1
// Frida script to find and modify coins in PWNKnight game
2
// Initial coin value: 20
3

4
console.log("[*] Coin Modifier for PWNKnight");
5
console.log("[*] Initial coin value: 20 (encoded as 40 in Dart Smi)");
6

7
const moduleName = "libapp.so";
8

9
// Wait for module to load
10
function waitForModule() {
11
  return new Promise((resolve) => {
12
    const check = setInterval(() => {
13
      const mod = Process.findModuleByName(moduleName);
14
      if (mod) {
15
        clearInterval(check);
16
        resolve(mod.base);
17
      }
18
    }, 5000);
19
  });
20
}
21

22
waitForModule().then((base) => {
23
  console.log("[+] libapp.so loaded at: " + base);
24

25
  // Strategy 1: Hook the coin read function
26
  console.log("\n[*] Strategy 1: Hooking coin read at 0x3f1d80");
27

28
  const coinReadAddr = base.add(0x3f1d80);
29
  let gameStatePtr = null;
30
  let coinAddr = null;
31

32
  Interceptor.attach(coinReadAddr, {
33
    onEnter: function (args) {
34
      // At this point, v6 register (x26) contains game state pointer
35
      const v6 = this.context.x26;
36

37
      try {
38
        // Calculate: *(_QWORD *)(v6 + 120) + 6440
39
        const ptr1 = v6.add(120).readPointer();
40
        coinAddr = ptr1.add(6440);
41

42
        // Read current coin value
43
        const coinSmi = coinAddr.readU64();
44
        const actualCoins = coinSmi.toInt32() >> 1;
45

46
        console.log("\n[*] Coin read detected!");
47
        console.log("    Game state (x26): " + v6);
48
        console.log("    Coin address: " + coinAddr);
49
        console.log("    Coin value (Smi): " + coinSmi);
50
        console.log("    Actual coins: " + actualCoins);
51

52
        // Save for later modification
53
        gameStatePtr = v6;
54
      } catch (e) {
55
        // Ignore errors during initial attempts
56
      }
57
    },
58
  });
59

60
  // Strategy 2: Hook shop purchase to intercept price check
61
  console.log("\n[*] Strategy 2: Hooking price check at 0x3f1d94");
62

63
  const priceCheckAddr = base.add(0x3f1d94);
64

65
  Interceptor.attach(priceCheckAddr, {
66
    onEnter: function (args) {
67
      // At this point:
68
      // x2 = current coins (Smi encoded)
69
      // x0 = item price (Smi encoded)
70
      // Comparison: if (coins < price) return;
71

72
      const currentCoins = this.context.x2.toInt32() >> 1; // Decode Smi
73
      const itemPrice = this.context.x0.toInt32() >> 1; // Decode Smi
74

75
      console.log("\n[*] Purchase check:");
76
      console.log("    Current coins: " + currentCoins);
77
      console.log("    Item price: " + itemPrice);
78

79
      try {
80
        const newCoins = 999999999; // จำนวน coins ที่ต้องการ
81
        const smiValue = newCoins * 2; // Encode เป็น Smi
82

83
        Memory.protect(coinAddr, 8, "rwx");
84
        coinAddr.writeU64(smiValue);
85

86
        console.log("[+] Modified coins in memory to: " + newCoins);
87
        console.log("    (Smi value: " + smiValue + ")");
88

89
        // อัพเดท register ด้วย
90
        this.context.x2 = ptr(smiValue);
91
      } catch (e) {
92
        console.log("[-] Error modifying coins: " + e);
93
      }
94
    },
95
    onLeave: function (retval) {
96
      // ตรวจสอบว่าการ purchase ผ่านไหม
97
      // บาง implementation อาจ return boolean หรือ error code
98
      console.log("    Return value: " + retval);
99
    },
100
  });
101
});