Smali Code Injection: Playing with 2048!

Injected 2048

I’ve met 2048 game many years ago. It is an addictive game witch takes lots of time from the player. 🙁

So what should I do if I want to have high score and save time? Here is where Smali takes part. 🙂

In this post I will describe how to inject into Android 2048 game and change the score!In the “Smali Code Injection” I describes how to inject into Android APK. The steps is like previous post but finding where to inject is the problem.

First of all I’ve downloaded 2048 APK and get Smali code with apktool.

Then I should find where the logic of the game is (the class and method). If the application is not obfuscated, you can use online tools such as Java Decompilers. Or you can use DEX2JAR and JDGUI.

If the application is obfuscated you should put some debug information in beginning of every method and trace the execution logic.

Fortunately 2048 was not obfuscated. So I’ve looked the logic and find where the score is changed.


The code above is where new button created (2 or 4).

this.grid[x][y] = 4;

} else {

this.grid[x][y] = MOVE_3;

And finding the Smali code is the next step.

The point is that v10 contains the number 4. v9 contains 2 (in the ELSE section). v9 changed from const/4 v9, 0x2 to const/16 v9, 0x400 (0x400 = 1024). This is the good one because v9 is not reused after assignment. But unfortunately v10 assigned in the first lines of method and used before aput v10, v8, v6.

So I’ve added a new variable (v11) and assigned the value of the first lines to it. And changed the locas from 11 to 12.

So after creating APK and signing it with your certificate, the APK is ready to be installed. (if you are not familiar with signing and repacking, check previous post).

The screen shots of the new injected application are here:

I’ve uploaded both the APKs here. You may download and use them.

2048 Game [Main].apk

2048 Game [Injected].apk

Comments

No comments yet. Why don’t you start the discussion?

Leave a Reply

Your email address will not be published. Required fields are marked *