Tutorial IDA Pro hacking: Returning false/true in x86

G-Bo ッ

Administrator
Staff member
Administrator
Hello dear community,

Today, i will teach you how to mod x86 libs. x86 is not that hard to understand because the instruction are almost the same as ARM. In this tutorial, i mod the game named The Sandbox 2 and unlock everything.

Now let's start modding.

First of all, you need IDA PRO and Hex Workshop installed on your computer. If you already have them installed, go to next step

Open the APK file with WinRar and extract the lib folder (In case you want to mod both x86 and ARM)

Open the x86 .so file in IDA. You will see the dialog box similar to the following:

ktDNoNu.png


In x86, you don't need to change anything. MetaPC is fine. Click OK to disassemble the lib file, and let it fully load. After that, press CTRL + F, search "isElementUnlocked" and double click on the function to open it

JSHwtbX.png


Remember the offset (9869E0) of first instruction. we need to use it later.

Note: The offset will change each update.

Mf1y3sf.png


Open Hex Workshop or other hex editing program, and search the offset. I'm using Hex Workshop

wC2186M.png


89a0Dqm.png


Here is the offset of isElementUnlocked

U9UTx2C.png


You can view hex to make sure that it is the correct function

sDj3fL7.png


The function isElementUnlocked sounds like a boolean function, which means it return true or false. For example: If we purchase unlock everything, it will return true, if not, it will return false. It's just like when you ask someone "are elements unlocked in the game?" and someone answer "yes!" or "no!"

If you want permanent unlock without purchase, replace the number 55 57 56 53 e8 87 with b8 01 00 00 00 c3, and it will permanent return true. In x86 instructions, it will look like

Code:
mov eax, 1 = b8 01 00 00 00
retn = c3


Code:
mov eax, 0 = b8 00 00 00 00

y91Vjh6.png


When you open the modded .so file in IDA, your modded instruction will look like:

iL4oLV5.png


Open the APK with WinRAR and replace the modded .so file. Re-sign the APK, install it and run the game.

1ilkfkF.png



Credits: iAndrohacker
 
Back
Top Bottom