Jump to content

11 posts in this topic

Recommended Posts

Posted (edited)

I'm very new into this game, yet I have some knowledge (programming and basic reverse-engineering).

I just dumped some data for a game (American Dad! Apocalypse Soon). It's an Unity game, so I used IL2CPPDump/I'm viewing the classes with dotPeek.

There are many methods including get and set methods. Basiclly every method has its own RVA and offset.

 

How would I change the behaviour of a method?

Say I want get_XYZValue() to return 1337 (or set_XYZValue(int x) to set x to 1337) and the offset is 0x17EC0809. Would I just override 17EC0809 with 0x539 or maybe 20A78052 (MOV W0, #1337) or is it more than that?

I tried the second approach with some functions using iOSGods Live Offset Patcher, yet it sadly didn't affect anything.

 

I appreciate any answer! Thanks.

Updated by Aarivex
Posted

Make sure that you have chosen the correct register to move a value into, and make sure it doesn’t get changed afterwards. This can be achieved by putting a RET statement right after it.

  • Like 1
Posted (edited)
13 hours ago, bR34Kr said:

Make sure that you have chosen the correct register to move a value into, and make sure it doesn’t get changed afterwards. This can be achieved by putting a RET statement right after it.

Thanks for your answer.

I already know about RET, but how would you fit both MOV and RET in one single HEX and how could I get the current register? Do I need to debug it, or would fridump do the job?

And does that mean that the offset of a method is just pointing to the corresponding ARM code that is being executed, just like you'd inspect an method inside IDA?

Updated by Aarivex
Posted

If you are using in game Menu patching   your hack is  0x20A78052C0035FD6.

If you are just patching binary for ipa sideloading the hack is 20A78052C0035FD6.

Posted (edited)
On 11/4/2019 at 5:01 PM, Aarivex said:

I already know about RET, but how would you fit both MOV and RET in one single HEX and how could I get the current register? Do I need to debug it, or would fridump do the job?

Yeah, you can fit both MOV and RET in a function as long as the function is at least 4 bytes in size.

Updated by DADi
  • Like 1
Posted
13 hours ago, DADi said:

Yeah, you can fit both MOV and RET in a function as long as the function is at least 4 bytes in size.

I got some answers on /r/jailbreakdevelopers that told me that I need the RVA and the ASLR slide, so it makes sense now to me.

Thanks for your answers!

What confused me was that why overriding a method address with ARM HEX instructions would work, but I got some insight there now that I know that you can "replace" the original function with your own and how the offset works using _dyld_get_image_vmaddr_slide(0).

Posted
51 minutes ago, Aarivex said:

I got some answers on /r/jailbreakdevelopers that told me that I need the RVA and the ASLR slide, so it makes sense now to me.

Thanks for your answers!

What confused me was that why overriding a method address with ARM HEX instructions would work, but I got some insight there now that I know that you can "replace" the original function with your own and how the offset works using _dyld_get_image_vmaddr_slide(0).

Ah, perhaps this would be of help to you. http://armconverter.com/mshookgenerator/

Posted
43 minutes ago, DADi said:

Ah, perhaps this would be of help to you. http://armconverter.com/mshookgenerator/

I already know that tool, but I can write that code on my own :D

I wrote this bit of code, which sadly doesn't affect anything:

#include <mach-o/dyld.h>
#include <substrate.h>
  
void *func = (void *)(_dyld_get_image_vmaddr_slide(0) + 0x101AA8924);
int (*original) (); // or int (*original) (void *self);
int replacement() { // or int replacement (void *self);
	return 10; 
}

%ctor {
	MSHookFunction(lvlFunc, (void *)replacement, (void **)&original);
}

whereas this code leads to an crash:

#include <mach-o/dyld.h>
#include <substrate.h>

int (*old_get_Level)(void *self);
int get_Level(void *self) {
	return 10;
}
  
%ctor {
	MSHookFunction((void *)(_dyld_get_image_vmaddr_slide(0) + 0x101AA8924), (void*)get_Level, (void**)&old_get_Level);
}

Not just with get_Level, but also with some methods inside a battle - f.e. MaxHealth or UnitHealth.

Posted

Is your offset an instrtuction inside the function? MSHookFunction only works on functions.

And also the function needs to be bigger than 8 bytes in order to use MSHookFunction on it from what I recall.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below. For more information, please read our Posting Guidelines.
Reply to this topic... Posting Guidelines

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Our picks

    • Eatventure v1.33.2 Jailed Cheats +2
      Modded/Hacked App: Eatventure By Lessmore UG haftungsbeschraenkt
      Bundle ID: com.hwqgrhhjfd.idlefastfood
      iTunes Store Link: https://apps.apple.com/us/app/eatventure/id1600871388?uo=4


      Hack Features:
      - Freeze Currencies
      - Free iAP (Turn on inside iOSGods Mod Menu first)


      Jailbreak required hack(s): https://iosgods.com/topic/168170-eatventure-cheats-all-versions-1/


      iOS Hack Download IPA Link: https://iosgods.com/topic/168169-eatventure-v110-jailed-cheats-2/
      • 312 replies
    • Harry Potter: Puzzles & Spells v91.0.293 +1 Jailed Cheat [ Unlimited Moves ]
      Modded/Hacked App: Harry Potter: Puzzles & Spells By Zynga Inc.
      Bundle ID: com.zynga.pottermatch
      iTunes Store Link: https://apps.apple.com/us/app/harry-potter-puzzles-spells/id1434505322?uo=4


      Hack Features:
      - Unlimited Moves -> Will not decrease.


      Jailbreak required hack(s): [Mod Menu Hack] Harry Potter: Puzzles & Spells v85.0.271 +1 Cheat [ Unlimited Moves ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Thanks
        • Like
      • 38 replies
    • Harry Potter: Puzzles & Spells v91.0.293 +1 Cheat [ Unlimited Moves ]
      Modded/Hacked App: Harry Potter: Puzzles & Spells By Zynga Inc.
      Bundle ID: com.zynga.pottermatch
      iTunes Store Link: https://apps.apple.com/us/app/harry-potter-puzzles-spells/id1434505322?uo=4


      Hack Features:
      - Unlimited Moves -> Will not decrease.


      Non-Jailbroken & No Jailbreak required hack(s): [IPA Mod Menu] Harry Potter: Puzzles & Spells v85.0.271 +1 Jailed Cheat [ Unlimited Moves ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 23 replies
    • DarkSlayerXGunbird2 v1.1.96 +4 Jailed Cheats
      Modded/Hacked App: Dark Slayer : Tengai Collabo By PD.X Co.,Ltd
      Bundle ID: com.gamepub.zhteam
      iTunes Store Link: https://apps.apple.com/us/app/dark-slayer-tengai-collabo/id6446265751?uo=4


      Hack Features:
      - God Mode
      - Attack Speed Multiplier


      Jailbreak required hack(s): [Mod Menu Hack] Dark Slayer : Tengai Collabo v1.1.62 +2 Cheats [ God Mode ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 7 replies
    • DarkSlayerXGunbird2 v1.1.96 +4 Cheats
      Modded/Hacked App: Dark Slayer : Tengai Collabo By Gamepub CO., LTD
      Bundle ID: com.gamepub.zhteam
      iTunes Store Link: https://apps.apple.com/us/app/dark-slayer-tengai-collabo/id6446265751


      Hack Features:
      - God Mode
      - Attack Speed Multiplier
      • 215 replies
    • SHIN MEGAMI TENSEI D×2 v8.0.11 +2 Cheats
      Modded/Hacked App: SHIN MEGAMI TENSEI D×2 By SEGA CORPORATION
      Bundle ID: com.sega.d2megaten.en
      iTunes Store Link: https://apps.apple.com/us/app/shin-megami-tensei-d-%EF%BC%92/id1349725119?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing / or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - x dmg
      - x def


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download Link:

      Hidden Content
      Download Hack







      Installation Instructions:
      STEP 1: Download the .deb Cydia hack file from the link above. Use Safari/Google Chrome or other iOS browsers to download.
      STEP 2: Once the file is downloaded, tap on it and then you will be prompted on whether you want to open the deb with iGameGod or copy to Filza.
      STEP 3: If necessary, tap on the downloaded file and then, you will need to press on 'Install' from the options on your screen.
      STEP 4: Let iGameGod/Filza finish the cheat installation. Make sure it successfully installs, otherwise see the note below.
      STEP 5: If the hack is a Mod Menu — which is usually the case nowadays — the cheat features can be toggled in-game. Some cheats have options that can be enabled from your iDevice settings.
      STEP 6: Turn on the features you want and play the game. You may need to follow further instructions inside the hack's popup in-game.

       

      NOTE: If you have any questions or problems, read our Troubleshooting topic & Frequently Asked Questions & Answers topic. If you still haven't found a solution, post your issue down below and we'll do our best to help! If the hack does work for you, please post your feedback below and help out other fellow members that are encountering issues.


      Credits:
      - AlyssaX64


      Cheat Video/Screenshots:

      N/A
      • 24 replies
    • SHIN MEGAMI TENSEI D×2 v8.0.11 +2 Jailed Cheats
      Modded/Hacked App: SHIN MEGAMI TENSEI D×2 by SEGA CORPORATION
      Bundle ID: com.sega.d2megaten.en
      iTunes Store Link: https://itunes.apple.com/us/app/shin-megami-tensei-d-%EF%BC%92/id1349725119?mt=8&uo=4&at=1010lce4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Cydia Impactor.
      - A Computer Running Windows/Mac/Linux.


      Hack Features:
      - No Skill Cost
      • 22 replies
    • DEAD TARGET: FPS Zombie Games v6.146.0 [ +10 Cheats ] Currency Max
      Modded/Hacked App: DEAD TARGET: FPS Zombie Games By VNG SINGAPORE PTE LTD
      Bundle ID: com.vng.g6.a.zombie
      iTunes Store Link: https://apps.apple.com/us/app/dead-target-fps-zombie-games/id901793885?uo=4
       

      Hack Features

      - Unlimited Gold
      - Unlimited Cash

      - Unlimited Diamonds
      - Unlimited Grenades
      - Unlimited MedKits
      - Unlimited Ammo
      - One Hit Kill
      - God Mode
      - High Accuracy

      - ADS NO
      • 9 replies
    • DEAD TARGET: FPS Zombie Games v6.146.0 [ +10 Jailed ] Currency Max
      Modded/Hacked App: DEAD TARGET: FPS Zombie Games By VNG SINGAPORE PTE LTD
      Bundle ID: com.vng.g6.a.zombie
      iTunes Store Link: https://apps.apple.com/us/app/dead-target-fps-zombie-games/id901793885?uo=4
       

      Hack Features

      - Unlimited Gold
      - Unlimited Cash

      - Unlimited Diamonds
      - Unlimited Grenades
      - Unlimited MedKits
      - Unlimited Ammo
      - One Hit Kill
      - God Mode
      - High Accuracy

      - ADS NO
      • 10 replies
    • Island War Raid V5.7.8 [ +2 Cheats ] Win Fight
      Modded/Hacked App: Island War: Raid By SamShui Corporation
      Bundle ID: com.addictive.strategy.island.clash
      iTunes Store Link: https://apps.apple.com/us/app/island-war-raid/id1542454536?uo=4

      Hack Features:
      - Die Anyone [ Red & Blue ] Win Fight
      - Destroy Building [ Win Fight ] 



      Note:- Works Only [ Arena ]
      • 25 replies
    • Island War Raid V5.7.8 [ +2 Jailed ] Win Fight
      Modded/Hacked App: Island War: Raid By SamShui Corporation
      Bundle ID: com.addictive.strategy.island.clash
      iTunes Store Link: https://apps.apple.com/us/app/island-war-raid/id1542454536?uo=4


      Hack Features:

      - Die Anyone [ Red & Blue ] Win Fight
      - Destroy Building [ Win Fight ] 



      Note:- Works Only [ Arena ]
      • 4 replies
    • Hungry Shark World v6.6.1 [ +9 Cheats ] Currency Max
      Modded/Hacked App: Hungry Shark World By Ubisoft
      Bundle ID: com.ubisoft.hungrysharkworld
      iTunes Store Link: https://apps.apple.com/us/app/hungry-shark-world/id1046846443?uo=4


      Hack Features:
      - ADS NO

      - Gems

      - Coins 

      - Pearls 

      - Premium Pass

      - Health Auto Drain [ OFF ]

      - Boost Max 

      - Score Multi 

      - Revive Max 


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 42 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines