Hacking Candy Crush Saga Game Saves in iOS – No Jailbreak Required

***** Updated with additional hex addresses and info below, thanks to Aurora1, idrc, sloym, and Gil Disatnik! *****

It’s sad to admit, but I’ve played Candy Crush Saga…quite a bit in fact.

It’s a fantastic time waster, and it appeals to my perfectionist nature. There is nothing quite like getting 3-stars on each and every level throughout the game. The only hitch is the built-in time limiters which the company uses to lure you into purchasing things such as extra lives and boosters. “The first one’s free”, as they say, but addictive as this game might be, you’re kidding yourself if you think this guy is handing over cold hard cash for a couple of extra lives. Not a chance!

Frustrated with the time/paywalls built into the game, I figured that I could play around with the game save files in iOS and make some tweaks in my favor. I was correct, and it’s downright easy too!

You’ll need a few things to get started: An iPhone of course, along with its USB dongle. You will need a copy of iFunbox (or similar program to access the phone’s file system), along with a hex editor. I happen to use HxD for this task as it’s lightweight, free, and has a nice compare tool built in.

Connect your iPhone to your PC and open up iFunbox. For what it’s worth, I prefer to use the application’s classic interface – it just seems more straightforward. Navigate to User Applications > Candy Crush > Documents as shown below and copy the save_##########.dat file to your computer. I suggest making a backup of this file just in case you screw things up along the way.

ifunbox

Open the save file and change the offsets listed below to suit your needs. I typically set each one to “FF” I typically set each offset to FFFFFF (Thanks Gil!), but you can chose whichever value works best for you. In the image shown below, I have set the number of lives to the hex value “FF”

hxd_lives

The offsets are as follows. Obviously there are some boosters not listed here, but as I come across them, they will be added to the list.

0x00000290 00 - Lives
0x00000050 00 - Color Bomb
0x00000050 0C - Jelly Fish
0x00000060 08 - Coconut Roller
0x00000070 04 - Lolipop Hammer
0x00000090 08 - Lucky Candy
0x000000A0 04 - Wrapped and Striped

Unlock all Yeti Shop items for free – Set ALL offsets to “FF”(Thanks sloym!)

0x000001C0 0C
0x000001C0 0D
0x000001C0 0E
0x000001C0 0F
0x000001D0 00
0x000001D0 01

Once you have finished editing the file, and you are sure you have done it correctly, save it then make a copy. Rename this copy to save_##########.bak, and then copy both files back to your phone.

The next time you open Candy Crush Saga, you should see something like this:

photo 1

That’s a lot of lives – no more waiting!

photo 2

The asterisks presumably indicate that you have more than 9 of each booster, but I’ve never seen them get that low.

One could make the argument that this takes money from the hands of developers – and it’s a good point, that. My view however, is that I would never buy any of the items offered in-game, rather I would simply stop playing it. This at least gives the devs a chance to bombard me with annoying ads. That’s payment enough if you ask me.

Happy hacking!





68 Responses to “Hacking Candy Crush Saga Game Saves in iOS – No Jailbreak Required”

  • Aurora1:

    do you have any new offsets for us ?
    the 0×00000070 04 = Lollipop Hammer
    i am searching for the +5 More Moves offset, do anoone know it ?

  • can you teach me how to identify the code ? for ex. how you identified these
    0×00000290 00 – Lives
    0×00000050 00 – Color Bomb
    0×00000050 0C – Jelly Fish
    0×00000060 08 – Coconut Roller
    0x000000A0 04 – Wrapped and Striped

    pls dont tell me you spend your time trying each and every code to find it.

  • FDGodxD:

    i tried your method for the same game (candy crush) and it worked. but i tried to find how to increase my gold in “Heroes vs Monsters”. cant seem to find it. can you help me by identifying the code for the gold, or maybe others as well if you have the time to. you have my email. thanks.

    • Mike:

      I basically waited until I was given a booster by the game, then I took a copy of the save file. I then used one of the boosters, and pulled another copy of the file, doing a compare afterward.

      As long as all you do is use the booster and then quit the level, the only value that should change is the booster, if I recall correctly.

      Lives might change as well, but as I identified that offset first, I ignored it going forward.

      Let me take a look at HvM to see what I can see!

  • irdc:

    0×00000090 08 = Lucky Candy

  • Mike:

    Thanks for those additional offsets, I will add them to the list.

    As far as finding more, that will likely cost $$. From what I understand, all of the other boosters such as extra moves, etc. require payment. If I get around to buying some, I will certainly add them to the list!

  • Dadi:

    Thanks for your method, it works like a charm!

    However, I would like to know how to completely restart the game from level 1 (Facebook linked account). I have erased all accessible datas, incl. on my Facebook account, I have uninstalled the app and reinstalled it, without success. Is there any way to modify the social datas in order to restart from level 1?

  • Aurora1:

    Hello,

    here is a actual list for the aviable boosters.
    http://candy-crush-saga.wikia.com/wiki/Booster

    And the hint when it is unlocked, it should be simple to find more hex offsets, whit this infos.

  • arnie:

    something interesting but not that good

    0×000002A0 0E = 00 – this gives you the connect to facebook first time bonus at first login screen when you start the game and any other number disables it !!!

  • arnie:

    i did post this on xsellize but nobody reply :(

    change these ranges to the below and it will unlock all bridges at you get to them so you dont have to spoil your own save game with some elses highscores – please note this is only upto 395 – if someone has a save game with all the levels complete to 440 then we can change those FF FF codes to the correct value for all levels

    0×00000200 0C to 0×00000280 0F

    18 00 00 00 23 00 00 00 32 00 00 00 41 00 00 00 50 00 00 00 5F 00 00 00 6E 00 00 00 7D 00 00 00 8C 00 00 00 9B 00 00 00 AA 00 00 00 B9 00 00 00 C8 00 00 00 D7 00 00 00 E6 00 00 00 F5 00 00 00 04 01 00 00 13 01 00 00 22 01 00 00 31 01 00 00 40 01 00 00 4F 01 00 00 5E 01 00 00 6D 01 00 00 7C 01 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

    • arnie:

      i added the levels to the bottom of the save and it lucked the bridge codes for me so from start to finish 440 level

      0×00000200 0C to 0×00000280 0F

      change to the below and then use your own level high scores :)

      1B 00 00 00 23 00 00 00 32 00 00 00 41 00 00 00 50 00 00 00 5F 00 00 00 6E 00 00 00 7D 00 00 00 8C 00 00 00 9B 00 00 00 AA 00 00 00 B9 00 00 00 C8 00 00 00 D7 00 00 00 E6 00 00 00 F5 00 00 00 04 01 00 00 13 01 00 00 22 01 00 00 31 01 00 00 40 01 00 00 4F 01 00 00 5E 01 00 00 6D 01 00 00 7C 01 00 00 8B 01 00 00 9A 01 00 00 A9 01 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

      • Wil:

        These are just the level number of the first level of the episodes.
        eg 0x1b = 35 (means level 36, they start at 0 internally). … 0x1a9 is 425, meaning 426 (or end of last==425).

        While I’m here … the last level you passed (max level) is at 0×0008 (obviously not checked since people have been manually changing the bridge), the last level played is at 0×0298, the quest levels are in the range (0x02c3, uneven offset), the quest number at 0x02af, the quest timestamp at 0x02b7 (last guest complete), a quest state at 0x02bf, the current episode at 0x020C and the last game played at 0x029c (seconds from 1970, unix time).

        Easiest way to work most of these out is to save the game every now and again and do a binary diff. And reinstall, etc (haven’t bothered yet). My phone died and I rarely connected to facebook so needed to work these out to get through the guests quickly.

        Pretty old school hacking. Reminds me of the Amiga days.

        Still stunned they are in the clear and without even a checksum or parity check. I guess they want people to play with the game (more interest) and have the ability to change it if they like (more levels in next version, must upgrade)!

        • Wil:

          Oh… and the obvious ones… level score and starts. 4 bytes each (just a series of ints). If you can’t find these you’re not trying hard enough!

          The file size and structure needs to change once they exceed 512 levels (mobile version).

  • arnie:

    please note that first value at 0×00000200 0C will change from 18 to something else when we add more levels (hmm i think so anyhow)

  • arnie:

    please please that that ranges 0×00000290 00 to 04 – control the number of Lives not only 00

  • arnie:

    another interesting one is that

    0×00000040 0C – change this from 00 to 01 unlocks the Color Bomb from level one instead of the required level 13

    i did find the fish unlock but i lost it i will post it when i find it again

  • arnie:

    now here a strange for for you

    0×00000050 04 – if you put a 01 it puts a tick to select colour bomb on colour levels and allows you to untick if you dont want it

    BUT…. if you put 02 or above it puts the tick on & WONT let you remove it – how strange is that then !!! :)

  • arnie:

    found this one for Striped and Wrapped

    0×000000A0 00 – imputing 01 unlocks – Striped and Wrapped without the level requirement

  • enam:

    Everything above really helped me,, the only thing i ignored is unlocking level coz i wanna unlock them as i progresses,,, can anybody plz post the offset of +5xtra lives

  • love:

    not able to hack anything. i saved the setting.bak & Save.bak files to the document folder of candy crush.

    pls help to hack levels. im on 103 level. i want to clear most to the further level.

  • Gil Disatnik:

    Just a small remark – all values are actually 4 bytes long (int) so basically you could have 0xFFFFFFEF on each value.
    (The EF at the end is not an error, FF on the last byte overflows the value, I guess it’s a signed int but I never bothered to check it…)

  • Gil Disatnik:

    Sorry, my bad – it overflows much sooner. Just use 24 bits (0xFFFFFF) – it gives you 16 million lives/powerups, sounds enough for me…

  • Smith007:

    Hello,

    Super intéressant, pouvons-nous avoir une récapitulatif de tout cela.
    Grand merci

  • ValyPilot:

    0×00000008 00 – freezing time

  • Smith007:

    je suis au niveau 440 est impossible d’allé plus loin :-(
    Avez-vous une astuce ?
    Merci à tous

  • Smith007:

    00 00 00 00 00 00 00 00 00 00 00 00 1E 00 00 00 23 00 00 00 14 00 00 00 32 00 00 00 41 00 00 00 50 00 00 00 5F 00 00 00 6E 00 00 00 7D 00 00 00 8C 00 00 00 9B 00 00 00 AA 00 00 00 B9 00 00 00 C8 00 00 00 D7 00 00 00 E6 00 00 00 F5 00 00 00 04 01 00 00 13 01 00 00 22 01 00 00 31 01 00 00 40 01 00 00 4F 01 00 00 5E 01 00 00 6D 01 00 00 7C 01 00 00 8B 01 00 00 9A 01 00 00 A9 01 00 00 B8 01 00 00 C7 01 00 00 FF FF FF FF FF FF FF FF
    Je suis bloqué au niveau 462, je ne vois pas ou il faut modifier ??
    D’avance merci à tous

  • Anep:

    why it doesn’t work on my candy crush ? is this work with candy crush version 1.22.1 ?

  • Jo:

    Looking for the offset for other boosters… Like Sweet Teeth, Bomb Cooler, Charm of Life, Striped Booster, Mystery Candy Booster, and Bubblegum Troll… anyone know the hex offsets?

  • sloym:

    Hello I Found out that 0x000001C0 – 0C 0D 0E 0F plus 0x000001D0 – 00 & 01 set to FF unlock the items of the Yeti Shop !!

  • fruit:

    sloym, can you explain this better? are you saying to set 6 blocks to FF? Also, what do you mean “unlock the items of the Yeti Shop”? Is everything free or just available?

  • YetiYetiBangBang:

    To clear quest challenge timeout –
    00002B0 00 – change value to 01

  • FoxAlpha:

    Hi, I found the “Free switch” booster value : 0x000000B0 – 00

  • arnie:

    i know you prob dont care – BUT… jelly spash is just as easy to hack for unlimited coins

    both the facebook save profile and none facebook profile – and you keep your own save game.

    just load user.json (offline profile) and **********_user.json (facebook profile) files into HxD (works on latest version as i just tried it)

    search for “hardCurrency” once you have found the data then just update this record to this – “hardCurrency” : 955000485,. – that gives you the maximum amount of coins no more messing around with asking people for them. and you can just unlock the level keys with coins as you get to them.

    you can change and add level scrores but they seem to be in a random format that wasnt straightforward but i did try import the levels from my facebook profile to my offline profile and that works perfectly

    • cptpiccard:

      Hello Arnie

      Thanks for the help :)

      What is de local path on iphone/browser from the file “user.json” ?

      Regards CptPiccard

      • arnie:

        same a candy crush just use ifunbox or iexplorer goto Applications > Jelly Splash > Documents folder you will see both files

  • Big Al:

    These are great hacks. Thanks Mike! I did your changes on the main boosters you listed. I only changed the offset to FF not FFFFFFFFacross the whole line. It gave me 255 of each booster. I did it on a Iphone. Tried changing things on a older, IPad and couldn’t get Jelly fish to work and Color Bomb wouldn’t let me uncheck it. so I put the number 20 in he color bomb value and it gave me 32 boosters that I could select. I will keep playing with the Ipad changes. I would love to find bomb cooler and sweet teeth. I didn’t try changing Yeti shop.I don’t even see it on my game screen

    • shazz:

      I am a bit dumb when it comes to these types of things but please be kind to me.
      Do I download all this stuff onto the computer or your phone? I did it to my computer but how do I copy the changes to my phone?

  • Nashe:

    does it work on subway surfer?

  • alan:

    I wonder if it has to do with fifa 14 and stay with unlimited currencies? please i need a lot.

    if what are the numbers?

    asks from others, how do I identify the codes?
    type
    0 × 00000290 00 – Lives
    0 × 00000050 00 – Color Bomb
    0 × 00000050 0C – Jelly Fish

    help please.

  • sANDER:

    000000B0 00 to FF and you will get 255 free switches

  • Fernando_Uruguay:

    Dear fellows:
    I am crushed with this damned game. I.vd done a stupid move and now don’t see how to fix it.
    I use to do the very simple trick “fast forward the clock in the iphone” to get 5 lives again when I run out of them. The problem is that yesterday I set the clock at 1/1/2038 (the highest date available in the 3Gs).
    My question is: Witch game`s file shoud I edit to get back the date?

    Thanks you
    Fernando

    • Shaz:

      turn your phone off and then turn it on again, delete the game and download it again. I play through face book. I have done the same thing and this is all I found that works. Make sure when you turn your phone on check the date under settings

  • alan:

    this code is for fifa 14?

  • mrbigg:

    New hack candy crush working http://adf.ly/eeAUy

  • GWN:

    Latest candy crush update for mobile devices gives moonstruck booster. $7.99 for 3 boosters in itunes app store. Change code as follows for 255 moonstruck boosters:

    000000B0 0C – Moonstruck Booster. Change to FF.

  • izaz:

    thanks…………………

  • Master:

    Setting 401F for 8000 Items:

    0×00000050 00 – Color Bomb
    0×00000050 0C – Jelly Fish
    0×00000060 08 – Coconut Wheel
    0×00000070 04 – Lollipop Hammer
    0×00000090 08 – Lucky Candy
    0x000000A0 04 – Wrapped and Striped
    0x000000B0 00 – Free Switch
    0x000000B0 0C – Moonstruck Booster
    0×00000290 00 – Lives

    Unlocked Yeti Shop with FF

    0x000001C0 0C
    0x000001C0 0D
    0x000001C0 0E
    0x000001C0 0F
    0x000001D0 00
    0x000001D0 01

  • Pedro:

    Setting 0F27 for 9999 Items:

    0×00000050 00 – Color Bomb
    0×00000050 0C – Jelly Fish
    0×00000060 08 – Coconut Wheel
    0×00000070 04 – Lollipop Hammer
    0×00000090 08 – Lucky Candy
    0x000000A0 04 – Wrapped and Striped
    0x000000B0 00 – Free Switch
    0x000000B0 0C – Moonstruck Booster
    0×00000290 00 – Lives

    Unlocked Yeti Shop with FF

    0x000001C0 0C
    0x000001C0 0D
    0x000001C0 0E
    0x000001C0 0F
    0x000001D0 00
    0x000001D0 01

  • DoSMaN:

    Hello,
    Have you found any other boosters?

  • makara:

    which editor to edit the Savxxx.dat file

  • YellowSnow:

    @Makara: RTFM

  • Shaz:

    I have 2 save dat files on my phone, which one should I use?

  • Shaz:

    your save.dat is a ultra edit document mine just says its a DAT file.
    I can get any of this to work.

  • YellowSnow:

    1. Be sure you have iTunes installed
    2. Open iFunBox and wait till you device is connected
    3. Browse: iFunClassic, User Applications, CandyCrush, Documents.
    4. Copy save.dat AND save.bak and save it somewhere on your pc for backup
    5. Delete save.dat and save.bak (the ones in iFunbox, not local)
    6. Start Candy Crush and close it again.
    7. Now you see new save.dat and save.bak files (step 3)
    8. Copy save.dat and save.bak to your desktop
    9. Open HxD and open the save.dat file found on your desktop
    10. Change data like:

    Setting 401F for 8000 Items:

    0×00000050 00 – Color Bomb
    0×00000050 0C – Jelly Fish
    0×00000060 08 – Coconut Wheel
    0×00000070 04 – Lollipop Hammer
    0×00000090 08 – Lucky Candy
    0x000000A0 04 – Wrapped and Striped
    0x000000B0 00 – Free Switch
    0x000000B0 0C – Moonstruck Booster
    0×00000290 00 – Lives

    Unlocked Yeti Shop with FF

    0x000001C0 0C
    0x000001C0 0D
    0x000001C0 0E
    0x000001C0 0F
    0x000001D0 00
    0x000001D0 01

    11. Save file in HxD
    12. Rename the save.dat.bak into save.bak
    13. Copy the saved save.dat and save.bak files and past them into Douments (step 3)
    14. Disconnect your device form PC
    15. Start Candy Crush
    16. Cheat :p

    • sharon:

      I have tried this but when I go to rename the save.dat.bak file it asks do you want to rename save.dat.bak to save.dat (2)

  • John:

    With the last update, my lives were gone, when i put in of27 again and play one game, i just have 8 lives left, is their a solution for that?

  • pac:

    yep. i think they just patch this app. lives rolls back to 8 when you play a level.

    • Mike:

      It looks like you’re right. The unlimited boosters still work, but not the lives.

      My guess is that they cap it to 8 and then reset the location at which they store lives. Give me a bit and I’ll see what I can dig up.

  • sharon:

    I have tried doing the change but when I open cc on my ipad nothing has changed

  • Mike:

    It looks like lives are capped by the application, and there is no way around it – save for jailbreaking.

    I believe the cap is calculated by two fields in the file:

    User Applications > Candy Crush > candycrushsaga.app > res_output > tweakdata.prop

    This file contains several lines of note:

    lives.base.max 5
    charm.life.extra.lives 3

    My guess is that the application combines these two numbers to identify the maximum number of lives a player might ever have, re-writing the save file to reflect that number, which is 8.

    The file in question is locked from writing, and I assume that area of the file system cannot be written unless the device is jailbroken.

    I’d love to hear otherwise, if anyone has ideas around the restriction!

  • yvi:

    Hello guys,

    I was at Level 163 and saved the candy crush Level in a Facebook account (registered with mailinator mail addy)
    and now I forgot the Name of the Facebook account. With sying goodbye to Facebook I lost all my savegames.
    Now with iexplorer I got thefile back, copied it to the Directory on my iPad but it won’t work.

    Please, can anyone send me the .documents zip file with a non Facebook account on Level 150+???
    thank you so much!!
    arkonohio@gmail.com

Leave a Reply