Discussion Appdome Protection

[nowhere_222]

Hey there, for a while now i'm trying to bypass the Appdome protection

I was able to bypass most of the alerts but one remains, the alert when u are enabling anything from mod menu..

And as long as i'm trying i'm still not finding anything that bypass this one

The first alerts were actually easy, kill signature, encrypting dex, not signing the APK while making modifications etc..

If anyone have some clue about the last alert, feel free to share your ideas in this discussion post ~

Here is a screenshot of what i'm talking about;

 

[Kaorin333]

whats the name of the game

 

[nowhere_222]

whats the name of the game

Battlemage Idle

 

[nowhere_222]

whats the name of the game

I have some ideas to bypass it, it's detecting my offset because the offset is from game guardian

I will try with hex patching only when i will be home (It should works.)

 

[Kaorin333]

i was reading you bypassed it. Hook Detected

did they patch it?

 

[nowhere_222]

i was reading you bypassed it. Hook Detected

did they patch it?

Not really, just detecting my speedhack offset, but others are fine, i already modded this protection i remember and with hex patch offsets only from the dump it wasn't detected

The game was Boomerang RPG by Super Planet and it was already NHN AppGuard with DetectionPopup system

So my bypass really works and you can add mod menu without any alert

The alert only triggers with that particular feature which is speedhack

 

[Kaorin333]

hm seeing this kind of protection the first time. do you just modify the dex files or are you also changing the code in the sofiles.

libdreus.so and libloader.so ?

 

[nowhere_222]

hm seeing this kind of protection the first time. do you just modify the dex files or are you also changing the code in the sofiles.

libdreus.so and libloader.so ?

Not even, i'm bypassing it without modifying any code, dex or libs

 

[Kaorin333]

So i guess from the reading, you just hex patched the il2cpp and it does not detect it. But you still have the problem with the tamper protection.

 

[nowhere_222]

So i guess from the reading, you just hex patched the il2cpp and it does not detect it. But you still have the problem with the tamper protection.

The two alerts from signature tampering detection and tampering does not trigger with my bypass, what's triggering is when adding XA offsets (which is for speedhack) to the mod menu

If you simple hex patching from the mod menu it will not detect it

The hex patching for speedhack actually hook the lib directly so it's detecting

For example, with the targetLibName tag it will not detect if you patch only the game methods

If hook libunity.so, it will detect, because they have hook to speedhack, it is said on the documentation of NHN AppGuard

What my bypass does is simply not signing the APK during modifications, encrypting the dex and not signing still so the protection not triggers when opening, and kill signature with hook so the signature tampering alert does not trigger :))

Hope it's better explained

 

[DoDevil]

Now normal Hex Patch got detected also

 

[nowhere_222]

Now normal Hex Patch got detected also

Still easy for me to bypass it

 

[DoDevil]

Still easy for me to bypass it

Your modify .APK? Well, i just testing and find a way without modify .APK