#import <substrate.h> #import <dlfcn.h> #import <mach-o/dyld.h> #import <string.h> #import <stdio.h> #import <UIKit/UIKit.h> int (*old_get_Gem)(); int new_get_Gem() { return 99999; } int (*old_get_Coin)(); int new_get_Coin() { return 300000000; } // 根据镜像名称获取镜像的偏移基址 intptr_t get_image_vmaddr_slide(const char * image_name) { uint32_t count = _dyld_image_count(); for (int i = 0; i < count; i++) { const char *path = _dyld_get_image_name(i); const char *name = strrchr(path, '/'); // printf("name = %s, path = %s", name, path); if (name != NULL && strcmp(image_name, name) == 0) { return _dyld_get_image_vmaddr_slide(i); } } return -1; } static void didFinishLaunching(CFNotificationCenterRef center, void *observer, CFStringRef name, const void *object, CFDictionaryRef info) { dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)(0.1 * NSEC_PER_SEC)), dispatch_get_main_queue(), ^{ intptr_t base_addr = get_image_vmaddr_slide("/UnityFramework"); printf("didFinishLaunching-base_addr = 0x%lx", base_addr); MSHookFunction((void *)(base_addr + 0x1E15468), (void *)&new_get_Gem, (void **)&old_get_Gem); MSHookFunction((void *)(base_addr + 0x1E1545C), (void *)&new_get_Coin, (void **)&old_get_Coin); }); } void launchEvent() { CFNotificationCenterAddObserver(CFNotificationCenterGetLocalCenter(), NULL, &didFinishLaunching, (CFStringRef)UIApplicationDidFinishLaunchingNotification, NULL, CFNotificationSuspensionBehaviorDrop); } __attribute__((constructor)) static void initialize() { launchEvent(); }