Red16

ICallHook - Tutorial Hello everyone I am Rednick16 (Red16) its been a while since I last made a tutorial so stay with me if this is a bit hard to follow along with. Ann ale (Lets begin). By now I am sure everyone participating in the unity modding scene have heard about IL2CPP (Intermediate Language To C++) Okay so let's actually begin. I am going to try and keep this tutorial straight forward and easy as possible to follow along with. In this tutorial you will be learning how to hook the following icalls. I should also mention that this does not need JIT (Just-In-Time). UnityEngine.Camera::get_fieldOfView() UnityEngine.Time::get_timeScale() UnityEngine.Time::set_timeScale(System.Single) UnityEngine.Input::GetKeyUpInt(UnityEngine.KeyCode) UnityEngine.Input::GetKeyDownInt(UnityEngine.KeyCode) The hooking method. See the spoiler box for a thorough tutorial on how this was achieved and why it works. NOTE: Timing is everything with this method. You must be very precise with where you setup the hook calls, for example the best place to put it would be in il2cpp_init ref: https://github.com/Rednick16/ICallHook/blob/a4cb7a17ac1abc9187080f0d7afea8ee6cd7cc46/Tweak.x#L67 #include <stdbool.h> #include <dlfcn.h> void* il2cpp_library_get_handle(void) { static void *handle = NULL; #if defined(__ANDROID__) if (NULL == handle) handle = dlopen("libil2cpp.so", RTLD_NOLOAD | RTLD_NOW | RTLD_GLOBAL); return handle; #elif defined(__APPLE__) return RTLD_DEFAULT; #else #error "Unsupported target" #endif } bool il2cpp_hook_icall(const char* name, void* hook, void** old) { if (name == NULL || hook == NULL) return false; /* NOTE: resolve these ahead of time if possible, dlsym is really slow, but should be fine to use here since we only use these at startup anyways */ void *(*il2cpp_resolve_icall)(const char *name) = NULL; if (il2cpp_resolve_icall == NULL) il2cpp_resolve_icall = (void * (*)(const char*))dlsym(il2cpp_library_get_handle(), "il2cpp_resolve_icall"); void (*il2cpp_add_internal_call)(const char* name, void* methodPointer) = NULL; if (!il2cpp_add_internal_call) il2cpp_add_internal_call = (void (*)(const char*, void*))dlsym(il2cpp_library_get_handle(), "il2cpp_add_internal_call"); if (il2cpp_resolve_icall == NULL || il2cpp_add_internal_call == NULL) return false; // The actual impl void* resolved = il2cpp_resolve_icall(name); if (!resolved) return false; if (old) *old = resolved; il2cpp_add_internal_call(name, hook); return true; } Lets have some fun and make some hooks static float (*_get_fieldOfView)(void *) = NULL; static float hooked_get_fieldOfView(void *_this) { float fov = _get_fieldOfView(_this); // printf(@"--> get_fieldOfView(): %f\n", fov); return fov; } static float (*_get_timeScale)() = NULL; static float hooked_get_timeScale() { float scale = _get_timeScale(); // printf(@"--> get_timeScale(): %f\n", scale); return scale; } static bool (*_GetKeyUpInt)(int keyCode) = NULL; static bool hooked_GetKeyUpInt(int keyCode) { bool status = _GetKeyUpInt(keyCode); // printf(@"--> GetKeyUpInt(): up: %s\n", status ? "YES" : "NO"); return status; } static bool (*_GetKeyDownInt)(int keyCode) = NULL; static bool hooked_GetKeyDownInt(int keyCode) { bool status = _GetKeyDownInt(keyCode); // printf(@"--> GetKeyDownInt(): down: %s\n", status ? "YES" : "NO"); return status; } void Il2CppDidInit(void) { // Called after il2cpp_init completes Il2CppHookInternalCall("UnityEngine.Camera::get_fieldOfView()", (void *)&hooked_get_fieldOfView, (void **)&_get_fieldOfView); Il2CppHookInternalCall("UnityEngine.Time::get_timeScale()", (void *)&hooked_get_timeScale, (void **)&_get_timeScale); Il2CppHookInternalCall("UnityEngine.Input::GetKeyUpInt(UnityEngine.KeyCode)", (void *)&hooked_GetKeyUpInt, (void **)&_GetKeyUpInt); Il2CppHookInternalCall("UnityEngine.Input::GetKeyDownInt(UnityEngine.KeyCode)", (void *)&hooked_GetKeyDownInt, (void **)&_GetKeyDownInt); } Thats it. You guys were probably expecting more from me but this all I got haha Test it out: https://github.com/Rednick16/ICallHook Yep thats it there are many other techniques that can be used along side this such as methodPointer swaps on Update, LateUpdate, Start, Awake for classes deriving from MonoBehaviour, and VTables are mostly intact as well. goodby Credits: @Red16

2 day streak 😛

Wow this is really nice, great work

Woah 😳 nice work, this is like standalone cheat engine for il2cpp games This is insane batch looking forward to your next projects

Very useful Thank you for sharing

ref: https://iosgods.com/topic/116875-terraria-v13078-30-godmode-spawn-items/ If your new around here back then I had these features ‘Spaz n Elevator’ the OGs know lol Spaz - Weapon Speed Hack Elevator - Infinite jumps ( choose the style: cloud, blizzard, sandstorm ) for the “Elevator” should I make it require a special custom item to activate it :))))))) please let me know what the crafting ingredients should be (Prehard mode?) back then I directly patched the assembly to make these but now it’s a different story I can simply change the field 😂

This will probably take me another 2 years I wonder if I can create a tweakloader to load ModBundle with dylibs this would be so op & bullet proof it (additional feature for advance users)

As some of you already know I have been creating this ModLoader which has the concepts of packages called mods If anyone is familiar with Flex2 you will know this little application is very simple & easy to use allowing you to simply override objc selectors and package and share the flex tweaks (unsure what they are called tbh) my idea was what if I take this concept and implement lua/js scripting to these tweaks to allow code patching, absolute dominance over il2cpp api and objc method swizzling? You would be able to call these apis at runtime imgui etc etc etc, access to iEdit lib for memory searching functionality kindof like GG I am still not sure if it’s worth the effort to create this tool tbh bc it will require a jailbreak 😐 and some of you know that the jailbreaking scene has been facing some significant troubles as of iOS 15.0+ anyone?

Hey you can use the dotnet version of it on your Mac make sure you install dotnet command dotnet Il2CppDumper.dll <executable-file> <global-metadata> <output-directory> type the command in terminal and just drag the files one after another note don’t include '</>' If you can’t use dotnet you can always use wine to directly run the windows version on your Mac: https://www.winehq.org

Why would you share this? The product is already free

To anyone who has tried this, what do you think?

This is not possible with my modloader, We are on iOS and are very limited to what can be done. I am currently in the process of adding custom textures and new items

How are you making these so fast lol

try this might work for ur app

You keepin this site alive keep up the great work man 😁

Your welcome I have a ModLoader coming soon no jailbreak required Patients lol I’m still working on the ModLoader for it, it will not disappoint

I am currently working on a Mod loader for this game xd you will absolutely love it

I remember libSupport used to work on older versions of standoff2 I updated it then they patched it again so I gived up, they implemented ‘Anti Fish’ library which can easily defeat libSupport in its current state I am working on moving away from it

@Rook can we remove this post I completely forgot I had it I would have Updated it ops

libSupport is a mini tool which helps modders combat side load detection in iOS apps. Features: - [JIT Required] { Hook, CodePatch } Bypass Sideload Detection To bypass sideload detection, SupportEntryInfo was provided so that you can modify and tweak the library for you apps specific needs. Example of SupportInitialize Usage: SupportEntryInfo entry_info = { .teamIdentifier = NULL, .bundleIdentifier = "com.example.myapp", .files = { "CydiaSubstrate", "embedded.mobileprovision", "libSupport", "BypassInjector", "H5GG", "iGameGod", NULL }, // Use full power if possible. .general = { .settings = { .hookSymbols = true, .hookMessages = true, .hookExpierimental = true, .allowDebugging = true } } }; SupportInitilize(&entry_info); How It Works: Bundle Identifier: Specify your app’s original bundle identifier to match its expected value. Files: Include any symbols and specific files that could be flagged during sideload detection. Settings: Options for modifying libSupport's internal behavior, such as enabling symbol hooking, debugging, or experimental features. This structure ensures flexibility, allowing you to bypass various sideload detection mechanisms which could be present. Get libSupport v1.2.1 With libSupport, you're in control of your app's environment and are encouraged to create, experiment, and debug. Happy Modding, @Red16

Lets have you try the libSupport AutoInjector which makes use of `libSupport 1.2.1` https://github.com/Rednick16/libSupport/releases/tag/v1.2.1

How did you create that clickable Note button? 😂