Help! How to bypass anticheat standoff2?

BouZe

Platinian
Original poster
Jun 12, 2020
6
0
48
Konoha
at first I bypass with apk signature killer, but now it says that the game is not installed from play market, then I tried to remove license check with np manager and it worked, but at the moment it does not work. Does anyone know how to bypass anticheat standoff2?
 

Vex186

Approved Modder
Approved Modder
Apr 14, 2021
92
1,774
193
World
Method: "how to get hashes"

1) We go to the application "mt manager". You must have downloaded the original hash and the game.
2) Go to the caching directory and hold down. When the window opens, click "properties". Later, click "Check". Copy the very first "MD5". And click "close".
3) We clamp again, select "properties" and look for "size" there. We click on it for 2-3 seconds, it is copied to the clipboard.
4) We do the same only with games, not cache. We get:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588 main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

5) We combine them using the sign: "|". Outcome:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

_____________________________________________________________________________________________


Method: "Return back to the game"

1) For this we need an offset. There are 2 of them:

"get_value" and ".ctor".

What is the difference?

"get_value" - used to bypass "monoString*" (private string)
".ctor" - used to bypass to "void" ( public void )

To find them, you need:

".ctor" = searched for:
= 10) he is alone there, looks like this:

// RVA: 0x9E9A0C Offset: 0x9E9A0C VA: 0x9E9A0C
public void .ctor(string GLHMNACCDLO, uint HBAECMMLGPK = 10) { }

get_value = searched for:
= 10) and look among it, there are 3 of them, they are a script like this:

// RVA: 0x9E9824 Offset: 0x9E9824 VA: 0x9E9824
public string GPFKAGJCNCD() { }
_____________________________________________________________________________________________

First, we write a bypass on ".ctor":

Standart hook:

void (*Name_hook)(...);
void Name_hook_other(...){

}

I will use these titles:

anti_ban_system_general
anti_ban_system

void (*anti_ban_system_general)(...);
void anti_ban_system(...){

}

now, instead of (...) we need to insert our variables, they are already registered in the offset, here:

public void .ctor(string GLHMNACCDLO, uint HBAECMMLGPK = 10) { }

yes, let's do it.

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
}

You ask why I took these values? The answer is simple - it was written in the 0.17.1 dump (without a cipher).

So, now you need to write a variable, what will be the return and lookup!

This is done like this:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
}

}

So, we set the variable "valtostd" to search, and "value" to return.

Now we need to return the original hashes. Let's get started. From the last lesson, we found the hashes:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

Now, we need to bring them back into the game.

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) != std::string::npos){
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100");
}
}

}

So we brought the original games back into the game. Bypassed the game hash and cache check. Now you need to bypass the signature check.

_____________________________________________________________________________________________

Method: "how to get signature"

Let's start.

First, I will teach you how to log anti-cheat. To get started you need:
- Offset
- The code

In order to find the offset for the log, you need a dump. We go into "dump.cs" and write in the search: "= 10)" and you get one offset!

Next, you need a code. This is a normal login code that is simply hooked to LOGI.
Here is the code:

void* (*old_Log)(void* inst, monoString* sub_704, uint sub_347);
void* Log(void* inst, monoString* sub_704, uint sub_347) {
if (inst != NULL) {
LOGI("%s", sub_704->toChars());
}
return old_Log(inst, sub_704, sub_347)
}

This code should be placed in the place where you have hooks. If you do not understand this, then your resource should have the inscription "---- Hooking ----" or something similar at the bottom.

void* (*old_Log)(void* inst, monoString* sub_704, uint sub_347);
void* Log(void* inst, monoString* sub_704, uint sub_347) {
if (inst != NULL) {
LOGI("%s", sub_704->toChars());
}
return old_Log(inst, sub_704, sub_347)
}

Should be clear.

If you have errors, then you need to find the logger.h file, it can be in any resource in the includes folder, along the path: /app/src/main/jni/Includes
and then you need to transfer the logger.h file to your resource, along the same path and specify in the main.cpp file on the first line: #include <Includes/Logger.h>

Everything, we inserted the code, now what? Now we need to knit our code to the offset.

MSHookFunction((void *) getAbsoluteAddress("libil2cpp.so", 0x123456), (void *) Log, (void **)&old_Log);

Instead of 0x123456 we should paste the offset we got from "dump.cs".

Done, let's compile our source. By the way, I almost forgot, you definitely need root rights to receive logs.

Here we have compiled our resource and now go to the "play market". Enter "logcat reader" into the search. Download this application, give it all permissions and select the root method, allow root and that's it.

Now the menu that we compiled needs to be inserted into the game, and add a .smali bypass, for example mUnityPlayer.smali, it can be found everywhere in the telegram groups. We just transfer this bypass along the path smali/com/unity3d/player and then go back and go to the file:
"Androidmanifest.xml" and go to:

< aplication
android:label="@String/app_name"
android:icon="@mipmap/app_icon"
android:allowBackup="false"
android:supportsRtl="true"
android:banner="@drawable/app_banner"
android:isGame="true"
android:roundIcon="@mipmap/app_icon_round"
android:appComponentFactory="androidx.core.app.CoreComponentFactory"
android:requestLegacyExternalStorage="true"

and after the line android:icon="@mipmap/app_icon" we write:
- android:name=".mUnityPlayer"

Then we will need to transfer the original standoff apk to the assets folder and specify the name:
-base.apk

Then we will need to go to the "Logcat Reader" application and then go to our game, and log in through our Facebook account, and wait until the user's data is verified to the end. And drop into the "Logcat reader" application and enter "Mod_Menu" into the application in the search. Everyone, I congratulate you, you have logged anti-cheat!
_____________________________________________________________________________________________

So, we logged the anti-cheat and got a lot of new values, we will all need them.

We got the signature! She looks like this:

lcG7acvUIg0k4FQSQmAbyw1tN0o=

Let's add it in the same bypass as the hashes:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100");
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o=");
}
}

}

Done, we have added the signature and hashes to our bypass. But there was a problem, axlbolt detects your device id and bans it. We need to fix this, in the logs we found our device id:

12h456asd123fd67 (example)

Hmm, what should we do so that the software automatically removes the ban device.

Exactly! You need to generate a new device id. We write code that generates 16 random values:

std::string gen_random(const int len) {
static const char alphanum[] =
"0123456789"
"abcdefghijklmnopqrstuvwxyz";
std::string tmp_s;
tmp_s.reserve(len);
for (int i = 0; i < len; ++i) {
tmp_s += alphanum[rand() % (sizeof(alphanum) - 1)];
}
return tmp_s;
}

И теперь нужно вернуть наше значение в обход,чтобы вернуть ровно 16 символов зададим этому значение 16

Сделаем это так:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
}
}

}

A little about the antiban device:

How does an anti-ban device work?

gen_random is the code that generates 16 random letters/numbers. Why 16? Because axlebolt bans your device id, it consists of 16 random values (letters/numbers).
Therefore, we create a code that generates 16 random values and it will change your device id and will not be banned by the device.

so, we wrote an anti-ban device and ran into a problem, our lib is being detected. Need to think about what can be done about it? Detection path:

/data/data/com.axlebolt.standoff2/cache/libgvraudio.so

This is what I found in the logs!

So, what if we load our lib endlessly, and there will be no detection!

To do this, we need the replaceAll code:

void replaceAll(std::string& str, const std::string& from, const std::string& to) {
if(from.empty())
return;
size_t start_pos = 0;
while((start_pos = str.find(from, start_pos)) != std::string::npos) {
str.replace(start_pos, from.length(), to);
start_pos += to.length();
}
}

a little about him:

replaceAll - will help load your lib into the game indefinitely and the anti-cheat won't notice it.

so let's do it like this.

our Detect path:

std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
} else if (valtostd.find("/data/") && (valtostd.find("data/")) && (valtostd.find("com.axlebolt.standoff2/")) && (valtostd.find("cache/")) && (valtostd.find(".so")) != std::string::npos){
std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";
if (valtostd.find(path_to_detect)){
std::string basicString;
basicString += replaceAll(valtostd, (path_to_detect + "|"));
value = CreateMonoString(basicString.c_str());
}
}
}

}

It remains to finish the code!

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
} else if (valtostd.find("/data/") && (valtostd.find("data/")) && (valtostd.find("com.axlebolt.standoff2/")) && (valtostd.find("cache/")) && (valtostd.find(".so")) != std::string::npos){
std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";
if (valtostd.find(path_to_detect)){
std::string basicString;
basicString += replaceAll(valtostd, (path_to_detect + "|"));
value = CreateMonoString(basicString.c_str());
}
}
return anti_ban_system_general(inst, value, KeyLength);
}

}

So, it remains to add all the logs that are and there will be no ban, if there is one - look for detects and think and fix. Everything is covered in this lesson!


-is a quote
 

Kaay

Rookie
Method: "how to get hashes"

1) We go to the application "mt manager". You must have downloaded the original hash and the game.
2) Go to the caching directory and hold down. When the window opens, click "properties". Later, click "Check". Copy the very first "MD5". And click "close".
3) We clamp again, select "properties" and look for "size" there. We click on it for 2-3 seconds, it is copied to the clipboard.
4) We do the same only with games, not cache. We get:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588 main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

5) We combine them using the sign: "|". Outcome:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

_____________________________________________________________________________________________


Method: "Return back to the game"

1) For this we need an offset. There are 2 of them:

"get_value" and ".ctor".

What is the difference?

"get_value" - used to bypass "monoString*" (private string)
".ctor" - used to bypass to "void" ( public void )

To find them, you need:

".ctor" = searched for:
= 10) he is alone there, looks like this:

// RVA: 0x9E9A0C Offset: 0x9E9A0C VA: 0x9E9A0C
public void .ctor(string GLHMNACCDLO, uint HBAECMMLGPK = 10) { }

get_value = searched for:
= 10) and look among it, there are 3 of them, they are a script like this:

// RVA: 0x9E9824 Offset: 0x9E9824 VA: 0x9E9824
public string GPFKAGJCNCD() { }
_____________________________________________________________________________________________

First, we write a bypass on ".ctor":

Standart hook:

void (*Name_hook)(...);
void Name_hook_other(...){

}

I will use these titles:

anti_ban_system_general
anti_ban_system

void (*anti_ban_system_general)(...);
void anti_ban_system(...){

}

now, instead of (...) we need to insert our variables, they are already registered in the offset, here:

public void .ctor(string GLHMNACCDLO, uint HBAECMMLGPK = 10) { }

yes, let's do it.

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
}

You ask why I took these values? The answer is simple - it was written in the 0.17.1 dump (without a cipher).

So, now you need to write a variable, what will be the return and lookup!

This is done like this:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
}

}

So, we set the variable "valtostd" to search, and "value" to return.

Now we need to return the original hashes. Let's get started. From the last lesson, we found the hashes:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

Now, we need to bring them back into the game.

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) != std::string::npos){
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100");
}
}

}

So we brought the original games back into the game. Bypassed the game hash and cache check. Now you need to bypass the signature check.

_____________________________________________________________________________________________

Method: "how to get signature"

Let's start.

First, I will teach you how to log anti-cheat. To get started you need:
- Offset
- The code

In order to find the offset for the log, you need a dump. We go into "dump.cs" and write in the search: "= 10)" and you get one offset!

Next, you need a code. This is a normal login code that is simply hooked to LOGI.
Here is the code:

void* (*old_Log)(void* inst, monoString* sub_704, uint sub_347);
void* Log(void* inst, monoString* sub_704, uint sub_347) {
if (inst != NULL) {
LOGI("%s", sub_704->toChars());
}
return old_Log(inst, sub_704, sub_347)
}

This code should be placed in the place where you have hooks. If you do not understand this, then your resource should have the inscription "---- Hooking ----" or something similar at the bottom.

void* (*old_Log)(void* inst, monoString* sub_704, uint sub_347);
void* Log(void* inst, monoString* sub_704, uint sub_347) {
if (inst != NULL) {
LOGI("%s", sub_704->toChars());
}
return old_Log(inst, sub_704, sub_347)
}

Should be clear.

If you have errors, then you need to find the logger.h file, it can be in any resource in the includes folder, along the path: /app/src/main/jni/Includes
and then you need to transfer the logger.h file to your resource, along the same path and specify in the main.cpp file on the first line: #include <Includes/Logger.h>

Everything, we inserted the code, now what? Now we need to knit our code to the offset.

MSHookFunction((void *) getAbsoluteAddress("libil2cpp.so", 0x123456), (void *) Log, (void **)&old_Log);

Instead of 0x123456 we should paste the offset we got from "dump.cs".

Done, let's compile our source. By the way, I almost forgot, you definitely need root rights to receive logs.

Here we have compiled our resource and now go to the "play market". Enter "logcat reader" into the search. Download this application, give it all permissions and select the root method, allow root and that's it.

Now the menu that we compiled needs to be inserted into the game, and add a .smali bypass, for example mUnityPlayer.smali, it can be found everywhere in the telegram groups. We just transfer this bypass along the path smali/com/unity3d/player and then go back and go to the file:
"Androidmanifest.xml" and go to:

< aplication
android:label="@String/app_name"
android:icon="@mipmap/app_icon"
android:allowBackup="false"
android:supportsRtl="true"
android:banner="@drawable/app_banner"
android:isGame="true"
android:roundIcon="@mipmap/app_icon_round"
android:appComponentFactory="androidx.core.app.CoreComponentFactory"
android:requestLegacyExternalStorage="true"

and after the line android:icon="@mipmap/app_icon" we write:
- android:name=".mUnityPlayer"

Then we will need to transfer the original standoff apk to the assets folder and specify the name:
-base.apk

Then we will need to go to the "Logcat Reader" application and then go to our game, and log in through our Facebook account, and wait until the user's data is verified to the end. And drop into the "Logcat reader" application and enter "Mod_Menu" into the application in the search. Everyone, I congratulate you, you have logged anti-cheat!
_____________________________________________________________________________________________

So, we logged the anti-cheat and got a lot of new values, we will all need them.

We got the signature! She looks like this:

lcG7acvUIg0k4FQSQmAbyw1tN0o=

Let's add it in the same bypass as the hashes:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100");
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o=");
}
}

}

Done, we have added the signature and hashes to our bypass. But there was a problem, axlbolt detects your device id and bans it. We need to fix this, in the logs we found our device id:

12h456asd123fd67 (example)

Hmm, what should we do so that the software automatically removes the ban device.

Exactly! You need to generate a new device id. We write code that generates 16 random values:

std::string gen_random(const int len) {
static const char alphanum[] =
"0123456789"
"abcdefghijklmnopqrstuvwxyz";
std::string tmp_s;
tmp_s.reserve(len);
for (int i = 0; i < len; ++i) {
tmp_s += alphanum[rand() % (sizeof(alphanum) - 1)];
}
return tmp_s;
}

И теперь нужно вернуть наше значение в обход,чтобы вернуть ровно 16 символов зададим этому значение 16

Сделаем это так:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
}
}

}

A little about the antiban device:

How does an anti-ban device work?

gen_random is the code that generates 16 random letters/numbers. Why 16? Because axlebolt bans your device id, it consists of 16 random values (letters/numbers).
Therefore, we create a code that generates 16 random values and it will change your device id and will not be banned by the device.

so, we wrote an anti-ban device and ran into a problem, our lib is being detected. Need to think about what can be done about it? Detection path:

/data/data/com.axlebolt.standoff2/cache/libgvraudio.so

This is what I found in the logs!

So, what if we load our lib endlessly, and there will be no detection!

To do this, we need the replaceAll code:

void replaceAll(std::string& str, const std::string& from, const std::string& to) {
if(from.empty())
return;
size_t start_pos = 0;
while((start_pos = str.find(from, start_pos)) != std::string::npos) {
str.replace(start_pos, from.length(), to);
start_pos += to.length();
}
}

a little about him:

replaceAll - will help load your lib into the game indefinitely and the anti-cheat won't notice it.

so let's do it like this.

our Detect path:

std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
} else if (valtostd.find("/data/") && (valtostd.find("data/")) && (valtostd.find("com.axlebolt.standoff2/")) && (valtostd.find("cache/")) && (valtostd.find(".so")) != std::string::npos){
std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";
if (valtostd.find(path_to_detect)){
std::string basicString;
basicString += replaceAll(valtostd, (path_to_detect + "|"));
value = CreateMonoString(basicString.c_str());
}
}
}

}

It remains to finish the code!

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
} else if (valtostd.find("/data/") && (valtostd.find("data/")) && (valtostd.find("com.axlebolt.standoff2/")) && (valtostd.find("cache/")) && (valtostd.find(".so")) != std::string::npos){
std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";
if (valtostd.find(path_to_detect)){
std::string basicString;
basicString += replaceAll(valtostd, (path_to_detect + "|"));
value = CreateMonoString(basicString.c_str());
}
}
return anti_ban_system_general(inst, value, KeyLength);
}

}

So, it remains to add all the logs that are and there will be no ban, if there is one - look for detects and think and fix. Everything is covered in this lesson!


-is a quote
Damn dude u can help my C++ exam xD ,, well if u want to help me xD
 
  • Like
Reactions: Vex186

Sninja

Platinian
Jun 25, 2022
7
2
3
43
Costa Rica
Method: "how to get hashes"

1) We go to the application "mt manager". You must have downloaded the original hash and the game.
2) Go to the caching directory and hold down. When the window opens, click "properties". Later, click "Check". Copy the very first "MD5". And click "close".
3) We clamp again, select "properties" and look for "size" there. We click on it for 2-3 seconds, it is copied to the clipboard.
4) We do the same only with games, not cache. We get:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588 main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

5) We combine them using the sign: "|". Outcome:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

_____________________________________________________________________________________________


Method: "Return back to the game"

1) For this we need an offset. There are 2 of them:

"get_value" and ".ctor".

What is the difference?

"get_value" - used to bypass "monoString*" (private string)
".ctor" - used to bypass to "void" ( public void )

To find them, you need:

".ctor" = searched for:
= 10) he is alone there, looks like this:

// RVA: 0x9E9A0C Offset: 0x9E9A0C VA: 0x9E9A0C
public void .ctor(string GLHMNACCDLO, uint HBAECMMLGPK = 10) { }

get_value = searched for:
= 10) and look among it, there are 3 of them, they are a script like this:

// RVA: 0x9E9824 Offset: 0x9E9824 VA: 0x9E9824
public string GPFKAGJCNCD() { }
_____________________________________________________________________________________________

First, we write a bypass on ".ctor":

Standart hook:

void (*Name_hook)(...);
void Name_hook_other(...){

}

I will use these titles:

anti_ban_system_general
anti_ban_system

void (*anti_ban_system_general)(...);
void anti_ban_system(...){

}

now, instead of (...) we need to insert our variables, they are already registered in the offset, here:

public void .ctor(string GLHMNACCDLO, uint HBAECMMLGPK = 10) { }

yes, let's do it.

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
}

You ask why I took these values? The answer is simple - it was written in the 0.17.1 dump (without a cipher).

So, now you need to write a variable, what will be the return and lookup!

This is done like this:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
}

}

So, we set the variable "valtostd" to search, and "value" to return.

Now we need to return the original hashes. Let's get started. From the last lesson, we found the hashes:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

Now, we need to bring them back into the game.

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) != std::string::npos){
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100");
}
}

}

So we brought the original games back into the game. Bypassed the game hash and cache check. Now you need to bypass the signature check.

_____________________________________________________________________________________________

Method: "how to get signature"

Let's start.

First, I will teach you how to log anti-cheat. To get started you need:
- Offset
- The code

In order to find the offset for the log, you need a dump. We go into "dump.cs" and write in the search: "= 10)" and you get one offset!

Next, you need a code. This is a normal login code that is simply hooked to LOGI.
Here is the code:

void* (*old_Log)(void* inst, monoString* sub_704, uint sub_347);
void* Log(void* inst, monoString* sub_704, uint sub_347) {
if (inst != NULL) {
LOGI("%s", sub_704->toChars());
}
return old_Log(inst, sub_704, sub_347)
}

This code should be placed in the place where you have hooks. If you do not understand this, then your resource should have the inscription "---- Hooking ----" or something similar at the bottom.

void* (*old_Log)(void* inst, monoString* sub_704, uint sub_347);
void* Log(void* inst, monoString* sub_704, uint sub_347) {
if (inst != NULL) {
LOGI("%s", sub_704->toChars());
}
return old_Log(inst, sub_704, sub_347)
}

Should be clear.

If you have errors, then you need to find the logger.h file, it can be in any resource in the includes folder, along the path: /app/src/main/jni/Includes
and then you need to transfer the logger.h file to your resource, along the same path and specify in the main.cpp file on the first line: #include <Includes/Logger.h>

Everything, we inserted the code, now what? Now we need to knit our code to the offset.

MSHookFunction((void *) getAbsoluteAddress("libil2cpp.so", 0x123456), (void *) Log, (void **)&old_Log);

Instead of 0x123456 we should paste the offset we got from "dump.cs".

Done, let's compile our source. By the way, I almost forgot, you definitely need root rights to receive logs.

Here we have compiled our resource and now go to the "play market". Enter "logcat reader" into the search. Download this application, give it all permissions and select the root method, allow root and that's it.

Now the menu that we compiled needs to be inserted into the game, and add a .smali bypass, for example mUnityPlayer.smali, it can be found everywhere in the telegram groups. We just transfer this bypass along the path smali/com/unity3d/player and then go back and go to the file:
"Androidmanifest.xml" and go to:

< aplication
android:label="@String/app_name"
android:icon="@mipmap/app_icon"
android:allowBackup="false"
android:supportsRtl="true"
android:banner="@drawable/app_banner"
android:isGame="true"
android:roundIcon="@mipmap/app_icon_round"
android:appComponentFactory="androidx.core.app.CoreComponentFactory"
android:requestLegacyExternalStorage="true"

and after the line android:icon="@mipmap/app_icon" we write:
- android:name=".mUnityPlayer"

Then we will need to transfer the original standoff apk to the assets folder and specify the name:
-base.apk

Then we will need to go to the "Logcat Reader" application and then go to our game, and log in through our Facebook account, and wait until the user's data is verified to the end. And drop into the "Logcat reader" application and enter "Mod_Menu" into the application in the search. Everyone, I congratulate you, you have logged anti-cheat!
_____________________________________________________________________________________________

So, we logged the anti-cheat and got a lot of new values, we will all need them.

We got the signature! She looks like this:

lcG7acvUIg0k4FQSQmAbyw1tN0o=

Let's add it in the same bypass as the hashes:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100");
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o=");
}
}

}

Done, we have added the signature and hashes to our bypass. But there was a problem, axlbolt detects your device id and bans it. We need to fix this, in the logs we found our device id:

12h456asd123fd67 (example)

Hmm, what should we do so that the software automatically removes the ban device.

Exactly! You need to generate a new device id. We write code that generates 16 random values:

std::string gen_random(const int len) {
static const char alphanum[] =
"0123456789"
"abcdefghijklmnopqrstuvwxyz";
std::string tmp_s;
tmp_s.reserve(len);
for (int i = 0; i < len; ++i) {
tmp_s += alphanum[rand() % (sizeof(alphanum) - 1)];
}
return tmp_s;
}

И теперь нужно вернуть наше значение в обход,чтобы вернуть ровно 16 символов зададим этому значение 16

Сделаем это так:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
}
}

}

A little about the antiban device:

How does an anti-ban device work?

gen_random is the code that generates 16 random letters/numbers. Why 16? Because axlebolt bans your device id, it consists of 16 random values (letters/numbers).
Therefore, we create a code that generates 16 random values and it will change your device id and will not be banned by the device.

so, we wrote an anti-ban device and ran into a problem, our lib is being detected. Need to think about what can be done about it? Detection path:

/data/data/com.axlebolt.standoff2/cache/libgvraudio.so

This is what I found in the logs!

So, what if we load our lib endlessly, and there will be no detection!

To do this, we need the replaceAll code:

void replaceAll(std::string& str, const std::string& from, const std::string& to) {
if(from.empty())
return;
size_t start_pos = 0;
while((start_pos = str.find(from, start_pos)) != std::string::npos) {
str.replace(start_pos, from.length(), to);
start_pos += to.length();
}
}

a little about him:

replaceAll - will help load your lib into the game indefinitely and the anti-cheat won't notice it.

so let's do it like this.

our Detect path:

std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
} else if (valtostd.find("/data/") && (valtostd.find("data/")) && (valtostd.find("com.axlebolt.standoff2/")) && (valtostd.find("cache/")) && (valtostd.find(".so")) != std::string::npos){
std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";
if (valtostd.find(path_to_detect)){
std::string basicString;
basicString += replaceAll(valtostd, (path_to_detect + "|"));
value = CreateMonoString(basicString.c_str());
}
}
}

}

It remains to finish the code!

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
} else if (valtostd.find("/data/") && (valtostd.find("data/")) && (valtostd.find("com.axlebolt.standoff2/")) && (valtostd.find("cache/")) && (valtostd.find(".so")) != std::string::npos){
std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";
if (valtostd.find(path_to_detect)){
std::string basicString;
basicString += replaceAll(valtostd, (path_to_detect + "|"));
value = CreateMonoString(basicString.c_str());
}
}
return anti_ban_system_general(inst, value, KeyLength);
}

}

So, it remains to add all the logs that are and there will be no ban, if there is one - look for detects and think and fix. Everything is covered in this lesson!


-is a quote
The most detailed and complete answer about anything I've ever read on most forum's!

Respect!
 
  • Like
Reactions: Vex186

Lond1kkk

Platinian
Feb 26, 2022
10
0
1
25
Russia
Method: "how to get hashes"

1) We go to the application "mt manager". You must have downloaded the original hash and the game.
2) Go to the caching directory and hold down. When the window opens, click "properties". Later, click "Check". Copy the very first "MD5". And click "close".
3) We clamp again, select "properties" and look for "size" there. We click on it for 2-3 seconds, it is copied to the clipboard.
4) We do the same only with games, not cache. We get:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588 main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

5) We combine them using the sign: "|". Outcome:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

_____________________________________________________________________________________________


Method: "Return back to the game"

1) For this we need an offset. There are 2 of them:

"get_value" and ".ctor".

What is the difference?

"get_value" - used to bypass "monoString*" (private string)
".ctor" - used to bypass to "void" ( public void )

To find them, you need:

".ctor" = searched for:
= 10) he is alone there, looks like this:

// RVA: 0x9E9A0C Offset: 0x9E9A0C VA: 0x9E9A0C
public void .ctor(string GLHMNACCDLO, uint HBAECMMLGPK = 10) { }

get_value = searched for:
= 10) and look among it, there are 3 of them, they are a script like this:

// RVA: 0x9E9824 Offset: 0x9E9824 VA: 0x9E9824
public string GPFKAGJCNCD() { }
_____________________________________________________________________________________________

First, we write a bypass on ".ctor":

Standart hook:

void (*Name_hook)(...);
void Name_hook_other(...){

}

I will use these titles:

anti_ban_system_general
anti_ban_system

void (*anti_ban_system_general)(...);
void anti_ban_system(...){

}

now, instead of (...) we need to insert our variables, they are already registered in the offset, here:

public void .ctor(string GLHMNACCDLO, uint HBAECMMLGPK = 10) { }

yes, let's do it.

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
}

You ask why I took these values? The answer is simple - it was written in the 0.17.1 dump (without a cipher).

So, now you need to write a variable, what will be the return and lookup!

This is done like this:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
}

}

So, we set the variable "valtostd" to search, and "value" to return.

Now we need to return the original hashes. Let's get started. From the last lesson, we found the hashes:

base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100

Now, we need to bring them back into the game.

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) != std::string::npos){
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100");
}
}

}

So we brought the original games back into the game. Bypassed the game hash and cache check. Now you need to bypass the signature check.

_____________________________________________________________________________________________

Method: "how to get signature"

Let's start.

First, I will teach you how to log anti-cheat. To get started you need:
- Offset
- The code

In order to find the offset for the log, you need a dump. We go into "dump.cs" and write in the search: "= 10)" and you get one offset!

Next, you need a code. This is a normal login code that is simply hooked to LOGI.
Here is the code:

void* (*old_Log)(void* inst, monoString* sub_704, uint sub_347);
void* Log(void* inst, monoString* sub_704, uint sub_347) {
if (inst != NULL) {
LOGI("%s", sub_704->toChars());
}
return old_Log(inst, sub_704, sub_347)
}

This code should be placed in the place where you have hooks. If you do not understand this, then your resource should have the inscription "---- Hooking ----" or something similar at the bottom.

void* (*old_Log)(void* inst, monoString* sub_704, uint sub_347);
void* Log(void* inst, monoString* sub_704, uint sub_347) {
if (inst != NULL) {
LOGI("%s", sub_704->toChars());
}
return old_Log(inst, sub_704, sub_347)
}

Should be clear.

If you have errors, then you need to find the logger.h file, it can be in any resource in the includes folder, along the path: /app/src/main/jni/Includes
and then you need to transfer the logger.h file to your resource, along the same path and specify in the main.cpp file on the first line: #include <Includes/Logger.h>

Everything, we inserted the code, now what? Now we need to knit our code to the offset.

MSHookFunction((void *) getAbsoluteAddress("libil2cpp.so", 0x123456), (void *) Log, (void **)&old_Log);

Instead of 0x123456 we should paste the offset we got from "dump.cs".

Done, let's compile our source. By the way, I almost forgot, you definitely need root rights to receive logs.

Here we have compiled our resource and now go to the "play market". Enter "logcat reader" into the search. Download this application, give it all permissions and select the root method, allow root and that's it.

Now the menu that we compiled needs to be inserted into the game, and add a .smali bypass, for example mUnityPlayer.smali, it can be found everywhere in the telegram groups. We just transfer this bypass along the path smali/com/unity3d/player and then go back and go to the file:
"Androidmanifest.xml" and go to:

< aplication
android:label="@String/app_name"
android:icon="@mipmap/app_icon"
android:allowBackup="false"
android:supportsRtl="true"
android:banner="@drawable/app_banner"
android:isGame="true"
android:roundIcon="@mipmap/app_icon_round"
android:appComponentFactory="androidx.core.app.CoreComponentFactory"
android:requestLegacyExternalStorage="true"

and after the line android:icon="@mipmap/app_icon" we write:
- android:name=".mUnityPlayer"

Then we will need to transfer the original standoff apk to the assets folder and specify the name:
-base.apk

Then we will need to go to the "Logcat Reader" application and then go to our game, and log in through our Facebook account, and wait until the user's data is verified to the end. And drop into the "Logcat reader" application and enter "Mod_Menu" into the application in the search. Everyone, I congratulate you, you have logged anti-cheat!
_____________________________________________________________________________________________

So, we logged the anti-cheat and got a lot of new values, we will all need them.

We got the signature! She looks like this:

lcG7acvUIg0k4FQSQmAbyw1tN0o=

Let's add it in the same bypass as the hashes:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100");
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o=");
}
}

}

Done, we have added the signature and hashes to our bypass. But there was a problem, axlbolt detects your device id and bans it. We need to fix this, in the logs we found our device id:

12h456asd123fd67 (example)

Hmm, what should we do so that the software automatically removes the ban device.

Exactly! You need to generate a new device id. We write code that generates 16 random values:

std::string gen_random(const int len) {
static const char alphanum[] =
"0123456789"
"abcdefghijklmnopqrstuvwxyz";
std::string tmp_s;
tmp_s.reserve(len);
for (int i = 0; i < len; ++i) {
tmp_s += alphanum[rand() % (sizeof(alphanum) - 1)];
}
return tmp_s;
}

И теперь нужно вернуть наше значение в обход,чтобы вернуть ровно 16 символов зададим этому значение 16

Сделаем это так:

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
}
}

}

A little about the antiban device:

How does an anti-ban device work?

gen_random is the code that generates 16 random letters/numbers. Why 16? Because axlebolt bans your device id, it consists of 16 random values (letters/numbers).
Therefore, we create a code that generates 16 random values and it will change your device id and will not be banned by the device.

so, we wrote an anti-ban device and ran into a problem, our lib is being detected. Need to think about what can be done about it? Detection path:

/data/data/com.axlebolt.standoff2/cache/libgvraudio.so

This is what I found in the logs!

So, what if we load our lib endlessly, and there will be no detection!

To do this, we need the replaceAll code:

void replaceAll(std::string& str, const std::string& from, const std::string& to) {
if(from.empty())
return;
size_t start_pos = 0;
while((start_pos = str.find(from, start_pos)) != std::string::npos) {
str.replace(start_pos, from.length(), to);
start_pos += to.length();
}
}

a little about him:

replaceAll - will help load your lib into the game indefinitely and the anti-cheat won't notice it.

so let's do it like this.

our Detect path:

std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
} else if (valtostd.find("/data/") && (valtostd.find("data/")) && (valtostd.find("com.axlebolt.standoff2/")) && (valtostd.find("cache/")) && (valtostd.find(".so")) != std::string::npos){
std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";
if (valtostd.find(path_to_detect)){
std::string basicString;
basicString += replaceAll(valtostd, (path_to_detect + "|"));
value = CreateMonoString(basicString.c_str());
}
}
}

}

It remains to finish the code!

void (*anti_ban_system_general)(void* inst, monoString* value, uint KeyLength);
void anti_ban_system(void* inst, monoString* value, uint KeyLength){
if (inst != NULL) {
std::string valtostd = value->get_sting(); // valtostd (поиск) | value (возврат)
if (valtostd.find("base.apk:") && (valtostd.find("|main.")) && (valtostd.find("2020.com.axlebolt.standoff2.obb:")) && (valtostd.find("|")) != std::string::npos){ // поиск хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
value = CreateMonoString("base.apk:c233fb0fcab72e288092d64f631fd8f7:92552588|main.2020.com.axlebolt.standoff2.obb:e1b42257d641ddf5eae045dd9277547a:1399548100"); // возврат хэшей base.apk | .main | 2020.com.axlebolt.standoff2.obb: |
} else if (valtostd.find("=") && (valtostd.find("|")) != std::string::npos){ // поиск сигнатуры
value = CreateMonostring("lcG7acvUIg0k4FQSQmAbyw1tN0o="); // возврат сигнатуры
} else if (valtostd.find("3") && (valtostd.find("|")) && (valtostd.find(" ")) && (valtostd.length() == 16) != std::string::npos){ // поиск вашего девайс айди и задача чтобы символов было == 16
value = CreateMonoString(gen_random(16).c_str()); // генерация 16 символов
} else if (valtostd.find("/data/") && (valtostd.find("data/")) && (valtostd.find("com.axlebolt.standoff2/")) && (valtostd.find("cache/")) && (valtostd.find(".so")) != std::string::npos){
std::string path_to_detect = "/data/data/com.axlebolt.standoff2/cache/libgraudio.so";
if (valtostd.find(path_to_detect)){
std::string basicString;
basicString += replaceAll(valtostd, (path_to_detect + "|"));
value = CreateMonoString(basicString.c_str());
}
}
return anti_ban_system_general(inst, value, KeyLength);
}

}

So, it remains to add all the logs that are and there will be no ban, if there is one - look for detects and think and fix. Everything is covered in this lesson!


-is a quote
Hi bro, I have carefully studied your bypass instructions. This is definitely respect for this, but there is a question! Have you personally done this? Does it work today? I will be grateful for the answer!
 

HouseVode

Rookie
Jun 26, 2023
1
0
1
24
Kanoha
Кто поможет написать кролинг на стандофф или кто может написать на все версии, дам хороший процент от мода