Title: Hacking iPhone game savegames: Game Dev Story
Slug: hacking-iphone-game-savegames-game-dev-story
Date: 2011-12-02 07:51:00
Author: Kartones
Lang: en
Tags: Game Hacks, Videogames, Game Dev, iOS
Description: An example of how to hack iPhone game savegames, exemplified with the game 'Game Dev Story'.

 <p>Years ago I wrote about <a href="https://blog.kartones.net/post/offtopic-cheat-engine">editing in-memory values with tools like Cheat Engine</a>, to hack your game as you were playing it. <br>But there is another way to hack games: <strong>To edit their savegames</strong>.</p> <p>I will use the great <a href="http://itunes.apple.com/us/app/game-dev-story/id396085661?mt=8">Game Dev Story</a> game, which you should buy inmediatly if you have an iPhone. It is a simulation of a videogame creation company; we will hack/modify the company money. </p> <p>I will do it on this smartphone because having so much games from varying skilled developers, probably not much of them will have online-only storage or synchronization of the game state, plus jailbreaking is an option but not too widely extended, so many developers might think access to phone files is forbidden.</p> <p> </p> <p>So... I started a new game, saved as soon as I could, took note of those 500.0K and exited.</p> <p><img alt="Screenshot of initil state" src="https://images.kartones.net/posts/screenshots/hack_gamedevstory_01.jpg"></p> <p> </p> <p>With a Jailbroken iPhone that has OpenSSH installed you just need to connect to it. I use <a href="http://winscp.net/eng/index.php">WinSCP</a> under Windows to connect.</p> <p>In my iphone, the path that we want to navigate to is:<br><font face="Courier New">/private/var/mobile/Applications/1E64F579-3EEC-495C-9C31-B179BEB06E0F/Library/Preferences</font><br>But the GUID in the path will change for each device, just search for '<em>gm08E</em>' inside.</p> <p>Once in that folder, copy to your PC the file '<font face="Courier New">com.kairosoft.gm08E.plist</font>', and open it with a hexadecimal editor (I use the great <a href="http://www.hexworkshop.com/">Hex Workshop</a>).</p> <p> </p> <p>Remember the initial money amount? The 500.0K?<br>As it has decimals, we can assume it can just shift the comma and use an integer number, there is no need of floats just for one digit...<br>Also there is no need for negative numbers, so we'll try with an unsigned.</p> <p><br>That trailing K can perfectly be a literal, to enforce the fake feeling of managing high sums of money (simple trick, instead of x1, make everything cost x1000). For the example, we will directly ignore it (because I know he solution) but usually you would have to search for both values.</p> <p>So, as the iPhone is Little endian we want to search for the values 0x 8813 (unsigned int 16 bits) or 0x 8813 0000 (unsigned int 32 bits).</p> <p>I was correct and in my savegame I found it at address 0x0000ACDF (After two tests, it is an unsigned int 32 bits).</p> <p>We can just change the value for 0094 3577  (2000000000 in hex, a bit below int 32 max. value), and save.</p> <p> </p> <p>We copy back the file to the device's folder, and run the game:</p> <p><img alt="Screenshot of the game after hacking" src="https://images.kartones.net/posts/screenshots/hack_gamedevstory_02.jpg"></p> <p>Check the money again in the upper-right part, it doesn't even fully fit so renders all 9s :)</p> <p>Remember that money doesn't equal to happiness, so try not to cheat until you have finished your games first at least once, or you will spoil the fun!</p> <p> </p> <p>With this small post we've went back to the early 90's where hex. editing strategy games saves was as easy as now it is editing an offline iPhone game! </p> <p>The best solutions to avoid this editing are usually:</p> <ul> <li>Encryption of the full savegame  </li><li>Checksums stored somewhere else, to detect tampering with the savegame and reset it  </li><li>Full online storage of saves (getting more common with "the Cloud")  </li><li>Online storage of sensible data (like money) so critical stuff is safer *</li></ul> <p> </p> <p>* Safer, but if sync. code is not properly done you could sniff the data and inject your values anyway!</p>
