Hello everybody and welcome to the third chapter of my Supercell reverse engineering posts chain. As said in the second post of the chain, everything has been so quite till the beginning of october, where a missive update has hit Clash Royale, Clash of Clans and Boom Beach.
New content has been introduced for almost all of the games and also, I’m happy to see some real security actions that has been taken to prevent reverse engineering and binary manipulation. That measures can be found inside Boom Beach, probably implemented only over there to have some feedbacks about the general score and a reaction from the reverse engineering scene.
Analayzing the changes for each game
Clash Royale
The focus of this update was certainly for the content. The new game mode, the quests and all the various changes that has been implemented from Clash Royale development team never really touched the security, which is the main topic of this post. The public server key is changed, as usual, and can be found at offset 5156872.
Clash of Clans
I can’t say that much about the content, since I’m not a CoC player, but I can start spending 2 lines on security changes here. My previously crack, documented in the first post, has been fixed (very softly). The other 2 methods used by private servers owners are left untouched, probably due to the nature of the projects which keep the works in a closed source state. Still wondering why they didn’t diff the modified binary supplied by private servers to prevent that patching too. I would imagine, due to the fix shipped in this new update, that Supercell is aware of my works and probably they are now keeping a better look to my post chain! Anyway, the time needed to found a new little hole to inject a 4 byte payload wasn’t that much.
The new payload injected in the same spot (with a different offset) is now changed to FC68, which translated to ARM assembly would be:
LDR R4, [R7, #0xC]
R7 struct still hold the hardcoded key at position 0xC which we can still use to generate our magic key. Pinocchio has already been updated to patch and proxy it
Boom Beach
Boom Beach is where the real magic happens! Let me go really streight. I’ve reach the goal. As said in my previous posts, my goal/challenge, is on protocol and encryption. The purpose of what I do is reading and understanding protocols and logics, and of course to bypass any kind of encryption if used. Boom Beach has been released with login involved encryption functions obfuscated, with some sort of antitamper which prevent binary modifications (this was really enough…), with something before login that prevent any debugger to be attached to the game process. Any tools that you are going to use on Boom Beach to attempt any kind of actions will be messed up. IDA can’t properly parse login encryption instructions, can’t generate any pseudo-code and functions signature are messed up as well. GDB, which i was used to use until now can’t be attached (maybe :P… I still have a valid solution for it that will se the light once whatever is this named will be shipped with Clash Royale or Clash of Clans). Any attempt to modify the binary will result as well in nothing, the game will just crash and whatever payload you are going to write, it will be re-written, not hard to understand that a checksum or similar method has been added. Once obfuscations has been figured, first good thing… Encryption isn’t changed at all!
Changing the modus operandi
Yeah. Why should I keep touch the binary? I would probably find a way to get rid to whatever is preventing me to inject a payload if i will be forced to, but actually, the goal is to read and understand… so, i wish @Ultrapowa and all his team to find a solution for their project (a lot of respect for him even if his main project is something that I personally don’t like). As said, I would also find a way to properly attach GDB but this time I had fun with Frida and JS.
Obfuscating is terrible
I mean why? I’ve learnt a lot just by translating back a lot of the logic used, why you want to stop people that love to learn?
Oh my lovely Frida…
Looks like we all did forget about Frida? Or maybe not. Even Frida turn out to be a bad way to follow at the beginning. Problem is still that SIGILL with illegal opcode thrown as well when attaching IDA debugger or GDB.
The game is not over yet
Exactly, the game is not over yet. The same crack used on CoC can be used as well on BoomBeach, the 2 offsets can be found easily through all the messed asm and the patch can be applied with notepad++ hexeditor plugin (this was discoveredater) or similar tools. Im gonna close this blog post with a dump from my tools, a public repo can be found on my personal github profile!. Waiting for this on Clash Royale! See you to the next chapter!
A better readable dump with code snippet can be found here!
SENT HELLO!
LOGIN!
ENTERING KEYPAIR
LEAVING KEYPAIR!
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 9f 67 08 7c 81 96 48 48 4f 9b ce d7 98 15 ae b7 .g.|..HHO.......
00000010 f8 34 2e 36 14 15 7e 1a b8 a2 35 a4 d8 dc ad 50 .4.6..~...5....P
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 2f e1 c7 59 ef e0 41 22 64 a9 7d cc d0 59 96 a4 /..Y..A"d.}..Y..
00000010 fe e3 d7 a1 51 fb d8 89 16 c7 1c dc 33 b3 3b eb ....Q.......3.;.
UPDATING B2
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 9f 67 08 7c 81 96 48 48 4f 9b ce d7 98 15 ae b7 .g.|..HHO.......
00000010 f8 34 2e 36 14 15 7e 1a b8 a2 35 a4 d8 dc ad 50 .4.6..~...5....P
UPDATING B2
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 81 dc 6b 89 6f b5 c9 36 0a fb 9f 51 41 db ae 21 ..k.o..6...QA..!
00000010 41 c1 ab 94 17 66 84 b0 0b 8e e6 76 29 a8 74 00 A....f.....v).t.
B2 FINISH!
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 18 00 00 00 10 c9 bd f2 67 e6 09 6a 3b a7 ca 84 ........g..j;...
00000010 85 ae 67 bb 2b f8 94 fe 72 f3 6e 3c f1 36 1d 5f ..g.+...r.n<.6._
00000020 3a f5 4f a5 d1 82 e6 ad 7f 52 0e 51 1f 6c 3e 2b :.O......R.Q.l>+
00000030 8c 68 05 9b 6b bd 41 fb ab d9 83 1f 79 21 7e 13 .h..k.A.....y!~.
00000040 19 cd e0 5b 00 00 00 00 00 00 00 00 00 00 00 00 ...[............
00000050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00000060 00 00 00 00 9f 67 08 7c 81 96 48 48 4f 9b ce d7 .....g.|..HHO...
00000070 98 15 ae b7 f8 34 2e 36 14 15 7e 1a b8 a2 35 a4 .....4.6..~...5.
00000080 d8 dc ad 50 f6 e0 7c 02 b7 28 df ee 9a 84 92 04 ...P..|..(......
00000090 b2 ac 1a 30 04 ae 3c e1 91 09 2a e9 ae 51 88 db ...0..<...*..Q..
000000a0 41 76 85 28 00 00 00 00 00 00 00 00 00 00 00 00 Av.(............
000000b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
000000c0 00 00 00 00 00 00 00 00 ........
ENTERING NM
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 f9 a3 d2 d5 de cb b9 e0 c7 81 c1 0f f5 ed ad a2 ................
00000010 f0 b9 8b 50 aa 59 df 79 ...P.Y.y
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 0c 81 48 d4 66 40 7e 47 a7 23 11 b7 ea 03 af 1b ..H.f@~G.#......
00000010 49 a3 bb 0c 0c d4 5f e6 b9 95 24 fa e1 6a 6f d2 I....._...$..jo.
// login encrypted
0 1 2 3 4 5 6 7 8 9 A B C D E F 0123456789ABCDEF
00000000 27 75 00 01 81 00 03 9f 67 08 7c 81 96 48 48 4f 'u......g.|..HHO
00000010 9b ce d7 98 15 ae b7 f8 34 2e 36 14 15 7e 1a b8 ........4.6..~..
00000020 a2 35 a4 d8 dc ad 50 cd 69 40 a7 64 48 54 69 7a .5....P.i@.dHTiz
00000030 c4 ad a2 95 32 42 2a d0 4a 37 66 8c cd 85 6b 76 ....2B*.J7f...kv
00000040 fb da f0 cf ba fb c3 8e 24 c1 b2 b4 3b e4 08 5c ........$...;..\
00000050 3b fd 19 b3 c4 9d 2b 97 45 e4 9f 78 7a 88 2d 2c ;.....+.E..xz.-,
00000060 aa 07 19 bf 33 98 13 7f 42 e6 04 9c f5 71 dd 7c ....3...B....q.|
00000070 c7 f0 54 cc c6 60 d3 87 1c 08 82 1c 8f 5a 0d 23 ..T..`.......Z.#
00000080 c4 7f d7 5a 2a 22 bf 79 35 24 56 d5 47 a4 6f 26 ...Z*".y5$V.G.o&
00000090 8e cd 0b 20 05 90 1f cb c4 24 58 37 83 3b 4d a9 ... .....$X7.;M.
000000a0 7f c3 8f 5d e1 55 e7 b7 eb 34 e0 82 41 90 73 a6 ...].U...4..A.s.
000000b0 6f 84 74 89 ab de ea 7a b3 90 25 29 7d 88 d0 63 o.t....z..%)}..c
000000c0 de 23 ec 7d 55 ee 65 bf e9 c6 c0 68 3d 4e 96 90 .#.}U.e....h=N..
000000d0 30 05 d8 88 a2 d6 32 af 21 c8 98 f1 18 22 4d 64 0.....2.!...."Md
000000e0 41 0e 02 67 42 39 05 80 01 38 57 94 74 35 93 37 A..gB9...8W.t5.7
000000f0 a9 84 9a 63 e1 a0 99 52 58 c1 39 50 47 b6 5a 70 ...c...RX.9PG.Zp
00000100 97 08 88 b9 af ec aa cb f7 ad 41 1b 7c a1 c1 e3 ..........A.|...
00000110 8f af f0 d0 2d a4 5c f3 ee fc e4 d3 5b 68 36 5d ....-.\.....[h6]
00000120 db 53 d0 47 a0 b9 0f 6a 29 23 e7 c7 14 29 f8 ce .S.G...j)#...)..
00000130 83 c9 88 96 d9 eb 57 fd 0a 6e 62 cf 22 e2 b8 97 ......W..nb."...
00000140 fa 4d f3 fd 1a 4c ba 3e 4c 7a ee c0 09 7c 77 bc .M...L.>Lz...|w.
00000150 a1 47 7f d4 22 da bb 1d 87 77 2b f6 99 44 bf 14 .G.."....w+..D..
00000160 44 97 b8 f2 a7 5d ea c4 57 39 77 c1 05 1a 23 32 D....]..W9w...#2
00000170 b6 e3 a9 9b f5 54 79 72 4f f7 ca 8a 97 b7 93 63 .....TyrO......c
00000180 ef 6b 75 6d 99 ce 13 08 .kum....
// decrypted
00000004e0000002862396661313536326161363932313562656632376334313037626263373065356433616332633037000000000000001034633363346630623835346630623361000000074c472d48383530001e84840000000569742d49540000002431636261356432312d336139352d343830322d623035392d32353436303331303333343800000003372e30020000000000000010346333633466306238353466306233610000002430646464633864632d646233622d346635632d626233652d3530313431633335316637370000000001000000020000000000000000ffffff88