Lesson 1.3:More about IDA Hacking #2

Requirements:
- IDA Pro (Download Here)
- Hex Editor
- Arm Converter
 Requirements:

1.  .Net Framework 4
2.  WinRar 5 (to open archive)

Download HERE


How to use

- The cracked binary of that game (Using Infection for example )

Instructions:
1. Open IDA and Copy the binary inside IDA
2. See the settings here:

3. After that the IDA will start loading and wait until it finishes loading fully
4. Now after everything is loaded, you can search for anything you like [Press Alt+T to search]
5. Since the game I am hacking is Infection, the main thing in there is DNA
6. So I will search for DNA
7. Now it's time to find the right function, I have found this function called DNA - SPEND
8. Which means this function represents when you Spend your DNA what happens
9. Now this is the function:

10. As the function says spend it means it subtracts :)
11. So the only subtraction function is SUBS r0, r2, r0
12. Highlight that function and go to Hex View-A (At the top category)
13. This is how it looks like in Hex View-A:

14. Now go back to IDA View and copy the function (SUBS R0, R2, R0)
15. Open up ARMConverter and paste the function there
16. Click submit and it show Thumb Output there which is 101A
17. Go to Hex View-A again and check if it's same as the one which showed in ARMConverter
18. Now it's time to hack the function
19. Open up Hex Editor and copy the binary inside
20. Now it's time to locate the place of the function in Hex Editor
21. You can find the hex location from here:

22. Now go to Hex Editor and go to Search > Go to...

23. Now write the location you have found in IDA:

24. Now it will take you to the right location that you have found in IDA
25. Now it's time to hack that function

There are several ways to hack it (The Ones I have learnt till now):

1. SUBS R0, R2, R0   =>  ADD R0, R2, R0 [In HEX: 1018] (It will give you the money it took instead of substracting)
2. SUBS R0, R2, R0   =>  MOVS  R0, R7 [In Hex: 38 1C]  (Will give you millions instead of substracting)
3. SUBS R0, R2, R0   =>  NOP    [In Hex: C0 46]                (it will be FREE)

26. Now change the function SUBS to any of them you like!
27. When you have changed it will be red (The place you have changed)
28. Now you can save it and go test your hack
29. Enjoy!

Meanings Of Most Popular Codes In Assembling(You should know)

Operations are:
• ADD operand1 + operand2
• SUB operand1 - operand2
• CMP operand1 - operand2, but result not written
• CMP compare operand1 and operand2
• CMN operand1 + operand2, but result not written
• MOV moves operand1 to operand2
• STR store operand1 in operand2
• LDR load operand2 in operand1
• NOP no operation
• BX LR end the function

This is the normal meaning here are some examples:
- ADD r0,r1,r2 ; r0 = r1 + r2
- SUB r0,r6,r5 ; r0 = r6 - r5
- CMP r0,r1 ; get the greater of r1,r0 in r0
- STR r0, [r1,#-200] store r0 at r1-200

You can watch video about IDA hacking with other game

And Here. Before you watch. You should watch this TUT to know about LLDB/GDB

Next Lesson