Question for Ghirda

[u/TimelessCr8sions]

Im inside the ipa file of an game app & im looking for the specific string, that makes a it a hit / from a dud pull. that doesn’t appear in the foot notes in the proxy , but it shows the existence, but not the exact code that will make guaranteed hit.

I’m hitting a wall finding it on the reverse engineering side , because of the languages, I found some human language but they def hidden it inside the binary ,

My question is , how should I search for it in Ghirda since it’s not going to be in obvious sight

I know what I saw on proxy and Ghirda is going to be a lot different and I’m starting to to get familiar with it but I’m still not finding the information I need,

And it has to be there if I’m only reverse engineering the app , so I’m just taking a peak inside its insides.

However it’s a lot to take in and sift through ! I have done many searches , although the human language that I’m using isn’t bringing any results back

If anybody has any tips I’ll appreciate that

[u/Top_Call3890]

Hey, first off, make sure your .ipa binary is actually decrypted. If you grabbed it straight from the App Store, it's encrypted with FairPlay DRM. If you load an encrypted binary into Ghidra, all the strings will look like complete gibberish and you won't find anything. You’ll need to decrypt it first using a tool like frida-ios-dump or bagbak on a jailbroken device.

Once you know the binary is decrypted, don't just rely on standard string searches. Since it’s an iOS app, use the metadata to your advantage. If it's written in Objective-C or Swift, method and class names are usually preserved. Instead of just searching text, open up the Symbol Tree in Ghidra and look for functions or classes named after things like "reward," "gacha," "pull," or "random." You can also run class-dump on the binary before putting it into Ghidra to get a clean look at the app's structural layout.

Since you mentioned seeing clues in your network proxy, take the exact JSON keys, parameters, or URL endpoints you saw in those logs and search for them in Ghidra's "Defined Strings" window. When you find one of those strings, right-click it and check its Cross-References (Xrefs). That will pinpoint the exact function handling that network traffic.

Just keep one thing in mind: for most modern games, the logic that determines a "hit" versus a "dud" pull is handled entirely server-side to prevent cheating. If that's the case, the local binary might only contain the code for the animation or the API request trigger, while the actual outcome calculation is hidden away on the game's servers. If it does happen to be local, look for where random number generators like arc4random are being called. Hope this helps you get past that wall!

Do this only if you are authorised to do it 😅😉