Skip to content

Instantly share code, notes, and snippets.

@FrankSpierings
Last active August 15, 2018 14:43
Show Gist options
  • Save FrankSpierings/6c3065bf6a71df52e927b7d01b26e30f to your computer and use it in GitHub Desktop.
Save FrankSpierings/6c3065bf6a71df52e927b7d01b26e30f to your computer and use it in GitHub Desktop.
Learning how to use Frida - Trying to modify Real Racing 3
function ProgressHack() {
progressObject = null
intProgress = Interceptor.attach(Module.findExportByName("libRealRacing3.so", "_ZNK10Characters14CareerProgress16IsStreamUnlockedEi"), {
onEnter: function(args) {
progressObject = args[0]
},
onLeave: function(result) {
}
});
while (progressObject === null) {
console.log('.')
Thread.sleep(1)
}
intProgress.detach()
console.log("Progress Object @" + progressObject)
symbol = DebugSymbol.fromName('_ZN10Characters14CareerProgress15SetStreamLockedEib')
f = new NativeFunction(symbol.address, 'pointer', ['pointer', 'int', 'bool'])
intProgress.detach()
for (i = 0; i < 0xffff; i++) {
f(ptr(progressObject),i,-1)
}
}
//Money hack
function MoneyHack(amount) {
moneyObject = null
intMoney = Interceptor.attach(Module.findExportByName("libRealRacing3.so", "_ZN10Characters5Money9GetAmountEv"), {
onEnter: function(args) {
moneyObject = args[0]
},
onLeave: function(result) {
}
});
while (moneyObject === null) {
console.log('.')
Thread.sleep(1)
}
intMoney.detach()
console.log("Money Object @" + moneyObject)
symbol = DebugSymbol.fromName('_ZN10Characters5Money9GiveMoneyEi')
f = new NativeFunction(symbol.address, 'pointer', ['pointer', 'int'])
f(ptr(moneyObject), amount)
}
//Gold hack
function GoldHack(amount) {
currencyObject = null
intCurrency = Interceptor.attach(Module.findExportByName("libRealRacing3.so", "_ZN10Characters8Currency9GetAmountEv"), {
onEnter: function(args) {
currencyObject = args[0]
},
onLeave: function(result) {
}
});
while (currencyObject === null) {
console.log('.')
Thread.sleep(1)
}
console.log("Currency Object @" + currencyObject)
symbol = DebugSymbol.fromName('_ZN10Characters8Currency4GiveEi')
f = new NativeFunction(symbol.address, 'pointer', ['pointer', 'int'])
f(ptr(currencyObject), amount)
intCurrency.detach()
}
//Car hack
Interceptor.attach(Module.findExportByName("libRealRacing3.so", "_ZN10Characters7Unlocks13IsCarUnlockedEi"), {
onEnter: function(args) {
this.name = '_ZN10Characters7Unlocks13IsCarUnlockedEi'
console.log(this.name + "(" +")");
},
onLeave: function(result) {
console.log("[!] Replacing result")
result.replace(1)
console.log(this.name + "=> (" + result +")");
}
});
ProgressHack()
MoneyHack(10000)
GoldHack(1000)
@Aaronh2o
Copy link

How do I run this or where do I store this script for it to run on my Android device?

@L1H0n9Jun
Copy link

Where is the money and gold definition in real racing's source code?
I unpack the apk and decompile the "classes.dex" and "classes2.dex" but can't find relative code.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment