Jump to content
  • Sky
  • Mint
  • Azure
  • Indigo
  • Blueberry
  • Blackcurrant
  • Watermelon
  • Strawberry
  • Pomegranate
  • Ruby Red
  • Orange
  • Banana
  • Apple
  • Emerald
  • Teal
  • Chocolate
  • Slate
  • Midnight
  • Maastricht
  • Charcoal
  • Matte Black
Guest

TuT [IDA Tutorial]How to Disable Memory Checks

215 posts in this topic

Recommended Posts

Guest

When developers make a game, sometimes they include memory checks to make things harder to hack. But what are memory checks? Memory checks are checks to make sure that a certain value, for example, money has been hacked. If it has been hacked, the memory check will kick in and set it back to its original, unhacked value. This is why when you test in iGameGuardian, GDB, LLDB, etc. your hack will not work. But we want our hacks to work, so here is how to disable them :snoop: This is also only an example function :snoop:

Hidden Content

    General background info: R0 holds your previous value of money. R5 holds the cost. R10 holds the new value of money after you bought something. The IDA offset for money will be 0xA99F8: STR R10, [R6, #32].

    Here is the example function that I came up with:

    0xA99C0 CMP R0, R10 //compare R10 with R0
    0xA99C4 BLE 0xA99E8 //branch to 0xA99E8 if it is less than or equal to
    0xA99C8 LDR R0, [R6, #32] //load R6+32 into R0
    0xA99CC SUB R5, R0, R10 //subtract R0 (previous money value) with R5 (cost) and put that value into R10
    0xA99D0 MOV R0, R6 //move R6 into R0
    0xA99D4 BL 0x30E7B0 //branch with link to 0x30E7B0
    0xA99D8 ADD R1, R0, R5 //add R0 with R1 and put that value into R5
    0xA99DC MOV R0, R6 //move R6 into R0
    0xA99E0 BL 0x30E7C0 //branch with link to 0x30E7C0
    0xA99E4 MOV R0, R6 //move R6 into R0
    0xA99E8 BL 0x30E7D0 //branch with link to 0x30E7D0
    0xA99EC ADD R1, R0, R5 //add R0 with R1 and put that value into R5
    0xA99F0 MOV R0, R6 //move R6 into R0
    0xA99F8 STR R10, [R6, #32] //IDA offset, store R10 (new money value) into R6+32
    

              I'm sure you know that the equivalent of spending in a game is subtracting. Knowing that, logically you would change 0xA99CC to MOV R10, R7. And you are right for thinking that (y), but it won't work because of the memory check. Earlier you read that R0 holds the previous value of money, R5 holds cost, and R10 holds the new value after spending.

              So you want to look for a "CMP" (compare) instruction that compares the previous value of money with the new value of money that is followed by a branch to somewhere. If the branch is BGT (branch if greater than), BLT (branch if less than), BNE (branch if not equal), or BLE (branch if less than or equal to), you usually have found the memory check. And there is one, at the beginning of the function: 0xA99C0: CMP R0, R10 followed by 0xA99C4: BLE 0xA99F8, or our IDA offset. That is telling the game to compare R10 with R0 and branch to 0xA99C4, or our IDA offset, and store the unhacked money value into R6+32 if R10 is less than or equal to R0.

              To defeat the memory check, you can NOP the branch to 0xA99F8 (our IDA offset) or change CMP R0, R10 to CMP R0, R0 or CMP R10, R10 so that the memory check (the CMP R0, R10) occurs but has no effect because the branch is NOP'ed or it is comparing itself to itself. And now you can change the SUB R5, R0, R10 (0xA99CC) to MOV R10, R7, and it will work! :)

    Recap:
    - R0 holds our previous value of money, R5 holds cost, and R10 holds the new value of money.
    - Our IDA offset is 0xA99F8, STR R10, [R6, #32].
    - Memory checks usually compare an old value of something with a new value of something, followed by a branch. They usually are BNE's (branch if not equal), BGT's (branch if greater than), BLT (branch if less than), or BLE's (branch if less than or equal to)
    - You can NOP the branch after the CMP to disable memory checks, or you can change CMP RX, RY to CMP RX, RX or CMP RY, RY to compare values to itself rather than comparing values to another value.

    Extra info:
    - Never NOP a CMP before a branch because a branch is literally a true or false type of instruction, and by doing that it the game will write both true and false, which will result in a crash.
    - Breakpoints really help with memory checks, if you set a breakpoint on what you think is a memory check, you will know if you got it if it hits or not.
    - If a breakpoint for what you think is a memory check hits, type "info r" for GDB or "reg re" in LLDB. That will let you see what registers hold what, and you can determine if you found the memory check or not. For example, if what you think you've found the memory check for a CMP R0, R3 followed by a BNE (branch if not equal), and the registers R0 and R3 are equal to each other, you have probably found the memory check.
    - This only applies to you if NOP'ing the branch does not work, or if you just decide to hack the CMP. Always check if the CMP is in ARM or thumb, and patch accordingly. If you patch a thumb instruction with an ARM instruction the game will crash. But how will you know if it is in thumb or in ARM? What you have to do it highlight the hex in IDA then go to "Hex View 1". If the hex is like this:

    00 00 00 00
    

    it is in ARM, but if the hex is like this:

    00 00
    

    it is in thumb. Think of it like this: an arm is longer than a thumb, so logically hex in ARM will be longer than hex in thumb.



I hope this helped! Also be sure to ask any questions if you have any :)

Edited by Guest

Share this post


Link to post
Share on other sites

let me see (y)

 

e ...

 

0xA99C0 CMP R0, R10 //compare R10 with R0
0xA99C4 BLE 0xA99E8 //branch to 0xA99E8 if it is less than or equal to

 

 

 

if R10 less or eq  R0,then branch to 0xA99E8..

so why you wrote 0xA99F8

 

is it wrong ?

Edited by zzmutu

Share this post


Link to post
Share on other sites
Guest

let me see (y)

 

e ...

 

0xA99C0 CMP R0, R10 //compare R10 with R0

0xA99C4 BLE 0xA99E8 //branch to 0xA99E8 if it is less than or equal to

 

 

 

if R10 less or eq  R0,then branch to 0xA99E8..

so why you wrote 0xA99F8

 

is it wrong ?

It's not wrong, it should be like that :) 

 

You don't always have to branch to a function, you can also branch directily to offsets. 

Share this post


Link to post
Share on other sites

lets see what took you over 1 hour to patch  :wallbash:


cant see any checks but anyway there are 3 ways to do what you want:

rGpKGk8.png

change cost to 0 

change your money on the load 

change the final money

Edited by iOSv64

Share this post


Link to post
Share on other sites
Guest

lets see what took you over 1 hour to patch :wallbash:

cant see any checks but anyway there are 3 ways to do what you want:

rGpKGk8.png

change cost to 0

change your money on the load

change the final money

Well it took me an hour because I was doing x/i in GDB because my SSH is screwed up, and yeah I knew that. I just wanted to hack the SUB because it was quicker

 

edit: actually, as a challenge for myself I could time myself and see how long it takes me to make the cost 0, thanks for that idea :)

Edited by Guest

Share this post


Link to post
Share on other sites

Well it took me an hour because I was doing x/i in GDB because my SSH is screwed up, and yeah I knew that. I just wanted to hack the SUB because it was quicker

 

edit: actually, as a challenge for myself I could time myself and see how long it takes me to make the cost 0, thanks for that idea :)

there is also a 4th solution , just mov r0 #0 bx lr the whole function ahah

Share this post


Link to post
Share on other sites
Guest

there is also a 4th solution , just mov r0 #0 bx lr the whole function ahah

Oh yeah I forgot about that, I'm guessing that's how free store was done in FG: Quest for Stuff? (never tried it myself)

 

00207047

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic... Posting Guidelines

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Our picks

    • Call of Duty®: Mobile v1.0.4 - [ Radar Hack & No Recoil ]
      Modded/Hacked App: Call of Duty®: Mobile By Activision Publishing, Inc.
      Bundle ID: com.activision.callofduty.shooter
      iTunes Store Link: https://apps.apple.com/ca/app/call-of-duty-mobile/id1287282214?uo=4&at=1010lce4

      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Cydia Impactor.
      - A Computer Running Windows/Mac/Linux.


      Hack Features:
      - Radar Hack
      - No Recoil
      Will Add More Features Later!!!

      This hack works on the latest x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, SE, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.


      Jailbreak required hack(s): https://iosgods.com/topic/103698-call-of-duty®-mobile-v104-radar-hack-more/#comments


      iOS Hack Download Link:

      Hidden Content
      Download iOSGods App







      PC Installation Instructions:
      STEP 1: If necessary, uninstall the app if you have it installed on your iDevice. Some hacked IPAs will install as a duplicate app. Make sure to back it up so you don't lose your progress.
      STEP 2: Download the pre-hacked .IPA file from the link above to your computer.
      STEP 3: Download Cydia Impactor and extract the archive.
      STEP 4: Open/Run Cydia Impactor on your computer then connect your iOS Device and wait until your device name shows up on Cydia Impactor.
      STEP 5: Once your iDevice appears, drag the modded .IPA file you downloaded and drop it inside the Cydia Impactor application.
      STEP 6: You will now be asked to enter your iTunes/Apple ID email login & then your password. Go ahead and enter the required information..
      STEP 7: Wait for Cydia Impactor to finish sideloading/installing the hacked IPA.
      STEP 8: Once the installation is complete and you see the app on your Home Screen, you will now need to go to Settings -> General -> Profiles & Device Management. Once there, tap on the email you entered from step 6, and then tap on 'Trust [email protected]'.
      STEP 9: Now go to your Home Screen and open the newly installed app and everything should work fine. You may need to follow further per app instructions inside the hack's popup in-game.
      NOTE: For free Apple Developer accounts you will need to repeat this process every 7 days. Using a disposable Apple ID for this process is suggested but not required. Jailbroken iDevices can skip using Cydia Impactor and just install the IPA mod with AppSync & IPA Installer (or alternatives) from Cydia. If you have any questions or problems, read our Cydia Impactor topic and if you don't find a solution, post your issue down below and we'll do our best to help! If the hack does work for you, post your feedback below and help out other fellow members that are encountering issues.


      Credits:
      - @DanYal


      Cheat Video/Screenshots:

      N/A
      • 6 replies
    • [ARM64] Stickman Legends: Shadow War Cheats v2.4.20 +12
      Modded/Hacked App: Stickman Legends: Shadow War By Zitga
      Bundle ID: com.zitga.ninja.stickman.legends
      iTunes Store Link: https://itunes.apple.com/us/app/stickman-legends-ninja-heroes/id1186523572?mt=8&uo=4&at=1010lce4



      Hack Features:
      - Free iAP (Remove Any iAP Hacks Before Use This)
      - God Mode
      - Huge Damage / OHK



      Hack Download Link: https://iosgods.com/topic/75246-arm64-stickman-legends-ninja-heroes-cheats-v2328-6/


      Credits:
      - @Laxus 

      #Hack #Jailbreak #Cydia #Cheat #Apple #Android #iOSGods
      • 490 replies
    • [ARM64] Exploding Kitten v4.0.2 Jailed Cheats +1
      Modded/Hacked App: Exploding Kittens® by Exploding Kittens LLC
      Bundle ID: com.explodingkittens.projectbombsquad
      iTunes Store Link: https://itunes.apple.com/us/app/exploding-kittens/id1040227414?mt=8&uo=4&at=1010lce4



      Hack Features:
      - iAP Hacks
       

      Hack Download Link: https://iosgods.com/topic/83296-arm64-exploding-kitten-v400-jailed-cheats-1/
      • 47 replies
    • [ARM64] Mimo: Learn to Code v3.31 Jailed Mod +1
      Modded/Hacked App: Mimo: Learn to Code By Mimohello GmbH
      Bundle ID: com.getmimo.mimo
      iTunes Store Link: https://itunes.apple.com/us/app/mimo-learn-to-code/id1133960732?mt=8&uo=4&at=1010lce4


      Hack Features:
      - Premium
      - All Chapters Unlocked
       

      Hack Download Link: https://iosgods.com/topic/68649-arm64-mimo-learn-to-code-v312-jailed-mod-2/


      Credits:
      - @Laxus
      • 434 replies
    • [ARM64] Dunk Nation 3X3 Cheats v2.2.0 +2
      Modded/Hacked App: Dunk Nation 3X3 by BEIJING HALCYON NETWORK TECHNOLOGY CO., LIMITED
      Bundle ID: com.gameleap.na.dn
      iTunes Store Link: https://apps.apple.com/us/app/dunk-nation-3x3/id1233128606?uo=4&at=1010lce4



      Hack Features:
      - Midorima Mode
      - Akashi Mode
       

      iOS Hack Download Link: https://iosgods.com/topic/103869-arm64-dunk-nation-3x3-cheats-v220-2/
      • 21 replies
    • [Rev]Call of Duty®: Mobile v1.0.4 +7 OfficialCheats[Radar,No Charge Lock+More]
      Modded/Hacked App: Call of Duty®: Mobile by Activision Publishing, Inc.
      Bundle ID: com.activision.callofduty.shooter
      iTunes Store Link: https://apps.apple.com/au/app/call-of-duty-mobile/id1287282214?uo=4&at=1010lce4


      Hack Features:
      - Radar hack
      - No "lock charge"/Instant shot
      - No spread
      - No recoil
      - No reload
      - Disable shake effects
      - Zero crosshair 
      - Knife button always active

      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download Link:
      • 35 replies
    • Looney Tunes™ World of Mayhem v14.2.3 - [ God Mode ]
      Modded/Hacked App: Looney Tunes™ World of Mayhem By Scopely
      Bundle ID: com.aqupepgames.pepe
      iTunes Store Link: https://apps.apple.com/ca/app/looney-tunes-world-of-mayhem/id1158042933?uo=4&at=1010lce4

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate or Substitute.
      - PreferenceLoader (from Cydia or Sileo).


      Hack Features:
      - God Mode 

      You need to update your characters otherwise you'll lose!!!

      All features are unlinked and only for player, you!

      This hack is an In-Game Mod Menu (iGMM). In order to activate the Mod Menu, tap on the iOSGods button found inside the app. This hack works on the latest x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, SE, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.


      iOS Hack Download Link:

      Hidden Content
      Download Hack







      Installation Instructions:
      STEP 1: Download the .deb Cydia hack file from the link above.
      STEP 2: Copy the file over to your iDevice using any of the file managers mentioned above or skip this step if you're downloading from your iDevice.
      STEP 3: Using iFile or Filza, browse to where you saved the downloaded .deb file and tap on it.
      STEP 4: Once you tap on the file, you will then need to press on 'Installer' or 'Install' from the options on your screen.
      STEP 5: Let iFile / Filza finish the cheat installation. Make sure it successfully installs, otherwise see the note below.
      STEP 6: Now open your iDevice settings and scroll down until you see the settings for this cheat and tap on it. If the hack is a Mod Menu, the cheat features can be toggled in-game.
      STEP 7: Turn on the features you want and play the game. You may need to follow further instructions inside the hack's popup in-game.

       

      NOTE: If you have any questions or problems, read our Troubleshooting topic & Frequently Asked Questions topic. If you still haven't found a solution, post your issue down below and we'll do our best to help! If the hack does work for you, post your feedback below and help out other fellow members that are encountering issues.


      Credits:
      - @DanYal


      Cheat Video/Screenshots:

      N/A
      • 9 replies
    • Critical Ops v1.7.3 +21 [No Recoil] [Always Headshot/Instant Kill]
      Modded/Hacked App: Critical Ops by Critical Force Oy
      Bundle ID: com.criticalforceentertainment.criticalops
      iTunes Store Link: https://itunes.apple.com/us/app/critical-ops/id1017717218?mt=8&uo=4&at=1010lce4


      Hack Features:
      - Radar
      - Semi Team Radar READ NOTE
      - Shoot Through Walls
      - Anti-Flash
      - Always See Crosshair
      - Increased Aim Assist
      - Increased Head Shot Ratio 
      - Increased Body Shot Ratio
      - Increased Hitbox Distance
      - Fly Hack
      - Commit Suicide
      - Walk Through Walls
      - Unlock All Skins Visual
      - Crouch Hack
      - No Sniper Blur
      - Low FOV
      - Medium FOV
      - High FOV
      - Upside Down FOV


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 1,801 replies
    • Call of Duty®: Mobile v1.0.4 - [ Radar Hack & More ]
      Modded/Hacked App: Call of Duty®: Mobile By Activision Publishing, Inc.
      Bundle ID: com.activision.callofduty.shooter
      iTunes Store Link: https://apps.apple.com/ca/app/call-of-duty-mobile/id1287282214?uo=4&at=1010lce4

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate or Substitute.
      - PreferenceLoader (from Cydia or Sileo).


      Hack Features:
      - Custom FOV - 1 - 10
      - Radar Hack
      - No Recoil
      - No Spread
      • 134 replies
    • Yu-Gi-Oh! Duel Links v3.9.0 - [ Auto-Play & More ]
      Modded/Hacked App: Yu-Gi-Oh! Duel Links By KONAMI
      Bundle ID: jp.konami.yugiohmobile
      iTunes Store Link: https://itunes.apple.com/us/app/yu-gi-oh-duel-links/id1068378177?mt=8&uo=4&at=1010lce4
       

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate (from Cydia).
      - PreferenceLoader (from Cydia).


      Hack Features:
      - Auto-Play - Don't Work In PVP 
      -- Always The Best Tactics
      - Face Up Card
      -- Enemies Hand Card Show
      - Show Monster And Status
      -- Enemies Deck Card Shows
      • 350 replies
    • ONE PIECE サウザンドストーム v1.25.7 - [ Security Check Bypass & More ]
      Modded/Hacked App: ONE PIECE サウザンドストーム By BANDAI NAMCO Entertainment Inc.
      Bundle ID: jp.co.bandainamcoent.BNEI0246
      iTunes Store Link: https://itunes.apple.com/jp/app/one-piece-サウザンドストーム/id1082959065?mt=8&uo=4&at=1010lce4

      Hack Features:
      - Instant Win - Enable It Before Entering Mission
      - Weak Enemies - Enable It In Mission
      - DisArmed Enemies - Enable It Before Entering Mission
      - 2.5K Sp - Not Unlimited
      - High Skill Damage
      - No Skill CD
      - No Player Exchange CD
      - Enemies Always Drop Berries
      - Enemies Always Drop Chests
      - Gold Chest On Every Quest
      - Increase Movement Speed
      • 213 replies
    • Dark Sword 2 v1.0.3 - [ One Hit Kill & More ]
      Modded/Hacked App: Dark Sword 2 By NANOO COMPANY Inc.
      Bundle ID: com.nanoo.darksword2
      iTunes Store Link: https://apps.apple.com/us/app/dark-sword-2/id1186180535?uo=4&at=1010lce4

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate or Substitute.
      - PreferenceLoader (from Cydia or Sileo).


      Hack Features:
      - One Hit Kill
      - High Defense
      - Unlimited Currencies
      - Unlimited EXP
      - Unlimited Stamina

      This hack is an In-Game Mod Menu (iGMM). In order to activate the Mod Menu, tap on the iOSGods button found inside the app. This hack works on the latest x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, SE, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.


      Non-Jailbroken & No Jailbreak required hack(s): 


      iOS Hack Download Link:

      Hidden Content
      Download Hack







      Installation Instructions:
      STEP 1: Download the .deb Cydia hack file from the link above.
      STEP 2: Copy the file over to your iDevice using any of the file managers mentioned above or skip this step if you're downloading from your iDevice.
      STEP 3: Using iFile or Filza, browse to where you saved the downloaded .deb file and tap on it.
      STEP 4: Once you tap on the file, you will then need to press on 'Installer' or 'Install' from the options on your screen.
      STEP 5: Let iFile / Filza finish the cheat installation. Make sure it successfully installs, otherwise see the note below.
      STEP 6: Now open your iDevice settings and scroll down until you see the settings for this cheat and tap on it. If the hack is a Mod Menu, the cheat features can be toggled in-game.
      STEP 7: Turn on the features you want and play the game. You may need to follow further instructions inside the hack's popup in-game.

       

      NOTE: If you have any questions or problems, read our Troubleshooting topic & Frequently Asked Questions topic. If you still haven't found a solution, post your issue down below and we'll do our best to help! If the hack does work for you, post your feedback below and help out other fellow members that are encountering issues.


      Credits:
      - @DanYal


      Cheat Video/Screenshots:

      N/A
      • 64 replies
  • Recently Browsing   0 members

    No registered users viewing this page.


    • Administrator |
    • Overseer  |
    • ViP Plus |
    • ViP Jailed |
    • ViP |
    • Cheater  |
    • Modder  |
    • Novice Cheater |
    • Rookie Modder |
    • Contributor |
    • Senior Member |
    • Member |
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue. Privacy Policy - Guidelines