DX12 Android Online Game Bot !?!Help!?!

Recommended Posts

Hi, New here. 

I need some help. My fiance and I like to play this mobile game online that goes by real time. Her and I are always working but when we have free time we like to play this game. We don't always got time throughout the day to Queue Buildings, troops, Upgrades....etc.... 

I was told to look into DLL Injection and OpenGL/DirectX Hooking. Is this true? Is this what I need to learn? 

How do I read the Android files, or modify the files, or get the in-game tags/variables for the game I want? 

Any assistance on this would be most appreciated. I been everywhere and seems no one knows or is to lazy to help me out. It would be nice to have assistance for once. I don't know what I need to learn. 

So links of topics I need to learn within the comment section would be SOOOOO.....Helpful. Anything to just get me started. 

Thanks, 

Dejay Hextrix 

Edited by DejayHextrix

Share this post


Link to post
Share on other sites
1 hour ago, DejayHextrix said:

I was told to look into DLL Injection and OpenGL/DirectX Hooking. Is this true? Is this what I need to learn? 

 

Not for Android, no.  DLL Injection is strictly for Windows programs.

I don't know how feasible it is for you, but you can probably get the APK off your device using adb (not sure about this).  APK files are just zip files, so extract it.  Then it will depend on how the program was written.  If it's C++, you'll have to get good reading assembly.  If it's Java, you can use a Java decompiler on it.  If it's C# then you can use a C# decompiler on it.  I do this at work to analyze the APKs we create before we publish them to make sure we're not wasting space on anything stupid.

After that, it's pretty much up to you to figure out how to find what you want to automate and put it back together into a working APK.  I've never done that.  It's also unlikely that a decompiler will give you something that you can actually compile again.  You also will not be able to sign the APK using the original signature, but you will probably be able to sign it yourself as long as nothing bothers to validate the signature.

If that fails, your next option (if it's a properly constructed client/server game) is to intercept the network traffic and automate the request/responses using a standalone program that you create from scratch.  This will only work if the game and server are not using SSL in a way that prevents proxy interception (and I know from experience that a lot of games do not bother).

Edited by Nypyren

Share this post


Link to post
Share on other sites
4 minutes ago, Nypyren said:

 

Not for Android, no.  DLL Injection is strictly for Windows programs.

Even if the Android game is ran through an emulator on windows? 

Btw, Thank you. At least someone who can help me instead of complaining about my "Low-Level Effort" in my post. All I'm trying to do is get started. 

Share this post


Link to post
Share on other sites

for Android game bot, you might want to take a look at 123Autoit-nonroot, do you youtube search on the name 123Autoit, and you should be able to see some demo on the result.

can you provide what game you want to automate?

Share this post


Link to post
Share on other sites
12 hours ago, DejayHextrix said:

Even if the Android game is ran through an emulator on windows?

Possibly.  It's possible you could inject a DLL into the emulator, but my gut feeling is that it would be even harder to find what you're interested in.  If you have an emulator you could possibly automate what you want at the UI level (i.e. make a program that simulates clicking on the emulator's screen at the right places).  It sounds like Kevin is talking about a similar tool that will run on the Android device itself, but I can't read Chinese so I'm not sure what any of those youtube tutorials say.

Share this post


Link to post
Share on other sites

Is there an alternative way to create the bot to use the UI Variables for more interaction? Because you're almost describing a macro recorder(Mouse Recorder, with UI Coordinates of each function to click) I wouldn't mind having a bot that can interact on it own and find certain variables on its own without UI interface Coordinates. If that makes sense?

13 hours ago, kevin yiu said:

for Android game bot, you might want to take a look at 123Autoit-nonroot, do you youtube search on the name 123Autoit, and you should be able to see some demo on the result.

can you provide what game you want to automate?

War and Order Android Game. 

Thank you guys so much for taking the effort to help me out. I really appreciate it, help finding a solution to my project.  

Share this post


Link to post
Share on other sites
6 hours ago, Nypyren said:

Possibly.  It's possible you could inject a DLL into the emulator, but my gut feeling is that it would be even harder to find what you're interested in.  If you have an emulator you could possibly automate what you want at the UI level (i.e. make a program that simulates clicking on the emulator's screen at the right places).  It sounds like Kevin is talking about a similar tool that will run on the Android device itself, but I can't read Chinese so I'm not sure what any of those youtube tutorials say.

 there are English subtitle provided within the video. anyway,  as you are saying if automation is your what you are intended  you could use tools like autoit or sikuli, i think they are all free and easy to learn, however then your computer will be taken over, which i don't think this is what you really wanted

Share this post


Link to post
Share on other sites

I need more then just Automation. I need the bot to interactive with the world to know where resource tiles, monsters and whatever else I need the bot to find within the world. So it needs to be interactive not just automation. Like I said a macro(mouse) recorder is not what I am looking for. 

Share this post


Link to post
Share on other sites

Typically when cheating in a Windows game (ex: CheatEngine), the way to go about it is to attach to the process with a debugger (or any other tool that can read memory from the process), look at an integer value on the UI and search for that value in the process memory.  You'll find potentially thousands of memory locations due to the value probably not being very unique, and a lot of memory available.  Then you perform an action in the game that you know can change that value, and search again.  If the memory has not been re-allocated in the meantime you will likely narrow down the memory address for the variable you're interested in.  That's usually fairly easy for integer values or strings.  It's harder (and slower) for floating point values, or values that you aren't sure of their representation in memory.  This also fails for Java and C# if they are using a relocating garbage collector (some mobile GC implementations disable relocation for performance, some keep it on to minimize fragmentation problems); it will depend on how the game was made.

Depending on how the game developers implement resource tiles, map tiles could be an array of tile data, an array of REFERENCES to tile data, or even just a slipshod list of game objects and components in Unity that has no simple and easy-to-manipulate representation in RAM.  At this point it starts heavily depending on how the game is implemented; what language or engine they used, etc.  If they used Unity, their code is in C# and you can probably decompile it from the Assembly-CSharp.dll inside the APK, unless they obfuscated it (in C#'s case that would mean renaming all classes and variables to meaningless things like "A" instead of "TileMap".  If it's written in Java, it's about the same effort and results.  If it's C++ or Unity with IL2CPP then you will have to learn how to be a professional assembly-level reverse engineer to get anything useful out of it.  If you aren't already, we're talking about multiple years worth of effort trying to learn how to do it.

If you luck out and it's unobfuscated C# or Java, your best bet is to modify that code directly to do what you need.  For Unity APKs which do not use IL2CPP, the .Net DLLs will be present and you should be able to edit them to a certain extent using dnSpy.  Unity does make some tweaks to these DLLs itself in order for prefab->script references to find and instantiate the proper classes (and other things like that), so there's a risk that you can break the game completely if you attempt this; I've only modified XNA games for Windows this way, personally.

For Java, I only know of jdGUI for decompiling code; I haven't found anything like dnSpy for Java yet.

For native code (compiled from C++ or IL2CPP) you will need a professional grade disassembler/decompiler such as IDA Pro.  IDA Pro has a free version of their disassembler that will work on the x86 binaries that should be present in Android APKs (Android native code should normally include both ARMv7 and x86 native code since some Androids use x86.  Most use ARM, which I don't believe is freely available in IDA's free version.  Their decompiler is not free and will likely be far outside of your budget.  Remember that if you modify the x86 binary you will have to run the modified version on an x86 processor, which likely means using the emulator since the vast majority of Android devices use ARM.

After that you have to figure out how to reconstruct an APK from your modified files and install it on your device.  If the game has any security measures which try to validate its signature, you will have to find and defeat those during the modification step.  I haven't done this myself so I'm not sure of what you might encounter.

Edited by Nypyren

Share this post


Link to post
Share on other sites
2 hours ago, kevin yiu said:

good luck for what you are looking for, but this kind of bot as if it is available, it probably going to cost you.

Thanks, for the long but very useful explanation. Helps me out a lot. I will figure this out or figure out an alternative.
 

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Forum Statistics

    • Total Topics
      628686
    • Total Posts
      2984237
  • Similar Content

    • By Beny Benz
      Hi,
      I'm currently trying to write a shader which shoud compute a fast fourier transform of some data, manipulating the transformed data, do an inverse FFT an then displaying the result as vertex offset and color. I use Unity3d and HLSL as shader language. One of the main problems is that the data should not be passed from CPU to GPU for every frame if possible. My original plan was to use a vertex shader and do the fft there, but I fail to find out how to store changing data betwen shader calls/passes. I found a technique called ping-ponging which seems to be based on writing and exchangeing render targets, but I couldn't find an example for HLSL as a vertex shader yet.
      I found https://social.msdn.microsoft.com/Forums/en-US/c79a3701-d028-41d9-ad74-a2b3b3958383/how-to-render-to-multiple-render-targets-in-hlsl?forum=xnaframework
      which seem to use COLOR0 and COLOR1 as such render targets.
      Is it even possible to do such calculations on the gpu only? (/in this shader stage?, because I need the result of the calculation to modify the vertex offsets there)
      I also saw the use of compute shaders in simmilar projects (ocean wave simulation), do they realy copy data between CPU / GPU for every frame?
      How does this ping-ponging / rendertarget switching technique work in HLSL?
      Have you seen an example of usage?
      Any answer would be helpfull.
      Thank you
      appswert
    • By ADDMX
      Hi
      Just a simple question about compute shaders (CS5, DX11).
      Do the atomic operations (InterlockedAdd in my case) should work without any issues on RWByteAddressBuffer and be globaly coherent ?
      I'v come back from CUDA world and commited fairly simple kernel that does some job, the pseudo-code is as follows:
      (both kernels use that same RWByteAddressBuffer)
      first kernel does some job and sets Result[0] = 0;
      (using Result.Store(0, 0))
      I'v checked with debugger, and indeed the value stored at dword 0 is 0
      now my second kernel
      RWByteAddressBuffer Result;  [numthreads(8, 8, 8)] void main() {     for (int i = 0; i < 5; i++)     {         uint4 v0 = DoSomeCalculations1();         uint4 v1 = DoSomeCalculations2();         uint4 v2 = DoSomeCalculations3();                  if (v0.w == 0 && v1.w == 0 && v2.w)             continue;         //    increment counter by 3, and get it previous value         // this should basically allocate space for 3 uint4 values in buffer         uint prev;         Result.InterlockedAdd(0, 3, prev);                  // this fills the buffer with 3 uint4 values (+1 is here as the first 16 bytes is occupied by DrawInstancedIndirect data)         Result.Store4((prev+0+1)*16, v0);         Result.Store4((prev+1+1)*16, v1);         Result.Store4((prev+2+1)*16, v2);     } } Now I invoke it with Dispatch(4,4,4)
      Now I use DrawInstancedIndirect to draw the buffer, but ocassionaly there is missed triangle here and there for a frame, as if the atomic counter does not work as expected
      do I need any additional synchronization there ?
      I'v tried 'AllMemoryBarrierWithGroupSync' at the end of kernel, but without effect.
      If I do not use atomic counter, and istead just output empty vertices (that will transform into degenerated triangles) the all is OK - as if I'm missing some form of synchronization, but I do not see such a thing in DX11.
      I'v tested on both old and new nvidia hardware (680M and 1080, the behaviour is that same).
       
    • By HD86
      I have a vertex buffer on a default heap. I need a CPU pointer to that buffer in order to loop through the vertices and change one value in some vertices (the color value). In the past this was possible by creating the buffer with the flag D3DUSAGE_DYNAMIC/D3D11_USAGE_DYNAMIC and using IDirect3DVertexBuffer9::Lock or ID3D11DeviceContext::Map to get a pointer.
      What is the correct way to do the same in DX 12? As far as I understand, the method ID3D12Resource::Map cannot be used on a default heap because default heaps cannot be accessed directly from the CPU. The documentation says that upload heaps are intended for CPU-write-once, GPU-read-once usage, so I don't think these are equivalent to the "dynamic" buffers. Is the readback heap equivalent to what was called a dynamic buffer? Or should I create a custom heap?
      I am thinking to do the following:
      -Create a temporary readback heap.
      -Copy the data from the default heap to the readback heap using UpdateSubresources.
      -Get a CPU pointer to the readback heap using Map and edit the data.
      -Copy the data back to the default heap using UpdateSubresources.
      What do you think about this?
    • By Doggolainen
      Hello, 
      I am, like many others before me, making a displacement map tesselator. I want render some terrain using a quad, a texture containing heightdata and the geometryshader/tesselator.
      So far, Ive managed the utilize the texture on the pixelshader (I return different colors depending on the height). I have also managed to tesselate my surface, i.e. subdivided my quad into lots of triangles .
       
      What doesnt work however is the sampling step on the domain shader. I want to offset the vertices using the heightmap.
      I tried calling the same function "textureMap.Sample(textureSampler, texcoord)" as on the pixelshader but got compiling errors. Instead I am now using the "SampleLevel" function to use the 0 mipmap version of the input texture.
      But yeah non of this seem to be working. I wont get anything except [0, 0, 0, 0] from my sampler.
      Below is some code: The working pixelshader, the broken domain shader where I want to sample, and the instanciations of the samplerstates on the CPU side.
      Been stuck on this for a while! Any help would be much appreciated!
       
       
      Texture2D textureMap: register(t0); SamplerState textureSampler : register(s0); //Pixel shader float4 PS(PS_IN input) : SV_TARGET {     float4 textureColor = textureMap.Sample(textureSampler, input.texcoord);     return textureColor; } GS_IN DS(HS_CONSTANT_DATA input, float3 uvwCoord : SV_DomainLocation, const OutputPatch<DS_IN, 3> patch) {     GS_IN output;     float2 texcoord = uvwCoord.x * patch[0].texcoord.xy + uvwCoord.y * patch[1].texcoord.xy + uvwCoord.z *                    patch[2].texcoord.xy;     float4 textureColor = textureMap.SampleLevel(textureSampler, texcoord.xy, 0);      //fill  and return output....  }             //Sampler             SharpDX.Direct3D11.SamplerStateDescription samplerDescription;             samplerDescription = SharpDX.Direct3D11.SamplerStateDescription.Default();             samplerDescription.Filter = SharpDX.Direct3D11.Filter.MinMagMipLinear;             samplerDescription.AddressU = SharpDX.Direct3D11.TextureAddressMode.Wrap;             samplerDescription.AddressV = SharpDX.Direct3D11.TextureAddressMode.Wrap;             this.samplerStateTextures = new SharpDX.Direct3D11.SamplerState(d3dDevice, samplerDescription);             d3dDeviceContext.PixelShader.SetSampler(0, samplerStateTextures);             d3dDeviceContext.VertexShader.SetSampler(0, samplerStateTextures);             d3dDeviceContext.HullShader.SetSampler(0, samplerStateTextures);             d3dDeviceContext.DomainShader.SetSampler(0, samplerStateTextures);             d3dDeviceContext.GeometryShader.SetSampler(0, samplerStateTextures);  
    • By Vortez
      Hi guys, im having a little problem fixing a bug in my program since i multi-threaded it. The app is a little video converter i wrote for fun. To help you understand the problem, ill first explain how the program is made. Im using Delphi to do the GUI/Windows part of the code, then im loading a c++ dll for the video conversion. The problem is not related to the video conversion, but with OpenGL only. The code work like this:

       
      DWORD WINAPI JobThread(void *params) { for each files { ... _ConvertVideo(input_name, output_name); } } void EXP_FUNC _ConvertVideo(char *input_fname, char *output_fname) { // Note that im re-initializing and cleaning up OpenGL each time this function is called... CGLEngine GLEngine; ... // Initialize OpenGL GLEngine.Initialize(render_wnd); GLEngine.CreateTexture(dst_width, dst_height, 4); // decode the video and render the frames... for each frames { ... GLEngine.UpdateTexture(pY, pU, pV); GLEngine.Render(); } cleanup: GLEngine.DeleteTexture(); GLEngine.Shutdown(); // video cleanup code... }  
      With a single thread, everything work fine. The problem arise when im starting the thread for a second time, nothing get rendered, but the encoding work fine. For example, if i start the thread with 3 files to process, all of them render fine, but if i start the thread again (with the same batch of files or not...), OpenGL fail to render anything.
      Im pretty sure it has something to do with the rendering context (or maybe the window DC?). Here a snippet of my OpenGL class:
      bool CGLEngine::Initialize(HWND hWnd) { hDC = GetDC(hWnd); if(!SetupPixelFormatDescriptor(hDC)){ ReleaseDC(hWnd, hDC); return false; } hRC = wglCreateContext(hDC); wglMakeCurrent(hDC, hRC); // more code ... return true; } void CGLEngine::Shutdown() { // some code... if(hRC){wglDeleteContext(hRC);} if(hDC){ReleaseDC(hWnd, hDC);} hDC = hRC = NULL; }  
      The full source code is available here. The most relevant files are:
      -OpenGL class (header / source)
      -Main code (header / source)
       
      Thx in advance if anyone can help me.
  • Popular Now