These day I was playing a new iOS game named Road to Dragons, ロード・トゥ・ドラゴン.
Analysis the file system found all the cache data store form a plist file which is in /Library/Preferences/jp.co.acquire.RTD.plist
In my experience this kind of game will connect to server when out of battle. It will use local calculator to calculate the battle result. So it could be cracked during the battle.
I found the plist file contain a line like
LOGINBONUS_PARAM
{“m_BonusLife”:0,”m_BonusAttack”:0,”m_BonusRecovery”:0,”m_BonusEvoPoint”:0,”m_BonusSoulPoint”:0,”m_BonusCriticalRate”:0,”m_BonusDropRate”:0,”m_BonusQuestMoney”:0,”m_BonusQuestExp”:0,”m_BonusQuestFriendPoint”:0}
That’s a strange line in this mass file, so I change all 0 to 100000 and try to get all the bonus.
It worked…So this game company use client and clean text (Ok, only Xcode can open this plist file) to calculate the battle and even it is multiplication…

Ok…That’s my first time to crack a online game…Maybe I will try more later…

Update, pets soul could be changed too…
Edit MDBS30 and change quest’s reward_soul value…
What a suck game!

10 Responses to “Cracked a Japanese iOS Online game…”

  1. Hi~
    After realizing which one is the save log of the game, I took a look of it and thought it’s crackable.
    However, I’m not sure if there’s an update recently or what, m_BonusXX you mentioned is not working.
    They seems to be protected by the hash value ahead, and if the system find the missmatch, it will kill the current save log and create a new one (which means NEW GAME).

    • m_BonusXX will always update after you everyday login. Make sure you change it after you everyday login && totally quit the game.
      Not all the data in hash, because I tested if you totally remove MDBS30 string, the game works good. Like this is only a cache string which store all the quest information. But if without this cache, the quest would be use server information.
      Suggestion is change m_Bonus && first quest’s reward_soul…

      • I don’t understand what to do with the MDBS30 string.
        What I’m trying is directly edit the bonus of mission. It works when entering the mission, but still has problem getting reward.
        Now I’m pretty sure that all the user data is stored on the server(including money, lv, units), the save log only record the uid and the name.
        The detailed information about units and mission is also in the file.

        • Yea, all user data in server, but some of the battle calculation is using local variable stored in MDBS30.
          Have you find out “reward_soul”, you could change all the “reward_soul” value with Regexr.

          • The MDBS30 string I found is “MDBS30YLDBS11133XLDB11230UMDB31_kFacebookAppIdKey”, and login bonus are
            “LOGINBONUSYLDBS12040YLDBS11002XL0(…)” and “LOGINBONUS_PARAMYLDBS12062XLDB112(…)”.
            I have no idea what they stand for.

            I did find the bonus setting string which is
            “”hash”:”4288497945″}_捼”m_BonusLife”:1000,”m_BonusAttack”:0,”m_BonusRecovery”:0,”m_BonusEvoPoint”:0,”m_BonusSoulPoint”:0,”m_BonusCriticalRate”:0,”m_BonusDropRate”:0,”m_BonusQuestMoney”:0,”m_BonusQuestExp”:0,”m_BonusQuestFriendPoint”"
            , and I tried to modify it, it turned out to be blocked from loading at the game loading section. It is possible that the hash value is not checked very time loading, just like the mission setting string.

          • It shouldn’t have any stuff like that “”hash”:”4288497945″}_捼
            If you really not sure plz login and quit then send me the plist file (i@moe.ai). I will edit for you and it should be work before next day login.
            BTW, are you using XCODE or plistset.exe? Try these software open it first.

          • Now I successfully edit the bonus you mentioned. The problem could be that you have to obtain the bonus before you can edit the value.
            And it is possible to “hijack” the battle session, since it’s totally offline and stored in the same plist. As long as you don’t finish the battle and connect to the server(battle report), you can restore the battle at any save point.
            My tool is ifile + ultraedit.

          • Looks like my guess is wrong…
            I can’t have two more bonus at once, and the bonus life is limited to 9999, and bonus attack is limited to 999.
            By the way, the hash value isn’t an ordinary one.
            If it’s convenient for you, would you send me a modified clean(right after finishing the training) plist file?
            Thank you.

  2. - -为嘛我想到了八门神器, - -

Leave a Reply to Neko Cancel reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>