Jump to content

How would I override an method with its offset?


Aarivex

11 posts in this topic

Recommended Posts

Posted

I'm very new into this game, yet I have some knowledge (programming and basic reverse-engineering).

I just dumped some data for a game (American Dad! Apocalypse Soon). It's an Unity game, so I used IL2CPPDump/I'm viewing the classes with dotPeek.

There are many methods including get and set methods. Basiclly every method has its own RVA and offset.

 

How would I change the behaviour of a method?

Say I want get_XYZValue() to return 1337 (or set_XYZValue(int x) to set x to 1337) and the offset is 0x17EC0809. Would I just override 17EC0809 with 0x539 or maybe 20A78052 (MOV W0, #1337) or is it more than that?

I tried the second approach with some functions using iOSGods Live Offset Patcher, yet it sadly didn't affect anything.

 

I appreciate any answer! Thanks.

Posted

Make sure that you have chosen the correct register to move a value into, and make sure it doesn’t get changed afterwards. This can be achieved by putting a RET statement right after it.

Posted
13 hours ago, bR34Kr said:

Make sure that you have chosen the correct register to move a value into, and make sure it doesn’t get changed afterwards. This can be achieved by putting a RET statement right after it.

Thanks for your answer.

I already know about RET, but how would you fit both MOV and RET in one single HEX and how could I get the current register? Do I need to debug it, or would fridump do the job?

And does that mean that the offset of a method is just pointing to the corresponding ARM code that is being executed, just like you'd inspect an method inside IDA?

Posted

If you are using in game Menu patching   your hack is  0x20A78052C0035FD6.

If you are just patching binary for ipa sideloading the hack is 20A78052C0035FD6.

Posted
On 11/4/2019 at 5:01 PM, Aarivex said:

I already know about RET, but how would you fit both MOV and RET in one single HEX and how could I get the current register? Do I need to debug it, or would fridump do the job?

Yeah, you can fit both MOV and RET in a function as long as the function is at least 4 bytes in size.

Posted
13 hours ago, DADi said:

Yeah, you can fit both MOV and RET in a function as long as the function is at least 4 bytes in size.

I got some answers on /r/jailbreakdevelopers that told me that I need the RVA and the ASLR slide, so it makes sense now to me.

Thanks for your answers!

What confused me was that why overriding a method address with ARM HEX instructions would work, but I got some insight there now that I know that you can "replace" the original function with your own and how the offset works using _dyld_get_image_vmaddr_slide(0).

Posted
51 minutes ago, Aarivex said:

I got some answers on /r/jailbreakdevelopers that told me that I need the RVA and the ASLR slide, so it makes sense now to me.

Thanks for your answers!

What confused me was that why overriding a method address with ARM HEX instructions would work, but I got some insight there now that I know that you can "replace" the original function with your own and how the offset works using _dyld_get_image_vmaddr_slide(0).

Ah, perhaps this would be of help to you. http://armconverter.com/mshookgenerator/

Posted
43 minutes ago, DADi said:

Ah, perhaps this would be of help to you. http://armconverter.com/mshookgenerator/

I already know that tool, but I can write that code on my own :D

I wrote this bit of code, which sadly doesn't affect anything:

#include <mach-o/dyld.h>
#include <substrate.h>
  
void *func = (void *)(_dyld_get_image_vmaddr_slide(0) + 0x101AA8924);
int (*original) (); // or int (*original) (void *self);
int replacement() { // or int replacement (void *self);
	return 10; 
}

%ctor {
	MSHookFunction(lvlFunc, (void *)replacement, (void **)&original);
}

whereas this code leads to an crash:

#include <mach-o/dyld.h>
#include <substrate.h>

int (*old_get_Level)(void *self);
int get_Level(void *self) {
	return 10;
}
  
%ctor {
	MSHookFunction((void *)(_dyld_get_image_vmaddr_slide(0) + 0x101AA8924), (void*)get_Level, (void**)&old_get_Level);
}

Not just with get_Level, but also with some methods inside a battle - f.e. MaxHealth or UnitHealth.

Posted

Is your offset an instrtuction inside the function? MSHookFunction only works on functions.

And also the function needs to be bigger than 8 bytes in order to use MSHookFunction on it from what I recall.

Archived

This topic is now archived and is closed to further replies.

  • Our picks

    • Dice Dreams Cheats v1.94.1 +2
      Modded/Hacked App: Dice Dreams™ By SuperPlay LTD
      Bundle ID: com.superplaystudios.dicedreams
      iTunes Store Link: https://apps.apple.com/us/app/dice-dreams/id1484468651?uo=4


      Hack Features:
      - Custom Rolls
      - Unlimited Coins - afford regardless of if you have enough


      iOS Hack Download Link: https://iosgods.com/topic/138011-dice-dreams%E2%84%A2-v1692-2-cheats/
      • 638 replies
    • Archero Cheats v7.0.0 +5 [ God Mode & More ]
      Modded/Hacked App: Archero by HABBY PTE. LTD.
      Bundle ID: com.habby.archero
      iTunes Store Link: https://apps.apple.com/us/app/archero/id1453651052?uo=4&at=1010lce4



      Hack Features:
      - Multiply Defense to
      - Multiply Damage to
      - God Mode
      - OHK (Must use with God Mode)
      - Freeze Enemies

      NOTE: If you want to use god mode and ohk turn off multiply damage and defense first. I added multiply damage and defense there to avoid ban


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/100710-archero-v210-enemies-dont-attack-x30-attack/


      Hack Download Link: https://iosgods.com/topic/96783-arm64-archero-cheats-v220-5/
      • 15,873 replies
    • Westland Survival - Cowboy RPG v10.1.0 +7 [ Items Cheat ]
      Modded/Hacked App: Westland Survival - Cowboy RPG By HELIO LTD
      Bundle ID: com.heliogames.a1
      iTunes Store Link: https://apps.apple.com/us/app/westland-survival-cowboy-rpg/id1339238576?uo=4


      Hack Features:
      - Unlimited Energy / Instant Energy Refills
      - Unlock All Blueprints
      - Items Duplicate When Split / Items Hack
      - Unlimited Consumable Items
      - Unlimited Item Durability
      - God Mode / Never Die -> Linked with enemies. Useful for looting.
      - One Hit Kill / High Damage -> Linked with enemies. Use with caution.


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 430 replies
    • Subway Surfers Cheats v3.49.2 +5
      Modded/Hacked App: Subway Surfers By Sybo Games ApS
      Bundle ID: com.kiloo.subwaysurfers
      iTunes Store Link: https://apps.apple.com/us/app/subway-surfers/id512939461?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Free Store (not Free iAP)
      - Free iAP (ViP Only)
      - Unlock Characters Outfit
      - Custom Jump Height
      - No Clip (To end level swipe to left til you get dizzy, swipe again and you will lose)

       

      Non-Jailbroken Hack: https://iosgods.com/topic/119795-subway-surfers-v3425-jailed-cheats-5/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/119793-subway-surfers-cheats-v3430-5/
        • Agree
        • Haha
      • 2,338 replies
    • Township: Farm & City Building v29.0.1 Jailed Cheats +2
      Modded/Hacked App: Township by PLR Worldwide Sales Limited
      Bundle ID: com.playrix.township-ios
      iTunes Store Link: https://apps.apple.com/us/app/township/id638689075?uo=4&at=1010lce4


      Hack Features:
      - Freeze Currencies

      EDIT: Please be aware that this maybe cause your account banned, please use with caution and don’t abuse


      iOS Hack Download Link: https://iosgods.com/topic/116584-arm64-township-farm-city-building-v852-jailed-cheats-2/
        • Agree
        • Thanks
        • Winner
        • Like
      • 1,709 replies
    • DomiNations v12.1500.1502 +40++ Cheats [ Exclusive ]
      Modded/Hacked App: DomiNations by NEXON M Inc.
      Bundle ID: com.nexonm.dominations
      iTunes Store Link: https://itunes.apple.com/us/app/dominations/id922558758


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate (from Cydia).
      - PreferenceLoader (from Cydia).


      Hack Features:
      - Unlimited Crowns/Food/Oil/Gold -> Resources will add instead of subtracting. Works with Crowns. Read note inside the feature for more information! This does not work for speeding up buildings.
      - All Achievements Unlocked
      - Freeze Crowns/Food/Oil/Gold -> Freezes Resources so they do not decrease when used! This does not work for speeding up buildings.
      - No Citizens Cost
      - Place Multiple of Same Building
      - 0 Cost to Speed Up Training Troops
      - 0 Cost to Speed Up Tactics
      - 0 Food Cost to Train Troops
      - 0 Food Cost to Upgrade Troops
      - No Timer to Upgrade Troops
      - 0 Food Cost to Train Spells
      - 0 General Train Cost
      - No General Train Cooldown
      - 0 Food Cost to Build Wonder
      - 0 Food Cost to Research Troops
      - 0 Food Cost to Upgrade Tactics
      - No Timer to Library Research
      - No Timer to Upgrade Spells
      - 0 Cost to Upgrade Buildings
      - 0 Workers Required to Upgrade
      This hack is an In-Game Mod Menu (iGMM). In order to activate the Mod Menu, tap on the iOSGods button found inside the app.
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 5,001 replies
    • BlazBlue Entropy Effect v1.1.0 +3 Cheats [ Damage + More ]
      Modded/Hacked App: BlazBlue Entropy Effect By ActGames Inc.
      Bundle ID: com.actgames.bbee.ios.gl
      App Store Link: https://apps.apple.com/us/app/blazblue-entropy-effect/id6742527094?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - God Mode
      - Freeze MP
      • 9 replies
    • Train of Hope: Survival Game v1.9.1 +5 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Train of Hope: Survival Game By Samfinaco LLC
      Bundle ID: com.samfinaco.tos
      iTunes Store Link: https://apps.apple.com/us/app/train-of-hope-survival-game/id6636482655?uo=4

       
       

      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Unlimited Resources -> Will increase instead of decrease.
      - Unlimited Hero Experience -> Will increase instead of decrease.
      • 56 replies
    • Train of Hope: Survival Game v1.9.1 +5 Cheats [ Damage & Defence ]
      Modded/Hacked App: Train of Hope: Survival Game By Samfinaco LLC
      Bundle ID: com.samfinaco.tos
      iTunes Store Link: https://apps.apple.com/us/app/train-of-hope-survival-game/id6636482655?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Unlimited Resources -> Will increase instead of decrease.
      - Unlimited Hero Experience -> Will increase instead of decrease.
      • 43 replies
    • Bloons Card Storm v5.1 +4 Jailed Cheats [ Unlimited Cards ]
      Modded/Hacked App: Bloons Card Storm By Ninja Kiwi Limited
      Bundle ID: com.ninjakiwi.bloonscardstorm
      iTunes Store Link: https://apps.apple.com/us/app/bloons-card-storm/id6478193271?uo=4


      Hack Features:
      - Unlimited Cards
      - Unlock All Cards
      - Unlock All Cosmetics -> Avatars, Card Backs etc.
      - Unlock All Heroes


      Jailbreak required hack(s): [Mod Menu Hack] Bloons Card Storm v1.00 +4 Cheats [ Unlimited Cards ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 29 replies
    • Bloons Card Storm v5.1 +4 Cheats [ Unlimited Cards ]
      Modded/Hacked App: Bloons Card Storm By Ninja Kiwi Limited
      Bundle ID: com.ninjakiwi.bloonscardstorm
      iTunes Store Link: https://apps.apple.com/us/app/bloons-card-storm/id6478193271?uo=4


      Hack Features:
      - Unlimited Cards
      - Unlock All Cards
      - Unlock All Cosmetics -> Avatars, Card Backs etc.
      - Unlock All Heroes


      Non-Jailbroken & No Jailbreak required hack(s): [IPA Mod Menu] Bloons Card Storm v1.00 +4 Cheats [ Unlimited Cards ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 32 replies
    • Merge 2 Survive: Zombie Game v1.22.2 +3 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Merge 2 Survive: Zombie Game By Pixodust Aplicativos LTDA
      Bundle ID: com.pixodust.games.merge.survive.puzzle.game
      iTunes Store Link: https://apps.apple.com/us/app/merge-2-survive-zombie-game/id6468487156?uo=4


      Hack Features:
      - Unlimited Coins
      - Unlimited Diamonds
      - Unlimited Energy


      Jailbreak required hack(s): [Mod Menu Hack] Merge 2 Survive: Zombie Game v1.0.3 +3 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 32 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines