Jump to content

[IDA Tutorial] How to Disable Memory Checks


1,072 posts in this topic

Recommended Posts

Updated (edited)

When developers make a game, sometimes they include memory checks to make things harder to hack. But what are memory checks? Memory checks are checks to make sure that a certain value, for example, money has been hacked. If it has been hacked, the memory check will kick in and set it back to its original, unhacked value. This is why when you test in iGameGuardian, GDB, LLDB, etc. your hack will not work. But we want our hacks to work, so here is how to disable them :snoop: This is also only an example function :snoop:

Hidden Content

    General background info: R0 holds your previous value of money. R5 holds the cost. R10 holds the new value of money after you bought something. The IDA offset for money will be 0xA99F8: STR R10, [R6, #32].

    Here is the example function that I came up with:

    0xA99C0 CMP R0, R10 //compare R10 with R0
    0xA99C4 BLE 0xA99E8 //branch to 0xA99E8 if it is less than or equal to
    0xA99C8 LDR R0, [R6, #32] //load R6+32 into R0
    0xA99CC SUB R5, R0, R10 //subtract R0 (previous money value) with R5 (cost) and put that value into R10
    0xA99D0 MOV R0, R6 //move R6 into R0
    0xA99D4 BL 0x30E7B0 //branch with link to 0x30E7B0
    0xA99D8 ADD R1, R0, R5 //add R0 with R1 and put that value into R5
    0xA99DC MOV R0, R6 //move R6 into R0
    0xA99E0 BL 0x30E7C0 //branch with link to 0x30E7C0
    0xA99E4 MOV R0, R6 //move R6 into R0
    0xA99E8 BL 0x30E7D0 //branch with link to 0x30E7D0
    0xA99EC ADD R1, R0, R5 //add R0 with R1 and put that value into R5
    0xA99F0 MOV R0, R6 //move R6 into R0
    0xA99F8 STR R10, [R6, #32] //IDA offset, store R10 (new money value) into R6+32
    

              I'm sure you know that the equivalent of spending in a game is subtracting. Knowing that, logically you would change 0xA99CC to MOV R10, R7. And you are right for thinking that (y), but it won't work because of the memory check. Earlier you read that R0 holds the previous value of money, R5 holds cost, and R10 holds the new value after spending.

              So you want to look for a "CMP" (compare) instruction that compares the previous value of money with the new value of money that is followed by a branch to somewhere. If the branch is BGT (branch if greater than), BLT (branch if less than), BNE (branch if not equal), or BLE (branch if less than or equal to), you usually have found the memory check. And there is one, at the beginning of the function: 0xA99C0: CMP R0, R10 followed by 0xA99C4: BLE 0xA99F8, or our IDA offset. That is telling the game to compare R10 with R0 and branch to 0xA99C4, or our IDA offset, and store the unhacked money value into R6+32 if R10 is less than or equal to R0.

              To defeat the memory check, you can NOP the branch to 0xA99F8 (our IDA offset) or change CMP R0, R10 to CMP R0, R0 or CMP R10, R10 so that the memory check (the CMP R0, R10) occurs but has no effect because the branch is NOP'ed or it is comparing itself to itself. And now you can change the SUB R5, R0, R10 (0xA99CC) to MOV R10, R7, and it will work! :)

    Recap:
    - R0 holds our previous value of money, R5 holds cost, and R10 holds the new value of money.
    - Our IDA offset is 0xA99F8, STR R10, [R6, #32].
    - Memory checks usually compare an old value of something with a new value of something, followed by a branch. They usually are BNE's (branch if not equal), BGT's (branch if greater than), BLT (branch if less than), or BLE's (branch if less than or equal to)
    - You can NOP the branch after the CMP to disable memory checks, or you can change CMP RX, RY to CMP RX, RX or CMP RY, RY to compare values to itself rather than comparing values to another value.

    Extra info:
    - Never NOP a CMP before a branch because a branch is literally a true or false type of instruction, and by doing that it the game will write both true and false, which will result in a crash.
    - Breakpoints really help with memory checks, if you set a breakpoint on what you think is a memory check, you will know if you got it if it hits or not.
    - If a breakpoint for what you think is a memory check hits, type "info r" for GDB or "reg re" in LLDB. That will let you see what registers hold what, and you can determine if you found the memory check or not. For example, if what you think you've found the memory check for a CMP R0, R3 followed by a BNE (branch if not equal), and the registers R0 and R3 are equal to each other, you have probably found the memory check.
    - This only applies to you if NOP'ing the branch does not work, or if you just decide to hack the CMP. Always check if the CMP is in ARM or thumb, and patch accordingly. If you patch a thumb instruction with an ARM instruction the game will crash. But how will you know if it is in thumb or in ARM? What you have to do it highlight the hex in IDA then go to "Hex View 1". If the hex is like this:

    00 00 00 00
    

    it is in ARM, but if the hex is like this:

    00 00
    

    it is in thumb. Think of it like this: an arm is longer than a thumb, so logically hex in ARM will be longer than hex in thumb.



I hope this helped! Also be sure to ask any questions if you have any :)

Updated by Guest
Posted (edited)

let me see (y)

 

e ...

 

0xA99C0 CMP R0, R10 //compare R10 with R0
0xA99C4 BLE 0xA99E8 //branch to 0xA99E8 if it is less than or equal to

 

 

 

if R10 less or eq  R0,then branch to 0xA99E8..

so why you wrote 0xA99F8

 

is it wrong ?

Updated by zzmutu
  • Like 3
  • Thanks 3
  • Agree 2
  • Informative 1
Posted

let me see (y)

 

e ...

 

0xA99C0 CMP R0, R10 //compare R10 with R0

0xA99C4 BLE 0xA99E8 //branch to 0xA99E8 if it is less than or equal to

 

 

 

if R10 less or eq  R0,then branch to 0xA99E8..

so why you wrote 0xA99F8

 

is it wrong ?

It's not wrong, it should be like that :) 

 

You don't always have to branch to a function, you can also branch directily to offsets. 

Posted (edited)

lets see what took you over 1 hour to patch  :wallbash:


cant see any checks but anyway there are 3 ways to do what you want:

rGpKGk8.png

change cost to 0 

change your money on the load 

change the final money

Updated by iOSv64
  • Like 1
Posted (edited)

lets see what took you over 1 hour to patch :wallbash:

cant see any checks but anyway there are 3 ways to do what you want:

rGpKGk8.png

change cost to 0

change your money on the load

change the final money

Well it took me an hour because I was doing x/i in GDB because my SSH is screwed up, and yeah I knew that. I just wanted to hack the SUB because it was quicker

 

edit: actually, as a challenge for myself I could time myself and see how long it takes me to make the cost 0, thanks for that idea :)

Updated by Guest
Posted

Well it took me an hour because I was doing x/i in GDB because my SSH is screwed up, and yeah I knew that. I just wanted to hack the SUB because it was quicker

 

edit: actually, as a challenge for myself I could time myself and see how long it takes me to make the cost 0, thanks for that idea :)

there is also a 4th solution , just mov r0 #0 bx lr the whole function ahah
  • Like 2
  • Agree 1
Posted

there is also a 4th solution , just mov r0 #0 bx lr the whole function ahah

Oh yeah I forgot about that, I'm guessing that's how free store was done in FG: Quest for Stuff? (never tried it myself)

 

00207047

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Groove Journey v4.1.0 Jailed Mod +1
      Modded/Hacked App: Groove Journey By Somtochukwu Mbala
      Bundle ID: com.kaipha.groovejourney
      iTunes Store Link: https://apps.apple.com/us/app/groove-journey/id6736345547?uo=4


      Hack Features:
      - PREMIUM


      iOS Hack Download IPA Link: https://iosgods.com/topic/190862-groove-journey-v311-jailed-mod-1/
        • Agree
        • Thanks
        • Winner
        • Like
      • 41 replies
    • Fishdom v8.9.2 Jailed Cheats +3
      Modded/Hacked App: Fishdom By PLR Worldwide Sales Limited
      Bundle ID: com.playrix.fishdom-freeplay
      iTunes Store Link: https://apps.apple.com/us/app/fishdom/id664575829?uo=4


      Hack Features:
      - Infinite Moves
      - Infinite Boosters
      - Infinite Lives

      NOTE: Play until you reached level 31 on non-hacked version before using this hack - Make sure you connected with GameCenter and Facebook to save your progress


      iOS Hack Download Link: https://iosgods.com/topic/116586-arm64-fishdom-v683-jailed-cheats-3/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 745 replies
    • DomiNation Asia By NEXON Company v12.1470.1471 - [ Currencies Freeze & More ]
      Modded/Hacked App: ドミネーションズ -文明創造- (DomiNations) By NEXON Company
      Bundle ID: com.nexon.dominations.asia
      iTunes Store Link: https://itunes.apple.com/jp/app/ドミネーションズ-文明創造-dominations/id1012778321


      Hack Features:
      - Unlimited Crowns/Food/Oil/Gold -> Resources will add instead of subtracting. Works with Crowns. Read note inside the feature for more information! This does not work for speeding up buildings.
      - All Achievements Unlocked 
      - Freeze Crowns/Food/Oil/Gold -> Freezes Resources so they do not decrease when used! This does not work for speeding up buildings.
      - No Citizen Cost 
      - 0 Cost to Speed Up Training Troops
      - 0 Cost to Speed Up Tactics
      - 0 Food Cost to Train Troops
      - 0 Food Cost to Upgrade Troops
      - No Timer to Upgrade Troops
      - 0 Food Cost to Train Spells
      - 0 General Train Cost
      - No General Train CoolDown
      - 0 Food Cost to Build Wonder
      - 0 Food Cost to Research Troops
      - 0 Food Cost to Upgrade Tactics
      - No Timer to Library Research
      - No Timer to Upgrade Spells
      - 0 Cost to Upgrade Buildings
      - 0 Workers Required to Upgrade
      - 0 Crown Cost For Peace

      This hack works on the latest x64 or ARM64 & ARM64e iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, 11, 11 Pro, 11 Pro Max, 12, 12 Pro, 12 Pro Max, 12 Mini, 13, 13 Pro, 13 Pro Max, 13 Mini, 14, 14 Plus, 14 Pro, 14 Pro Max, SE, iPod Touch 6G, 7G, iPad Air, Air 2, iPad Pro & iPad Mini 2, 3, 4, 5, 6 and later.


      Global hack(s): https://iosgods.com/topic/50401-ultrahack-dominations-v6660661-40-cheats-iosgods-exclusive/?tab=comments#comment-1582742
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,093 replies
    • Lands of Jail v1.0.7 [+1 Jailed Cheats]
      Modded/Hacked App: Lands of Jail By SINGAPORE JUST GAME TECHNOLOGY PTE. LTD.
      Bundle ID: com.justgame.jails.global
      App Store Link: https://apps.apple.com/us/app/lands-of-jail/id6738469826?uo=4



      🤩 Hack Features

      - Enemy Can't Attack (Enable Before Enter the Stage)

        • Winner
      • 1 reply
    • Lands of Jail v1.0.7 [+1 Cheats]
      Modded/Hacked App: Lands of Jail By SINGAPORE JUST GAME TECHNOLOGY PTE. LTD.
      Bundle ID: com.justgame.jails.global
      App Store Link: https://apps.apple.com/us/app/lands-of-jail/id6738469826?uo=4



      🤩 Hack Features

      - Enemy Can't Attack (Enable Before Enter the Stage)
       
        • Winner
      • 4 replies
    • Obsidian Knight RPG v1.97 [+3 Jailed Cheats]
      Modded/Hacked App: Obsidian Knight RPG By ActFirst Games AB
      Bundle ID: com.actfirstgames.obsidianknight
      iTunes Store Link: https://apps.apple.com/us/app/obsidian-knight-rpg/id6505061490?uo=4



      🚀 Hack Features

      - Unlimited Currency
      - God Mode / Never Die
      - High Damage / OHK
        • Informative
        • Winner
        • Like
      • 16 replies
    • Obsidian Knight RPG v1.97 [+3 Cheats]
      Modded/Hacked App: Obsidian Knight RPG By ActFirst Games AB
      Bundle ID: com.actfirstgames.obsidianknight
      iTunes Store Link: https://apps.apple.com/us/app/obsidian-knight-rpg/id6505061490?uo=4

       

      🚀 Hack Features

      - Unlimited Currency
      - God Mode / Never Die
      - High Damage / OHK
        • Agree
        • Haha
        • Winner
        • Like
      • 21 replies
    • Z Survivor: Backpack Shooter v0.59 [+2 Cheats]
      Modded/Hacked App: Z Survivor: Backpack Shooter By Tapped Ltd
      Bundle ID: com.tapped.zsurvivor
      iTunes Store Link: https://apps.apple.com/us/app/z-survivor-backpack-shooter/id6557072922?uo=4



      🤩 Hack Features

      - Debug Menu (Auto Play, Skip Level and more)
      - Never Die
      - Unlimited Resource (Currency, Keys, Blueprints)
        • Thanks
        • Winner
        • Like
      • 5 replies
    • Z Survivor: Backpack Shooter v0.59 [+2 Jailed Cheats]
      Modded/Hacked App: Z Survivor: Backpack Shooter By Tapped Ltd
      Bundle ID: com.tapped.zsurvivor
      iTunes Store Link: https://apps.apple.com/us/app/z-survivor-backpack-shooter/id6557072922?uo=4



      🤩 Hack Features

      - Debug Menu (Auto Play, Skip Level and more)
      - Never Die
      - Unlimited Resource (Currency, Keys, Blueprints)
        • Informative
        • Agree
        • Winner
        • Like
      • 5 replies
    • Kingdom Survivors v1.0720 [+4 Cheats]
      Modded/Hacked App: Kingdom Survivors By a plant standing on a chair Game Studio HB
      Bundle ID: com.DefaultCompany.MonsJacobSurvivorGame
      iTunes Store Link: https://apps.apple.com/us/app/kingdom-survivors/id1662497248?uo=4



      🚀 Hack Features

      - Never Die
      - Gain Exp (Toggle On gives you exp in battle)
      - Unlock All Characters
      - Add Currency
        • Like
      • 16 replies
    • Kingdom Survivors v1.0720 [+4 Jailed Cheats]
      Modded/Hacked App: Kingdom Survivors By a plant standing on a chair Game Studio HB
      Bundle ID: com.DefaultCompany.MonsJacobSurvivorGame
      iTunes Store Link: https://apps.apple.com/us/app/kingdom-survivors/id1662497248?uo=4



      Hack Features:

      - Never Die
      - Gain Exp (Toggle On gives you exp in battle)
      - Unlock All Characters
      - Add Currency

        • Informative
        • Agree
        • Thanks
        • Like
      • 12 replies
    • Dwarf Kingdom - Idle Survival v5.2 Debug Menu [+6 Jailed Cheats]
      Modded/Hacked App: Dwarf Kingdom - Idle Survival By PAPER PIGEON YAZILIM VE OYUN GELISTIRME LIMITED SIRKETI
      Bundle ID: com.PaperPigeon.DwarfKingdom
      iTunes Store Link: https://apps.apple.com/us/app/dwarf-kingdom-idle-survival/id6477745778?uo=4



      🤩 Hack Features

      - Debug Menu (Enable cheat and debug menu will open)
       
        • Informative
        • Like
      • 4 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines