Saturday, May 26, 2012

Cheating the Android

Yarr everybody,

Long time since my last post, and today I’m returning to an old subject that I like very much. Cheating in games. And this time Android games.
I include in this post a small tutorial about patching an Android application, followed with introducing a big problem I’m facing in my attempts to cheat in various games. If you are already familiar with the technique of patching Android apps you can skip straight to the last paragraph where I talk about the problematic aspects of it. I would love to hear any comments the readers might have about my methods or any tips and tricks that might make the process easier to endure.

The Tutorial part:
I would walk you through the following steps:

  1. Getting the binary
  2. Unpacking, Disassembly and Decompiling it
  3. Finding a good place to patch
  4. Patching
  5. Repacking, ReSigning and ReInstalling the app
  6. Having fun

Setting up:
For these tasks you are going to need a rooted Android device (In some cases the emulator could do), and the standard ADK tools installed.
First enable the USB debugging from the Settings->Applications->Development menu, and connect to the computer with a USB cable. Now check the connection using the “adb devices” command. If the ADB can’t find the device, recheck the cable, the drivers and the adb.
Tip for those of you who use a Samsung Android device: the fastest way to get the right drivers is by installing the SamsungKies.

Step 1 Getting the binary
To get the binary of the application in target, you can simply search the right APK under  /data/app where usually APKs are stored. Or you can:
Run the application

  • Connect to the device with adb
  • Run “adb shell”
  • Run “su” (If needed)
  • Run “ps” to find the process id.
  • Run “ls -la /proc/PROCESS_ID/fd” and search in the long list of file descriptors for the apk file.
  • Pull the file from the device using the “adb pull” command.

Step 2 Unpacking, Disassembly and Decompiling it
For this step we will get to know not one but three tools to work with APKs
1. apktool
2. dex2jar
3. jd
The apktool would be used to unpack the apk file into its inner components. Using the command “apktool d APK_FILE OUTPUT_DIR”,  you can produce a directory with all of the components that makes the APK including a dir called smali that contains disassembly of the Dalvik bytecode. The smali files are text files that can be edited to make a patch. The directory can be repacked into an APK simply with the command “apktool b CONTENT_DIR OUTPUT_APK”.
Another tip: If you are facing any trouble during the repacking, you can try to unpack with “-r” flag “apktool d -r APK_FILE OUTPUT_DIR”, to leave the resources untouched, sometimes, the source to many problems is the resources. If you are not trying to deface the application don’t bother solving these problems.
The 2nd and 3rd tools are used to produce a decompiled, more readable code, and they are not a must for patching. The principle, is to open the APK file with a standard unzip tool, find the classes.dex file in it, use the dex2jar tool to convert the dex to a jar file, and decompile the jar with the Java decompiler.

Step 3 Finding a good place to patch
Now you’ve got lots of decompiled Dalvik code, use your reverse engineering talent to find a good cozy spot for your patch, or any other kind of cheats you would like. Note that some applications use a native arm code combined with the Dalvik code, which is usually found under the lib subfolder and could be disassembled with IDA pro as a ELF ARM (LE) binary.

Step 4 Patching
Patching, either by changing a smali file or by patching a lib file. Note, that the smali code is not the most familiar assembly, but I find it very intuitive and easy to understand.

Step 5 Repacking, ReSigning and ReInstalling the app
Repack using the apktool: “apktool b CONTENT_FOLDER OUTPUT_APK”. Now if you try to install the APK you just made, you would most probably get an error code that says “INSTALL_PARSE_FAILED_NO_CERTIFICATES”. In that case what you need to do is to use the signapk tool found at to sign the apk, you can use the sample certificate and key that are shipped with the tool.

Step 6 Having fun
Have fun.

The big problem:
Now if one would follow the exact steps trying to patch a game such as DrawSomething he would soon find out that most of the code is not in the Java nor in the native ARM binary. Instant the interesting part is found in another binary file called DrawSomethingFree.s3e, which is a binary file of the Marmalade SDK. Marmalade is a platform for developers to create games for both iOS and Android at the same time.
If one would try to decompile the Templerun game he would soon find a very similar story written in Mono for android. Mono is a C# like SDK for developing applications for both iOS and Android. Now this makes no sense, C# is a language made by Microsoft mostly optimized for Windows x86 platforms, why adapt it to Android, which handles Java like code naturally, is there really a benefit in C# coding style over Java? And if so is it worth the effort and the overhead of making a new VM to execute CLI code on Android?
Researching even further, I found out that there are awfully lots of such cross platform SDKs running everything from C to Lua including Python and Javascript. Each of them required understanding a new unknown homemade file type with new kind of bytecode encoding of some kind of imitation of a standard language.
I’m looking for any help from people on researching and understanding these files and how to disassemble and patch them for the better good.
So if anyone knows anything about the internals of any of the following:

  • Widgetpad
  • Whoop
  • RhoMobile
  • Shiva3d
  • SIO2
  • Unity
  • Corona
  • PhoneGap
  • Titanium Mobile
  • cocos2d-x
  • Edgelib
  • Moai
  • Mono
  • MoSync
  • Mominis
  • Marmalade
  • Simple DriectMedia Layer

I would be more than happy to learn more about it. And if anyone knows of any other cross platform environment, please let me know, as I’m trying to make some knowledge base about them.



  1. Anonymous17/7/12

    not sure how you're interested in game hacking nowadays but this guy seem to have some quite nice insights regarding punkbuster and the like

    1. This comment has been removed by a blog administrator.

  2. Hello Assaf,

    I recently had this same issue decompiling an android application and finding that it was written in marmalade. Were you able to find any information on how to go about decompiling the s3e binary files?

  3. Nope, sorry. I didn't have the time to go any deeper on that thing, but I would love to research that in the future and maybe write a follow up.

    1. Thank you for getting back to me. I look forward to a follow up on this subject.

  4. This comment has been removed by a blog administrator.

  5. Anonymous15/12/16

    I am agree with your post. I hope you are always shared me this type of post. Thanks a lot. blossom blast saga tips

  6. Anonymous20/2/17

    Good information, thanks for providing us such a useful information. Keep up the good work and continue providing us more quality information from time to time. look here

  7. This comment has been removed by a blog administrator.

  8. This comment has been removed by a blog administrator.

  9. including reasonable comments here... Towelroot v3

  10. This comment has been removed by a blog administrator.

  11. This comment has been removed by a blog administrator.

  12. This comment has been removed by the author.

  13. Srinivasan28/9/17

    This comment has been removed by a blog administrator.

  14. Game Guardian is an amazing game hack/alteration tool. Game guardian helps you modify money, HP, Sp and more aspects of the game.
    Game Guardian apk

  15. Anonymous15/1/18

    Thank you for sharing this post with us.
    subway surfers hack

  16. Within the past few years we have seen an explosion in the market of handheld devices and new tech gadgets.Zombie Tsunami Hack Tool


  17. An intriguing discussion is worth comment. To the next! Kind regards!!
    ipl auction 2018
    live telecast of ipl

  18. Brawl stars apk has come up with four different game modes , Bounty mode is the first one where the team has to collect stars by picking it up from opponents and the team who has most stars at the end will win the game

  19. All the free brain and puzzle Android games here are amazingly fun to play, innovative, and in most cases you will stretch your brain out to some degree. GTA 5 APK


  20. Gangstar Vegas is an open world action-adventure video game developed by Gameloft for Android, iOS.

  21. There is no doubt that play store has the largest possible collection of application and various games, but play store also has some limitations for users and some policies of play store are not satisfactory. Due to the dominance of play store, we are bound to search an alternative and thanks to those third-party App stores like Appvn app we can enjoy all the contents for free. Now we have so many alternatives to Appvn and can enjoy all of them hassle-free.

  22. Appvn for Pc Download Your Favorite Apps For Free On PC The biggest invention of this century is Smartphones, but we cannot degrade the credibility of computers as we are taking the services of computers from decades. Imagine if you can use the computers like your Smartphones, yes you heard it right now with the availability of apps like Appvn for pc you can download and install all your android and iOS apps right on your desktop and use it wherever on the go.

  23. It's now common knowledge that with exercise, your brain can become more powerful and the more you work it, the more control you'll have over it and better recall you'll have when needed.Bullet Force Hack Online

  24. App Valley is a collection of the large number of apps.It is an alternative app store to the Google Play store. It contains all the apps that are found in the Google Play store along with the apps that are now available on the Google play store as well as the Apple store. The apps which you don’t find anywhere will be available on Appvalley Apk Download or App Valley is the perfect destination for finding the apps that are not available any where.


  25. The basic difference between a smartphone and that of the old keypad phones is the ability to download and install various applications.

    http injector apk

  26. Extremely fascinating online journal. Alot of websites I see nowadays don't generally give anything that I'm keen on, yet I'm most definately intrigued by this one. Recently believed that I would post and let you know. AppValley iOS 10

  27. WhatsApp Plus is basically not just another messenger app. Whatsapp PLUS is APK of original whatsapp with Modded Stylesheet files. In Android APK, Stylesheet information is NOT ENCRYPTED but the codes are encrypted.

  28. Really pleasant post. I just discovered your weblog and needed to say that I have truly delighted in skimming your blog entries. After all I'll be subscribing to your food and I trust you compose again soon! Cyrus Installer Download

  29. Magnificent and intriguing article. Extraordinary things you've generally imparted to us. Much appreciated. Simply keep making this kind out of post. Phantom for SnapChat

  30. Always wonder how well research content i found on this website.
    Please Check Blogs As well
    happy wheels game||||||happy wheels

  31. Truly an incredible expansion. I have perused this great post. A debt of gratitude is in order for sharing data about it. I truly like that. Much obliged so part for your assemble. FlekStore

  32. You got a very excellent website, Glad I noticed it through yahoo.
    Brawl Stars Cheats

  33. When we talk about phone then instantly Android come in our mind, and we know that Android platform is growing at a hasty rate worldwide. Several updated phone coming with Android platform.ShowBox APK

  34. It has managed to stay relevant because it has continually expanded its horizons to include more amazing features.trichefortnite

  35. While developing mobile apps, businesses target Android due to its massive worldwide mobile operating system market share.ShowBox APK

  36. Game modification and hacking has been a favorite hobby of Android users for a last time and GameCIH is one of the best tools for such users. GameCih for Android

  37. It is really a great work and the way in which you are sharing the knowledge is excellent.Thanks for your informative article

    software testing course in chennai

  38. This Word Counter application allows you to enter your text and get the count of words, characters with spaces and without spaces and number of lines of the given text. word counter

  39. Android App Maker make easy to create an app of your own. There are some easy steps in making first of all you have to choose a template then add your content (text) of your choice and even pictures.Custom Software Development Company

  40. If you re bored of playing the same fighting or puzzle games, water slide 3D then is the best option to add something new to your APK Download library.

  41. Nice post By reading your blog, i get inspired and this provides some useful information. Thank you for posting this exclusive post for our vision.
    Web Design Training

  42. The website is looking bit flashy and it catches the visitors eyes. Design is pretty simple and a good user friendly interface.
    metsec wall
    metsec cladding rails
    curtain wall detail
    timber cladding details

  43. Love to read it,Waiting For More new Update and I Already Read your Recent Post its Great Thanks.
    certified Ethical Hacker nj
    comptia linux plus nj
    mcsa certification
    mcsa certifications

  44. The website is looking bit flashy and it catches the visitors eyes. Design is pretty simple and a good user friendly interface.
    best hair dryers for fine hair
    titanium hair straightener
    hair straightening products uk
    best ceramic straightener

  45. I just needed to record a speedy word to express profound gratitude to you for those magnificent tips and clues you are appearing on this site.nebosh course in chennai

  46. I wish to indicate because of you only to bail me out of this specific trouble. As a consequence of checking through the net and meeting systems that were not beneficial, I thought my life was finished.industrial safety course in chennai

  47. Hey, Your post is very informative and helpful for us.
    In fact i am looking this type of article from some days.
    Thanks a lot to share this informative article.
    hardware and networking course in hyderabad


  48. Thanks for sharing this Informative content. Well explained. Got to learn new things from your Blog on
    linux training in hyderabad

  49. Very nice post here and thanks for it .I always like and such a super contents of these post.Excellent and very cool idea and great content of different kinds of the valuable information's.
    Best Devops online Training
    Online DevOps Certification Course - Gangboard

  50. Thanks for sharing the details! thanks for sharing information,nice article.
    i would like to more information from your side!
    please added more then tips!Am working in
    websphere training in hyderabad


  51. It seems you are so busy in last month. The detail you shared about your work and it is really impressive that's why i am waiting for your post because i get the new ideas over here and you really write so well.

    Selenium training in Chennai
    Selenium training in Bangalore
    Selenium training in Pune
    Selenium Online training
    Selenium training in bangalore

  52. Thanks For sharing Your information The information shared Is Very Valuable Please Keep Updating Us Time Just went On reading Thae article Python Online Training DataScience Online Training AWS Online Training Hadoop Online Training

  53. Finally, the latest *New Method* Fortnite Free V Bucks Hack that you have been searching for is here. This is the only hack that has been updated and is currently the only one that actually works.

  54. Wenn Sie nach unbegrenztem Geld und PR suchen, um Ihre GTA 5-Aktivität zu überprüfen, besuchen Sie meine Website : Gta 5 Geld Hack

  55. Wenn Sie nach unbegrenztem Geld und PR suchen, um Ihre GTA 5-Aktivität zu überprüfen, besuchen Sie meine Website :
    Gta 5 Geld Hack
    Gta 5 Geld Cheat
    Gta 5 Geld Glitch

  56. Sanjay Precision Industries Leading Exporter of Tapes Threaded Coupler, Stainless Steel Threaded Parts, Turned Parts, Turned Parts, Brass Inserts and Sliding Head Machined Parts from Ghaziabad. Sanjay Precision provide the best turned components, brass pins, brass inserts, Machined Shafts, Gear Blank, etc. If you wants this kind of components then contact Sanjay Precision.

    Turned Components
    CNC & VMC Turned Parts Exporter
    Sanjay Precision
    Turned Components Exporter
    Turned Components Exporter from Ghaziabad

  57. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.
    Selenium Training in Electronic City