TuT [IDA Tutorial]How to deal with/hack vectors

May 14, 2015

This is a tutorial that is pretty advanced and because of that, I expect you to have a grip on regular IDA (normal instructions I mean, MOV, SUB, STR, etc). Of course it is not a requirement, you could just be viewing this tutorial out of curiosity. But it would really help to know some basic IDA before trying to hack vectors.

But what the hell is a vector? A vector is an instruction prefixed with "V". For example: VSTR, VMOV, VSUB, VCVT (convert), VLDR, etc. It is the instruction that you get when you set a watchpoint on a memory address that holds a float value. You will know that it is a float when iGameGuardian displays the number like "500.000000". Most of the time you be hacking VSTR, VSUB, and VCVT, at least in my experience.

Hidden Content

Since there is no R7 type register for vectors, we have to find different ways to hack them. If IDA drops you off at a

VSTR S0, [R0, #20]

VSTR S7, [R0, #20]

So what the hell can we do? The best way to hack a VSTR is to NOP it (except for when hacking cooldown, but I will get to that). This is extremely effective when hacking your health because instead of storing your health value in a normal, unhacked game, the game won't be able to store your health at all which results in infinite health for you :snoop: But sometimes both enemy health and your health are linked and you have to unlink them. I'll cover that at the end of this tutorial.

If you are hacking cooldown for some sort of skill, you cannot just NOP the VSTR (instructions for cooldown are most always VSTR) because once the timer starts, it will never count down, resulting in an infinite timer for skills. To combat this, either you can:

1. Find a register that holds the value of zero and store that register into R0+20 or

2. Move zero into an already existing register and store that register into R0+20.

If you are going with option one, you'll have to set a breakpoint on your offset and examine the registers to see what they hold (reg re for LLDB and info r for GDB). Just for the sake of this tutorial, we'll say that R3 holds the value of zero. Now that you know that, you can change

VSTR S0, [R0, #20]

STR R3, [R0, #20]

If you are going with option two, it will be just a tiny bit more complicated. You'll have to hack the instruction above the VSTR with a MOV R0, #0. Then you'll have to store R0 into R0+20. If that is confusing, look at this:

Here are the instructions before any modification:

VCVT.F32.F64 S0, D2
VSTR S0, [R0, #20]

MOV R0, #0
STR R0, [R0, #20]

VSTR's are really the only instructions that you hack differently than everything else. You hack VSUB's with NOP's, you can hack VMOV's the normal way you hack a MOV (but with common sense), etc. It is not really hard once you get the hang of it.

About unlinking vectors:

I'm not entirely sure about this, but to unlink vectors you could try this:

1. Set a breakpoint on your offset.

2. Let the enemy hit you, and your breakpoint should hit. Now type "bt", which means "backtrace". Copy the backtrace onto notepad or something convienent and label it "my health backtrace".

3. Now continue, but this time you hurt the enemy, and your breakpoint should hit. Do a backtrace again and copy it onto notepad and label it "enemy health backtrace".

4. See which frame first differs between the two backtraces (you'll know what I mean by frame when you backtrace) and NOP the branch that connects them.

That's it! If you want to see some examples of me hacking vectors, check these links out: http://iosgods.com/topic/7615-offsetsdragon-slayer-v110/

http://iosgods.com/topic/7152-offsets-not-str-r7-for-everything-pindestructible-v301/

http://iosgods.com/topic/7501-offsetsblood-and-glory-immortals-v110/

Please let me know if you have any questions.