Help/Support Unity IDA WriteData. What I'm doing wrong?

Piro · March 4, 2019

Hey masters \o/. First of all, sorry about my english, im brazillian (it's green and yellow xD)

I'm trying to hack my own game lol, and what would you do if you could not hack your own game? Maybe kill yourself? I'm almost killing myself because that lol.

Let's go for what matter. I'm trying to be immortal in my own game (it's in development fase yet xD). I have a function that basically say "when balloon touch the spike, explode the balloon attached on my penguim".

This is my prototype game image. ⬇️⬇️⬇️⬇️⬇️⬇️

Im trying to hack some funtions that i think can work, like (get_life, set_life, onTriggerEnter2D, UpdateLifeCanvas).

I want it when balloon touches in thorns, they will not explode, in other words, i want to me immortal hahaha

Look my dump.cs ⬇️⬇️⬇️⬇️⬇️⬇️

I tried NOP in get_life, set_life, onTriggerEnter2D, UpdateLifeCanvas. But anyone worked =S.

Here is IDA ⬇️⬇️⬇️⬇️⬇️⬇️

And here is my Tweak.xm ⬇️⬇️⬇️⬇️⬇️⬇️

I think that i saw all tutorial about "how to hack" here, and i think that i have a lot of information at same time, and it was not so good for me lol. I'm a little lost about how many methods there are and when i'll use it for a specific case. Can you tell me what's the better way to hack unity and no unity games? Have a master method that i can use for both?

I wrote in title tutorial "writedata", is this the only way to hack unity? Has another way, other than unity that is sub_x?

Please, remember that i'm starting and i'm a noob still lol. Be pattient and clear, because one day you were a newbie too xD.

Thanks if you read this far, and thanks in advance if you'll help me.

Updated March 5, 2019 by Piro
Best layout

TheArmKing · March 4, 2019

umm, get_Life is an int and looks hackable, dont NOP Ints, provide a value, idk how its done on arm64 but its something like

MOV W0, #0xfffff

in hex its

00FEBF12

try that

Saitama · March 4, 2019

set_life and get_life work only for ur lifes
so u will not be immortal its just dont touch ur lifes
and if u nop function get_life this function anyway must return a value W0 and W0 will be zero (i think) better change NOP to MOV W0, 3 for example

Joka · March 4, 2019

No need to hide the content.

Saitama · March 4, 2019

for making immortal it more hard task and u need to look inside ur collision function better show here IDA code of collision

Ted2 · March 4, 2019

You have several things you can do:

1. get_live --> what you can do, is return a HUGE value (MOV W0, W29, RET) for example.

//original assembly code
 LDR W0, [X0, #0x18]
 RET
  
//patched code
  MOV W0, W29
  RET
   
/* how to do this with writeData:
  MOV W0, W29 = E0031D2A in HEX 
*/
   writeData(0x10081C830, 0xE0031D2A);

2. set_live --> this is setting your live when your live value changes

- NOP'ing the STR SHOULD work, since this will result in failing to Store (STR) a new value aka infinite health.

3. BalloonController_onTriggerEnter2D --> I THINK if you RET the top of the function right away (return), it will not know your 2D transform was hit, aka your health won't be effected.

- RET'ing the top of the function, is basically returning the function when it gets executed, so nothing will happen.

4. UpdateLiveCanvas --> I can't see the function, but I assume this handles your live when you get hit? If so, you'll likely see a branch of get_live or set_live & near that, you'll see a SUB
SUB means subtract, so if you change this to a ADD, or a NOP you health will also be hacked.

edit:

Oh also,

test without ifGetPrefBool first, sometimes one typo in the tweak.xm & .plist for the key will make you brain dead as f***.

I also suggest to use smaller key names, it's easier to spot a typo then.

edit 2:

You have my discord, I'm always open to help. Waiting for your topic to be approved may take so much time

Updated March 4, 2019 by Joey

Saitama · March 4, 2019

On 3/4/2019 at 3:00 PM, Joey said:

3. onTriggerEnter2D --> I THINK if you RET the top of the function right away (return), it will not know your 2D transform was hit, aka your health won't be effected.

- RET'ing the top of the function, is basically returning the function when it gets executed, so nothing will happen.

Expand

not good idea becouse this trigger will work with coins etc... if u just put ret any other collision will be ignored too....

Updated March 4, 2019 by gogigogi1

Ted2 · March 4, 2019

On 3/4/2019 at 3:02 PM, gogigogi1 said:

dont good idea becouse this trigger will work with coins etc... if u just put ret any other collision will be passed too....

Expand

But it says BalloonController_OnTriggerEnter2D, I don't see why this function should handle all collisions?

Saitama · March 4, 2019

On 3/4/2019 at 3:04 PM, Joey said:

But it says BalloonController_OnTriggerEnter2D, I don't see why this function should handle all collisions?

Expand

ah lol im look inside PlayerController