Tutorial Learn how to hack games with IDA, CodeInject and HooKfunction (with example!)

princessXZ · November 28, 2022

Hello there:)

Today I want to tell you about Code Inject and MSHook Hacking.

I will explain with a practical example for clarity!

I thank this community and leave this guide.

Thank you!

✔Requirements

Spoiler

IDA PRO

Theos ( https://github.com/theos/theos/wiki/Installation )

Knowledge about C++

✔Binary

Spoiler

1.Add this repo http://cydia.iphonecake.com/

2.Install CrackerXI.

3.Turn on all in Settings.

4.Slect app which you want to get binary in Applist.

5.It will save to /var/mobile/Documents/CrackerXI

✔Note about Tweak.xm

Spoiler

The latest version of Theos uses Tweak.x instead of Tweak.xm.

These differences are explained at this page:

https://iphonedevwiki.net/index.php/Logos#File_Extensions_for_Logos

This can cause errors when compiling code found on the net. (In my case when compiling the code for PrefBundle)

So follow this:

1.Change name from Tweak.x to Tweak.xm

2.Change <ProjectName> _FILES = Tweak.x to <ProjectName> _FILES = Tweak.xm in Makefile.

✔ASLR Slide

Spoiler

There is ASLR slide is ARM64 binary, so IDA offset and actual binary offset are shifted by ASLR value.

※You can give IDA offset to vm_WriteData because ASLR considered Automatically in vm_WriteData.h

#import <mach-o/dyld.h>

uint64_t getRealOffset(uint64_t offset){

return _dyld_get_image_vmaddr_slide(0)+offset;

}

✔ARM Insructions

Spoiler

Load

MOV r0, r1

Move the value of r1 to r0

LDR r0, [r1]

Load from memory r1 to register r0

STR r0, [r1]

Store the value of r0 into r1

Store memory r1 with value of register r0

Branch

Compare previous CMP values

BEQ label

jump to label if values are equal

BNE label

jump to label if values are not equal

etc...

CBZ r0, label

jump to label if r0 is 0

CBNZ r0, label

jump to label if r0 is not 0

✔CodeInject

Spoiler

Place vm_WriteData.h in your project.

And add this to beginning of the code

#import <vm_writeData.h>

Identify the part to change

1.Change the return value

Look at the processing at the bottom of the function (the part load to X0)

MOV X0, 100

2.Change branch

BEQ X0, label

Change the branch to always jump to any label:

B X0, label (BAL is also ok)

Change the branch to never jump to any label:

NOP

Convert to Hex

1.Load

http://armconverter.com/

2.Branch

http://armconverter.com/branchfinder/

Enter ARM instruction and copy ARM64 HEX.

Apply Changes

vm_WriteData(0x100000000, 0x00000000);

Change the memory starting from 0x100000000 to 00000000.

Ex1:Change instruction to change damage

Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link. 👀

Ex2:Change branch to change accuracy of weapon

Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link. 👀

❔ Where should I actually write ❔

Spoiler

It is good to write in %ctor. You can write it like this:

#import <vm_writeData.h>

%ctor {

vm_WriteData(0x1002B55D8, 0x953E80D2);

}

✔MS(Object-C func)

Spoiler

Class name depends on the game Use class name which has applicationDidBecomeActive method!

(Easy to find on Flex)

%hook AppController // class name

-(void)applicationDidBecomeActive:(id)argument { // (type od return value) and method name and (type of argument)

UIAlertView *alert = [[UIAlertView alloc] initWithTitle:@"test" message:@"Detected App opened!" delegate:nil cancelButtonTitle:@"Continue" otherButtonTitles:nil];

[alert show];

return %orig(argument);

}

%end

%orig holds the original function. Since we only want to add processing, we also call the original function.

※You can change the process by changing the argument.

This way is only available for Object-C functions, so if you want to hook a native function you can see in IDA and use MSHook!

✔MSHook(Native func)

Spoiler

Import substrate at beginning of code.

#import <substrate.h>

Hook function with offset

MSHookFunction((void *)getRealOffset(0x100000000), (void *)func, (void **)&org_func);

func

func - Function that has a process that you want to overwrite.

org_func - Function that keeps the original processing.

Since MSHookFuntion's void is cast and passed to void type, it is always void.

argument

Be sure to include this pointer first.

Ex1:Increase Damage

Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link. 👀

✔NSLog

Spoiler

To check NSLog on a device.

Add Flexing from the BigBoss repository.

You can display the log by pressing and holding three fingers on the application you want to see logs.

It can be used by tapping System Log and enabling it from Setting in the upper right.

NSLog(@"Your Log Text Here");

To display argument values:

%d int

%f float

%c unsigned char

%hi short

Ex:Display argument values

Spoiler

You can add it in the function definition that overrides like this.

int getDamage(void* this_, void* UserInfor, unsigned char arg0, float arg1) {

NSLog(@"getDamage Called! arg0: %c, arg1: %f", arg0, arg1);

return org_getDamage(this_, UserInfor, arg0, arg1);

}

✔Call the native func

Ex:Call a function to get user information

Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link. 👀

✔PrefBundle

Spoiler

https://iosgods.com/topic/444-tutorial-how-to-make-a-preference-bundle/

https://www.youtube.com/watch?v=iHEuM1e8V40&list=PLFWEDfSyl7h9JFTfKD4qBdh_5OjZ1DdAw&index=16&t=0s

You can learn about PredBundle easily from the link above.

I only mention here how to add icons.

How to add icons

Add icon.png file to <project>/<prefbundl_project>/Resources/

You have to export with these size:

> icon.png - 29×29

> [email protected] - 58×58

> [email protected] - 87×87

You can export icon in here: https://appiconmaker.co/

p.s. A knowledgeable person would think why I don't talk about debuggers. Unfortunately gdb is displayed as BadCPUType in my environment and watch-point does not work properly in lldb.

Here are some great tutorials if you are interested in them:

https://iosgods.com/topic/75950-arm64-ida-lldb-tutorial-noob-friendly/

If there are any mistakes please point in reply !

Enjoy

Updated November 28, 2022 by princessXZ
some stuff

April 21, 2020

Thank you very much brother! So good

Enoch · April 21, 2020

Very well written and explained. Great tutorial.

DedCracks · April 21, 2020

Great

najali · April 21, 2020

Hi

can you please tell me how to hack on nfs nolimits ,any help is very apreciated

Ted2 · April 21, 2020

7 hours ago, mafusuke said:

STR r0, [r1]

Load the value of r0 into r1

Nicely written, note thought that STR stands for store, so it's storing it.
Generally, LDR is used to load something from memory to a register, and STR is used to store something from a register to a memory address.

GodsAndMe · April 21, 2020

thank you

LeakedTreasure · April 21, 2020

Thanks for the info man!

princessXZ · April 22, 2020

3 hours ago, Ted2 said:

Nicely written, note thought that STR stands for store, so it's storing it.
Generally, LDR is used to load something from memory to a register, and STR is used to store something from a register to a memory address.

Thank you! I'll fix that 🙂