Help/Support Coin Dozer IDA help... Function

[K_K 167.5k iPhone 13 Pro Max 15.1]

4CF25E                 ADDS             R0, #1  

 

change this to a mov r0,r7

Just now, K_K said:

4CF25E                 ADDS             R0, #1  

 

change this to a mov r0,r7

381c

[Goran 1.9k]

9 hours ago, K_K said:

4CF25E                 ADDS             R0, #1  

 

change this to a mov r0,r7

381c

nothing happening on decrease or increase.......

 

Updated August 24, 2017 by Goran

[K_K 167.5k iPhone 13 Pro Max 15.1]

did you change in a hex editor and put back into ipa?

 

[Goran 1.9k]

8 hours ago, K_K said:

did you change in a hex editor and put back into ipa?

 

Changed with HxD, Signed, 777 everything... but nothing happens... maybe that BRANCH??? i will try to breakpoint that LOC... to see what happens...

 

how to breakpoint this loc? " loc_4CF252 "

"b 0x4CF252"?

Updated August 24, 2017 by Goran

[Goran 1.9k]

what can be done here? Coin Dozer Game
R1 holds Coins value...

 

__text:004CF252 loc_4CF252                  ; CODE XREF: sub_4CEE7C+3CCj
__text:004CF252                 ADD.W           R0, R4, R11,LSL#2
__text:004CF256                 LDR                R1, [SP,#0x34+var_2C]
__text:004CF258                 STR                R1, [R0,#0x10]
__text:004CF25A                 LDR.W           R0, [R8,#0x30]
__text:004CF25E                 ADDS            R0, #1
__text:004CF260                 STR.W           R0, [R8,#0x30]
__text:004CF264                 ADD              SP, SP, #0x1C
__text:004CF266                 POP.W          {R8,R10,R11}
__text:004CF26A                 POP             {R4-R7,PC}

 

b 0x4CF252
Breakpoint 1: where = CoinDozer`CallbackILi1ELb1EE + 444833, address = 0x004cf252
(lldb) c
Process 235535 resuming
(lldb) Process 235535 stopped
* thread #1: tid = 0x3980f, 0x004cf252 CoinDozer`CallbackILi1ELb1EE + 444833, stop reason = breakpoint 1.1
    frame #0: 0x004cf252 CoinDozer`CallbackILi1ELb1EE + 444833
CoinDozer`CallbackILi1ELb1EE + 444833:
-> 0x4cf252:  addeq  lr, r11, r4, lsl #22
   0x4cf256:  .long  0x61019902                ; unknown opcode
   0x4cf25a:  .long  0x0030f8d8                ; unknown opcode

Updated August 28, 2017 by Goran

[Taylor Meyer 288 iPad (9th gen) 26.2]

On August 23, 2017 at 4:22 PM, Ted2 said:

Try NOP ' 0x4cf248' 

 

Also, why do u got all those ;load from memory?

I was wondering about that to 

[Goran 1.9k]

6 hours ago, Taylor Meyer said:

I was wondering about that to 

Man, I dont know, I did not makr that game, am just hacking

will try...

[Taylor Meyer 288 iPad (9th gen) 26.2]

18 hours ago, Goran said:

Man, I dont know, I did not makr that game, am just hacking

will try...

I meant the other texts by the registers on your image example load from memory