Noob needs a push in the right direction - reverse engineer mobile game

snowball_v · Apr 23, 2018 10:37 AM

I am trying to do some reverse engineering on a game called "Dungeon crusher: soul hunters"
It is available on mobile and as a browser version on sites like Armorgames and Kong.

Specifically, the game has a crafting system where you combine various useless items to get more valuable ones. Many of these crafting recipes are currently unknown and nearly impossible to find with normal gameplay.
So a while ago some unknown individual somehow extracted all recipes available at the time. His/her contribution looked like this:
Spoiler (Click to View)

No information how this was pulled off, but it was good enough to deduce the ingredients ingame.
Since then new recipes were added and they remain unknown.

What I did so far:
I produced a memory dump from the game running on windows in google chrome. And I pulled the apk file from an android phone and extracted it.
Went through the files and found some interesting stuff like png images for currently unknown content...but other than that I am a bit lost where and how to find what I am looking for.

Could you point me in the right direction? I don't even know if I am on the right track with the apk file 😧

V3t3r4n · Apr 23, 2018 11:02 AM

For Android, one of two things could be happening:

They are saving that information on a local database inside the apk. SQLite is usually the one that is used the most. Especially on Android. So you could try looking for a database file inside your extracted apk. Since you mentioned they have a browser version of the game as well, I somehow think this is very unlikely. I think you can't use this on the browser version, Although I don't know enough about browser based video games to know if this is true or not.

The other option, and the one that I find most likely is that they are saving it all server-side. So your best bet would be to install Wireshark and sniff the packets they are sending to the server, and the packets you're receiving from the server to figure out if any important information is being transmitted. (Maybe when you open the menu/shop/npc for crafting, the game might return you the various recipes that exists in the game at that moment. You can use Wireshark and limit it to just the browser, for when you're playing the game in Chrome, or just the App, if you're playing on an Android emulator. They might contain different information...? Although that's very unlikely.

If none of that works, you could start by actually reverse engineering the Android app. Though it's not a very easy thing to do. You should start by installing Android Studio, which is the Google Software used to code Android apps, and installing an appropriate SDK, which is the Android Version (You can pick from a multitude of them). Then you download the game, decompile it, try changing it's manifest (Like a main file with a bunch of rules for the app) to make it debugable (Debugging is the thing developers do to test an app), you digitally sign it yourself (There's a program that does this, and it allows you to trick Android Studio into thinking you made the app, making it debuggable), and then you run it in Android Studio and figure out what it's doing. This can be easier if the developers don't protect their code, which is unlikely. The code that will be given to you will be hard to understand, and you'll need to debug it to figure out what it does. This a very hard and tedious process. Not impossible by any means though :)

Here's an article that explains how to debug an apk in an easier to understand and step-by-step way: https://blog.netspi.com/attacking-androi...debuggers/ . This worked for me when I tried, although that was about 2 years ago. Hopefully not much as changed since then, and all the software mentioned there was appropriately updated to still work today.

Here's a link to Wireshark: https://www.wireshark.org/ All-around very useful software to figure out what's being sent and received over your network. An invaluable tool when it comes to not only reverse engineering an webservice, but also for security and privacy reasons.

This post is only supposed to provide you with some direction, as you asked for. You should research everything I mentioned for yourself.

Best of Luck! 👍

snowball_v · (This post was last modified: Apr 23, 2018 11:32 AM by snowball_v.)

Thanks, this gives me something to work with. Exactly what I was hoping for.
Others can still feel free to add hints ;)

V3t3r4n · Apr 24, 2018 03:02 AM

(Apr 23, 2018 11:30 AM)snowball_v Wrote: Thanks, this gives me something to work with. Exactly what I was hoping for.
Others can still feel free to add hints ;)

No problem :) Please keep us updated on your progress so far, I'm sure it would be helpful to a lot of people if you could.

BrilliantAdam · Apr 24, 2018 12:06 PM

(Apr 23, 2018 11:02 AM)V3t3r4n Wrote: For Android, one of two things could be happening:

They are saving that information on a local database inside the apk. SQLite is usually the one that is used the most. Especially on Android. So you could try looking for a database file inside your extracted apk. Since you mentioned they have a browser version of the game as well, I somehow think this is very unlikely. I think you can't use this on the browser version, Although I don't know enough about browser based video games to know if this is true or not.

The other option, and the one that I find most likely is that they are saving it all server-side. So your best bet would be to install Wireshark and sniff the packets they are sending to the server, and the packets you're receiving from the server to figure out if any important information is being transmitted. (Maybe when you open the menu/shop/npc for crafting, the game might return you the various recipes that exists in the game at that moment. You can use Wireshark and limit it to just the browser, for when you're playing the game in Chrome, or just the App, if you're playing on an Android emulator. They might contain different information...? Although that's very unlikely.

If none of that works, you could start by actually reverse engineering the Android app. Though it's not a very easy thing to do. You should start by installing Android Studio, which is the Google Software used to code Android apps, and installing an appropriate SDK, which is the Android Version (You can pick from a multitude of them). Then you download the game, decompile it, try changing it's manifest (Like a main file with a bunch of rules for the app) to make it debugable (Debugging is the thing developers do to test an app), you digitally sign it yourself (There's a program that does this, and it allows you to trick Android Studio into thinking you made the app, making it debuggable), and then you run it in Android Studio and figure out what it's doing. This can be easier if the developers don't protect their code, which is unlikely. The code that will be given to you will be hard to understand, and you'll need to debug it to figure out what it does. This a very hard and tedious process. Not impossible by any means though :)

This post is only supposed to provide you with some direction, as you asked for. You should research everything I mentioned for yourself.

Best of Luck! 👍

Thanks so much ! i found this reply very helpful to me too . I'm trying to crack Empires And Allies (by Zynga) . Wish me some luck =) i'm going to follow ur steps , but i have only a one problem . All critical information are encrypted in the HTTP REQUEST and even RESPONSE ( i use Burpsuite to interrupt requests on fb gameroom) , Variety of Md5 , Sha1 , Base64 .. and so on are used . I tried to look at the code using (dnSpy) , and i can find many many files called (Hash , HashAssembely , Encryption , .. etc ) and many algorithms in c# that i can't identify at all and can't find the main line which controls the whole encryption traffic . Any help / Advice would be greatly appreciated . Warm Regards =)

snowball_v · (This post was last modified: Apr 25, 2018 12:21 PM by snowball_v.)

So what I did among other things was using il2cppdumper.
It produced a dump file with some interesting information, among other things entries like these:

Code 
// Namespace: TM.ClickerCore.Models.Craft

public class CraftRecipeEntry : ClickerConfigEntry // TypeDefIndex: 4604

{

 // Fields

 private string <NameID>k__BackingField; // 0x10

 private string <IconID>k__BackingField; // 0x14

 private RecipeType <Type>k__BackingField; // 0x18

 private float <BaseChance>k__BackingField; // 0x1C

 private float <MaxChance>k__BackingField; // 0x20

 private List`1<Tuple`2<int, int>> <Ingredients>k__BackingField; // 0x24

 private LootFormat <Result>k__BackingField; // 0x28

 private int <LevelRestrictions>k__BackingField; // 0x2C

 private int <DiscoveryWeight>k__BackingField; // 0x30

 // Methods

 public void .ctor(); // 0x1105850

 public string get_NameID(); // 0x1105858

 private void set_NameID(string value); // 0x1105860

 public string get_IconID(); // 0x1105868

 private void set_IconID(string value); // 0x1105870

 public RecipeType get_Type(); // 0x1105878

 private void set_Type(RecipeType value); // 0x1105880

 public float get_BaseChance(); // 0x1105888

 private void set_BaseChance(float value); // 0x1105890

 public float get_MaxChance(); // 0x1105898

 private void set_MaxChance(float value); // 0x11058A0

 public List`1<Tuple`2<int, int>> get_Ingredients(); // 0x11058A8

 private void set_Ingredients(List`1<Tuple`2<int, int>> value); // 0x11058B0

 public LootFormat get_Result(); // 0x11058B8

 private void set_Result(LootFormat value); // 0x11058C0

 public int get_LevelRestrictions(); // 0x11058C8

 private void set_LevelRestrictions(int value); // 0x11058D0

 public int get_DiscoveryWeight(); // 0x11058D8

 private void set_DiscoveryWeight(int value); // 0x11058E0

 public static CraftRecipeEntry ParseFromTable(string[] row, string[] header, string[] validHeader); // 0x11058E8

 private static List`1<Tuple`2<int, int>> ParseIngredients(string value); // 0x1105CB8

}

What can I do with it? I can look up what is in the offsets in global-metadata, but I can not make any sense of it from looking at the file in a hexeditor.
I have to admit, maybe I need more than a gentle push in the right direction 🤨

V3t3r4n · Apr 26, 2018 01:21 AM

(Apr 24, 2018 12:06 PM)BrilliantAdam Wrote: Thanks so much ! i found this reply very helpful to me too . I'm trying to crack Empires And Allies (by Zynga) . Wish me some luck =) i'm going to follow ur steps , but i have only a one problem . All critical information are encrypted in the HTTP REQUEST and even RESPONSE ( i use Burpsuite to interrupt requests on fb gameroom) , Variety of Md5 , Sha1 , Base64 .. and so on are used . I tried to look at the code using (dnSpy) , and i can find many many files called (Hash , HashAssembely , Encryption , .. etc ) and many algorithms in c# that i can't identify at all and can't find the main line which controls the whole encryption traffic . Any help / Advice would be greatly appreciated . Warm Regards =)

(Apr 25, 2018 12:18 PM)snowball_v Wrote: So what I did among other things was using il2cppdumper.
It produced a dump file with some interesting information, among other things entries like these:

Code
// Namespace: TM.ClickerCore.Models.Craft public class CraftRecipeEntry : ClickerConfigEntry // TypeDefIndex: 4604 { // Fields private string <NameID>k__BackingField; // 0x10 private string <IconID>k__BackingField; // 0x14 private RecipeType <Type>k__BackingField; // 0x18 private float <BaseChance>k__BackingField; // 0x1C private float <MaxChance>k__BackingField; // 0x20 private List`1<Tuple`2<int, int>> <Ingredients>k__BackingField; // 0x24 private LootFormat <Result>k__BackingField; // 0x28 private int <LevelRestrictions>k__BackingField; // 0x2C private int <DiscoveryWeight>k__BackingField; // 0x30 // Methods public void .ctor(); // 0x1105850 public string get_NameID(); // 0x1105858 private void set_NameID(string value); // 0x1105860 public string get_IconID(); // 0x1105868 private void set_IconID(string value); // 0x1105870 public RecipeType get_Type(); // 0x1105878 private void set_Type(RecipeType value); // 0x1105880 public float get_BaseChance(); // 0x1105888 private void set_BaseChance(float value); // 0x1105890 public float get_MaxChance(); // 0x1105898 private void set_MaxChance(float value); // 0x11058A0 public List`1<Tuple`2<int, int>> get_Ingredients(); // 0x11058A8 private void set_Ingredients(List`1<Tuple`2<int, int>> value); // 0x11058B0 public LootFormat get_Result(); // 0x11058B8 private void set_Result(LootFormat value); // 0x11058C0 public int get_LevelRestrictions(); // 0x11058C8 private void set_LevelRestrictions(int value); // 0x11058D0 public int get_DiscoveryWeight(); // 0x11058D8 private void set_DiscoveryWeight(int value); // 0x11058E0 public static CraftRecipeEntry ParseFromTable(string[] row, string[] header, string[] validHeader); // 0x11058E8 private static List`1<Tuple`2<int, int>> ParseIngredients(string value); // 0x1105CB8 }

What can I do with it? I can look up what is in the offsets in global-metadata, but I can not make any sense of it from looking at the file in a hexeditor.
I have to admit, maybe I need more than a gentle push in the right direction 🤨

To the both of you, this has apparently gotten into C# (Or at least .NET) Reverse Engineering/Debugging. My desktop work environment is Linux (Solus), and to be able to help you guys with any sort of specifics would take an initial setup that I'm not willing to go through.

I suggest both of you to maybe try posting your more specific issues over at the Visual Basic and .NET Framework or the C# Programming Language sections.

Try to go into as much detail about what you already did, what you're trying to do, and what exactly it is that you are trying to get (Maybe a little bit on how the game works, because you have to remember the people trying to help you might not know a single thing about it).

Good luck :)

And to snowball_v specifically: Where you able to find anything at all through Wireshark?

BrilliantAdam · Apr 26, 2018 03:10 AM

(Apr 26, 2018 01:21 AM)V3t3r4n Wrote: To the both of you, this has apparently gotten into C# (Or at least .NET) Reverse Engineering/Debugging. My desktop work environment is Linux (Solus), and to be able to help you guys with any sort of specifics would take an initial setup that I'm not willing to go through.

Try to go into as much detail about what you already did, what you're trying to do, and what exactly it is that you are trying to get (Maybe a little bit on how the game works, because you have to remember the people trying to help you might not know a single thing about it).

Good luck :)

And to snowball_v specifically: Where you able to find anything at all through Wireshark?

Thanks for your reply , sir
I was refreshing the website many times to see if u replied =)

snowball_v · (This post was last modified: Apr 26, 2018 11:27 AM by snowball_v.)

(Apr 26, 2018 01:21 AM)V3t3r4n Wrote: And to snowball_v specifically: Where you able to find anything at all through Wireshark?

It's the same problem: I don't know what to look for. I sure can isolate the packets related to checking a craft result, but have no idea what to do with them.
But in the end, I hardly think that what I am looking for (see initial post, i described it to the best of my ability) is transmitted here.

V3t3r4n · Apr 27, 2018 12:48 AM

(Apr 26, 2018 03:10 AM)BrilliantAdam Wrote: Thanks for your reply , sir
I was refreshing the website many times to see if u replied =)

Well, sorry for keeping you waiting for so long :) I don't engage on activity on HF as much these days.

Hope you're able to find what you're looking for for, good luck!

(Apr 26, 2018 11:24 AM)snowball_v Wrote: It's the same problem: I don't know what to look for. I sure can isolate the packets related to checking a craft result, but have no idea what to do with them.
But in the end, I hardly think that what I am looking for (see initial post, i described it to the best of my ability) is transmitted here.

Can you post some snippets of those packets contents? That way I can have a look at it myself.

Login
Username/Email:
Password:	Lost Password?
	Remember me

Possibly Related Threads...
Thread / Author	Replies	Views	Last Post
Overwatch Rating Push by TyrOct 14, 2025 11:21 PM	8	140	Oct 14, 2025 11:21 PM Last Post: Tyr
Carrom disk pool game still remains my favorite multiplayer mobile game by HarryOct 1, 2025 04:40 PM	1	257	Oct 1, 2025 04:40 PM Last Post: DemonAsylum
% Free Call of Duty Mobile 440CP & Free COD Mobile Premium Battle Pass by aulakhzJan 8, 2025 09:46 PM	11	535	Jan 8, 2025 09:46 PM Last Post: _SyncX404