Jump to content

XEKEX

Contributor
 View Profile  See their activity

  • Posts

    255

  • Joined

  • Last visited

  • Days Won

    13

 Content Type 

File Comments posted by XEKEX

    Posted · Edited by XEKEX

    Last thing I forget to mention , 
    the company of grim soul changed and the dev are patching it's inner function and method etc , 
    the game became more depending on LIBC -- and this open the usage of FRIDA , and hacking became more easy ( frida will reclone libil2cpp and perform trampoline hook on every class , method etc ) editing libil2cpp dynamiclay real-time and require no knowladge of assembly language , all you need is basic level of node js code or python ,

    here is a tamplete I wrote for hooking il2cpp with FRIDA that work on grim soul : 

      

    var lib = Module.findBaseAddress('libil2cpp.so');
function awaitForCondition(callback) {
    var i = setInterval(function () { 
      var addr = Module.findBaseAddress('libil2cpp.so');
        if (addr) {
            clearInterval(i);
            callback(+addr);
        }
    }, 0);
  }

  
  Java.perform(function () { // this will get the base adderess of il2cpp
      awaitForCondition(function (base) {
          lib = ptr(base);
          if (lib != null) {  
            console.log('lib = ',lib) // this will print the start address of il2cpp in memory
            
          
  }})
  })
// copy and paste the code below for multiple method hooks or create a function that does this
  Interceptor.attach(lib.add(0x1C665E0),{ // change the 0x1C665E0 to the offset of method and the function is hooked ( RVA or Offset in dump.cs)
    onEnter: function(args){ // time = 0 when the method is called
     // console.log('args : '+args[0]) arg[0] = R0 (they are the registers in CPU I guess)
    },
    onLeave: function(retval){ // return value of the function
     // console.log('retval : '+retval)
      retval.replace(ptr(0x0)) // this will replace the return value to the one you want
    },
    })

    --> FRIDA
    --> Tuto on how to use FRIDA on il2cpp games
    you can call any function in the il2cpp with it with the parameter you want.

    2

    Posted · Edited by XEKEX

    50 minutes ago, Alessa- said:

    Thanks dor that, but how you doit hook function enum like item hack 

    Can you explain ?

    • its a field pointer sweap
    • in grim soul they use pointers in the field values , 
    • "somthing"ScriptNode classes and entity are the main classes for almost every object in the game,
    • game functionality is based on tables similar to lua ,
    • every item , event , actions etc are just strings , similar to Decision Trees Games ( in 3d ) 
    • stringlinear.json file will be helpful in creating a powerful script for grim soul
    •( many traps set for hackers such as poker , sanct.. , friend chest keys etc)
    •you can use pointer sweap in many cases , il2cpp patching is powerful ( you can search for ENUM and lookup what methods / fields use these ENUM and patch them )
    •you can patch echeckwall method etc using ENUM values to build upon anything including outside your home 
    •pet rarity , gender , color is used by somthing ScriptNode you can patch it using ENUM
    • Error handdler in the game is based on ENUM also, 1 , 2 , 3 , 4 etc same for Echeck wall foundation etc the response should be OK enum , 
    • you can exploit error handling to unban or manipulates requestes server-side ( I guess ) 
    • igrim class will hold all the server-side data and encrypted data 
    • hooking ENUM for il2cpp patch u need to use stringlinear.json file to get the offset of string in CB region 
    • patch : use LDR to load the string pointer into a register then BLX to call a function that use string as parameter * use with caution *  ( Not recomanded in grim soul since its heavy depending on strings, most of the time it crash for me )
    • gg alloc memory will crush the game ( idk why )
     

    2

    Posted

    1 hour ago, Papoycore said:

    Sir, I have a question.. is there any chance my acc will get banned if I activate the FlowVipController? 

    I followed the badcase tutorial and changed the dump.cs file to lua using your tool and I was surprised that we were able to hack almost anything.

    Im just curious 😋

    Not sure but some functions might give ban for example Poker, Sanctuary, Invite boxes
    try on unlinked acc if it get ban then delete data and start again

    1

    Posted

    2 hours ago, Papoycore said:

    Thank for the script ❤️

    But idk sometimes the cheat doesnt work and so on, there must always be one of the cheats that doesnt work. i use emulator btw.

    I recommand using rooted device , sorry for the inconvenience but i'm just using 32bit rooted device and I can't test the script on other devices

    1

    Dump.CS to Lua Table

    in Tools

       983    3

    Posted

    3 minutes ago, Kosovari2019 said:

    Hello Xekex, this script of yours is making only a part of the dump, not the whole dump

    Yes it filter the dump and give you the parts of the dump that can be hackable please read the description of the script.
    you can also access the script and modify it it's not encrypted.

    0

    Posted

    9 hours ago, WTFUUN said:

    Really great script .Thanks for the share.

    Here are the new items of the last update in case you want to add them with the other:

    PotionEnergy BlackShuko

    PiligrimHat PiligrimShirt PiligrimPants PiligrimBoots PiligrimGloves

    ResearchForSoldierHat ResearchForSoldierShirt ResearchForSoldierGloves ResearchForSoldierPants ResearchForSoldierBoots SoldierHat SoldierShirt SoldierPants SoldierBoots SoldierGloves

    ChestCultist ChestHarid ChestPlague

    Thank you for your comment I'll include them asap ❤️ 

    2

    Posted

    4 hours ago, xMrRovers said:

    Can you send also the32 bit apk thanks

    if u attach gg to grim soul and it write next to its name x64 then the script wont work to solve it downlaod the game from any websites that provide apk then open the apk as zip and search for armv8 folder and delete it if u didnt find it then the apk is 32 bit (armv8 for 64bit and armv7 for 32bit)

    0

    Jad3d arm64 .so injector

    in Tools

       1,322    4

    Posted

    in_module_name not declared
    line 84 : miss write String
    I'm not 64x user so i can't test it but good work 
    if possible 32 bit I'd like to inject frida in and make conversation between the script and the lib injected

    1
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept