IDA tutorial - Bypassing fake update warning
Sometime you'll meet fake bugs in
some games. This fake update warning didn't help much because it's easy to bypass. I'll show you how to
bypass it easly
The game is The Evolution Sandbox.
You need:
- IDA Pro
- 7-zip or Winrar to open APK file
- Basic knowledge of IDA hacking
Video tutorial:
Start disassemble the ARM version libcocos2d.so
file
Press CTRL+F, search
UpdateWarningScreen and open up UpdateWarningScreen::Create(void)
Because I know this is the right function to look for right hehehe.
Highlight _ZN19UpdateWarningScreen…
and press X to XREF to see which function are calling this function. There are
2 functions. Double-click to view the code.
Press F5 to view Pseudocode to
understand the code easier
It looks very intersting. It checks
for Lucky Patcher, signature or other hacking related stuff. I assume
checkSignature detected tampered APK.
I'm too lazy to look deeper into it
so I'll NOP the loc_xxxxxx instead. Highlight the loc_xxxxxx and press X to
XREF. Hmm there is only 2 loc_xxxxx in one function and it's right here,
highlighted in yellow
Go to the offsets you found and replace
them with NOP (40 46 in THUMB) in hex editor. NOP means No Operation
When you re-disassemble the modified
.so file, you'll see the changes.
The fake update warning won't appear
anymore. Enjoy playing the modded game.
Credit:
AndnixSH#
Credit:
AndnixSH#
