bundle ID: com.sticksports.stickcricketclash
      iTunes Store Link: https://apps.apple.com/us/app/stick-cricket-clash/id6444344271?uo=4



      Hack Features:
      - Currency Freeze
      - Score Win All Match
      - Ads Reward 



      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 40 replies
    • Backpack Rush v1.602.207 [ +20 Cheats ] Currency Max
      Modded/Hacked App: Backpack Rush By Noodle Games Limited
      Bundle ID: com.onicore.backpack.rush
      iTunes Store Link: https://apps.apple.com/us/app/backpack-rush/id6736857029?uo=4

      Hack Features:
      - ADS Ticket

      - Gems

      - Gold

      - Energy

      - Silver Coins [ Merge Weapons ]

      - Summon Coins

      - Heroic Water [ Hero Up ]

      - Meteor Essence [ Gear Refining ]

      - Talent Book +2

      - Core Evo Stone [ Pet Evo Up ]

      - Fish Hook [ Obtain Gear During A Voyage ]

      - Pickaxe [ Mine ]

      - Blueprint [ Outfit Equip UP ]

      - Fragment [ Gear Up ]

      - Fragment [ Pet UP ]

      - Dungeon Keys +3

      - Spin

      - Enemy Status [ HP ATK 0 ] Easy Kill

      - DMG [ Outfit Just Equip & Unequip ]

      - HP [ Outfit Just Equip & Unequip ]


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 34 replies
    • Backpack Rush v1.602.207 [ +20 Jailed ] Currency Max
      Modded/Hacked App: Backpack Rush By Noodle Games Limited
      Bundle ID: com.onicore.backpack.rush
      iTunes Store Link: https://apps.apple.com/us/app/backpack-rush/id6736857029?uo=4

      Hack Features:

      - ADS Ticket

      - Gems

      - Gold

      - Energy

      - Silver Coins [ Merge Weapons ]

      - Summon Coins

      - Heroic Water [ Hero Up ]

      - Meteor Essence [ Gear Refining ]

      - Talent Book +2

      - Core Evo Stone [ Pet Evo Up ]

      - Fish Hook [ Obtain Gear During A Voyage ]

      - Pickaxe [ Mine ]

      - Blueprint [ Outfit Equip UP ]

      - Fragment [ Gear Up ]

      - Fragment [ Pet UP ]

      - Dungeon Keys +3

      - Spin

      - Enemy Status [ HP ATK 0 ] Easy Kill

      - DMG [ Outfit Just Equip & Unequip ]

      - HP [ Outfit Just Equip & Unequip ]

       
      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 25 replies
    • Candy Pop Story : Match 3 v1.21.0618 [ +3 Cheats ] Auto Win
      Modded/Hacked App: Candy Pop Story : Match 3 By F.O.G LIMITED
      Bundle ID: com.gamoper.candysweetstory.ios
      App Store Link: https://apps.apple.com/us/app/candy-pop-story-match-3/id6670773988?uo=4


      🤩 Hack Features

      - Auto Win
      - Coins
      - Moves
      -
      • 3 replies
    • Candy Pop Story : Match 3 v1.21.0618 [ +3 Jailed ] Auto Win
      Modded/Hacked App: Candy Pop Story : Match 3 By F.O.G LIMITED
      Bundle ID: com.gamoper.candysweetstory.ios
      App Store Link: https://apps.apple.com/us/app/candy-pop-story-match-3/id6670773988?uo=4
       

      🤩 Hack Features

      - Auto Win
      - Coins
      - Moves
      • 4 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines