Jump to content

Enyby

Administrators
  • Posts

    8,811
  • Joined

  • Last visited

  • Days Won

    1,061

Everything posted by Enyby

  1. Enyby

    GameGuardian

    It is empty. Nothing check. You collect it in wrong way. Follow instructions by my link above. Try different tools for collect logcat if some of them not work or produce empty or small log.
  2. Enyby

    GameGuardian

    Wrong log. Need logcat. https://gameguardian.net/forum/topic/7419-how-to-collect-logcat/
  3. Enyby

    GameGuardian

    Yes. .xml in shared_prefs. But we change it in future. And add some magic for bypass ASLR in some cases. May be in next release.
  4. Enyby

    GameGuardian

    Transfer data in /data/data/gg-package-name/ folder. But it is useless. Addresses usually changed even between runs.
  5. I only show way. Reason can by any and depends from user. Knife can be used for make food or stabbed people. Knife is only tool. GG is same.
  6. How to copy memory
  7. I want copy 4 dword in memory started from 00009000h to 00009100h. It is mean offset +100. I add my 4 dword to saved list, frezze them and move with offset +100. It is copy memory because values freezed. You can subscribe to our new videos. Watch on YouTube: How to copy memory - GameGuardian
  8. Google Play
  9. You can subscribe to our new videos.
  10. 1. Find value in memory with encrypted search. 2. Use value from game as key and remember result. 3. Do it again with another value. If result still same as previous then this is your XOR key. If not - then it is not XOR encryption. You can subscribe to our new videos.
  11. Enyby

    GameGuardian

    It is not missed bytes. .so load to memory specially. And it can have relocations. Shortly speaking - you can not get .so file from memory dump because not all info from file stored in memory. It is enough for debug or investigate but bot enough for build valid ELF file.
  12. Enyby

    GameGuardian

    No. It is just temp file in shared memory. It is normal and not connected with defend. And you can not get normal .so file because in memory .so files stored in special way. It is not same file as on disk. .so file (any ELF file if be exact) loaded partially, linked and so on. It is mean if you dump .so from memory it is not valid executable ELF file.
  13. You can subscribe to our new videos. Watch on YouTube: How to dump deleted file from memory on Android - GameGuardian
  14. Enyby

    GameGuardian

    I not understand what you mean.
  15. You can subscribe to our new videos. Watch on YouTube: How to dump odex file from memory on Android - GameGuardian
  16. 1. Find value in memory with encrypted search. 2. Use value from game as key and remember result. 3. Do it again with another value. If result still same as previous then this is your XOR key. If not - then it is not XOR encryption. You can subscribe to our new videos. Watch on YouTube: How to find XOR key - GameGuardian
  17. Some apps use encryption for load dex or so file. They decrypt it before load and remove after that. Dump can be useful for this. It is only possibility. Each one can use for own targets. It is not for all of course. Another usage - investigate memory usage for store different data. For regular file you can use any tool rather from undumped memory of process. And so on.
  18. Usually height of jump is 5.8. I changed it to 50. You can subscribe to our new videos.
  19. Enyby

    GameGuardian

    I understand nothing.
  20. Enyby

    GameGuardian

    It is raw file. You can use hex editor or some special tools for this.
  21. You can subscribe to our new videos. Watch on YouTube: How to dump memory of any running processes in Android - GameGuardian
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.