How do you search for offsets in a game via GG?

[StaysonL]

The game is on cocos2dcpp, the whole library is encrypted and cannot be done through IDA Pro, is it possible to do something through GG in this case? There are scripts for the game, i.e. offsets exist and they are somehow searched. If something offset that I need is - library.so + offset with for example the value of 100 float.

[JastardNeverdie]

On 3/8/2025 at 4:42 PM, StaysonL said:

Game ini ada di cocos2dcpp, seluruh pustaka dienkripsi dan tidak dapat dilakukan melalui IDA Pro, apakah mungkin melakukan sesuatu melalui GG dalam kasus ini? Ada skrip untuk game tersebut, yaitu offset ada dan entah bagaimana dicari. Jika ada offset yang saya butuhkan adalah - library.so + offset dengan misalnya nilai 100 float.

If the entire library is encrypted, IDA Pro won't be useful unless you can decrypt it first. However, since there's already a script that finds the offset, that means the script is likely reading memory dynamically rather than statically analyzing the .so file.

In Game Guardian (GG), if you have the base address of lib.so, you can use GG to search for values at base_address + offset. Since they mentioned 100.0 float, you can try:

1. Find the base address: Use gg.getRangesList('lib.so') in Lua to get the start address of the library.

2. Calculate the final address: Add the offset to the base address.

3. Search for the value dynamically in GG.

If GG can read memory properly, they should be able to modify values in real time, even if the library itself is encrypted.

Edited March 14 by JastardNeverdie

[snatchwidee]

On 3/8/2025 at 4:42 PM, StaysonL said:

The game is on cocos2dcpp, the whole library is encrypted and cannot be done through IDA Pro, is it possible to do something through GG in this case? There are scripts for the game, i.e. offsets exist and they are somehow searched. If something offset that I need is - library.so + offset with for example the value of 100 float.

Yes, even if the .so library is encrypted on disk, Game Guardian (GG) can access it once it's loaded and decrypted in memory.

Here's the short version of what to do:

Find the base address of liblibrary.so using GG → "Memory Ranges".

Add your offset to that base address:
base + offset = target address

Go to that address in GG and check if the value is 100.0 (float).

Edit the value or script it in Lua using GG's API.

So yes, it’s totally possible to work with such offsets in GG, even if IDA fails.

Need a simple Lua snippet example?