Open Request Korean Student Simulator

[EtherealPrincess]

Game Name: Korean Student Simulator

Google Play Store Link:

Korean Student Simulator - Apps on Google Play

Lost Memory, Aiming for the best University

play.google.com

APK Link:

Korean Student Simulator APK for Android Download

Korean Student Simulator 1.24.0 APK download for Android. Lost Memory, Aiming for the best University

apkpure.com

Cheat Requested:

• Free purchase
• Unlimited Cookies

Have you tried any cheat engines?:
No

 

[huklh]

Cookies and Reroll works but IAP isn't working for me, will update once I figure this out. This one is more difficult than usual. All IAP are server-sided tied to firebase so I definitely need to wait for someone who owns real purchase of DLCs or I could hack my way through, I'll definitely try the latter and report back.

lensdump.com/v/cb3U92
lensdump.com/v/cb3FW9
View attachment 954546

Pleaasee my hopeee

 

[huklh]

up

 

[huklh]

Cookies and Reroll works but IAP isn't working for me, will update once I figure this out. This one is more difficult than usual. All IAP are server-sided tied to firebase so I definitely need to wait for someone who owns real purchase of DLCs or I could hack my way through, I'll definitely try the latter and report back.

lensdump.com/v/cb3U92
lensdump.com/v/cb3FW9
View attachment 954546

can you upload this version first? i don't mind just this

 

[SweetLuna]

I got to a similar conclusion. Didn't know what to do after reaching firebase verifypaymentV2 lol. game does appear to have some local premium states, probably all validated via google play so can't do anything there. It seems like the answer is so close, will keep investigating alongside o7.

Yeah verifypaymentV2 is the wall. Server hits Google with the purchase token and writes the unlock based on what Google says. Local premium flags are downstream of that, not really worth attacking imo :/

The annoying part is the response shape. We can fake the call easy (I tried), problem is we don't know what an actually-owned response looks like, so I've been guessing field names blind. None of my guesses stuck so far, UI either ignores it or hangs.

If anyone with a legit purchase can share their captured traffic this closes fast. Otherwise it's just trial and error

can you upload this version first? i don't mind just this

Not yet, sorry. The cookies/reroll part isn't really packaged as a clean modded APK that you can just install. It's a runtime hook setup, so it depends on Frida and a custom script which most users won't be able to run easily without me writing a proper guide for it. I'd rather not push something half-cooked and have people brick their save trying to follow steps I haven't tested with random users yet.

Also if I drop it now while IAP is still unsolved, the dev sees it, patches the cookie hook, and we lose the only working part. So I'd rather hold the release until either the IAP piece works too or until I'm sure it can't be patched easily.

 

[Anonymous2018]

Up

 

[Lurious]

Yeah verifypaymentV2 is the wall. Server hits Google with the purchase token and writes the unlock based on what Google says. Local premium flags are downstream of that, not really worth attacking imo :/

The annoying part is the response shape. We can fake the call easy (I tried), problem is we don't know what an actually-owned response looks like, so I've been guessing field names blind. None of my guesses stuck so far, UI either ignores it or hangs.

If anyone with a legit purchase can share their captured traffic this closes fast. Otherwise it's just trial and error

Not yet, sorry. The cookies/reroll part isn't really packaged as a clean modded APK that you can just install. It's a runtime hook setup, so it depends on Frida and a custom script which most users won't be able to run easily without me writing a proper guide for it. I'd rather not push something half-cooked and have people brick their save trying to follow steps I haven't tested with random users yet.

Also if I drop it now while IAP is still unsolved, the dev sees it, patches the cookie hook, and we lose the only working part. So I'd rather hold the release until either the IAP piece works too or until I'm sure it can't be patched easily.

Which ones have you tried? I'll do the same and avoid the ones you've already done. If it takes more than like 72 hours of both our combined efforts, I might take one for the team, the features are so costly though.

 

[huklh]

Yeah verifypaymentV2 is the wall. Server hits Google with the purchase token and writes the unlock based on what Google says. Local premium flags are downstream of that, not really worth attacking imo :/

The annoying part is the response shape. We can fake the call easy (I tried), problem is we don't know what an actually-owned response looks like, so I've been guessing field names blind. None of my guesses stuck so far, UI either ignores it or hangs.

If anyone with a legit purchase can share their captured traffic this closes fast. Otherwise it's just trial and error

Not yet, sorry. The cookies/reroll part isn't really packaged as a clean modded APK that you can just install. It's a runtime hook setup, so it depends on Frida and a custom script which most users won't be able to run easily without me writing a proper guide for it. I'd rather not push something half-cooked and have people brick their save trying to follow steps I haven't tested with random users yet.

Also if I drop it now while IAP is still unsolved, the dev sees it, patches the cookie hook, and we lose the only working part. So I'd rather hold the release until either the IAP piece works too or until I'm sure it can't be patched easily.

ok ill be waiting

 

[thebisss]

up

 

[mkmsld]

You guys are amazing

 

[lalarina]

up

 

[talong00]

Uppp

.

 

[SweetLuna]

Which ones have you tried? I'll do the same and avoid the ones you've already done. If it takes more than like 72 hours of both our combined efforts, I might take one for the team, the features are so costly though.

Quick rundown of what I tried so you can skip these BS stuff...

I hooked the verify call to fake success but it never fires, the game filters fakes upstream first. Then I tried mocking the billing layer with synthetic purchases, same filter ate it. Writing ownership directly on the backend got reverted in like 5 sec, no error or ban tho which was nice. Heads up, don't touch the restore path, wrong shape there nuked a throwaway account I was testing on. Also tried the offline trick (load then kill wifi), local cache just stays empty so the UI never flips anything.

Spent today building a local mock backend and redirecting the game to it. Got past auth and even the welcome screen showing my nickname which felt like progress, but loading hangs at one specific spot bc I'm guessing field shapes blind without owned data to copy from. Kinda death by papercuts at this point ngl.

Stuff I haven't tried but might be your angle(?)... patching the ownership check directly in memory (risky if the offsets change between updates), or watching what the game actually reads when it loads purchase data. I started the second one but my reverse engineering tools gave me wrong function names, so I couldn't really tell what was what and gave up.

What is possible and can be safely modded right now... cookies, reroll, ad bypass, and daily cookie stuff. The DLC unlock part is the only thing still stuck because of the billing wall, and honestly if anyone here already owns one of the DLCs and could share a capture from a normal play session, that would basically end this in a day. Just one capture and I can copy the response shape directly..

 

[SweetLuna]

Quick rundown of what I tried so you can skip these BS stuff...

I hooked the verify call to fake success but it never fires, the game filters fakes upstream first. Then I tried mocking the billing layer with synthetic purchases, same filter ate it. Writing ownership directly on the backend got reverted in like 5 sec, no error or ban tho which was nice. Heads up, don't touch the restore path, wrong shape there nuked a throwaway account I was testing on. Also tried the offline trick (load then kill wifi), local cache just stays empty so the UI never flips anything.

Spent today building a local mock backend and redirecting the game to it. Got past auth and even the welcome screen showing my nickname which felt like progress, but loading hangs at one specific spot bc I'm guessing field shapes blind without owned data to copy from. Kinda death by papercuts at this point ngl.

Stuff I haven't tried but might be your angle(?)... patching the ownership check directly in memory (risky if the offsets change between updates), or watching what the game actually reads when it loads purchase data. I started the second one but my reverse engineering tools gave me wrong function names, so I couldn't really tell what was what and gave up.

What is possible and can be safely modded right now... cookies, reroll, ad bypass, and daily cookie stuff. The DLC unlock part is the only thing still stuck because of the billing wall, and honestly if anyone here already owns one of the DLCs and could share a capture from a normal play session, that would basically end this in a day. Just one capture and I can copy the response shape directly..

Oh and I mean DM me directly here on Platinmods, just send me the captured traffic file privately and I'll feed it into my fake server to grab the response shape.

 

[SweetLuna]

TLDR: TBH guys, I can't ship a mod yet bc the game pulls everything from the dev's backend every time you boot, so normal "edit save file" tricks just get wiped on next refresh see (IGNSST's post). I'm building something that survives this, but missing one piece of reference data to finish it (DLCs, yes pain...) I genuinely cannot make a modded APK version.

For anyone curious why this is hard and I cannot do anything without DLCs..

Most mobile games keep everything stored locally, so you mod them by editing a memory value and done. This one doesn't, almost everything (cookies, stories, traits, DLC) lives on the dev's backend and refreshes every boot, so any normal edit gets wiped on the next sync. The ONLY way around it is to handle the game's questions ourselves so the dev's server never sees anything and can't do anything about it. I'm using standard RE tools for this (frida, jadx, blutter), nothing exotic. Basically what I need is the missing data, not a skill issue (lol). What I currently have working isn't safe, it will potentially leaks back to their side.

The DLC ownership answer is paid account only, so I've literally never seen what a valid one looks like. Every other answer I could just hack my way through easily, but this one I keep guessing wrong bc the shape is slightly off and the game rejects it. With one capture from someone who actually owns a DLC, I copy the format and finish the whole thing.

so... my end goal here is an offline "kinda" APK, meaning the game still thinks it's online and works normally, but nothing actually leaves your device. That's the entire reason I'm going through all this BS instead of just shipping a quick memory hack. The dev team is Korean indie and they are def very very strict, so anything that talks to their backend gets caught and reverted. The fake version goal is to locally route, which is genuinely the only safe option for users that doesn't get them flagged. Can't say more about how it works without giving the dev a roadmap, sorry LMAO.. but that's why a partial release isn't an option, dropping cookies only would close the DLC route with it and burn everyone and no more modded version forever.

If anyone here owns a DLC and can share a capture from a normal play session, DM me.

 

[SweetLuna]

Btw funny thing i found while digging through the APK btw, found that "Deserted Island Campaign" is already sitting in the game files. like fully there, character pack, trait pack, all the UI strings, even the "new expansion released" popup. just locked behind a server flag right now so nobody can see it. probably the next paid expansion.