[Android Q&A, Help & Troubleshooting] bugs1337:
Okay so I am trying to see how secure this game I am playing really is, partially to learn android game hacking/reversing and partially because the game has gotten to a point where it has become pay2win so gives me the perfect excuse to start digging into this stuff.

For context, it is an android unity game. I have managed to extract from the apk the Assembly-CSharp.mdl (yea not dll) file in this case which was weird since I assume it should be DLL right? but no it wasn't and comparing with another legit Assembly-CSharp.dll file I see they did some quick and dirty obfuscation in the header part to bork it so you cannot load it into something like ilspy or dnspy (thats my assumption who knows if there is some other legit reason) but very easily bypassed by inspecting in hex editor and just copying those bytes from the legit one into this one and renaming to .dll.

Now from here I loaded into ilspy and saved the entire C# code to a directory to begin inspecting, also used asset ripper to get all resources I could from here by following the same technique on other .mdl files as described above. I should be able to win win now? so I thought, but inspecting through the code I couldn't see anything interesting to get myself more resources in the game by patching the code in there which made me wonder everything is somehow going over in the server side.

I thought of looking to see if there is any interesting DLL which is handling google play in app purchases that I can patch to buy things for free, but I couldn't really see anything interesting like that. However, I do see a lot of Lua/xLua stuff going on which makes me wonder if things are being dynamically pushed on run time somehow (I am still a beginner at android game hacking). So here is the problem now, I want to "hook" into these functions which is not really possible, I can do things with frida to display any file write events that happen during the game but that leads me to nowhere, I wanna be able to see the data like strings that get created in memory from various functions in the code. Is there a possible way to achieve this? One solution I thought was to patch the code to print out all these string values and write them into a file and then somehow sign and install this modded apk but now the problem is there is SOOO much of these things in there I will lose my mind going there patching everywhere to write everything to file, there has to be a way to somehow achieve this much more easily in C#.

I also bypassed cert pinning with a frida script and proxied the traffic through a web proxy like burp to see what http traffic I could see but apparently nothing comes through, digging more into the code I realised its talking over different TCP ports with the server. I thought of printing out the TCP traffic while in game using a frida script to see if I can see anything interesting but it seems to be encrypted, I can see there is AES class lying around with hardcoded decryption keys as well so not too far fetched to try and code up a custom TCP proxy to be able to inspect the traffic between the server and the game to see if it leads to somewhere (Still only an idea).

Would appreciate any ideas on how I can tackle this. I guess I just brain dumped what I was thinking in here so anyone with experience might be able to guide me a little.

Report