How to hack the Sandbox game

The Sandbox” is a powder gameĀ recently ported to Android. It’s fun, but they try to get you to buy “mana” to unlock stuff that you need to use in the normal course of the game. Nope, not gonna do that.

We can hack the Android version to drop the price of elements to near-free.

To do this:

  1. Get the Sandbox APK by backing up the installed game (ES File Manager’s App Manager can do this)
  2. Transfer APK to PC
  3. Extract it as a ZIP file
  4. Edit assets/shop.plist to drop prices to 3 mana for each element
  5. Rezip the files
  6. Use the “testsign.jar” tool to sign the ZIP, thus making it an installable APK:

    java -jar testsign.jar hacked.zip ready-to-install.apk
  7. Uninstall the non-hacked game from your device
  8. Copy the hacked APK to your device
  9. Install the hacked APK.

All the elements should now cost just 3 mana, so head to the element store and unlock them all.

Getting around stability/sound issues

On my Nexus 7, the hacked version of the game didn’t have sound for some reason and I saw a few glitches.

To fix this, I just:

  1. unlocked all the elements,
  2. backed up the profile data (/sdcard/Android/data/com.pixowl.thesandbox.android),
  3. uninstalled the hacked APK,
  4. installed the normal APK, and
  5. restored the profile data.

After re-launching the game, the unlocked profile remains with sound restored.

Methods which didn’t work

There is a guide to hack the iPhone version by editing rewards.plist, a file which exists in the Android version too, but making the change suggested in that guide had no effect, which is why I hit the shop.plist instead. Perhaps they left that file as a red herring?

Also, you may be tempted to try to edit the player profile.dat directly to change your mana, and you can find the binary number to do it (offset 0x94), but the file is hashed with a 160-bit hash (probably SHA-1), and the hash is salted or something, because I couldn’t figure out how to re-sign it.

Leave a Reply

Your email address will not be published. Required fields are marked *

*