Jump to content

How would I override an method with its offset?


Aarivex

11 posts in this topic

Recommended Posts

Posted

I'm very new into this game, yet I have some knowledge (programming and basic reverse-engineering).

I just dumped some data for a game (American Dad! Apocalypse Soon). It's an Unity game, so I used IL2CPPDump/I'm viewing the classes with dotPeek.

There are many methods including get and set methods. Basiclly every method has its own RVA and offset.

 

How would I change the behaviour of a method?

Say I want get_XYZValue() to return 1337 (or set_XYZValue(int x) to set x to 1337) and the offset is 0x17EC0809. Would I just override 17EC0809 with 0x539 or maybe 20A78052 (MOV W0, #1337) or is it more than that?

I tried the second approach with some functions using iOSGods Live Offset Patcher, yet it sadly didn't affect anything.

 

I appreciate any answer! Thanks.

Posted

Make sure that you have chosen the correct register to move a value into, and make sure it doesn’t get changed afterwards. This can be achieved by putting a RET statement right after it.

Posted
13 hours ago, bR34Kr said:

Make sure that you have chosen the correct register to move a value into, and make sure it doesn’t get changed afterwards. This can be achieved by putting a RET statement right after it.

Thanks for your answer.

I already know about RET, but how would you fit both MOV and RET in one single HEX and how could I get the current register? Do I need to debug it, or would fridump do the job?

And does that mean that the offset of a method is just pointing to the corresponding ARM code that is being executed, just like you'd inspect an method inside IDA?

Posted

If you are using in game Menu patching   your hack is  0x20A78052C0035FD6.

If you are just patching binary for ipa sideloading the hack is 20A78052C0035FD6.

Posted
On 11/4/2019 at 5:01 PM, Aarivex said:

I already know about RET, but how would you fit both MOV and RET in one single HEX and how could I get the current register? Do I need to debug it, or would fridump do the job?

Yeah, you can fit both MOV and RET in a function as long as the function is at least 4 bytes in size.

Posted
13 hours ago, DADi said:

Yeah, you can fit both MOV and RET in a function as long as the function is at least 4 bytes in size.

I got some answers on /r/jailbreakdevelopers that told me that I need the RVA and the ASLR slide, so it makes sense now to me.

Thanks for your answers!

What confused me was that why overriding a method address with ARM HEX instructions would work, but I got some insight there now that I know that you can "replace" the original function with your own and how the offset works using _dyld_get_image_vmaddr_slide(0).

Posted
51 minutes ago, Aarivex said:

I got some answers on /r/jailbreakdevelopers that told me that I need the RVA and the ASLR slide, so it makes sense now to me.

Thanks for your answers!

What confused me was that why overriding a method address with ARM HEX instructions would work, but I got some insight there now that I know that you can "replace" the original function with your own and how the offset works using _dyld_get_image_vmaddr_slide(0).

Ah, perhaps this would be of help to you. http://armconverter.com/mshookgenerator/

Posted
43 minutes ago, DADi said:

Ah, perhaps this would be of help to you. http://armconverter.com/mshookgenerator/

I already know that tool, but I can write that code on my own :D

I wrote this bit of code, which sadly doesn't affect anything:

#include <mach-o/dyld.h>
#include <substrate.h>
  
void *func = (void *)(_dyld_get_image_vmaddr_slide(0) + 0x101AA8924);
int (*original) (); // or int (*original) (void *self);
int replacement() { // or int replacement (void *self);
	return 10; 
}

%ctor {
	MSHookFunction(lvlFunc, (void *)replacement, (void **)&original);
}

whereas this code leads to an crash:

#include <mach-o/dyld.h>
#include <substrate.h>

int (*old_get_Level)(void *self);
int get_Level(void *self) {
	return 10;
}
  
%ctor {
	MSHookFunction((void *)(_dyld_get_image_vmaddr_slide(0) + 0x101AA8924), (void*)get_Level, (void**)&old_get_Level);
}

Not just with get_Level, but also with some methods inside a battle - f.e. MaxHealth or UnitHealth.

Posted

Is your offset an instrtuction inside the function? MSHookFunction only works on functions.

And also the function needs to be bigger than 8 bytes in order to use MSHookFunction on it from what I recall.

Archived

This topic is now archived and is closed to further replies.

  • Our picks

    • Zombie Fortress: Trap Defense v0.8.0 [+6 Jailed Cheats]
      Modded/Hacked App: Zombie Fortress: Trap Defense By SayGames LTD
      Bundle ID: com.nlabsoft.zombiecrusher.s
      App Store Link: https://apps.apple.com/us/app/zombie-fortress-trap-defense/id6747713523?uo=4



      🤩 Hack Features

      - Add Cash
      - Add Diamond
      - Add Energy
      - Add Parts
      - Never Die
      - Add Battle Gold (Enable inside battle)
        • Winner
      • 3 replies
    • Zombie Fortress: Trap Defense v0.8.0 [+6 Cheats]
      Modded/Hacked App: Zombie Fortress: Trap Defense By SayGames LTD
      Bundle ID: com.nlabsoft.zombiecrusher.s
      App Store Link: https://apps.apple.com/us/app/zombie-fortress-trap-defense/id6747713523?uo=4



      🤩 Hack Features

      - Add Cash
      - Add Diamond
      - Add Energy
      - Add Parts
      - Never Die
      - Add Battle Gold (Enable inside battle)
        • Winner
      • 1 reply
    • Heroes Crew: Strategy Defense v1.1.5 [+6 Cheats]
      Modded/Hacked App: Heroes Crew: Strategy Defense By AlohaFactory
      Bundle ID: com.overdogs.heroes
      App Store Link: https://apps.apple.com/us/app/heroes-crew-strategy-defense/id6744350078?uo=4



      🤩 Hack Features

      - Add Currency
      - Unlimited Items
      - Unlimited Property (Heroes, Relic etc)
      - Activate VVip (Use after tutorial and only in main menu)
      - Activate Premium Hunt Pass (Use after tutorial and only in main menu)
      - Unlimited Battle Currency (Always Will Increase)
        • Winner
        • Like
      • 31 replies
    • Heroes Crew: Strategy Defense v1.1.5 [+6 Jailed Cheats]
      Modded/Hacked App: Heroes Crew: Strategy Defense By AlohaFactory
      Bundle ID: com.overdogs.heroes
      App Store Link: https://apps.apple.com/us/app/heroes-crew-strategy-defense/id6744350078?uo=4



      🤩 Hack Features

      - Add Currency
      - Unlimited Items
      - Unlimited Property (Heroes, Relic etc)
      - Activate VVip (Use after tutorial and only in main menu)
      - Activate Premium Hunt Pass (Use after tutorial and only in main menu)
      - Unlimited Battle Currency (Always Will Increase)
        • Informative
        • Agree
        • Winner
        • Like
      • 15 replies
    • Candy Pop Story : Match 3 v1.23.0722 [ +3 Cheats ] Auto Win
      Modded/Hacked App: Candy Pop Story : Match 3 By F.O.G LIMITED
      Bundle ID: com.gamoper.candysweetstory.ios
      App Store Link: https://apps.apple.com/us/app/candy-pop-story-match-3/id6670773988?uo=4


      🤩 Hack Features

      - Auto Win
      - Coins
      - Moves
      -
        • Thanks
      • 6 replies
    • Candy Pop Story : Match 3 v1.23.0722 [ +3 Jailed ] Auto Win
      Modded/Hacked App: Candy Pop Story : Match 3 By F.O.G LIMITED
      Bundle ID: com.gamoper.candysweetstory.ios
      App Store Link: https://apps.apple.com/us/app/candy-pop-story-match-3/id6670773988?uo=4
       

      🤩 Hack Features

      - Auto Win
      - Coins
      - Moves
        • Winner
        • Like
      • 6 replies
    • Boom Castle Tower Defense TD v1.5.2 [ +7 Jailed ] Easy Win
      Modded/Hacked App: Boom Castle: Tower Defense TD By Terahype s.r.o.
      Bundle ID: castle.heroes.tower.defense.kingdom.magic.battle.archer
      iTunes Store Link: https://apps.apple.com/us/app/boom-castle-tower-defense-td/id6502820312?uo=4


      Hack Features:

      - Enemy Status [ HP DEF ]

      - Base HP 

      - Battle Cost 0 

      - Stage Unlocked [ Play Any Stage ]

      - Battle Pass Unlocked 

      - Battle Pass Claim Unlimited [ Gems Gold ]

      - iGG Speed Hack Max 0 - 10 [ Skill CD - ATK Speed - Animation Speed - Wave Faster ]


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Winner
        • Like
      • 48 replies
    • Boom Castle Tower Defense TD v1.5.2 [ +7 Cheats ] Easy Win
      Modded/Hacked App: Boom Castle: Tower Defense TD By Terahype s.r.o.
      Bundle ID: castle.heroes.tower.defense.kingdom.magic.battle.archer
      iTunes Store Link: https://apps.apple.com/us/app/boom-castle-tower-defense-td/id6502820312?uo=4


      Hack Features:
      - Enemy Status [ HP DEF ]

      - Base HP 

      - Battle Cost 0 

      -  Stage Unlocked [ Play Any Stage ]

      - Battle Pass Unlocked 

      - Battle Pass Claim Unlimited [ Gems Gold ]

      - iGG Speed Hack Max 0 - 10 [ Skill CD - ATK Speed - Animation Speed - Wave Faster ] 


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 52 replies
    • Zombie Infinity v1.9.1 [ +5 Cheats ] Currency Max
      Modded/Hacked App: Zombie Infinity By kamasu.jp Inc.
      Bundle ID: jp.kamasu.oread
      App Store Link: https://apps.apple.com/ph/app/zombie-infinity/id6736433765?uo=4


      🤩 Hack Features

      - ADS Pass

      - Energy Pass

      - Premium Pass

      - Currency

      - Hero Status [ HP - DMG ]
        • Thanks
        • Like
      • 4 replies
    • Zombie Infinity v1.9.1 [ +5 Jailed ] Currency Max
      Modded/Hacked App: Zombie Infinity By kamasu.jp Inc.
      Bundle ID: jp.kamasu.oread
      App Store Link: https://apps.apple.com/ph/app/zombie-infinity/id6736433765?uo=4


      🤩 Hack Features

      - ADS Pass

      - Energy Pass

      - Premium Pass

      - Currency

      - Hero Status [ HP - DMG ]
        • Like
      • 3 replies
    • Alien Survivor: Survival Arena v1.40.0 [ +7 Cheats ] Currency Max
      Modded/Hacked App: Alien Survivor: Survival Arena By IMPONILOX LIMITED
      Bundle ID: world.playme.x
      iTunes Store Link: https://apps.apple.com/us/app/alien-survivor-survival-arena/id1669761844?uo=4
       

      🚀 Hack Features

      - ADS NO [ Rewards Free ]

      - Gems [ Achievements Rewards Only One Get ]

      - Energy [ Just Buy ]

      - HP [ Just Equip & Unequip ]

      - ATK [ Just Equip & Unequip ]

      - DEF [ Just Equip & Unequip ]

      - Skill CD [ First Get Then Use ]


      🍏 For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/forum/79-no-jailbreak-section/
      🤖 Modded Android APK(s): https://iosgods.com/forum/68-android-section/
        • Informative
        • Agree
        • Haha
        • Winner
        • Like
      • 19 replies
    • Alien Survivor: Survival Arena v1.40.0 [ +7 Jailed ] Currency Max
      Modded/Hacked App: Alien Survivor: Survival Arena By IMPONILOX LIMITED
      Bundle ID: world.playme.x
      iTunes Store Link: https://apps.apple.com/us/app/alien-survivor-survival-arena/id1669761844?uo=4


      🚀 Hack Features

      - ADS NO [ Rewards Free ]

      - Gems [ Achievements Rewards Only One Get ]

      - Energy [ Just Buy ]

      - HP [ Just Equip & Unequip ]

      - ATK [ Just Equip & Unequip ]

      - DEF [ Just Equip & Unequip ]

      - Skill CD [ First Get Then Use ]


      🍏 Jailbreak iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      🤖 Modded Android APKs: https://iosgods.com/forum/68-android-section/
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 32 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines