ada1016

This is a cosco2djx game, not sure if Unity Hacking method guru can help

Cool! looking forward to see more H5GG hack. Can learn and use at same time

thank you!

Can I customize the H5GG advance menu? For example, a way to hide search area, float tolerance area since I don't always need it once the code is stable.. Thank you

Exactly. it is different way of thinking logic, but this is getting closer to the way Game Developer thinking, much more O-O orient and... I hope I am not taking too much of your time, I try to micmic your code and change the total number of turn that I can use, so I had below diff adding below to var cheats StopCount:["PuzzleUI","notUsed","ONE","SELF","ON","stopCount"] and have below under togglecheat PuzzlePlayer.stopCount = function(){ appendLog("this.m_nTurnNumber= "+this.m_nTurnNumber) this.m_nTurnNumber = 15; } let PuzzleUI = new UnityObject(PuzzlePlayer.PuzzleUI) PuzzleUI.loadFields(["m_nTurnNumber","LootTurnRuneCount"]) // this.m_nTurnNumber = this.LootTurnRuneCount appendLog("m_nTurnNumber= "+this.m_nTurnNumber+" : LootTurnRuneCount ="+this.LootTurnRuneCount) I thought I can print out the turn number, but always I get undefined. I am sure in PuzzleUI, there is such field, and in PuzzlePlayer, there is an instance of PuzzleUI My code here https://www.icloud.com/iclouddrive/0ebWuS2833pIaaBca7M-q3viQ#H5JSPlugin_-_Gem_of_War thank you so much..

and just like you mentioned, this way of cheating make it almost effortless to maintain. The game just upgraded to 7.1 and your script directly take effect with no problem I really must learn this more, thank you!

wow! thank you sooooo much!!!!

This is Gem of War. https://apps.apple.com/tw/app/gems-of-war-match-3-strategy/id897954560 thank you for great advice, I will keep learning and play with it. The thing about reseting mana are good advice, but it looks like this game is call same method to control both side (my and enemy's) mana. So when I alter the change, it affect both side.

sorry, ,really interested in this but really got a lot to learn. The more I play with this, the more unknown I realises. Q:Is this script worked like one time thing? That, the script only get executed when the code path get there, and you have to run the script before it trigger. For some method that happened at battle, such as adjust mana when take damage, you cannot use this script as it does not work like a hook. Is this understand correct? Q: if a method has game object in parameter, how do I loadMethods it?e.g. public void AdjustPlayerMana(int playerIndex, int[] manaCollected, ref bool activateManaMatchTraits, bool collectedFromBoard = False, bool wasMatch = False, PuzzleTroop pAdjustmentCause) { } thank you for your time.

No, I cannot change via US Analyser as well. But I should be able to find the address and patch it. So.. if the value cannot be change by UA, it cannot be altered by plugin?

Thank you.. I had very weak sense of Unity Game development, sorry for my further more question.... Objective: change the remaining attempts of a dungen from Dump.cs, I captured this public class GWGameState : MonoBehaviour // TypeDefIndex: 9219 { : public int DelveAttempts { get; } public int get_DelveAttempts() { } : } my Plug.js code try { script = initializeUnitySupport(); //[STEP 2][MODIFY]Change the root object of interest, which should able to link to your other cheat object aryObj = script.call("findUnityObjectOfType", ["$GWGameState", true]); if (!aryObj || aryObj.length == 0) { } for (let i = 0; i < aryObj.length; i++) { let GWGameState = new UnityObject(aryObj[i]); GWGameState.loadFields(['int32 DelveAttempts']); GWGameState.loadMethods(["int32 get_DelveAttempts()"]); GWGameState.DelveAttempts=5 alert("GWGameState (" + aryObj[i].toString(16) + ") with UnityObject:" + GWGameState.DelveAttempts+"get_DelveAttempts="+GWGameState.get_DelveAttempts()) GWGameState.loadFields(['int32 DelveAttempts']); alert(GWGameState.DelveAttempts) } } catch (e) { //reset Unity Support gIl2cppInit = false; var script = initializeUnitySupport(); } Result GWGameState (0x13125ba80) with UnityObject: 5. get_DelveAttempts=3 Unity support crashed and reset completeTypeError: Attempting to change the setter of an unconfigurable property. I believe I didn't change the object value at all, I just changed the object that I initiated, can you please educate ?

thanks @Happy Secret Still much to learn.. I made a recording on what I am experiencing below and found two new things 1. I was able to locate GWEconomyModel as class in UA, but when I click, it always goes to something else (e.g GWGameState). Please see the clip at 17 second. What does this tells me? Please educate 2. I love your tutorial, but if possible, can you share what the code looks like at dump.cs that leads you made aware that instead of tracking GamePlay directly, it is Gameplay.m_ItemStat that you are interested? Wanted to learn you thinking path as well. Thank you so much

This is my game looks like public class GWEconomyModel // TypeDefIndex: 9184 { public int LoyaltyBonusPerDay_Gold; // 0x288 } and my plug-in code try { script = initializeUnitySupport(); aryObj = script.call("findUnityObjectOfType", ["$GWEconomyModel", true]); if (!aryObj) { alert("Cannot find object to cheat. Engine stopped."); } else if (aryObj.length == 0) { var GWEconomyModel = new UnityObject(aryObj[0]) GWEconomyModel.loadFields(['DelveAttemptsPerDay']) var DelveAttemptsPerDay = new UnityObject(GWEconomyModel.DelveAttemptsPerDay) DelveAttemptsPerDay = 50 //CharacterMotor.loadFields(['DelveAttemptsPerDay']) //var DelveAttemptsPerDay = aryObj[0].DelveAttemptsPerDay alert(aryObj.length) } } catch (e) { //reset Unity Support gIl2cppInit = false; var script = initializeUnitySupport(); alert("Unity support crashed and reset complete"); } The result is app always crash at var GWEconomyModel = new UnityObject(aryObj[0]) the aryObj.length is always 0, but not able to load the field. Can you correct my understand and educate how to fix this error?

I am on v1.8.8 (thanks for the great work!) iOS 16.6 iPhone 14 (non-JB) when I try Unity and look for specific address, it froze, at least 5 mins I wait. Nothing happen, not able to tell if it is processing or just hanged. Is this because the game is "complex", or I have not wait no enough? Anyway to tell it is progressing? thank you

does it work on non-JB iOS? I am about to start everything you write here, just in case the JB is show stopper... please advise. thx

Thank you!!!

Thank you!

This is so embarrassing, the download link is hard to find for me. I'd like to download the 0.3.6 bed file directly to my PC. not any repo. Can you please direct where to find the link? I clicked almost all clickable link in the doc here. Thank you for answer me this damn simple question! But believe me, I tried..

thank you

Where is part 2? I love this, specially how lldb debug and how to find the value ..etc.. For part 2, can you perhaps give advance example? like a list object, how to further dive in and lock the value? and some turn based card game , the object is in same class, they used target index to indicate enemy/heros. But share same health/mp change function. Is it still possible to change the value (godmode) base on this structure? really appreciated in advance

how silly I am, you already gave instruction 1. Copy following files to Payload/<YourAppName>.app folder - frida-gadget-16.0.10.config - frida-gadget-16.0.10.dylib - h5frida-16.0.10.dylib 2. Repackage your game into ipa 3. Sideload the H5GGv7.9_with_Instruction_Debug_v1.4.dylib with your game. Note: You do not need the original H5GGv7.9通用注入版.deb will come back with more question later, thank you

Sorry I am new to H5GG, I found on the github there is deb version (https://github.com/H5GG/H5GG/tree/main/packages) and here I can find the zip, which has config and dylibs. Do I inject to install deb, dylib and config all at once? I am running my app on apple silicon. injecting with sideloadly. really appreciated in advance.

This is so cool, thank you

This is so cool, thank you

https://app.iosgods.com/store/appdetails/3277-lonely-survivor-hack I had same issue sideloadly this one to MBP M1 as well. It crashed. FYI, the snapshot, thank you ------------------------------------- Translated Report (Full Report Below) ------------------------------------- Incident Identifier: AE9FE080-A819-4691-84B1-763291C10C20 CrashReporter Key: 523CD9C6-8269-0A2D-6D8C-0007A32CE692 Hardware Model: MacBookPro18,2 Process: LonelySurvivor [73419] Path: /private/var/folders/*/LonelySurvivor.app/LonelySurvivor Identifier: com.cobby.lonelysurvivor.QB4KN3CKWY Version: 1.11.0 (22092223) AppStoreTools: 14A305 Code Type: ARM-64 (Native) Role: Foreground Parent Process: launchd [1] Coalition: com.cobby.lonelysurvivor.QB4KN3CKWY [3595] Date/Time: 2022-11-22 10:18:49.3344 +0800 Launch Time: 2022-11-22 10:18:47.1009 +0800 OS Version: macOS 12.3 (21E230) Release Type: User Report Version: 104 Exception Type: EXC_BREAKPOINT (SIGTRAP) Exception Codes: 0x0000000000000001, 0x0000000198f455b4 Exception Note: EXC_CORPSE_NOTIFY Termination Reason: SIGNAL 5 Trace/BPT trap: 5 Terminating Process: exc handler [73419] Triggered by Thread: 0 Application Specific Information: Crashing on exception: [<__NSFrozenDictionaryM 0x147a070e0> setValue:forUndefinedKey:]: this class is not key value coding-compliant for the key AppLovinSdkKey.