Jump to content

6 posts in this topic

Recommended Posts

Posted

Intro:
There's a bunch of tries to to decrypting lua but none of it isnt clear enough how to do it. I'm aware that this approach isnt good enough, because too much step that you'll not need to do but i'm still write it instead. Code in this tutorial ofcourse just bunch of copy-pasta stackoverflow.

Prerequisites
1. Frida (optional)
2. Disassembler (IDA, r2, ..)
3. Python (optional) (I'll use python in this tutorial)
4. A little knowledge about this

What will you need to do?
1. Get the KEY for decryption,
2. Write a script for decryption,
3. Edit the lua (Self explanation),
4. Encrypt back the file (Self explaination) (Same as step 2, but you'll encrypt instead of decrypt),
5. PROFIT.

---- Step by step ----

Get the KEY for decryption
There's bunch of way to do it, some of them:
1. XREFS for XXTeaLuaLoader::setXXTeaKey(string), and you can see it clearly. Most used methods among many games.
nJX33Yr.png
2. Use Frida. I'll explain it on 2nd post.
3. http://forum.xda-developers.com/showthread.php?p=12853986#post12853986
4. etc.. You get the idea.

Write a script for decryption
This is an example of use for XXTEA encryption, requirements(xxtea-py)

 
Code (Text):





#!/usr/bin/env python
import xxtea

chiper = open("assets/script/fund.lua", "rb").read()

out = open("out.lua", "wb")

key = b'mrgj'

out.write(xxtea.encrypt(chiper, key))

out.close()END

Example of use of frida (https://github.com/antojoseph/frida-android-hooks)

As described here, 

Opening the lua files with hex editor reveals that they use XXTEA block cipher.

Analyze libjinqu.so and it blatantly shows the following decryption subroutines:
xxtea_decrypt
cocos2d::extra::CCCrypto::decryptXXTEA

Get a pseudocode generator and copy the program in C++.

. We need to put a hook either at xxtea_decrypt or cocos2d::extra::CCCrypto::decryptXXTEA. Then prints out the arguments passed.
We know that args[2] is the one holding the pointer to key from decompile xxtea_decrypt lib.so
Oh5SCFC.png 
Explaination, v9 is the one holding the chiper text, v30 chipertext len(?), v13 pointer to key, v14 is key.length.
Its obvious if we want to leak the key we need to print args[3] bytes at args[2]. This is an example of use for it.

 

#!/usr/bin/env python
import frida
import sys

package_name = "com.gamebau.pq"

def get_messages_from_js(message, data):
            print(message)

jsc = """
Interceptor.attach (Module.findExportByName( "libgame.so", "xxtea_decrypt"), {
    onEnter: function (args) {
        console.log("----------------BEGIN----------------");
        console.log(hexdump(Memory.readByteArray(args[2], 12),{
         offset: 0,
         length: 12,
         header: true,
         ansi: true
        }));
    },
    onLeave: function (retval) {
        console.log("Decrypt:");
        console.log(hexdump(Memory.readByteArray(retval, 16),{
         offset: 0,
         length: 16,
         header: true,
         ansi: true
        }));
        console.log("-----------------END-----------------");   
    }
});
"""

process = frida.get_usb_device().attach(package_name)
script = process.create_script(jsc)
script.on('message',get_messages_from_js)
script.load()
sys.stdin.read()

profit,
gohBm09.png
 
--Update, forgot to mention about this. Another note, some games tries to pack the assets with common file compressor. While loading it, it tries to unpack the assets on stream. As you can see on the image, its PK file header. With simple google search you can deduce its a zip alike compression. Try to extract the decrypted file with 7zip/Winrar/etc.. and you could see the unpacked file.

Image:
gohBm09.png
 
 
Credits: Wobm And Stack Overflow

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Angry Birds 2 Cheats v4.0.2 +1 [ Infinite Currencies ]
      Modded/Hacked App: Angry Birds 2 By Rovio Entertainment Oyj
      Bundle ID: com.rovio.baba
      iTunes Store Link: https://apps.apple.com/us/app/angry-birds-2/id880047117?uo=4


      Hack Features:
      - Infinite Currencies ( Spend some/ Get some )


      Non-Jailbroken & No Jailbreak required hack(s):  https://iosgods.com/topic/70081-angry-birds-2-v2600-jailed-cheats-2/


      Hack Download Link: https://iosgods.com/topic/72039-angry-birds-2-cheats-v2600-1-infinite-currencies/
      • 1,960 replies
    • Alien Invasion: RPG Idle Space Cheats v4.18.00 +2
      Modded/Hacked App: Alien Invasion: RPG Idle Space By MULTICAST GAMES LIMITED
      Bundle ID: com.multicastgames.venomSurvive
      iTunes Store Link: https://apps.apple.com/us/app/alien-invasion-rpg-idle-space/id6443697602?uo=4


      Hack Features:
      - Infinite Currencies


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/167591-alien-invasion-rpg-idle-space-v204-jailed-cheats-1/


      iOS Hack Download Link: https://iosgods.com/topic/167589-alien-invasion-rpg-idle-space-cheats-v204-1/
      • 414 replies
    • Airport City Cheats v8.39.01 +1
      Modded/Hacked App: Airport City by Game Insight UAB
      Bundle ID: com.gameinsight.airportcity
      iTunes Store Link: https://apps.apple.com/us/app/airport-city/id495637457?uo=4&at=1010lce4


      Hack Features:
      - Free Store


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/126716-arm64-airport-city-v717-jailed-cheats-1/


      iOS Hack Download Link: https://iosgods.com/topic/126714-arm64-airport-city-cheats-v717-1/
      • 761 replies
    • Real Boxing 2 Cheats v1.55.2 +3
      Modded/Hacked App: Real Boxing 2 By Vivid Games S.A.
      Bundle ID: com.vividgames.realboxing2
      App Store Link: https://apps.apple.com/us/app/real-boxing-2/id932779605?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - God Mode
      - One Hit Kill
      - No Punch Cooldown

       

      Non-Jailbroken Hack: https://iosgods.com/topic/195702-real-boxing-2-v1550-jailed-cheats-3/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/195685-real-boxing-2-cheats-v1550-3/
      • 11 replies
    • Dead Trigger 2 Cheats v2.4.1 +10 [ God Mode & More ]
      Modded/Hacked App: DEAD TRIGGER 2: Zombie Games By Deca Games EOOD
      Bundle ID: com.madfingergames.deadtrigger2
      iTunes Store Link: https://apps.apple.com/us/app/dead-trigger-2-zombie-games/id720063540?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Infinite Ammo
      - No Reload
      - God Mode
      - Infinite Consumable
      - One Hit Kill
      - Drop Hacks
      - Instant Win
      - Better Aim
      - Aimbot
      - Kill All Zombies with 1 Tap

       

      Non-Jailbroken Hack: https://iosgods.com/topic/73791-dead-trigger-2-v230-jailed-cheats-10

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/78126-dead-trigger-2-cheats-v230-10-god-mode-more/
      • 2,841 replies
    • Boxing Star: Real Boxing Fight Cheats v7.0.0 +4
      Modded/Hacked App: Boxing Star: Real Boxing Fight By THUMBAGE Co., Ltd
      Bundle ID: com.ftt.boxingstar.gl.ios
      iTunes Store Link: https://apps.apple.com/us/app/boxing-star-real-boxing-fight/id1241887528?uo=4


      Hack Features:
      - Multiply Attack
      - Multiply Defense
      - God Mode
      - One Touch & Win

      Free Non-Jailbroken Hack: https://iosgods.com/topic/92347-boxing-star-real-boxing-fight-v620-jailed-cheats-4/


      Hack Download Link: https://iosgods.com/topic/72805-boxing-star-real-boxing-fight-cheats-v620-4/
      • 1,685 replies
    • [ Chiikawa Pocket JP ] ちいかわぽけっと v1.2.10 Jailed Cheats +3
      Modded/Hacked App: ちいかわぽけっと By Applibot Inc.
      Bundle ID: jp.co.applibot.chiikawapocket
      iTunes Store Link: https://apps.apple.com/jp/app/%E3%81%A1%E3%81%84%E3%81%8B%E3%82%8F%E3%81%BD%E3%81%91%E3%81%A3%E3%81%A8/id6596745408?uo=4

       

      📌 Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      🤩 Hack Features

      - God Mode
      - Multiply Attack
      - Custom Speed (Customize before Login or Clear stage to get apply)

       

      ⬇️ iOS Hack Download IPA Link: https://iosgods.com/topic/194281-chiikawa-pocket-jp-%E3%81%A1%E3%81%84%E3%81%8B%E3%82%8F%E3%81%BD%E3%81%91%E3%81%A3%E3%81%A8-v1111-jailed-cheats-3/
      • 24 replies
    • Chiikawa Pocket Cheats v1.2.10 +3
      Modded/Hacked App: Chiikawa Pocket By Applibot Inc.
      Bundle ID: jp.co.applibot.chiikawapocketgl
      iTunes Store Link: https://apps.apple.com/us/app/chiikawa-pocket/id6740838442?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - God Mode
      - Multiply Attack

       

      Non-Jailbroken Hack: https://iosgods.com/topic/193718-chiikawa-pocket-v111-jailed-cheats-2/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/193717-chiikawa-pocket-cheats-v111-2/
      • 45 replies
    • Real Racing 3 Cheats v13.5.1 +4
      Modded/Hacked App: Real Racing 3 By Electronic Arts Inc.
      Bundle ID: com.ea.realracing3.inc
      iTunes Store Link: https://apps.apple.com/us/app/real-racing-3/id556164008?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Free Store
      - Freeze M$
      - Freeze R$
      - Freeze Gold

      Non-Jailbroken Hack: https://iosgods.com/topic/185163-real-racing-3-v1317-jailed-cheats-4/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/147926-real-racing-3-cheats-v1318-4/
      • 1,048 replies
    • Dream League Soccer 2025 v12.240 +12 Cheats
      Modded/Hacked App: Dream League Soccer 2024 By First Touch Games Ltd.
      Bundle ID: com.firsttouch.dls7
      iTunes Store Link: https://apps.apple.com/us/app/dream-league-soccer-2024/id1462911602?uo=4


      Hack Features:
      - Stupid AI
      - No Foul
      - No Injuries
      - No Offside
      - Freeze Stamina
      - No Substitutions Limit
      - No Forfeit Penalty
      - Custom Logo Unlocked
      - Custom Kit Unlocked
      - Unlock Customizations
      - Throw In to End Current Half
      - Freeze Match Clock

      Notes: Play offline if you get kicked out of match.


      Non-Jailbroken & No Jailbreak required hack(s): 
       

      iOS Hack Download Link: https://iosgods.com/topic/138633-dream-league-soccer-2024-v11230-12-cheats/
      • 2,129 replies
    • Subway Surfers Cheats v3.48.10 +5
      Modded/Hacked App: Subway Surfers By Sybo Games ApS
      Bundle ID: com.kiloo.subwaysurfers
      iTunes Store Link: https://apps.apple.com/us/app/subway-surfers/id512939461?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Free Store (not Free iAP)
      - Free iAP (ViP Only)
      - Unlock Characters Outfit
      - Custom Jump Height
      - No Clip (To end level swipe to left til you get dizzy, swipe again and you will lose)

       

      Non-Jailbroken Hack: https://iosgods.com/topic/119795-subway-surfers-v3425-jailed-cheats-5/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/119793-subway-surfers-cheats-v3430-5/
      • 2,334 replies
    • Dice Dreams Cheats v1.93.0 +2
      Modded/Hacked App: Dice Dreams™ By SuperPlay LTD
      Bundle ID: com.superplaystudios.dicedreams
      iTunes Store Link: https://apps.apple.com/us/app/dice-dreams/id1484468651?uo=4


      Hack Features:
      - Custom Rolls
      - Unlimited Coins - afford regardless of if you have enough


      iOS Hack Download Link: https://iosgods.com/topic/138011-dice-dreams%E2%84%A2-v1692-2-cheats/
      • 636 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines