Requirements:
- GNU DEBUGGER - [ from http://cydia.radare.org ]
- GamePlayer/iGameGuardian [ from http://yuan.duowan.com ]
- ASLR Remover
- SSH
Instructions:
1. Remove ASLR from the game
2. Open the app your are hacking
3. Search the value in GP or iGameGuardian
4. Find the true value in GP or iGameGuardian
5. If you have 2, then try to make them different number and see which one is right
6. Write down the GP or iGameGuardian Number in one place [you will need it later]
7. Dont close the app yet, go to your PC or MAC and Open SSH [PUTTY]
8. You will need to log in as root in your device so type this inside SSH [PUTTY]:
ssh root@iPAddressThatYourDeviceUses
9. Then it will ask for the password .. If you havent changed it, it will be alpine
10. Now lets go to GDB commands! First of all before you start GDB hacking, you will need to on gbs so type this inside SSH [PUTTY]
gdb
11. Now GDB is On and next step is to attach the game, which will make the app to freeze [NO WORRIES] So type this:
attach BINARYNAME
12. Now you will need the GP or iGameGiardian Offsets you found, so type this in:
watch *0xTheAddressinGPoriGameGuardian
13. Then you will need to unfreeze the app and use the currency/thing u r trying to hack, so this in:
continue
14. And the app will unfreeze now and you will need to use/gain some currency/thing u r trying to hack
15. When it increases or decreases the app will freeze again and this time it will show the OFFSET IN IDA
16. If u want you can load up the IDA and go to that offset and Hack it directly if u know how to or if u wish to find out more, u can try this! :D
17. If you wish to continue type this command to see the function in that offset
x/i 0xADDRESSYOUFOUNDJUSTNOW
18. The offset you have found might not be the one u can actually hack so you can try to change the adress by one or two [ex: SUB r1, r0]
19. Now after you have found the hackable offset, you need to see the hex address for that, so type this in:
x/x 0xADDRESSWHICHISTHEHACKABLEONE
20. Now go to http://armconverter.tk to convert the ARM-TO-HEX
21. Go there and change the function u want to do [ex: 39 1C]
22. Now you are done! but if you would like to test it, type this:
set *0xADDRESWHICHISHACKABLE = 0xTHEHEXNUMBERYOUWANT
Continue
23. As you will see the currency/thing will be the amount you have chosen :D
24. Good Luck :D