[IDA tutorial] How to mod x86 lib .so file
Hello dear community,
Today, i will teach you how to mod
x86 libs. x86 is not that hard to understand because the instruction are almost
the same as ARM. In this tutorial, i mod the game called The Sandbox 2.
You don't really need to mod x86 at
all since I never heard any problem with ARM translating to x86, and it's too
hard to change instruction without code caving. Just wanna make tutorial lol
Now let's start modding.
In this tutorial, I'll show you how
to mod The Sandbox Evolution very easy in x86.
First of all, you need IDA PRO and Hex Workshop installed on your computer. If you
already have them installed, go to next step
Open the APK file with WinRar and extract
the lib folder (In case you want to mod both x86 and ARM)
Open the x86 .so file in IDA. You
will see the dialog box similar to the following:
![[IMG]](https://i.imgur.com/ktDNoNu.png)
In x86, you
don't need to change anything. MetaPC is fine. Click OK to disassemble the lib
file, and let it fully load. After that, press CTRL + F, search "isElementUnlocked" and
double click on the function to open it

Remember
the offset (9869E0) of first instruction. we need to use it later.
Note: The
offset will change each update.
![[IMG]](https://i.imgur.com/Mf1y3sf.png)
Open Hex
Workshop or other hex editing program, and search the offset. I'm using Hex
Workshop
![[IMG]](https://i.imgur.com/wC2186M.png)
![[IMG]](https://i.imgur.com/89a0Dqm.png)
Here is the
offset of isElementUnlocked
![[IMG]](https://i.imgur.com/U9UTx2C.png)
The function isElementUnlocked is a
boolean function, which means it can return true or false. If you want unlock everything, replace it with b8 01 00 00 00 c3, which will return true.
True is:
b8 01 00 00 00
(mov eax, 1)
false is:
b8 00 00 00 00
(mov eax, 0)
And return is:
c3 (retn)
![[IMG]](https://i.imgur.com/y91Vjh6.png)
When you
open the modded .so file in IDA, your modded instruction will look like:
![[IMG]](https://i.imgur.com/iL4oLV5.png)
Isn't that easy?
If you want to hack mana like
9999999, search getManaBalance and giveMana, and replace it with any values you
want
b8 7f 96 98 00 (mov eax, 9999999)
c3 (ret)
Open the
APK with WinRAR and replace the modded .so file. Re-sign the APK, install it
and run the game.

Credits:
AndnixSH#
Tutorial updated (May
2018)
Comments
Post a Comment