TUT Modding Brave Frontier using IDA pro.

[AnonThanatos]

Quick modding guide for Brave Frontier.

Author: Anon-Thanatos

Required tools:

IDA Pro

Android Tool

HxD

Ok lets start!

 

First decompile/unpack the Brave Frontier APK by using Android Tool.

Once it is done launch up IDA Pro, Then select new and close down the popup window that comes next "if it comes up a window".

Drag and drop libgame.so into the IDA window the libgame.so are located in lib\armeabi folder.

Make sure filetype is set to ELF for ARM and then press OK.

IDA will now disassemble the .so file and depending on your computers speed it will take quite some time for it to complete. Once done you should have 2 forms open Functions and the ASM code window.

 

Lets start with Karma Hack.

In function windows search for function GetKarma and click it to make it show in the ASM window.

Now you should see this,

BL      _ZN16BattleRewardList14getRewardPointEv ; BattleRewardList::getRewardPoint(void)

This is the part we want to change.

select that part with the mouse and then go to hex view there you should see following hex values selected FF F7 9F FF

Those 4 bytes are the ones we are going to edit.

Now open HxD and open libgame.so into it and then search hex value

FF F7 9F FF 00 F0 E9 FB  08 BD 00 00 70 B5 17 4C

You should come to Offset 0x311A38 and see the FF F7 9F FF there.

Now we want to make the original instruction into a MOVS R0, 0xFF00.

To do that we add in the following values FF 20 00 02 "the FF is a value you can change to anything you like. FF is max and will make you always get 65k+ Karma" I dont recomend that high since the karma will pile up really fast and if you have alot of karma on your account it will most likely get banned so go for a fairly low number instead, you will have to test around with it.

 

Next function you need to edit is the getSendKarma (it is located a couple of functions above the getKarma function)

you will see the instruction

BL      _ZN16BattleRewardList14getRewardPointEv

There aswell. Just edit it the same way you edited the getKarma function.

Ok now the Karma hack is completed, next will be Zel hack.

Go to function getZel you see same instruction there as in the karma one. Do same thing as you did in karma hack.

Next go to getSendZel and edit that instruction aswell. Remember dont do to high values because it will be obvious that you are hacking and you will get banned.

 

This method of editing will work on alot other functions and its just to test around and explore the files functions.

(Sometimes you will have to use different instructions like MUL to mutiply or ADD to add a value.)

Here is a good page with Hex code for different ARM opcodes LINK

 

If you got any questions then you can contact me on skype.

skypename: gm-enigma

I will answer when i got time and try help you with your questions as good as i can.

Edited September 1, 2015 by d2dyno
Updated text color for readability.

[Sysadmin]

Nice to have someone who knows IDA! I look forward to your future contributions as well Shared on Twitter: https://twitter.com/GameGuardian/status/450111572602408960

[AnonThanatos]

I will try my best to write up some basic tutorials on how to do more things with IDA that can be usefull. And maybe some tutorials on decompiling and recoding C# libraries.

[Donquixote]

I will try my best to write up some basic tutorials on how to do more things with IDA that can be usefull. And maybe some tutorials on decompiling and recoding C# libraries.

 

are you able to work on the code that generate units by any chance?

there was a thread on AGH few weeks ago, got deleted right away though.

 

i'm assumming through summon changing things in IDA gets you any unit you want

[AnonThanatos]

Its possible to decide what unit gets summoned. The function for summon contains a random generator function with a lookup table where you can bypass the function and then set a static ID instead.

[afarina]

Does android tool work in windows 8?  I keep getting an error when I try to decompile....

[afarina]

Bloody hell how do you add ARM into the processor list

[AnonThanatos]

should be working fine in WIN 8. Dont use spaces in paths to folders. Try use simple locations like C:\apks and C:\decompiled etc etc

Seems like the signing and decompiling parts doesnt like spaces in folder structures. It will be fixed in next version. GUI will be remade aswell

[Musica]

Can you give us tutorial to hack energy? Thanks so much!

[AnonThanatos]

Ill try write some VIP tutorials. I been quite busy lately with studies.

[Musica]

Ill try write some VIP tutorials. I been quite busy lately with studies.

Take your time dude, I'll be patiently waiting

[Enyby]

Another good links:

ODA - The Online Disassembler - http://www.onlinedisassembler.com/odaweb/

ARM instruction evaluator - http://svr-acjf3-armie.cl.cam.ac.uk/main.cgi

Edited August 27, 2015 by Enyby