[Tutorial #2] Making Code Cave

[Eiffel2018]

Last tutorial
https://gbatemp.net/threads/tutorial-1-making-a-multiplier-cheat.603417/

Continue the second part now

Invincible or sometimes called god-mode or HP not decrease is a need for most game.
However it is rather difficult for beginners

Generally, there are two situations where Code cave is needed
1. the function change HP may increase or decrease, we want to hack the decrease only
2. This function affects both enemies and players

the first one is easy to coding,
just a TBZ/TBNZ (test bit zero / not zero) to check the highest bit to decide it is positive or negative
e.g. TBZ W8, 0x1F, .+8 will skip the following line if w8 is not negative

This tutorial show mainly for the 2nd case

---

In this tutorial, I've used the following tools
1. Edizon SE (latest version)
2. nxdumptool
3. il2cppdumper
4. ns2elf
5. keystone 9.2 & keypatch plugin for IDA PRO (upgrade to python 3 is perferred)
For simplify,
I skip the steps for :
- taking out the main and metadat.dat by nxdumptool
- get the main.elf by ns2elf
- getting dump.cs, script.json and il2cpp.h

you can try yourself, if you've got problems, leave a message.

---

Continue the last tutorial, we need to detach from IDA before we can use Edizon SE,


search repeatly until you get the address of HP

There is only one correct value 0x67FA44079C , the other 4 are bugs

Attach to the process with IDA again.
Make a breakpoint with that address


it stopped at here


Let's try to remarks this line, use NOP


deleted the last breakpoint and F9 run the game
- The player loses the entity, the body can pass through the enemy,
- But player can’t hit the enemy, and the treasure chest can’t be opened.

It seems that statement affect many game object.
Let's press F2 make a breakpoint on that statement, and make some test in the game

When the player was hit, it stop at 1A267B0


press F2 to delete this breakpoint first, and then move the cursor on the lines following and then press F4 to let the PC register goes.
move the cursor back to 1A267B0 and press F2 again to reactive the breakpoint, and then F9 to continue the game
(this is the whole steps for making breakpoint on code, without error, If you get alert repeatedly, you need to detach and attach again)

Try to play more, when you hit the enemy, it will stop.
when you open the chest, it will also stop.

From now, we need to study the difference between the above cases,
I capture the registers in such 3 cases

(No finding with comparing these registers)

and then I open the elf with unity il2cpp script in another IDA new instance. press G and type the code address 1A267B0 to goto the corresponding position


you can find something at the bottom status, the line 1A270B8 locates at a function called Marsu.Health$$Damage with an offset 0x310
now, press G and type the offset with a minus sign -310, to locate the view at function head.


there are several parameter pass in this function
the first one Marsu_Health_o *this is always the class which hold this function, that is X0 in most cases.
the second one int32_t damage is the first parameter pass in, it is W1 in this case (if the parameter is a floating number, it use S1 or D1 instead, for Single or Double respectively)
the third one is W2 or X2, etc

Note: this function names or variables does appear only after using il2cpp script in Unity Game.
So, we said unity game is easier to hack

Now we need to study this class in detail, in order to get the characteristics to distinguish it is player or emenies

Copy the starting address of this function 1A264A0.
Open the file dump.cs with a text editor and search it

there would be only 1 result and it is the whole class structure.
Scroll up to the class head

all properties had been show.

Take a look on the name of each variable and child function
Sometimes there is variable or function implies whether the current object is belong to player or enemy
Then we can use directly.
In this case, it does not! So, I need to study the values with the memory.

Before, I've capture the registers of 3 cases that active breakpoint,
the X0 address can be uses now


On the main IDA View - PC, type G and Alias:67FA440780 to go there, and then press N and give a name for that.



Now, compare the offset and change the type such that they match what show in the Dump.cs,
(press Q for type of address, press D for type of bool / int32 etc. if it is float, you need to right click and find it out )

As shown here

then highlight the whole memory of this class, right click, create struct


You can also type each variable name in the structure with pressing N


Now you can apply this structure on the other address (they are the X0 from the capture before)


All the three memory were well patterned






You need to find out which variable you can use for disgusting
I like to compare them horizontally

The orange one may be used as a characteristic,
I believe _autoRespawn (0xF0) is a good choice

---

To make a code cave, we use Ctrl S to find a large gap between segments (it only show in the main.elf file, GDBstub does not provide such detail information)

We can only use the segment with "X" and there is always a large gap on the last segment with "X"

However, this game is an exception (I handled over 100 games, non of them like this one, there are only 8 bytes between .text and .rodata
8 bytes = 2 statements, it is no use!

So, I need to find out some dummy code and replace them.

I remember every game had such a stupid function, I believe it is no use in all case.

so, I replace the first two line with MOV W0, #1 and then RET .
then I can write a function of 6 lines at most.

---

Come back to the code cave injection point, watch above and check what is X19,
MOV X19, X0 defined in the head, i.e. X19 is equal to X0

So, if [X19, 0xF0] is zero, then it is player, otherwise it should be enemy or chest

(However it may be wrong, e.g. the boss may also get zero, let's test and fix it if necessary afterward.)

Also, we need to check which register can be used in the code cave,
At least X0, X1 can be used (X22 may also be used)

The code cave function should be a short one,

First load the content [x19, 0xF0] into x0


Then check if X0 is zero, if so, skip the next command.
One command 4 bytes, that is jumping to current address +8, we can use "dot" stands for current address

Now, copy the original command of injection

The last one, Return.

My code cave has 4 statements, start at 0x1A27F28,
move the cursor to there, and then press P, make it becomes a function
Then press N to rename it as a meaning name


Then, press ESC to go back to the place where breakpoint issued.

Rewrite it as BL yourFunctionName


It is finished.


copy the code at HEX view (change to 1 column and press 8)

add a space in the middle of each 16-digit number,
remove the double space in the middle
finally change the starting 00000000 to be 08000000

08000000 01A27F20 D65F03C0 52800020
08000000 01A27F28 B4000040 F9407A60
08000000 01A27F30 D65F03C0 B9001E68

Similarly, make the last code

04000000 01A267B0 940005DE

Codes and spoilers in this group are for members. Join the Nintendo SWITCH Cheat Codes Download group to reveal them. It's free.

Register Log in

That's all.

 

[patjenova]

To make a cleaner code cave you could also try and find empty lines in the main file. Search bits like 00 00 00. They are not used and you can use them without altering other codes. I like to search for 3 empty space like this 00 00 00 00 00 00 00 00 00 00 00 00. If your code is longer than 3 32bit lines u can branch to another empty place. Just use the last 00 00 00 00 and make a code like b #0x and calculate were to jump to.

 

[patjenova]

Also unity likes to use functions like get_player or is_entity use define the objects.

 

[team-knight-rider]

Hi,
thanks in advance

 

[absso]

how do you get theses files?
taking out the main and metadat.dat by nxdumptool
- get the main.elf by ns2elf
- getting dump.cs, script.json and il2cpp.h

 

[Luffysan]

Thanks for the Tutorial but how can i change this instructions in IDA
MOV X8, #0x3F50624DD2F1A9FC
thanks in advance

 

[R1N08GAM1]

Thanks to your tutorial, I was able to understand Code Cave. It was very valuable for someone like me who lacks knowledge. Thank you always.

 

[Eiffel2018]

Thanks for the Tutorial but how can i change this instructions in IDA
MOV X8, #0x3F50624DD2F1A9FC
thanks in advance

for large number, we use MOVK

For example, MOV W8, #0x12345678
we need to separate it into 2 instructions, as follows
MOV W8, #0x5678
MOVK W8, #0x12340000 (or you can write in this way MOVK W8, #0x1234, LSL #16)

Similarly, MOV X8, #0x3F50624DD2F1A9FC can be express as
MOV X8, #0xA9FC
MOVK X8, #0xD2F1 , LSL#16
MOVK X8, #0x624D, LSL#32
MOVK X8, #0x3F50, LSL#48


But normally, we can just use LDR X8, .+addr instead.
i.e. something like these

LDR X8, .+8
RET
0x3F50624DD2F1A9FC

 

[Luffysan]

for large number, we use MOVK

For example, MOV W8, #0x12345678
we need to separate it into 2 instructions, as follows
MOV W8, #0x5678
MOVK W8, #0x12340000 (or you can write in this way MOVK W8, #0x1234, LSL #16)

Similarly, MOV X8, #0x3F50624DD2F1A9FC can be express as
MOV X8, #0xA9FC
MOVK X8, #0xD2F1 , LSL#16
MOVK X8, #0x624D, LSL#32
MOVK X8, #0x3F50, LSL#48


But normally, we can just use LDR X8, .+addr instead.
i.e. something like these

LDR X8, .+8
RET
0x3F50624DD2F1A9FC

Thanks a lot sir I understand