Edited values revert back to original | Portable Dungeon II

[PAF13]

Hello,

I have been using GG on some easy, small apps for about two weeks now just to learn how it works. A few days ago I tried editing my gold in PD (Portable Dungeon II). First I used the exact search and the encrypted exact search to find the gold. After doing that I end up with these values;

Due to problems that I will talk about later I switched to fuzzy search and found these values;

With fuzzy search, I could only narrow the results down to 488 so I looked through all the numbers until I found values that seemed to be of use.

 

Now my problem is that every time I try to edit my coins and go back to the game I see the number has changed to what I want but ends up going back to what I had before. I noticed that the searched always come up with multiple value types with the same number and an XOR value. With that in mind, I tried editing all the values (W,B,D and Q) at the same time thinking that having all of them change would possibly take out the possibility of the app checking back up values to reset itself.

 

With all this being said I have a few questions:

1) How is it possible for values to have the same address?

2) Are there some techniques that developers use to make sure values stay unmodified?

3) What is the use of XOR values? I have already read a lot about XOR encryption/decryption and understand it but when I find XOR values in searches I am never sure how or if I can use them to assist me in cracking a game.

 

Any information to point me in the right direction would be awesome.

Thanks

 

Edited November 24, 2017 by PAF13
There was a picture at the end that was not supposed to be there.

[Enyby]

2 minutes ago, PAF13 said:

How is it possible for values to have the same address?

The address points to the bytes in the memory. They can be understood in different ways. GG shows you different interpretations for the same address.

2 minutes ago, PAF13 said:

Are there some techniques that developers use to make sure values stay unmodified?

Yes, there are different ways to detect unauthorized changes.

2 minutes ago, PAF13 said:

What is the use of XOR values?

Differently. If protection is based on XOR with an address, then this can be useful.

[PAF13]

Thank you Enyby for the answers. 

So I have been working more on the game and looked into why there might be multiple results for my gold and everything else. It seems like one value controls the displayed value and the other is the background value if that makes sense. 

I went to the address of both values to see how the numbers are represented and see if there are bytes around it that might affect them. When I went into settings to changed the number view to hex I found something weird. One of the hex values showed 0000003Eh which would make sense because I have 62 gold in the game but when looking at the other hex value it showed 000000320000003Eh which to me makes no sense to me. Does someone know what the first 8 bites could mean? could it be some reference to something else like a pointer or some kind of mathematical number correction thing?

also other values such as skill points have the same system but the first 8 bites are different from each other.

[Enyby]

You try watch value as qword? If yes - disable it for see as 4 byte in hex.

[PAF13]

I am not sure how to change that. 

this is what I have.

First I used group search and used the values of my gold and skill points. the results are only 4 dword values in the second picture. The in the address area this is what I have now.

@Enyby

[Enyby]

In memory editor disable show double because it is 8 byte wide data.

 

[PAF13]

I disabled it but the other values have stayed the same. I will keep looking into how to make this work.

[Enyby]

All must look like this - no 8 byte hex.

 

[PAF13]

OK I just noticed that the first 8 bites are gone now so thanks. Now I need to found the main address that the gold is compared to.

[PAF13]

So I think I am close to finding the solution but I am currently stuck.

 

I used a fuzzy search instead of group search this time and found more values that seem to be connected to my gold.

Here are the screenshots.

Besides the first two values in the first picture, I found some values I really do not understand.

Firstly, the values that are highlighted have a second value that is always 8 bytes away (ex. second picture - 7E0FC164 and 7E0FC16C). That being said I feel that could be the XOR key but when I use the calculator it does not change to anything that seems useful.

Secondly, the value (address: 7DB36FF4) in the first picture does not have a value that is 8 bytes away so I am not sure what it does. Maybe the app checks this number to see if a value has been modified.

So now I played around in the game to change how much gold I had and would keep track of 4 of the values to see if something interesting would happen. I made a spreadsheet of what I found.

 

 

Sorry that the picture is so small but the values(The numbers that are highlighted) have a cycle of 10 numbers that they go through.

There is more info that I found but it is too much information to type at once. That aside could someone kindly give me some hints or tips that I could try because right now I am not really sure how these numbers interact with each other. 

Thanks