HotelStory not complying

[CmP]

You missed one important detail: 

On 8/16/2021 at 6:14 AM, CmP said:

In my case 32-bit android emulator for Windows was used causing game libraries for x86 to be used. Correspondingly, all library-specific values like offsets that will be shown or mentioned in this post are only applicable to game's library for x86.

The offset from library start to instructions of the function and new values for them that were mentioned are only applicable for library of the game for x86. On your device library for arm64-v8a is expected to be used, so the offset to the function and which instructions to modify in it need to be located exactly in this variant of library.

[CmP]

Regarding the needed details about "IsMatchHash" function in the variant of the library for arm64-v8a.

The function is located at offset 0x18E078 from the start of the library. Here is the result of decompilation of function's code: 

The assignment on line 23 can be modified to achieve desired result (for function to always return 1). The assignment is performed by this instruction at offset 0x18E0EC from library start ("this" is a label for x0/w0 register): 

Modification of this instruction to MOV W0, #1 (hex bytes: 20 00 80 52) will cause the function to return 1 even when computed hash doesn't match stored hash. This modification of function's behavior is sufficient for bypassing in-memory data integrity check.

[GeraldLim]

12 hours ago, CmP said:

Regarding the needed details about "IsMatchHash" function in the variant of the library for arm64-v8a.

The function is located at offset 0x18E078 from the start of the library. Here is the result of decompilation of function's code: 

The assignment on line 23 can be modified to achieve desired result (for function to always return 1). The assignment is performed by this instruction at offset 0x18E0EC from library start ("this" is a label for x0/w0 register): 

Modification of this instruction to MOV W0, #1 (hex bytes: 20 00 80 52) will cause the function to return 1 even when computed hash doesn't match stored hash. This modification of function's behavior is sufficient for bypassing in-memory data integrity check.

I was finally able to crack it! Thanks so much! 

This was quite an experience for me, I actually only know the basics of assembly thanks to the cheat engine tutorial, but actually modifying code in hex on a mobile device is a first. And also, this is my first time working with encoded values. 

Could you maybe help give me some pointers on how you found the values? (The OP instructions and the XOR keys)

I'd love to learn and be able to do this on my own someday