Jump to content
  • 0

How to use the offsets found in libil2cpp.so to modify values


Adminsfan

Question

I saw some scripts with this 

gg["toast"]("")
      io.open(gg["EXT_CACHE_DIR"] .. "/ᴡɪɴᴛᴀᴘ.cfg", "w+"):write("
\n10587
\nVar #B49E0F04|b49e0f04|10|e3a00000|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af04
\nVar #B49E0F08|b49e0f08|10|e12fff1e|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af08
\nVar #B49E0F78|b49e0f78|10|e3a00000|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af78
\nVar #B49E0F7C|b49e0f7c|10|e12fff1e|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af7c
\n"):close()
      gg["loadList"](gg["EXT_CACHE_DIR"] .. "/ᴡɪɴᴛᴀᴘ.cfg", gg["LOAD_VALUES"])
      gg["clearList"]()
      io.open(gg["EXT_CACHE_DIR"] .. "/ᴡɪɴᴛᴀᴘ.cfg", "w+"):write(""):close()
    else
      ButBlockMove = OffBlockMove
      gg["toast"]("")
      io.open(gg["EXT_CACHE_DIR"] .. "/ᴡɪɴᴛᴀᴘ.cfg", "w+"):write("
\n22319
\nVar #B525FF04|b525ff04|10|e92d4c70|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af04
\nVar #B525FF08|b525ff08|10|e28db010|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af08
\nVar #B525FF78|b525ff78|10|e92d4c70|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af78
\nVar #B525FF7C|b525ff7c|10|e28db010|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af7c
\n"):close()
      gg["loadList"](gg["EXT_CACHE_DIR"] .. "/ᴡɪɴᴛᴀᴘ.cfg", gg["LOAD_VALUES"])
      gg["clearList"]()
      io.open(gg["EXT_CACHE_DIR"] .. "/ᴡɪɴᴛᴀᴘ.cfg", "w+"):write(""):close()
    end
  end

I want to know what are these " \nVar #B525FF78|b525ff78|10|e92d4c70|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af78" zeros and how do they find the variable is there any one familiar with this please help me out by answering this would be helpful for me

Link to comment
Share on other sites

7 answers to this question

Recommended Posts

On 8/29/2021 at 2:48 AM, Adminsfan said:

0|0|r-xp

These are declaring the read and execution permissions of the file sort of like python

On 8/29/2021 at 2:50 AM, Adminsfan said:

That kinda helped but do you know any tutorial on these methods? Thanks for replying

These can be made with saved lists and and saved variables see these for more information

https://gameguardian.net/help/classgg.html#a18bdecc384ccee353a2fc2eab24b0c5b

https://gameguardian.net/help/classgg.html#a204f5dea60cac80c39521ceb4936a83b

I'd definitely recommend being familiarized with the basics of reversing apk files to know what's being saved and loaded here, it doesn't take much to save and load them yourself but to do so effectively  may take a little of time and trial and error however after that you'll more than likely have no problem with identifying the individual parameters

Link to comment
Share on other sites

On 8/25/2021 at 12:35 AM, Adminsfan said:

want to know what are these " \nVar #B525FF78|b525ff78|10|e92d4c70|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af78"

Values like this occur if you save the values stored in a list(in gg) containing the last used address, offset(if its not a field method) in which region its stored or in what library its stored and if its r, rw and so on

Link to comment
Share on other sites

On 8/30/2021 at 11:56 PM, AKidWithMidgetFriend said:

These are declaring the read and execution permissions of the file sort of like python

These can be made with saved lists and and saved variables see these for more information

https://gameguardian.net/help/classgg.html#a18bdecc384ccee353a2fc2eab24b0c5b

https://gameguardian.net/help/classgg.html#a204f5dea60cac80c39521ceb4936a83b

I'd definitely recommend being familiarized with the basics of reversing apk files to know what's being saved and loaded here, it doesn't take much to save and load them yourself but to do so effectively  may take a little of time and trial and error however after that you'll more than likely have no problem with identifying the individual parameters

Well yes but how to get these Statements I got know that it's done by searching then they do something and save it in . TXT file when you open it there's this kinda line #B525FF7C|b525ff7c|10|e28db010|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af7c

But that person isn't showing how to do it 😞 I'm just asking for that

Link to comment
Share on other sites

58 minutes ago, Adminsfan said:

Well yes but how to get these Statements I got know that it's done by searching then they do something and save it in . TXT file when you open it there's this kinda line #B525FF7C|b525ff7c|10|e28db010|0|0|0|0|r-xp|/data/app/com.axlebolt.standoff2-xmGGkolMmLHZzZIA3ijuwQ==/lib/arm/libil2cpp.so|f5af7c

But that person isn't showing how to do it 😞 I'm just asking for that

Those two links do show you how to do it. You have to make an empty txt file in a directory that you'll later be able to access through gg (such as the directory you're executing the script from) then copy it's path and when gg.saveList() or saveVariable() is called with the path defined to that empty.txt file "those kinda lines" that you were referring to will be returned automatically in the file based on either what's saved in the save tab or based on the variable passed into the saveVariable parameters

The chunk given in your first post was using gameguardians External cache directory's path to save and load the variables and those variables appear to belong to values in the libil2cpp.so and are most likely are static values that accessed at the same address (with exception to the arm version ofcourse)

 

I understood what you were asking for and the information given in my prior reply was enough to derive the important information in this reply with trial and error. 

Link to comment
Share on other sites

On 8/25/2021 at 6:46 PM, nio04 said:

Probably...like this

 

first, they dec libil2cpp & find target offset & goto the 'offset' from gg & get the address 

 

& Its look like they used 'address' method to hack

Do you know any tutorial for the "address" method 

Yes I understood the offset but what are 0|0|r-xp as of I know from programming language | this OR or add so why are they adding those

Link to comment
Share on other sites

On 8/26/2021 at 1:21 PM, YeetMeister said:

Values like this occur if you save the values stored in a list(in gg) containing the last used address, offset(if its not a field method) in which region its stored or in what library its stored and if its r, rw and so on

That kinda helped but do you know any tutorial on these methods? Thanks for replying 😃

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.