Help with Modding Lua

[johnhern]

I was wondering if anyone has an easy (or not super difficult) way to mod games with lua files.

Also, I am trying to figure out a good way to get into modding .so being that I am not experienced there at all.

Finally, a third thought, since I am here, how the heck do many people mod the "IAP" in games?

 

[Sbenny]

LUA games (and you recognize them because there's an "assets" folder full of .lua files have usually encrypted .lua files so you cannot look inside them, but in some cases, they're not encrypted. If this is the case, a simple Notepad++ file will suffice, while if they're encrypted, you can try hacking the file which uses these .lua files which is located into the lib folder. You can recognize it because it's usually the biggest file in there. If this is the case, you'll need to have some basic or advanced knowledge with the usage of IDA Pro. Basic in the case they didn't encrypt the .so file so it should be relatively easier to find the values you're looking for by simple search, and Advanced in case they encrypted it.

About your third though, IAP (In-App Purchases) can be hacked in several ways. The problem is that it's not always (well, almost never) possible to hack them, because it's the main source of income for developers and they try their best to make sure they can't be cracked in any way.

A simple way of hacking In-App Purchases is modifying the google play store IAP mechanism stored into the smali files (obtained after backsmaling/decompiling the apk, using your favourite apktool).
Another way of hacking In-App Purchases is using Net Reflector (if the game is built with Unity) and looking for In-App Purchases-related values, usually some VOID functions you'll need to modify in order to make a purchase successful even if it wasn't.
If the game isn't built with Unity you should try with IDA, or even Notepad++ (for text-based games for example, modifying some javascript files), or even Lucky Patcher . The counter-side of using LP is that users are forced to have it installed on their devices and, most games detect it. Also, it's been recently reported that users with Android 6.0 and higher devices cannot use Lucky Patcher properly, resulting in a non-working mod.

Hope it helps.

 

[johnhern]

Thanks a lot.

IDA.... my nemisis... its all greek to me so far... lol... I am trying to learn it though (not how to use IDA itself, but Hex conversion and identifying anything in IDA.. lol).

I will have a deeper look into IAP in Unity, and see what to look for.. I hadn't tried it yet.

At the same time, I have a game that has a bunch of TXT files for the data.. but I can't read the data, any way to figure out what it is encrypted with/coded with/obfuscated with?

Thanks again.

 

[Sbenny]

I know only the theory about this, as I didn't personally try.

What I know is that every encrypted file into a .apk file has got, ALWAYS, the decryption key somewhere inside it. It's usually into the smali, and a good starting point should be looking into the MainActivity of that game. But two problems (at least for me) are there:
1) Once you find the decryption key, how you'll actually decrypt the files?
2) Even if you manage to decrypt the file. How will you encrypt it again? As the game wont recognize unencrypted files, or you'll have to remove the decryption key completely, but you'll also need to decrypt ALL the files (and if the list is huge, I'm not sure how many hours it'll take.