Leaderboard
Popular Content
Showing content with the highest reputation since 10/09/2025 in all areas
-
Version 7.1.0
1,162 downloads
SCRIPT MENU: Mode Bomb Menu • FreeWeapons • LocateC4 • FastDefuse • EnablePersistentShop • ForceMatchEnd • ForceTeamSwap • NoMoneyLoss Misc Menu • Unlock All Characters + Skins • RegenBoost • OneKillAdvance • Avatar Selector • Phantom Lock • Radar • BypassLevelRestrictions • CustomFov • FastAutoFire • NoSpread • NoRecoil • Unlimited Ammo • RewardScaler • ExplosiveSmoke • ActiveVIPBonus • Speed • HighDamage • CustomPlayerLevel • NukeGrenade • AllGunsSniperMode • NoFlashEffect • SoftGodMode • WallPierce • FullClipReload • ExtendedClip • OneKillWin Attention: ExplosiveSmoke When active, this feature turns the smoke grenade into an **invisible explosion**. The visual remains as a regular smoke for other players — but it deals **real damage**. Supports **Default**, **Global**, or **Custom Radius**, with an option to **edit the damage**. Use with caution: highly powerful and visually undetectable in-game.3 points -
3 points
-
Junior = 1,776,749,182 Comp JP2 = 1,739,976,340 Pyroraptor Dominion = -1,853,388,4462 points
-
2 points
-
2 points
-
2 points
-
2 points
-
Version 101.1
211,075,320 downloads
Overview: Play games your way! “GameGuardian” is a game cheat / hack / alteration tool. With it, you can modify money, HP, SP, and much more. You can enjoy the fun part of a game without suffering from its unseasonable design. Requires Android: 2.3.3+ GameGuardian Features Summary Runs on ARM, x64 and x86 devices, including x86 emulators (LDPlayer, Droid4X, MOMO, KOPlayer, Andy, Memu, Leapdroid, AMIDuOS, Windroye, RemixOS, PhoenixOS, AVD, Genymotion, Nox, BlueStacks etc.) Supports Android 2.3.3+ (Gingerbread) through Lollipop (5+), Marshmallow (6+), Nougat (7+), Oreo (8+), Pie (9+), 10+. Support work without root via different virtual spaces. Support different emulators like PPSSPP, ePSXe, GameBoy etc. Game deceleration and acceleration (speedhack) for ARM and x86 devices, including x86 emulators. Also supports both 32-bit and 64-bit applications on 64-bit devices using speedhack. Search feature: encrypted values. Search of unknown values when specifying the difference between values. Search addresses by mask. Explicit and "fuzzy" numeric searches. Text (String, Hex, AoB) search. Supports: Double, Float, Qword, Dword, XOR, Word, Byte, or Auto data-type searches. Lua scripting support. Modify all search results at once. Filtering of search results (address greater than and less than, value greater than and less than). Search in the background feature. 'The fill' feature. Time jump feature. Dump memory. Copy memory. Customizable UI. App locale for over 50 languages. And, much, much more. Notes: ** ROOT or VIRTUAL ENVIRONMENT ONLY ** This tool only works on rooted devices or in virtual environment (without root in limited mode)! GG can work in limited mode without root, through a virtual environment. For example, through Parallel Space, VirtualXposed, Parallel Space Lite, GO multiple, 2Face and many others. Read the help for more details. You can find more information about rooting your device at XDA Developers. Want to help us improve, or add a translation? Then please visit thread "If you want to add a new translation or improve an existing". If you are having issues with the app, please visit thread "Gathering information about GG errors". Want to donate and help keep the project going? That's awesome! You can donate any amount (anything helps) here: Donate Need help with how to use this application? Please visit "Video tutorials" and forum "Guides". Credit: @d2dyno - Owner, lead designer, project management. @Enyby - Lead coder, project management. @Trasd - Technical consultant, project management. @Aqua - Creator (retired).2 points -
Version 1.0.0
279 downloads
Join the Discord server for script updates: https://discord.gg/TFtZUgfTs9 Script Informations: • Enables In-App Purchases Bypass – it means you can buy everything for free that’s normally only buyable with real money • Made for 64-bit (x64) version of the game • Works for all game versions – Auto Update YouTube Tutorial to use the script below:1 point -
1 point
-
1 point
-
Version V 06
20,804 downloads
UPDATED 04 Nov 2025 VERSION 06 ( 235+ Total Games ) 1945 Air Force 3D Pool Ball ACE Fighter Agent J Aliens vs Zombies Almost A Hero Ancient Allies TD Angry Birds 2 AnimA Archero Arrow Quest Attack Hole Auto Hero Awesome Tanks Ball Blast Bang Bang Rabbit Battle Strategy TD BeatStar Beyblade Rivals Bladebound Blitz: R.o.Heroes Boom Castle Boom Stick BounceMasters Bowmasters Box Head ZMD Brawl Fighter Brick Inc Bricks Breaker GB Bullet Echo Bullet Echo India CarX Highway Catapult King Chill & Kill Clan Race Clash of Destiny Conquer the Tower Conquer the Tower 2 Crossy Road Cyber Surfer DC Heroes & Villains Dead Ahead ZW Dead Raid ZS 3D Dead Trigger Dead Trigger 2 Dead Warfare Death Invasion Surv Defenders 2 Defense Legend 5 Demon Blade Devil Eater Dice Dreams Disney Heroes BM Doomsland Dragon Ball Legends Dragon POW! Dream Defense Dust Settle Dye Hard Endless Frontier Epic Stickman Faily Brakes 2 Fight for America Final Galaxy Fire Hero 2 Forged Fantasy Frozen: Free Fall Fruit Ninja 1 Fruit Ninja 2 Galaxiga Galaxy Attack SG Galaxy Shooter AFW Gems of War Grow Castle Grunt Rush Gun War Hero Blitz Hero Factory Heroes of Mavia Heroes vs Hordes Hockey All Stars 24 Honor Bound Horizon Chase Hyper Heroes Idle Hero TD Impossible Space Imposter Battle Royale Impostor Shooter MR Infinity Ops Infinity Shooter OS Injustice Gods A.U. Into the Dead 2 Island War Jewel World Museum Jurassic Monster World King of Defense Kingdom Clash Last Hero S.A Left to Survive Legion Master Lilys Garden Lonely Survivor Loot Heroes Mad Skills MX3 Magic Rampage Magic Siege Major Gun 2 MARVEL C.o.Champions Match Hit Meow Hunter Merge Archers Mini Golf King Mini TD 2 Mob Control Modern Sky War Moto Rider BRG Mr. Autofire NecroMerger NERF Superblast NFL Rivals Ninja Turtle Legends NonStop Knight 2 Otherworld Legends Pac Man 256 Panda Pop BS Perfect Kick 2 Pocket Necromancer Pokemon Quest POOKING Billliards City Pool Stars Puzzle Brawl Quest 4 Fuel R.A.C.E. Racing Legends Raid Royal 2 TD Raid Rush Raiden Fighter Ramboat 2 Real Steel Boxing Champ Realm Defense Red Siren Rival Kingdoms Robot Warfare Rodeo Stampede Royal Match Sci-Fi TD Module Shadow Gun ESW Shadow Knights Shadow Legends S.F. Shadow of Death Shadow Slayer Shadowgun Legends Shooter.io.WS SkullGirls Sky Force Reloaded Slash and Girl Slime Castle Smash Bandits Sniper 3d Sniper Strike Sonic Boom 2 Space Shooter GA Squad Alpha Star Force Steampunk Tower Steel Rage Stick Ninja 3v3 Stick War Saga Stickman Archer Online Storm Blades Street Racing 3D Stupid Zombies 1 Subway Match Survive Squad Surivor Z Swamp Attack 2 Tacticool Tank Combat WB Tank Hero Tank Stars Tap Titans 2 Tiny Gladiators 1 Tiny Gladiators 2 Top Troops Tower and Swords Tower Conquest Tower Defense BZ Tower Gunner ZS Towerlands Toy Blast Traffic Rider Transformers Bumblebee Transmute: GB Turret Defense King Undead City ZS Undead VS Demon Under Dark Unkilled Wacky Battles War Commander R.A. War Heroes War Inc : Rise War Strategy Game Warhammer 40k Tacticus Warzone Commander Wind Wings World of Artillery World Robot Boxing World Robot Boxing 2 WWE Mayhem WWII Defence Zombeast Zombie Defense Zombie Fire 3d Zombie Hunter Zombie State Zombie Warfare TDP Zombies Boom Zombtube1 point -
Try looking for 400D;1D::8. I've noticed that the storage value for gold and other coins is always followed by a 1 for some reason. There is also a big Dword value in front of it which is unique, but I don't have access to my PC now for that one. This logic is not true for all items btw, for example the storage value for steel is followed by a 2 instead. Edit: turns out I had the Excel sheet saved on my OneDrive1 point
-
1 point
-
sorry. but can no longer update the bullet echo scripts . it's now been removed from list1 point
-
1 point
-
1 point
-
1 point
-
1 point
-
1 point
-
1 point
-
1 point
-
it's not for sale. it's all FREE .. you can try it on emulator, but can't guarantee it will work.1 point
-
1 point
-
I have a script for this Online Mega Script v04 (100% Free & Not Encrypted) New Scripts Added Daily/Weekly. APEX[GG]v2 (#7iwkynr)1 point
-
1 point
-
1 point
-
For now, you can only change the value of the suns. As for the rest, you need to either find some other values or find the value you want.1 point
-
Version 2.0
339 downloads
TK_Tool — LuaScript_Builder Build GameGuardian Lua scripts instantly with menus, password lock, expiry date, and auto function generation. Features: Easy step-by-step script builder Password & expiry protection Menu creator (single/multi) Function modes: Manual, Patch-Offset, Search & Edit Auto-save & resume wizard Clean, ready-to-use .lua output Ideal for modders who want fast, structured, and customizable script creation. Must Watch video For How to Use1 point -
1 point
-
1 point
-
-- Il2CppGG by LeThi9GG require("Il2CppGG") -- Usage Instructions: -- This script demonstrates the core functionalities of Il2CppGG, a Lua-based toolkit for inspecting and manipulating Il2Cpp structures in GameGuardian. -- It covers image retrieval, class searching, method and field access, value modification, class dumping, and memory hooking. -- Prerequisites: Ensure GameGuardian is running and the target application uses Il2Cpp. Load this script in GameGuardian for execution. -- Note: Addresses and values are examples; adapt them to your specific game or application. -- For detailed API documentation, refer to the project's README.md or wiki. -- Example: Retrieve Image by Name -- Description: Fetches an Il2Cpp image (assembly) by its name. Use Il2Cpp.Image() without arguments to get all images. local Assembly = Il2Cpp.Image("Assembly-CSharp") -- Retrieves the "Assembly-CSharp" assembly. -- Example: Find Class within an Image -- Description: Searches for a class in the specified image using namespace and class name. Namespace can be nil for root-level classes. local PlayerScript = Assembly:Class(nil, "PlayerScript") -- Parameters: (namespace, classname) -- Alternative: Find Class by Name, Address, or Index -- Description: Directly searches for a class by name (recommended to use GetIndex() for performance optimization). --local PlayerScript = Il2Cpp.Class("PlayerScript") --print(PlayerScript:GetIndex()) -- Outputs the class index for faster future access. -- Example: Find Methods in a Class -- Description: Retrieves a specific method by name or lists all methods with GetMethods(). local LateUpdate = PlayerScript:GetMethod("LateUpdate") -- Finds the "LateUpdate" method. local addPoints = PlayerScript:GetMethod("addPoints") -- Finds the "addPoints" method. -- Example: Find Fields in a Class -- Description: Retrieves a specific field by name or lists all fields with GetFields(). local points = PlayerScript:GetField("points") -- Finds the "points" field. -- Alternative: Find Field by Name or Address -- Description: Global search for a field by name or direct address. --local points = Il2Cpp.Field("points") -- Searches globally by name. -- Alternative: Find Method by Name or Address -- Description: Global search for a method by name or direct address. --local AddPoints = Il2Cpp.Method("AddPoints") -- Searches globally by name. -- Example: Modify a Field Value -- Description: Locates an instance of the class and sets a new value for the field. local obj = PlayerScript:GetInstance() -- Retrieves instances of the class. points:SetValue(obj, 1000) -- Sets the "points" field to 1000 in the instance. -- Example: Dump Class to C# Format -- Description: Outputs the class structure in C# syntax for reverse engineering purposes. --print(PlayerScript:Dump()) -- Dumps the class definition, including fields, methods, and offsets. -- Hooking Examples -- Description: Demonstrates memory hooking for real-time modifications using the Hook module. -- Hooks allow intercepting and altering method calls, parameters, and fields. -- Hook a Field via a Method (e.g., hook "points" field using "LateUpdate" method) -- Description: Modifies the field value every time the method is called. local _LateUpdate = LateUpdate:field() -- Initializes hook on the method for field modification. _LateUpdate:setValues({{offset = points.offset, flags = "int", value = 9999}}) -- Sets the field to 9999. gg.sleep(10000) -- Pauses for 10 seconds to observe the effect. _LateUpdate:off() -- Disables the hook and restores original behavior. -- Hook Parameters of a Method (e.g., hook parameters of "addPoints") -- Description: Alters the parameter values passed to the method. local _addPoints = addPoints:method() -- Initializes hook on the method for parameter modification. _addPoints:param({{param = 1, flags = "int", value = 999999}}) -- Sets the first parameter to 999999. gg.sleep(10000) -- Pauses for 10 seconds. _addPoints:off() -- Disables the hook. -- Hook a Method Call (e.g., call "addPoints" from "LateUpdate") -- Description: Injects a call to another method with custom parameters during execution. local _addPoints = LateUpdate:call()(addPoints) -- Initializes hook to call "addPoints" from "LateUpdate". _addPoints:setValues({{param = 1, flags = "int", value = 999}}) -- Sets the parameter for the called method. gg.sleep(10000) -- Pauses for 10 seconds. _addPoints:off() -- Disables the hook. Il2CppGG Telegram Youtube1 point
-
I just noticed your comment about IDA. If your use case is simply to find offsets, this tool does much more than what you're looking for. In terms of the AOB generation, all it does is dumbly check if instructions contains `0x` or `#` (which is not a foolproof system and results in false positives). IDA supports AOB searches, and surely there's better tools out there that you can use to generate AOBs. For instance, https://guidedhacking.com/threads/aob-signature-maker.8524/ seems promising. I'm not trying to discourage you from using my tool, I just want to clarify that it's nothing magical.1 point
-
Update: I have found a way to cheat the “create an extra cell” part, u no longer have to be level 100 to be able to have max cells1 point
-
1 point
-
1 point
-
1 point
-
I need help I just got the dump.cs of the csr2 and I want to try to turn off the anti-cheat of the game with liboffset using gg but I find it hard to do the task bcs I'm still new to doing this kind of things. I found some terms connected to cheats in the dump.cs but I can't figure it out if it's the anti-cheat offset. If anyone their could help me I would much appreciate it1 point
-
1 point
-
Version 3.8.0
11,611 downloads
Features : • Skill Hack (Default SAS Skills) - Reload Speed. - Fast Movement. - Toughness. - Recovery Time. - Health Regen. - Pay Grade. - Body Armor Expert. - Energy Boost. - Energy Regen. - Field Supplies. - Grenade Damage. - Critical Shot. • Skill Hack (Assault) - Overpowered Adrenaline. - Overpowered Killing Spree. • Skill Hack (Medic) | Coming Soon • Skill Hack (Heavy) | Coming Soon • Skill Hack (Global Character) - Long Skill Duration [Except Medic] - No Skill Cooldown. - No Skill Energy Cost. [NEW] • Mastery Hack - Set Mastery Level To Max. - High Mastery Bonus. • Weapon Hack - High Crit DMG/Chance Bonus. - High Pierce. [Coming Soon] - High Rocket Explosion Radius. [Coming Soon] - High AOE. [Coming Soon] • Others - God Mode. - No-Clip. - F.O.V. If you face some problems with the script contact me via telegram. Game Link1 point -
Version 2
1,281 downloads
import this lib to your script : • setup ! XEK = nil load_lib = gg.makeRequest('https://raw.githubusercontent.com/chihaamin/XEKEX/main/xLIB.lua') if load_lib.code == 200 then -- check the status of the request XEK = load(load_lib.content,'bt')() end • Comment if you find a bug / error or if you have Idea for implementation. • All the file is documented and commented for beginners. ♥ Add "XEKEX was here" in your script if it was helful ------------------------------------------------------------------------------- IMPORT : JSON = XEK.import('https://raw.githubusercontent.com/rxi/json.lua/master/json.lua') -- this will import a lib into your script JSON.decode(response.content) Text2Dword : -- Text2Dword function Convert a text to dword value local DWORD = XEK.Text2Dword("berry") -- Print the result print(DWORD) --> Output: '6619234;7471218;121::9' Dword2Text : -- Dword2Text function Convert a Dword value to text local sampleValue = "6619234;7471218;121" local text = XEK.Dword2Text(sampleValue) -- Print the result print(text) --> Output: 'berry' hex : The 'hex' function takes two arguments: a value to convert to hexadecimal and a boolean 'hx' indicating whether to add '0x' or 'h' prefix to the output. --[[ If hx is true, the function returns the hexadecimal value with '0x' prefix. If hx is false, the function returns the hexadecimal value with 'h' suffix. If hx is not provided or not a boolean, the function returns the hexadecimal value without any prefix or suffix. The function uses string formatting to convert the value to hexadecimal. ]] --> Examples: --Convert decimal value to hexadecimal with '0x' prefix print(XEK.hex(255, true)) --> Output: 0xFF --Convert decimal value to hexadecimal with 'h' suffix print(XEK.hex(255, false)) --> Output: FFh --Convert decimal value to hexadecimal without any prefix or suffix print(XEK.hex(255)) --> Output: FF dump : --[[ dump function takes a table as input and returns a string representation of the table. If the input is not a table, it returns a string representation of the input. Parameters: tab (table): the table to be dumped Returns: (string): the string representation of the table ]] --> Example usage: local myTable = {name = "John", age = 30, hobbies = {"reading", "running"}} print(XEK.Dump(myTable)) -- Output: { ["name"] = "John", ["age"] = 30, ["hobbies"] = { [1] = "reading", [2] = "running", } } split : --split function splits a string into a table of substrings using a specified delimiter --The function takes two parameters: s, which is the string to be split, and delimiter, which is the character or string used to separate the substrings --> Example usage: local myString = "apple,banana,cherry,orange" local myTable = XEK.split(myString, ",") -- The above code will split the string "apple,banana,cherry,orange" into substrings using the comma as the delimiter and store the result in a table called myTable --The resulting table will contain the following values: myTable[1] = "apple" myTable[2] = "banana" myTable[3] = "cherry" myTable[4] = "orange" ARMIT fix : --# Example 1: Converting an Integer to Assembly Instructions local instructions = XEK.ARMIT(123456, "int", true) --The above function call will generate assembly instructions to move the value 123456 into a register in AArch64. --> Output: instructions = { [1] = '~A8 MOVK W0, #0xE240, LSL #16', [2] = '~A8 MOVK W0, #0x0001, LSL #32', [3] = '~A8 RET', } --# Example 2: Converting a Boolean to Assembly Instructions local instructions = XEK.ARMIT(true, "bool") --The above function call will generate assembly instructions to move the value 1 (true) into a register in AArch32. --> Output: instructions = { [1] = '~A MOV R0, #0x1', [2] = '~A BX LR', } --# Example 3: Converting a Float to Assembly Instructions local instructions = XEK.ARMIT(3.14159, "f", true) --The above function call will generate assembly instructions to move the value 3.14159 into a floating point register in AArch64. --> Output: instructions = { [1] = '~A8 MOVK W0, #0x0FD0, LSL #16', [2] = '~A8 MOVK W0, #0x4049, LSL #32', [3] = '~A8 FMOV S0, W0', [4] = '~A8 RET', } --# Example 4: Converting a Double to Assembly Instructions local instructions = XEK.ARMIT(123456789.987654321, "d") --The above function call will generate assembly instructions to move the value 123456789.987654321 into a double precision floating point register in AArch32. --> Output: instructions = { [1] = '~A MOVW R0, #0x5BA8', [2] = '~A MOVT R0, #0x57F3', [3] = '~A MOVW R1, #0x6F34', [4] = '~A MOVT R1, #0x419D', [5] = '~A VMOV D0, R1, R0', [6] = '~A BX LR', } readBytes | readWord | readDword | readFloat | readDouble : local words = XEK.readWord(addr, size, ';') <-| return a string local dwords = XEK.readDword(addr, size, '-') <-| return a string local floats = XEK.readFloat(addr, size, '|') <-| return a string local doubles = XEK.readDouble(addr, size, ':') <-| return a string -- OR local words = XEK.readWord(addr, size) <-| return a table local dwords = XEK.readDword(addr, size) <-| return a table local floats = XEK.readFloat(addr, size) <-| return a table local doubles = XEK.readDouble(addr, size) <-| return a table --<< these function purpose is to read values from memory for comparison >>-- getResults : --# Example usage of getResults function and its returned table local t = XEK.getResults(10) or t = XEK.getResults() <-|-- Get 10 results or all result | you can specified parameter same as GG print(t.data[1].address) <-|-- Print the address of the first result --# Example usage of focus function t:focus() <-|-- Save original values of results table print(t.original[1]) <-|-- Print the original value of the first result --# Example usage of update function t:update(999) <-|-- Set all values in result table to 999 --# Example usage of reset function t:reset() <-|-- Reset all values in result table to their original values --# Example usage of offset function t:offset(0x8) <-|-- Add 8 to the address of each result --# Example usage of append function local t2 = XEK.getResults(5) <-|-- Get 5 more results t:append(t2) <-|-- Append t2 results to t print(#t.data) <-|-- Print the total number of results in t --# Example usage of get function t:get() <-|-- Refresh the results table --# Example usage of clear function t:clear() <-|-- Destroy the results table and clear garbage MakeMenu : -- Create a new menu object local myMenu = XEK.MakeMenu().Menu:new({"Option 1", "Option 2", "Option 3"}) | this will add Menues -- Add a new action to the menu myMenu.actions:new(1, function() -- argument 1 is the index of menu ( option 1 function ) | index must be a number print("Option 1 was selected!") end) myMenu.actions:new(2, function() print("Option 2 was selected!") end) -- etc -- . -- . -- . -- Display the menu and wait for the user to make a selection myMenu:display() --whenever the user select a menu item it will trigger the functions inside myMenu.actions ( created with myMenu.actions:new(index, function) )1 point -
Version 4.0.9070+1.0.3010+1.0.3049
15,396,160 downloads
Requires Android: Android 4.0.3-4 / Ice Cream Sandwich MR1 or later. There is support for x86. Video: No root via optimized Parallel Space Lite - GameGuardian (#47glijbj) Before installing the optimized version, uninstall the version from Google Play. Differences of the optimized version: no error 105. About second apk (32-Bit Support): About third apk (64-Bit Support): You do not need to install it if you do not intend to crack 64-bit games. After installing it, GG will not see 32-bit games in the virtual space, only 64-bit.1 point -
View File SAS 4 Mega Script Features : • Skill Hack (Default SAS Skills) - Reload Speed. - Fast Movement. - Toughness. - Recovery Time. - Health Regen. - Pay Grade. - Body Armor Expert. - Energy Boost. - Energy Regen. - Field Supplies. - Grenade Damage. - Critical Shot. • Skill Hack (Assault) - Overpowered Adrenaline. - Overpowered Killing Spree. • Skill Hack (Medic) | Coming Soon • Skill Hack (Heavy) | Coming Soon • Skill Hack (Global Character) - Long Skill Duration [Except Medic] - No Skill Cooldown. - No Skill Energy Cost. [NEW] • Mastery Hack - Set Mastery Level To Max. - High Mastery Bonus. • Weapon Hack - High Crit DMG/Chance Bonus. - High Pierce. [Coming Soon] - High Rocket Explosion Radius. [Coming Soon] - High AOE. [Coming Soon] • Others - God Mode. - No-Clip. - F.O.V. If you face some problems with the script contact me via telegram. Game Link Submitter xLuaR Submitted 01/19/2023 Category LUA scripts1 point
-
Name : Harvest Town Playstore link : https://play.google.com/store/apps/details?id=com.harvest.android.gr Download link: https://apkpure.com/harvest-town/com.harvest.android.gr hack request: - gold - gem - stamina - health - clock freeze - Anything can be hacked1 point
-
I thought I was the only one, but it turns out I'm not. The same, I tried to scour the Internet in the hope of finding at least a tiny hack, even in YouTube I searched, but there was only a divorce, "AFK arena hacking game currency", and the hack was through some left-wing site. I even tried to hack this game myself, but it didn't work out. I think that one day, at some point, someone will hack this game. (I apologize in advance for mistakes)1 point
-
1 point
-
GameGuardian work without root So, as for work without root. This is not magic. Technical limitations were, and have remained. So it will not work anywhere and always. Actually it looks like this: 1. You put an application of virtual space (Parallel Space, VirtualXposed, Parallel Space Lite, GO multiple, 2Face and many others). 2. In it you add the game and installed GameGuardian. 3. From the virtual space application, you launch the game and GameGuardian. Actually everything. GameGuardian can be used to hack the game. Everything is simple and transparent. It was a good part of the news. Now about the bad: 1. The game has zero progress. You can not transfer the progress from the existing installation of the game, if the game itself does not provide it (through the cloud or somehow). 2. Not all games work through virtual spaces. 3. There may be another account in the game. 4. Not all functions will be available in GameGuardian. 5. On some firmware it does not work at all. If you cannot choose a proсess in GameGuardian, or get an error 105/106, then on your firmware, GG, without root, will not work. Try optimized versions of virtual spaces or another firmware or other device or get root. 6. In some virtual spaces GameGuardian does not work. What can be done in case of problems: 1. Try different virtual spaces if the problem is in them. Best option: Parallel Space. 2. Try changing the firmware. 3. Get a root and do not fool yourself. Once again: it will not work at all and always. It is possible that it will work for you and will not. Virtual spaces to run GameGuardian without root (#ct7bob3) Proper install without root - GameGuardian (#abausujp) Help: https://gameguardian.net/help/help.html#work_without_root Video-examples: Balls Bounce Free - hack balls - without root - GameGuardian, Parallel Space Bejeweled Stars: Free Match 3 - hack without root - group search - GameGuardian, GO Multiple Hack Tap Counter without root via GO Multiple on Android 7.1.1 - GameGuardian Hack Tap Counter without root via GO Multiple - GameGuardian Work without root via Parallel Space - GameGuardian Work without root via 2Face - GameGuardian Work without root via Mutiple Accounts - GameGuardian Work without root via GO Multiple - GameGuardian No root via VirtualXposed - GameGuardian (#b6l7k1qu) No root via VirtualXposed (without error 105) - GameGuardian (#bpb5835m) No root via optimized Parallel Space Lite - GameGuardian (#47glijbj) No root [from scratch] (boring and long video) - GameGuardian (#9rf9317c) No root via Dr. Clone - GameGuardian (#aft8whcy)1 point
-
Bypassing XOR encryption in mobile games with Game Guardian In the last few months we noticed increased number of mobile games that uses some sort of encryption. Some of them are simple, like multiplying value with some random number (example: let’s say random number is 8 – in that case, 10 gold in our in-game inventory will be stored as 80 in memory). This simple kinds of encryption can’t trick anyone. But XOR encryption is different story. It is one of the simplest encryption methods, but in most cases it can’t be broken (if data and key have the same length). It is often used as a part in more advanced ciphers. But we will cover this latter. There are lot of tutorials that teach us how to bypass XOR encryption in mobile games, but most of them don’t show us process that lies behind. So before we start, we need to read some theory about the subject. If you learn this, you will be able to bypass XOR encryption with only basic memory editor, paper and pen. Of course, this is some sort of advanced tutorial – we assume that you are at least familiar with basics of memory editing. Cryptography 101 (logic for dummies) In the beginning, there was Boolean algebra. For those who haven’t overslept math and logic classes, you can skip this chapter. If you have overslept, read carefully. George Boole was mathematician, logician and philosopher who published his most famous notes in the middle of the 19th century. You probably asked yourself why are you reading about some dude who lived 100 years before ENIAC. This dude is father of all computers – every digital circuit on our planet works on his principles. For our story, it is important to notice that every algebra has own values and operations. Imagine that, in some sort of simple algebra, values are set of natural numbers from 1 to 10 [1,2,3,4,5,6,7,8,9], and only operations are addition(+), subtraction(-), multiplication(*), and division(/). From our knowledge of elementary algebra (math from school), you can tell that 1+1 =2, or 2*4=8. While elementary algebra deals with numbers, Boolean algebra use only two values – TRUEand FALSE. They are represented as 1(true) and 0(false). All operations are done on this two values. Of course, you can’t preform multiplication or subtraction on this values. We need some other operations that can be preformed on TRUE and FALSE. These operations are called bitwise operations. There are three basic operations in Boolean algebra – NOT(¬), AND (∧) and OR (∨), and they are really simple to understand. Take a look at this image, and everything will be clear. Source: Wikipedia Just kidding, forget this and let’s move on. Basic bitwise operations I know this will maybe be hard to understand, especially if this is your first time you read about logic. So I will try to make it simple. Boolean algebra (and any other logic) are made to teach us how to make correct conclusions. In elementary algebra, correct conclusion is when we write that 1+1=2. As we said, in Boolean algebra there are only two values, and we can only preform operations on them. Now imagine that we have a few true or false statements: Tom is a cat (TRUE or 1) Jerry is a mouse (TRUE or 1) Sky is green (FALSE or 0) NOT operator This is fairly simple examples. Let’s see our first operator, NOT(¬). “Tom in not a cat”, is this statement true or false? Of course, it is FALSE. Jerry is not a mouse = FALSE or 0. Sky is not green = TRUE or 1. This operator preforms logical negation on a given statement. 0 become 1, and 1 become 0. We can write it like this: ¬0 = 1 ¬1 = 0 AND operator AND(∧) operator takes two arguments, and returns TRUE only if both arguments are TRUE. Tom is a cat AND Jerry is a mouse = TRUE(1). Tom is a cat AND Sky is green = FALSE(0). You can easily remember this operator – just multiply two arguments and you have correct result. We can write it like this: 1 ∧ 1 = 1 1 ∧ 0 = 0 0 ∧ 1 = 0 0 ∧ 0 = 0 OR operator OR (∨) operator takes two arguments, and return FALSE only if both of the statements are FALSE. In every other case it returns TRUE. Tom is car OR Sky is green = TRUE(1). Sky is green OR Sky is red = FALSE(0). 1 ∨ 1 = 1 1 ∨ 0 = 1 0 ∨ 1 = 1 0 ∨ 0 = 0 Maybe you wonder why are we talking about Tom and Jerry. In computer world, everything is made in binary system. There are only two states in computer – there is current flow (1) and there isn’t current flow (0). So every information is stored in binary numeral system. Each digit (0 or 1) is called bit. Group of 8 bits are called byte. Any information can be translated into binary system. So our “tom” will be 01110100 01101111 01101101 in binary, and “sky” will be 01110011 01101011 01111001. Guess what? You can preform this bitwise operations on binary values. So, “tom” OR “sky”? 01110100 01101111 01101101 tom ∨ 01110011 01101011 01111001 sky ____________________________ 01110111 01101111 01111101 wo} If we want preform AND operator, this will be result: 01110100 01101111 01101101 tom ∧ 01110011 01101011 01111001 sky _______________________________ 01110000 01101011 01101001 pki Well, this was not very useful. But it is important to remember this, because now you will learn another bitwise operation – exclusive disjunction (exclusive OR, known as XOR). XOR (exclusive OR) bitwise operator I hope you understand these basic bitwise operators. There is also so-called “secondary operators or operations”, which can be derived from basic operators. One of these secondary operators is XOR, or exclusive OR. You will understand why is it called “exclusive OR” when you see the following table. 1 XOR 1 = 0 1 XOR 0 = 1 0 XOR 1 = 1 0 XOR 0 = 0 As you can see, if you perform XOR operation on two different values, it will return 1 or true. If values are the same, it will return 0 or false. So what is the catch? Why are XOR so special, and why is it used in cryptography? Now, look again our previous example, and you will see. From now on, we will preform XOR operation on original data (“tom” in our case) with the key (“sky” in our case). 01110100 01101111 01101101 tom XOR 01110011 01101011 01111001 sky _____________________________________ 00000111 00000100 00010100 //this can't be converted to meaningful text But what will happen if we XOR out new value (00000111 00000100 00010100) with the same key (sky or 01110011 01101011 01111001)? Let’s try it. 00000111 00000100 00010100 XOR 01110011 01101011 01111001 sky ___________________________________ 01110100 01101111 01101101 tom Right, we got our original data. But there is more -what if we don’t know the key (“sky”) 01110100 01101111 01101101 tom XOR 00000111 00000100 00010100 ___________________________________ 01110011 01101011 01111001 sky We have out original key. This is the reason why XOR operator is special. We can’t achieve this with other operators. XOR encryption in mobile games So let’s see some real world example – using XOR encryption in mobile games. Imagine that you have 1000 gold in some game. Developers implemented that all values are XOR-ed with the key 1337, and stored in memory. So look at the example. For conversion for decimal to binary you can use Windows calculator, or some online tools [BINARY TO DECIMAL CONVERTER] 0000001111101000 1000 XOR 0000010100111001 1337 _________________________ 0000011011010001 1745 This means that “1000” gold is stored as “1745” in memory. If you earn more gold (let’s say you got 1050 gold now), it will be stored in memory like this. 0000010000011010 1050 XOR 0000010100111001 1337 _________________________ 0000000100100011 291 So how we can bypass this sort of encryption? Bypassing XOR encryption with Game Guardian We already saw that: original value XOR key = encrypted value encrypted value XOR key = original value original value XOR encrypted value = key With this principle, we can bypass XOR encryption even if we don’t know that key developers used. So let’s start with practical work. If you aren’t familiar with fuzzy search, it will be useful to first read this tutorial [GAME GUARDIAN FUZZY SEARCH TUTORIAL]. We are going to use examples from previous paragraph. Our first step is to find address where the encrypted value is stored. This step is simple. First, scan for unknown starting value – this is done by selecting Fuzzy search from Game Guardian. As value type, you can choose DWORD (it was DWORD in all games that we cheated). Change the amount of gold in-game, then search for changed value. Repeat this step until only one address has left on the list. Now it is time to check if XOR encryption is used. Let’s say you got 1000 gold in game, but with fuzzy search you found value 1745. Preform XOR operation on this two values. 0000001111101000 1000 //Ingame gold XOR 0000011011010001 1745 //Value that you have found with fuzzy search _________________________ 0000010100111001 1337 //Key? --write it down Now change original value – earn or spend some gold. Let’s say you have 1050 gold now. Look at the address that you found with fuzzy search, and read the value. Again, preform XOR operation with in-game value and in-memory value. 0000010000011010 1050 //In-game value XOR 0000000100100011 291 //Value which is stored in memory _________________________ 0000010100111001 1337 //KEY!! If two keys are the same, XOR encryption is used and you have found the key. If they are not, XOR encryption is not used. Now, let’s change our gold (it was our primary goal, right?). We want 9999 gold. Again, preform XOR operation on it with key that you found (1337 in our case). 0010011100001111 9999 XOR 0000010100111001 1337 ___________________________ 0010001000110110 8758 Change the value that you found with fuzzy search – as new value set 8758. Open game again, and you should have 9999 gold. You can now cheat game using paper and pen, as we promised on the beginning. But it would be smarter if you use XOR calculator built in Game Guardian Second method to bypass XOR encryption Now, you will see the true power of Game Guardian. For this method, it is important to note that in most games, encrypted value and key are stored next to each other in memory – for DWORD type,one value occupies 4 bytes,so the key is usually 4 bytes away from encrypted value. Look at this picture. In Game Guardian, there is builtin method which automatically search for values, and XOR them with value which is X bytes away. That means that we don’t need to do fuzzy search, or calculate XOR values. Game Guardian can do it for us. Let’s get back to our previous example and imagine that encrypted value and key are 4 bytes away. If you have 1000 gold in-game, click on Known search, as type choose Dword (it can be some other types too, but it is usually dword.). As value, put in 1000X4, and click on search. In this example, first number “1000” is amount of currency that we want to change. Second part, “X4“, marks how many bytes away is the key. For dword values it can be X4,X8, X12, X16… Earn or spend some currency – let’s say that you have 900 gold now. Now input 900X4, and click on refine. Repeat previous step until you have only one address left (or few addresses if you want). Click on Edit, and as a value input 9999X4. And that’s it. Game Guardian will automatically search for encrypted values, and XOR them with key which is X bytes away. Pretty impressive feature. With this, our tutorial has finished. There will be reference links bellow, if you want to know more about this subject. Any suggestions are appreciated. Happy cheating. Reference links [Algebraic operation – Wikipedia article] [Binary numbers] [Boolean algebra] [Exclusive OR – XOR, Wikipedia] [NoFear’s tutorial – Xor search guide] [Binary to decimal online calculator]1 point
-
1 point
