Google Integrity Breakdown

Thanks for staying with the RevDex Security Researcher community I guess two apps are enough to understand

Play integrity token Bypass

#1
https://t.me/RevDex/632

#2
https://t.me/RevDex/633

F**k you google 🫵👉👌

God 🔌 Plugging - https://t.me/RevDex/631

Google Login (Break Bug 🪲)

I recently bypassed the Google Login system in a modded app the bypass itself isn't very difficult but analyzing the new implementation was much more challenging

I'm planning to add this feature to my Play Integrity Service allowing Google account signin even on supported modded apps

bool bAutoSlice = false;
void *playerBladeOwner = NULL; 
void (*Fruit_Slice)(void *instance, 
int bladeId, 
void *bladeOwner, 
float bladePosX, 
float bladePosY, 
float sliceDirX, 
float sliceDirY, 
float sliceSpeed, 
bool triggerModifers, 
bool countTowardsAchievement, 
bool sliceDiamondEnabled, 
bool juiceEnabled, 
bool splatsEnabled);

void (*old_Fruit_Update)(void *instance);
bool (*Fruit_get_IsBomb)(void *instance);

void* (*Blade_get_Owner)(void *instance);
void (*old_Blade_Update)(void *instance);

void hook_Blade_Update(void *instance) 
{
    if (instance != NULL) 
    {
        if (Blade_get_Owner != NULL) 
        {
            playerBladeOwner = Blade_get_Owner(instance);
        }
    }
    return old_Blade_Update(instance);
}

void hook_Fruit_Update(void *instance) 
{
    if (instance != NULL && bAutoSlice) 
    {
        if (Fruit_get_IsBomb != NULL && !Fruit_get_IsBomb(instance)) 
        {
            float bladePosX = 5.0f;
            float bladePosY = 5.0f;
            
            float sliceDirX = 5.0f;
            float sliceDirY = 5.0f;
            float sliceSpeed = 35.0f;
            int targetBladeId = (playerBladeOwner != NULL) ? 0 : 1;
   
            Fruit_Slice(
                instance, 
                targetBladeId,
                playerBladeOwner,
                bladePosX, bladePosY, 
                sliceDirX, sliceDirY, 
                sliceSpeed, 
                true,
                true,
                true,
                true,
                true
            );
        }
    }
    return old_Fruit_Update(instance);
}

Fruit_Slice = (void (*)(void *, int, void *,
float, float, float, float, float,
bool, bool, bool, bool, bool))getAbsoluteAddress(targetLibName, 0x1C74C64);
Fruit_get_IsBomb = (bool (*)(void *))getAbsoluteAddress(targetLibName, 0x1C72234);
Blade_get_Owner = (void* (*)(void *))getAbsoluteAddress(targetLibName, 0x20748D8);
HOOK_LIB("libil2cpp.so", "0x1C730D8", hook_Fruit_Update, old_Fruit_Update);
HOOK_LIB("libil2cpp.so", "0x2075418", hook_Blade_Update, old_Blade_Update);

OBFUSCATE("1_Toggle_Auto Slice Fruits")

case 1:
bAutoSlice = boolean;
break;

Dev - @aantik_mods

Fruit Ninja 3.96.5 ( Auto Play )

Old game modding experience 😂👍

Hook - https://t.me/RevDex/640

struct Vector3 {
    float x, y, z;
};

bool bAutoSlice = false;
void *playerBladeOwner = NULL;
void *(*Fruit_Slice)(void *instance, int bladeId, int bladeOwner, float bladePosX, float bladePosY, float sliceDirX, float sliceDirY, float sliceSpeed, bool triggerModifers, bool countTowardsAchievement, bool sliceDiamondEnabled, bool juiceEnabled, bool splatsEnabled);
void (*old_Fruit_Update)(void *instance);
bool (*Fruit_get_IsBomb)(void *instance);
bool (*Fruit_get_IsMenuFruit)(void *instance);
bool (*Fruit_get_IsSliced)(void *instance);
bool (*Fruit_get_IsSliceable)(void *instance);
void (*old_Blade_Update)(void *instance);
int (*Blade_get_Id)(void *instance);
int (*Blade_get_Owner)(void *instance);
void *(*Blade_get_BladeSlicer)(void *instance);
void (*BladeSlicer_AddToCurrentCombo)(void *instance, void *sliceEvent, void *fruit);
void *(*Component_get_transform)(void *instance);
Vector3 (*Transform_get_position)(void *instance);
void *(*BladeManager_get_Instance)();
void *(*BladeManager_get_PlayerBlade)(void *instance);
void *(*ScoreCard_get_Instance)();
void (*ScoreCard_ModifyScore)(void *instance, int player, int delta);

/**
 *
 *
 * @code with RevDex antik mods cxx
 * @param instance
 */

void hook_Blade_Update(void *instance) {
    if (instance != NULL && Blade_get_Owner != NULL) {
        int owner = Blade_get_Owner(instance);
        if (owner == 0) {
            if (playerBladeOwner != instance) {
                LOGI(OBFUSCATE("Player Blade Captured: %p"), instance);
                playerBladeOwner = instance;
            }
        }
    }
    old_Blade_Update(instance);
}

void hook_Fruit_Update(void *instance)
{
    if (instance != NULL && bAutoSlice)
    {
        if (Fruit_get_IsBomb && Fruit_get_IsBomb(instance)) return old_Fruit_Update(instance);
        if (Fruit_get_IsMenuFruit && Fruit_get_IsMenuFruit(instance)) return old_Fruit_Update(instance);
        if (Fruit_get_IsSliced && Fruit_get_IsSliced(instance)) return old_Fruit_Update(instance);
        if (Fruit_get_IsSliceable && !Fruit_get_IsSliceable(instance)) return old_Fruit_Update(instance);

        int bladeId = 0;
        int bladeOwner = 0;
        float posX = 0, posY = 0;

        void *playerBlade = playerBladeOwner;
        if (playerBlade == NULL && BladeManager_get_Instance && BladeManager_get_PlayerBlade) {
            void *bm = BladeManager_get_Instance();
            if (bm) {
                playerBlade = BladeManager_get_PlayerBlade(bm);
                if (playerBlade) {
                    LOGI(OBFUSCATE("Blade found via BladeManager: %p"), playerBlade);
                }
            }
        }

        if (playerBlade != NULL) {
            if (Blade_get_Id) bladeId = Blade_get_Id(playerBlade);
            if (Blade_get_Owner) bladeOwner = Blade_get_Owner(playerBlade);
        }

        if (Component_get_transform && Transform_get_position) {
            void *transform = Component_get_transform(instance);
            if (transform) {
                Vector3 pos = Transform_get_position(transform);
                posX = pos.x;
                posY = pos.y;
            }
        }

        void *sliceEvent = Fruit_Slice(
                instance,
                bladeId,
                bladeOwner,
                posX, posY,
                5.0f, 5.0f,
                35.0f,
                true,
                true,
                true,
                true,
                true
        );

        if (sliceEvent) {
            LOGI(OBFUSCATE("Fruit pointer --> %p"), sliceEvent, bladeOwner);
            int points = *(int*)((uintptr_t)sliceEvent + 0x7C); // m_slicePoints offset
            void *sc = ScoreCard_get_Instance();
            if (sc && ScoreCard_ModifyScore) {
                ScoreCard_ModifyScore(sc, 0, points > 0 ? points : 1);
                LOGI(OBFUSCATE("m_slicePoints --> %d points"), points > 0 ? points : 1);
            }

            if (playerBlade && Blade_get_BladeSlicer && BladeSlicer_AddToCurrentCombo) {
                void *slicer = Blade_get_BladeSlicer(playerBlade);
                if (slicer) {
                    BladeSlicer_AddToCurrentCombo(slicer, sliceEvent, instance);
                   /**
                    *
                    *  done add points same like normal environment
                    *
                    */
                    LOGI(OBFUSCATE("_"));
                }
            }
        }
    }
    return old_Fruit_Update(instance);
}

Fruit_Slice = (void *(*)(void *, int, int, float, float, float, float, float, bool, bool, bool, bool, bool))getAbsoluteAddress(targetLibName, 0x1C74C64);
Fruit_get_IsBomb = (bool (*)(void *))getAbsoluteAddress(targetLibName, 0x1C72234);
Fruit_get_IsMenuFruit = (bool (*)(void *))getAbsoluteAddress(targetLibName, 0x1C72220);
Fruit_get_IsSliced = (bool (*)(void *))getAbsoluteAddress(targetLibName, 0x1C722F8);
Fruit_get_IsSliceable = (bool (*)(void *))getAbsoluteAddress(targetLibName, 0x1C7230C);
Blade_get_Id = (int (*)(void *))getAbsoluteAddress(targetLibName, 0x20748E8);
Blade_get_Owner = (int (*)(void *))getAbsoluteAddress(targetLibName, 0x20748D8);
Blade_get_BladeSlicer = (void *(*)(void *))getAbsoluteAddress(targetLibName, 0x20748D0);
BladeSlicer_AddToCurrentCombo = (void (*)(void *, void *, void *))getAbsoluteAddress(targetLibName, 0x1BEB09C);
Component_get_transform = (void *(*)(void *))getAbsoluteAddress(targetLibName, 0x3C67160);
Transform_get_position = (Vector3 (*)(void *))getAbsoluteAddress(targetLibName, 0x3C744DC);
BladeManager_get_Instance = (void *(*)())getAbsoluteAddress(targetLibName, 0x1BE1F04);
BladeManager_get_PlayerBlade = (void *(*)(void *))getAbsoluteAddress(targetLibName, 0x1BE1E7C);
ScoreCard_get_Instance = (void *(*)())getAbsoluteAddress(targetLibName, 0x1E6E018);
ScoreCard_ModifyScore = (void (*)(void *, int, int))getAbsoluteAddress(targetLibName, 0x1E6E48C);

HOOK_LIB("libil2cpp.so", "0x1C730D8", hook_Fruit_Update, old_Fruit_Update);
HOOK_LIB("libil2cpp.so", "0x2075418", hook_Blade_Update, old_Blade_Update);

OBFUSCATE("1_Toggle_Auto Play")

case 1:
bAutoSlice = boolean;
break;

Fruit Ninja 3.96.5 ( Auto Play )

😶‍🌫️😶‍🌫️ mf google
https://t.me/RevDex/638

Dex2C Pro v3.5 (Offline Support)

New Added :
# fixed null byte

# background task in background ally's isolated process alive libArt.so & libAndroid_runtime.so hook thanks for LSPlant

# T(N) = N / 2 »» O(N) Shifting ( Fix )

Send bug 🪲 - @aantik_mods