Jump to content

[IDA Tutorial] How to Disable Memory Checks


Guest

942 posts in this topic

Recommended Posts

When developers make a game, sometimes they include memory checks to make things harder to hack. But what are memory checks? Memory checks are checks to make sure that a certain value, for example, money has been hacked. If it has been hacked, the memory check will kick in and set it back to its original, unhacked value. This is why when you test in iGameGuardian, GDB, LLDB, etc. your hack will not work. But we want our hacks to work, so here is how to disable them :snoop: This is also only an example function :snoop:

Hidden Content

    General background info: R0 holds your previous value of money. R5 holds the cost. R10 holds the new value of money after you bought something. The IDA offset for money will be 0xA99F8: STR R10, [R6, #32].

    Here is the example function that I came up with:

    0xA99C0 CMP R0, R10 //compare R10 with R0
    0xA99C4 BLE 0xA99E8 //branch to 0xA99E8 if it is less than or equal to
    0xA99C8 LDR R0, [R6, #32] //load R6+32 into R0
    0xA99CC SUB R5, R0, R10 //subtract R0 (previous money value) with R5 (cost) and put that value into R10
    0xA99D0 MOV R0, R6 //move R6 into R0
    0xA99D4 BL 0x30E7B0 //branch with link to 0x30E7B0
    0xA99D8 ADD R1, R0, R5 //add R0 with R1 and put that value into R5
    0xA99DC MOV R0, R6 //move R6 into R0
    0xA99E0 BL 0x30E7C0 //branch with link to 0x30E7C0
    0xA99E4 MOV R0, R6 //move R6 into R0
    0xA99E8 BL 0x30E7D0 //branch with link to 0x30E7D0
    0xA99EC ADD R1, R0, R5 //add R0 with R1 and put that value into R5
    0xA99F0 MOV R0, R6 //move R6 into R0
    0xA99F8 STR R10, [R6, #32] //IDA offset, store R10 (new money value) into R6+32
    

              I'm sure you know that the equivalent of spending in a game is subtracting. Knowing that, logically you would change 0xA99CC to MOV R10, R7. And you are right for thinking that (y), but it won't work because of the memory check. Earlier you read that R0 holds the previous value of money, R5 holds cost, and R10 holds the new value after spending.

              So you want to look for a "CMP" (compare) instruction that compares the previous value of money with the new value of money that is followed by a branch to somewhere. If the branch is BGT (branch if greater than), BLT (branch if less than), BNE (branch if not equal), or BLE (branch if less than or equal to), you usually have found the memory check. And there is one, at the beginning of the function: 0xA99C0: CMP R0, R10 followed by 0xA99C4: BLE 0xA99F8, or our IDA offset. That is telling the game to compare R10 with R0 and branch to 0xA99C4, or our IDA offset, and store the unhacked money value into R6+32 if R10 is less than or equal to R0.

              To defeat the memory check, you can NOP the branch to 0xA99F8 (our IDA offset) or change CMP R0, R10 to CMP R0, R0 or CMP R10, R10 so that the memory check (the CMP R0, R10) occurs but has no effect because the branch is NOP'ed or it is comparing itself to itself. And now you can change the SUB R5, R0, R10 (0xA99CC) to MOV R10, R7, and it will work! :)

    Recap:
    - R0 holds our previous value of money, R5 holds cost, and R10 holds the new value of money.
    - Our IDA offset is 0xA99F8, STR R10, [R6, #32].
    - Memory checks usually compare an old value of something with a new value of something, followed by a branch. They usually are BNE's (branch if not equal), BGT's (branch if greater than), BLT (branch if less than), or BLE's (branch if less than or equal to)
    - You can NOP the branch after the CMP to disable memory checks, or you can change CMP RX, RY to CMP RX, RX or CMP RY, RY to compare values to itself rather than comparing values to another value.

    Extra info:
    - Never NOP a CMP before a branch because a branch is literally a true or false type of instruction, and by doing that it the game will write both true and false, which will result in a crash.
    - Breakpoints really help with memory checks, if you set a breakpoint on what you think is a memory check, you will know if you got it if it hits or not.
    - If a breakpoint for what you think is a memory check hits, type "info r" for GDB or "reg re" in LLDB. That will let you see what registers hold what, and you can determine if you found the memory check or not. For example, if what you think you've found the memory check for a CMP R0, R3 followed by a BNE (branch if not equal), and the registers R0 and R3 are equal to each other, you have probably found the memory check.
    - This only applies to you if NOP'ing the branch does not work, or if you just decide to hack the CMP. Always check if the CMP is in ARM or thumb, and patch accordingly. If you patch a thumb instruction with an ARM instruction the game will crash. But how will you know if it is in thumb or in ARM? What you have to do it highlight the hex in IDA then go to "Hex View 1". If the hex is like this:

    00 00 00 00
    

    it is in ARM, but if the hex is like this:

    00 00
    

    it is in thumb. Think of it like this: an arm is longer than a thumb, so logically hex in ARM will be longer than hex in thumb.



I hope this helped! Also be sure to ask any questions if you have any :)

Updated by Guest
Link to comment
Share on other sites

let me see (y)

 

e ...

 

0xA99C0 CMP R0, R10 //compare R10 with R0
0xA99C4 BLE 0xA99E8 //branch to 0xA99E8 if it is less than or equal to

 

 

 

if R10 less or eq  R0,then branch to 0xA99E8..

so why you wrote 0xA99F8

 

is it wrong ?

Updated by zzmutu
  • Like 1
  • Thanks 3
  • Agree 2
Link to comment
Share on other sites

let me see (y)

 

e ...

 

0xA99C0 CMP R0, R10 //compare R10 with R0

0xA99C4 BLE 0xA99E8 //branch to 0xA99E8 if it is less than or equal to

 

 

 

if R10 less or eq  R0,then branch to 0xA99E8..

so why you wrote 0xA99F8

 

is it wrong ?

It's not wrong, it should be like that :) 

 

You don't always have to branch to a function, you can also branch directily to offsets. 

Link to comment
Share on other sites

lets see what took you over 1 hour to patch :wallbash:

cant see any checks but anyway there are 3 ways to do what you want:

rGpKGk8.png

change cost to 0

change your money on the load

change the final money

Well it took me an hour because I was doing x/i in GDB because my SSH is screwed up, and yeah I knew that. I just wanted to hack the SUB because it was quicker

 

edit: actually, as a challenge for myself I could time myself and see how long it takes me to make the cost 0, thanks for that idea :)

Updated by Guest
Link to comment
Share on other sites

Well it took me an hour because I was doing x/i in GDB because my SSH is screwed up, and yeah I knew that. I just wanted to hack the SUB because it was quicker

 

edit: actually, as a challenge for myself I could time myself and see how long it takes me to make the cost 0, thanks for that idea :)

there is also a 4th solution , just mov r0 #0 bx lr the whole function ahah
  • Agree 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below. For more information, please read our Posting Guidelines.
Reply to this topic... Posting Guidelines

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Our picks

    • WAR OF THE VISIONS FFBE Cheats v8.6.0 +3 [ Multiply Damage & Defense ]
      Modded/Hacked App: FINAL FANTASY BE:WOTV By SQUARE ENIX Co., Ltd.
      Bundle ID: com.square-enix.WOTVffbeww
      iTunes Store Link: https://apps.apple.com/us/app/final-fantasy-be-wotv/id1484937345?uo=4


      Hack Features:
      - Multiply Attack
      - Multiply Defense
      - Full Map Movement


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/173485-final-fantasy-bewotv-v730-jailed-cheats-3/


      iOS Hack Download Link: https://iosgods.com/topic/173483-war-of-the-visions-ffbe-cheats-v740-3-multiply-damage-defense/
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 124 replies
    • Slash & Girl - Endless Run By Shenzhen Qingtian IE Technology Co., Ltd v7.9.981 Cheats +4
      Modded/Hacked App: Slash & Girl - Endless Run By Shenzhen Qingtian IE Technology Co., Ltd
      Bundle ID: com.slash.girl.redfish
      iTunes Store Link: https://apps.apple.com/vn/app/slash-girl-endless-run/id1484766098?uo=4

      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - No die
      - One hit
      - Freeze combo
      - Freeze lighting
        • Informative
        • Thanks
        • Like
      • 3 replies
    • Slash & Girl - Endless Run By Shenzhen Qingtian IE Technology Co., Ltd v7.9.981 Cheats +7
      Modded/Hacked App: Slash & Girl - Endless Run By Shenzhen Qingtian IE Technology Co., Ltd
      Bundle ID: com.slash.girl.redfish
      iTunes Store Link: https://apps.apple.com/vn/app/slash-girl-endless-run/id1484766098?uo=4

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing / or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).
       

      Hack Features:
      - No die
      - One hit
      - Earn more currencies
      - Custom score
      - Freeze combo
      - Freeze lighting
      - Jump height
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 32 replies
    • Blood Knight : 3D Idle RPG v2.98 Cheats +1
      Modded/Hacked App: Blood Knight : 3D Idle RPG By SUPERBOX. Inc
      Bundle ID: com.superbox.ios.blood
      iTunes Store Link: https://apps.apple.com/us/app/blood-knight-3d-idle-rpg/id6443827240?uo=4

       


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - High damage
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 76 replies
    • Blood Knight : 3D Idle RPG v2.98 Cheats +1
      Modded/Hacked App: Blood Knight : 3D Idle RPG By SUPERBOX. Inc
      Bundle ID: com.superbox.ios.blood
      iTunes Store Link: https://apps.apple.com/us/app/blood-knight-3d-idle-rpg/id6443827240?uo=4

       


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - High damage
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 37 replies
    • [ Dead by Daylight TW ] 黎明死線M - Envoy v1.0.32 +27 Cheats
      Modded/Hacked App: 黎明死線M - Envoy [ Dead by Daylight Mobile TW ] By Envoy Interactive Entertainment Co., Ltd.
      Bundle ID: com.netease.dbdtw
      iTunes Store Link: https://apps.apple.com/tw/app/%E9%BB%8E%E6%98%8E%E6%AD%BB%E7%B7%9Am-envoy/id1504610184?uo=4


      Hack Features:
      - No Skill Check
      - No Killer Attack/Miss Cooldown
      - Custom Speed
      - Killer Location Cham
      - Survivor Location Cham
      - Generator Cham
      - Totems Cham
      - Chest Cham
      - Portal Cham
      - Hatch Cham
      - Hooks Cham
      - Trap Cham
      - Escape Switch Cham
      - Normal Pallet Cham
      - Dream Pallet Cham
      - Lockers Cham
      - Survivor Trap Immunity
      - Instant Window Vault*
      - Instant Destroy Pallets*
      - Instant Pickup Downed Players*
      - Custom FOV
      - Disable Footsteps - use as a survivor.
      - No Nurse Fatigue
      - Instant Nurse Teleport
      - Nurse Teleport Through Anything
      - Better Aim Assist
      - No Heartbeat

      * Under one switch


      iOS Hack Download Link: https://iosgods.com/topic/164639-dead-by-daylight-tw-%E9%BB%8E%E6%98%8E%E6%AD%BB%E7%B7%9Am-envoy-v1024-27-cheats/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 95 replies
    • OUTERPLANE - Strategy Anime v1.1.92 Cheats +4
      Modded/Hacked App: OUTERPLANE - Strategy Anime By Smilegate Holdings, Inc.
      Bundle ID: com.smilegate.outerplane.stove.ios
      iTunes Store Link: https://apps.apple.com/us/app/outerplane-strategy-anime/id1630880836?uo=4

       

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - God mode
      - OHK
      - Unlimited AP
      - No CD skill
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 70 replies
    • Boomerang RPG v1.0.18 Cheats +3
      Modded/Hacked App: Boomerang RPG By SuperPlanet corp.
      Bundle ID: com.superplanet.boomerang
      iTunes Store Link: https://apps.apple.com/us/app/boomerang-rpg/id6472151756?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - God mode
      - High damage
      - Fast attack
        • Informative
        • Agree
        • Haha
        • Thanks
        • Like
      • 18 replies
    • Boomerang RPG v1.0.18 Cheats +3
      Modded/Hacked App: Boomerang RPG By SuperPlanet corp.
      Bundle ID: com.superplanet.boomerang
      iTunes Store Link: https://apps.apple.com/us/app/boomerang-rpg/id6472151756?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - God mode
      - Fast attack
      - High damage
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 59 replies
    • 菇勇者傳說-送3000抽 v2.0.13 Cheats +2
      Modded/Hacked App: 菇勇者傳說-送3000抽 By JOY MOBILE NETWORK PTE. LTD.
      Bundle ID: com.mxdzz.tw.ios
      iTunes Store Link: https://apps.apple.com/tw/app/%E8%8F%87%E5%8B%87%E8%80%85%E5%82%B3%E8%AA%AA-%E9%80%813000%E6%8A%BD/id6466405648?uo=4

       

      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - God mode
      - OHK
        • Informative
        • Haha
        • Winner
        • Like
      • 54 replies
    • BiliBili - HD Anime, Videos v2.81.0 Cheats +4
      Modded/Hacked App: BiliBili - HD Anime, Videos By BALABOOM PTE LTD
      Bundle ID: com.bstar.intl
      iTunes Store Link: https://apps.apple.com/vn/app/bilibili-hd-anime-videos/id1548857482?uo=4

       


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - No ads
      - Minimize watermark
      - Watch 4k
      - Can download 4k
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 101 replies
    • BiliBili - HD Anime, Videos v2.81.0 Cheats +4
      Modded/Hacked App: BiliBili - HD Anime, Videos By BALABOOM PTE LTD
      Bundle ID: com.bstar.intl
      iTunes Store Link: https://apps.apple.com/vn/app/bilibili-hd-anime-videos/id1548857482?uo=4

       

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - No ads
      - Minimize watermark
      - Watch 4k
      - Can download 4k
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 51 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines