Tutorial [Beginner Friendly] Guide to Easily Hacking Your First Unity Game

[Farag1212 4 iPhone 13 Pro Max 15.5]

Good luck 👍🍀 

[LeePham 4k iPhone X 12.4]

 

On 6/9/2020 at 1:54 PM, D red said:

Hello,

What is the different of fmov and mov ? 

Thanks  

fmov is FLOAT

and MOV is INT

[LeePham 4k iPhone X 12.4]

 

they updated und change Binary to -> Unityframework  

[Alihackali 15 iPhone X 14]

Hello sir, thanks for helping   I hope you will help me.. I want to know how I can hack this game. I have now dnspy and ida pro. I extracted offset, but I do not know what to do anymore. I want to hack coins from the game (( Sugar Blast )) and extracted Offset. This is Huh 0x15938BC But I don't know what to do anymore Can you help me please I want to make it as  Tweak  to hack this game For Jailbreak users I know how to make Tweak I just want the way how to write  the code what I can put it in Tweak.xm

Offset. This is 0x15938BC 

DreamBlast.Inventory$$GetCoins

 

or can you show me what I have to use  hex on tool iOSGods Live Offset 

Updated February 20, 2021 by Apps96

[Alihackali 15 iPhone X 14]

.

.

Updated February 20, 2021 by Apps96

[ꪫꪑꪖꪚ 56]

It gave me this message while dumping il2cpp,

----- [Dumping ARM64] -----
Read config...
Initializing metadata...
System.IndexOutOfRangeException: Index was outside the bounds of the array.
   at Il2CppDumper.Metadata.ProcessingMetadataUsage()
   at Il2CppDumper.Metadata..ctor(Stream stream)
   at Il2CppDumper.FormGUI.Init(String il2cppPath, String metadataPath, Metadata& metadata, Il2Cpp& il2Cpp)
   at Il2CppDumper.FormGUI.Dumper(String file, String metadataPath, String outputPath)

Copied ida_with_struct.py
Copied ida_with_struct_py3.py

Updated June 16, 2021 by CrazyBloo

[ic0 1 iPhone 8 Plus 12.3]

qss

[Noela87 12 iPhone 6 12.5.2]

Can this also be used for non Unity games?

[cybergeisha 148 iPhone 11 14.0]

.

Updated November 9, 2021 by cybergeisha

[xrayactual 6 iPhone 11 Pro Max 14.3]

Solution:

Spoiler

Unity games place their executable/binary within the Frameworks folder of the app

~/this.app/Frameworks/UnityFramework.framework/UnityFramework

I was able to decrypt the UnityFramework executable using flexdecrypt, because CrackerXl+ does not allow you to target any binary other than the one in the app's main directory, making it useless for cracking unity games.

Using the much larger decrypted UnityFramework along with the aforementioned global-metadata spits out the necessary archive

~/this.app/Data/Managed/Metadata/global-metadata.dat

Original post:

@Enoch Is it not possible to decrypt unity games using Il2cpp Dumper anymore?
CC: @Ted2@Rook
I'm getting errors on the two online tools, (IOSGods & JumboPerson), even though I have the executable/binary from CrackdXl, and the metadata from the file path "/this.app/Data/Managed/Metadata", but nothing is working.
One of the games I was testing this with has already has mod menus (jailed & jailbroken)

Spoiler

Screen Shot

There are so many tutorials on IOSGods (regarding mobile hacking basics/tools) and they are all so spread out (in time), some of which are extremely outdated or have requirements that are no longer available/reliable, it's difficult to piece together the process together as it stands today. At this point it's honestly easier to troubleshoot the issues I or others encounter, as they occu, until someone redoes/properly updates the tutorials.

Some other issues that don't seem to have an explanation:

1. Using the attach command on an active process through LLDB will crash LLDB, returning you to the previous file path
2. GNU Debugger is completely broken, using the gdb command (literally the first step) spits out the following error, attempts to fix/circumvent caused a cascade of headaches in sources, tweaks/names, duplicate files (during/after install), and their prerequisites
   • Spoiler

     /usr/bin/gdb: line 355: /usr/libexec/gdb/gdb-arm-apple-darwin: Bad CPU type in executable
     /usr/bin/gdb: line 355: /usr/libexec/gdb/gdb-arm-apple-darwin: Undefined error: 0

3. Syscall, ptrace, etc. not found in disassembled executable
4. I'll add more as they present themselves

Solutions: 
 

Spoiler

1. Anti-debugging detection?
   1. So far no bypass has worked for me
   2. Haven't found any known debug checkers, functions are clean too
2. Possibly deprecated?
   1. Given up on GDB

 

Updated January 21, 2022 by xrayactual
Additional details