nngot44

Please tell us about a way to change the behavior of an iOS program by introducing dylib directly into the Frameworks folder of the iPA file. Are there any detailed articles on this topic? What methods of hooking, calling functions, or patching assembly instructions are used in this approach? I will be glad for any information

love

Thank you, after the new igamegod update, I no longer have errors

I'm hooking a function like this: public static bool IsValidName(string Name) { } But the source file of my library is written in Objective-C ++, so there is no exactly the same string class as in Unity. Now I can't return control to the original function because I need the original data type for everything to work without errors. How can such a problem be solved? Should I convert std::string to Unity string or NSString to Unity string

Maybe I found a bug. I tried dumping the minecraft binary and ended up restarting my ipad and jailbreak had to be reinstalled. Rootless jb most likely restricts access to memory, is it possible to bypass this?

I have an iOS 15.3.1 iPad with Dopamine jb. I want to write a cheat for some game. As much as possible? Are there any differences between the code for rootless and classic jb?

Hello, in this tutorial I will show one of the ways to hook a function. I will be hooking a function from a Unity game. First you need to find the address at which the beginning of the function is located in real time, this is difficult due to ASLR (address randomization). First, let's write a method that will return the following address: // RVA: 0x11FE288 Offset: 0x11FE288 VA: 0x11FE288 private void Update() { } (This is the address and information about the function that is in the compiled game engine) uint64_t getExecAddr(uint64_t addr, int index) { const struct mach_header* header = _dyld_get_image_header(index); if (header == NULL){return 0;} uint64_t libLoadAddr = (uint64_t)header; uint64_t exec_addr = libLoadAddr + addr; return exec_addr; } In this example, we are making a method that returns a number of type uint64_t and takes two parameters: the address of the function (for example, the one I gave above) and the library index. Using the _dyld_get_image_header() method, we get the address from which the library was loaded by its index. How to find the library index? This can be done in two ways: Using the LLDB debugger (image list command) or using another method that we will now write (this method is better than the first one) uint64_t getLibIndex(const char* que_image) { int i = 0; int image_count = _dyld_image_count(); for(; i < image_count; i++) { const char* req_image = _dyld_get_image_name(i); if(req_image && strcmp(req_image, que_image) == 0) {return i;} } return -1; } This method takes a path parameter to the library, we use the _dyld_image_count() method to find out how many libraries are loaded into the game process, then using a loop we compare our path to the library with others, and if the paths match, we return the index. Okay, there's not much left. Now let's create a pointer to the old function and create a replacement function that will be called instead of the original one: void (*old_Update)(void *self); void Update(void *self) { // "your code here" old_Update(self); } Now let's just make a hook according to a template that can be easily found on the Internet: %ctor { MSHookFunction( (void *)address_to_your_func_with_aslr, (void *)Update, (void **)&old_Update); } To make it clearer, I will show the full code of my hook: #include <unistd.h> #include <dispatch/dispatch.h> #include <mach-o/dyld.h> #include <substrate.h> #include <string.h> uint64_t getExecAddr(uint64_t addr, int index) { const struct mach_header* header = _dyld_get_image_header(index); if (header == NULL){return 0;} uint64_t libLoadAddr = (uint64_t)header; uint64_t exec_addr = libLoadAddr + addr; return exec_addr; } uint64_t getLibIndex(const char* que_image) { int i = 0; int image_count = _dyld_image_count(); for(; i < image_count; i++) { const char* req_image = _dyld_get_image_name(i); if(req_image && strcmp(req_image, que_image) == 0) {return i;} } return -1; } void (*old_Update)(void *self); void Update(void *self) { sleep(5); old_Update(self); } %ctor { dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{ sleep(150); int index = getLibIndex("/private/var/containers/Bundle/Application/BAE27894-6809-4743-AFFA-C1F6B93195CB/hidenseek.app/Frameworks/UnityFramework.framework/UnityFramework"); uint64_t address = getExecAddr(0x11fe288, index); MSHookFunction( (void *)address, (void *)Update, (void **)&old_Update); }); } This is my test version of the hook, it works great. (dispatch_async I used to wait until all libraries are loaded) In my example, the hook changes the behavior of the program so that when Update() is called, the game slows down for 5 seconds, this is only a beta version and you can add other logic there If you liked the tutorial, please rate it. I will try to answer questions

Thank you for not passing by my question, the information that you provided is very useful!

I used your advice and wrote this code (i hope my method returns the correct address) : #include <unistd.h> #include <dispatch/dispatch.h> #include <mach-o/dyld.h> uintptr_t getExecAddr(uintptr_t addr) { const struct mach_header* header = _dyld_get_image_header(341); if (header == NULL){return 0;} uintptr_t libLoadAddr = (uintptr_t)header; uintptr_t exec_addr = libLoadAddr + addr; return exec_addr; } %ctor { dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{ sleep(150); void* (*VELights$$get_Instance)() = (void* (*)())getExecAddr(0x12FD104); void (*VELights$$ResetMainSunLightAngle)(void *VELights) = (void(*)(void *))getExecAddr(0x12FD4B8); void* VELightsInstance = VELights$$get_Instance(); VELights$$ResetMainSunLightAngle(VELightsInstance); }); } In the debugger, I always get rather strange errors, for example, from the libobjc.A.dylib'objc_retain library. I thought it would be easier for me if it was possible to disable ASLR for this game. Is it possible to do this on iOS 13?

Thanks for these examples, I'm new and still learning how to make dylib libraries for games. I tried to call the Update function because I thought it would be the easiest to call

Thanks for the answer! but i did not understand where to call the function, if this is done in the same place where the pointer is declared, the compiler will gile the error "use of undeclared identifier 'inst'' for Update(inst);

Hi I'm trying to call a function in the game Hide N Seek : Mini Games. Here is my code, (I just need to call any function): function dump: //RVA: 0x11FE288 Offset: 0x11FE288 VA: 0x11FE288 private void Update() { } #include <unistd.h> #include <dispatch/dispatch.h> #include <mach-o/dyld.h> uintptr_t getExecAddr(uintptr_t addr) { const struct mach_header* header = _dyld_get_image_header(341); // this is the library index, it's so big because I'm using a debugger so far. if (header == NULL){return 0;} uintptr_t libLoadAddr = (uintptr_t)header; uintptr_t exec_addr = libLoadAddr + addr; return exec_addr; } void (*Update)(); %ctor { dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{ sleep(15); // wait for all libraries to load Update = (void(*)())getExecAddr(0x11FE288); Update(); }); } The game crashes when the moment comes to call the function. What am I doing wrong?