Jump to content

Learn how to hack games with IDA, CodeInject and HooKfunction (with example!)


princessXZ

127 posts in this topic

Recommended Posts

Hello there:)
Today I want to tell you about Code Inject and MSHook Hacking.
I will explain with a practical example for clarity!
I thank this community and leave this guide. 
Thank you!
 
✔Requirements
Spoiler
IDA PRO
Knowledge about C++ 
 
✔Binary
Spoiler
1.Add this repo http://cydia.iphonecake.com/
2.Install CrackerXI.
3.Turn on all in Settings.
4.Slect app which you want to get binary in Applist.
5.It will save to /var/mobile/Documents/CrackerXI
 
✔Note about Tweak.xm
Spoiler
The latest version of Theos uses Tweak.x instead of Tweak.xm.
These differences are explained at this page:
This can cause errors when compiling code found on the net. (In my case when compiling the code for PrefBundle)
So follow this:
1.Change name from Tweak.x to Tweak.xm
2.Change <ProjectName> _FILES = Tweak.x to <ProjectName> _FILES = Tweak.xm in Makefile.
 
✔ASLR Slide
Spoiler

There is ASLR slide is ARM64 binary, so IDA offset and actual binary offset are shifted by ASLR value.

※You can give IDA offset to vm_WriteData because ASLR considered Automatically in vm_WriteData.h
#import <mach-o/dyld.h>
uint64_t getRealOffset(uint64_t offset){
return _dyld_get_image_vmaddr_slide(0)+offset;
}

✔ARM Insructions

Spoiler

Load

MOV r0, r1 
Move the value of r1 to r0
LDR r0, [r1]
Load from memory r1 to register r0
STR r0, [r1]
Store the value of r0 into r1
Store memory r1 with value of register r0 
 
Branch
Compare previous CMP values
BEQ label
jump to label if values are equal
BNE label
jump to label if values are not equal
etc...
CBZ r0, label
jump to label if r0 is 0
CBNZ r0, label
jump to label if r0 is not 0

 

 
✔CodeInject
Spoiler

Place vm_WriteData.h in your project.

And add this to beginning of the code  
#import <vm_writeData.h>
 
Identify the part to change
1.Change the return value
Look at the processing at the bottom of the function (the part load to X0)
MOV X0, 100
2.Change branch
BEQ X0, label
Change the branch to always jump to any label:
B X0, label (BAL is also ok)
Change the branch to never jump to any label:
NOP
Convert to Hex
1.Load
2.Branch
Enter ARM instruction and copy ARM64 HEX.
Apply Changes
vm_WriteData(0x100000000, 0x00000000);
Change the memory starting from 0x100000000 to 00000000.
 
Ex1:Change instruction to change damage
Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link.

Ex2:Change branch to change accuracy of weapon

Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link.

Where should I actually write

Spoiler

It is good to write in %ctor. You can write it like this:

#import <vm_writeData.h>
%ctor {
  vm_WriteData(0x1002B55D8, 0x953E80D2);
}
 
✔MS(Object-C func)
Spoiler

Class name depends on the game Use class name which has applicationDidBecomeActive method!

(Easy to find on Flex)
%hook AppController // class name
-(void)applicationDidBecomeActive:(id)argument { // (type od return value) and method name and (type of argument)
    UIAlertView *alert = [[UIAlertView alloc] initWithTitle:@"test" message:@"Detected App opened!" delegate:nil cancelButtonTitle:@"Continue" otherButtonTitles:nil];
    [alert show];
    return %orig(argument);
}
%end
%orig holds the original function. Since we only want to add processing, we also call the original function.
※You can change the process by changing the argument.
This way is only available for Object-C functions, so if you want to hook a native function you can see in IDA and use MSHook!
 
✔MSHook(Native func)
Spoiler

Import substrate at beginning of code.

#import <substrate.h>
Hook function with offset
MSHookFunction((void *)getRealOffset(0x100000000), (void *)func, (void **)&org_func);
func
func - Function that has a process that you want to overwrite.
org_func - Function that keeps the original processing.
Since MSHookFuntion's void is cast and passed to void type, it is always void.
argument
Be sure to include this pointer first.
 
Ex1:Increase Damage
Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link.

 

✔NSLog

Spoiler

To check NSLog on a device.

Add Flexing from the BigBoss repository.
You can display the log by pressing and holding three fingers on the application you want to see logs.
It can be used by tapping System Log and enabling it from Setting in the upper right.
NSLog(@"Your Log Text Here");
To display argument values:
%d int
%f float
%c unsigned char
%hi short
 
Ex:Display argument values
Spoiler

You can add it in the function definition that overrides like this.

int getDamage(void* this_, void* UserInfor, unsigned char arg0, float arg1) {
  NSLog(@"getDamage Called! arg0: %c, arg1: %f", arg0, arg1);
  return org_getDamage(this_, UserInfor, arg0, arg1);
}
 
✔Call the native func
 
Ex:Call a function to get user information
Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link.

✔PrefBundle

Spoiler

https://iosgods.com/topic/444-tutorial-how-to-make-a-preference-bundle/

You can learn about PredBundle easily from the link above.
I only mention here how to add icons.
How to add icons
Add icon.png file to <project>/<prefbundl_project>/Resources/
You have to export with these size:
> icon.png - 29×29
[email protected] - 58×58
[email protected] - 87×87
You can export icon in here: https://appiconmaker.co/
 
p.s. A knowledgeable person would think why I don't talk about debuggers. Unfortunately gdb is displayed as BadCPUType in my environment and watch-point does not work properly in lldb.
Here are some great tutorials if you are interested in them:
 
If there are any mistakes please point in reply !
Enjoy :)
Updated by princessXZ
some stuff
  • Like 259
  • Winner 21
  • Thanks 25
  • Haha 6
  • Agree 7
  • Informative 18
Link to comment
Share on other sites

7 hours ago, mafusuke said:
STR r0, [r1]
Load the value of r0 into r1

Nicely written, note thought that STR stands for store, so it's storing it.
Generally, LDR is used to load something from memory to a register, and STR is used to store something from a register to a memory address.

Link to comment
Share on other sites

3 hours ago, Ted2 said:

Nicely written, note thought that STR stands for store, so it's storing it.
Generally, LDR is used to load something from memory to a register, and STR is used to store something from a register to a memory address.

Thank you! I'll fix that 🙂

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below. For more information, please read our Posting Guidelines.
Reply to this topic... Posting Guidelines

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Our picks

    • Bloons TD 6 v43.3 +15 OP Cheats
      Modded/Hacked App: Bloons TD 6 By Ninja Kiwi Limited
      Bundle ID: com.ninjakiwi.bloonstd6
      iTunes Store Link: https://apps.apple.com/us/app/bloons-td-6/id1118115766?uo=4


      Hack Features:
      - Place Tower Anywhere<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Multiple God Towers<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- God Mode<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Infinite Cash<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Infinite Monkey Money<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Infinite Powers<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Unlock All Heroes<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Unlock All Knowledges<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Unlock All Towers<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Unlock All Upgrades<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Can Unlock Map (Click any locked map)<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Bypass Tutorial (Place one tower and quit the game)


      Jailbreak required hack(s): 
        • Informative
        • Agree
        • Haha
        • Winner
        • Like
      • 1,097 replies
    • Bloons TD 6 v43.3 +24 MEGA Cheats +[Free Paid IPA]
      Modded/Hacked App: Bloons TD 6 By Ninja Kiwi Limited
      Bundle ID: com.ninjakiwi.bloonstd6
      iTunes Store Link: https://apps.apple.com/us/app/bloons-td-6/id1118115766?uo=4


      Hack Features:
      - God Mode -updated- Clear Bloons -new
      - Auto Win Game -new
      - Set Round -new
      - Restart Game -new
      - Add Cash - new
      - Place towers anywhere
      - Multiple God Towers
      - Infinite Cash
      - Infinite Monkey Money
      - Infinite Powers
      - Unlock all Heros
      - Unlock all Knoledge
      - Unlock all towers
      - Unlock all upgrades 
      - Can unlock map (click locked map)
      - Skip tutorial (load the games first tutorial then exit app and start it. should skip tutorial) -new
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,433 replies
    • Zombies vs. Towers v13.1.120 +4 [Currency Hack]
      Modded/Hacked App: Zombies vs. Towers By intellis d.o.o.
      Bundle ID: com.edenap.z2
      iTunes Store Link: https://apps.apple.com/us/app/zombies-vs-towers/id1545660538?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing / or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - No Ads
      - Infinite Currencies
      - Infinite Ammo
      - Freeze Wall HP


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      • 82 replies
    • Zombies vs. Towers v13.1.120 +4 [Currency Hack]
      Modded/Hacked App: Zombies vs. Towers By intellis d.o.o.
      Bundle ID: com.edenap.z2
      iTunes Store Link: https://apps.apple.com/us/app/zombies-vs-towers/id1545660538?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - No Ads
      - Infinite Currencies
      - Infinite Ammo
      - Freeze Wall HP


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      • 57 replies
    • Ball Sort Color Water Puzzle v25.1.0 +2
      Modded/Hacked App: Ball Sort Color Water Puzzle By GLOBAL MOBILE APPLICATION LIMITED COMPANY
      Bundle ID: com.gma.ball.sort.color.water.puzzle
      iTunes Store Link: https://apps.apple.com/us/app/ball-sort-color-water-puzzle/id1550569446?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - No Ads
      - Freeze Undo Count


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      • 22 replies
    • Ball Sort Color Water Puzzle v25.1.0 +2
      Modded/Hacked App: Ball Sort Color Water Puzzle By GLOBAL MOBILE APPLICATION LIMITED COMPANY
      Bundle ID: com.gma.ball.sort.color.water.puzzle
      iTunes Store Link: https://apps.apple.com/us/app/ball-sort-color-water-puzzle/id1550569446?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - No Ads
      - Freeze Undo Count


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      • 20 replies
    • Picture Cross v4.9 +2 [Currency Hack]
      Modded/Hacked App: Picture Cross By AppyNation Ltd
      Bundle ID: com.appynation.wbpc
      iTunes Store Link: https://apps.apple.com/us/app/picture-cross/id977150768?uo=4


      Hack Features:
      - Infinite Coins<br style="background-color:#1e1f25;color:rgba(255,255,255,0.81);font-size:14px;">- Free Gameplay 


      Jailbreak required hack(s): 


      • 34 replies
    • Mining Fever v1.4.1 +2
      Modded/Hacked App: Mining Fever By TapNice Sp. z o.o.
      Bundle ID: com.mining.fever
      iTunes Store Link: https://apps.apple.com/us/app/mining-fever/id1617081051?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - Infinite Gems
      - Dumb Enemies
      - High Mining Damage


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      • 32 replies
    • Mining Fever v1.4.1 +15
      Modded/Hacked App: Mining Fever By TapNice Sp. z o.o.
      Bundle ID: com.mining.fever
      iTunes Store Link: https://apps.apple.com/us/app/mining-fever/id1617081051?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - Add 100 Gems
      - Add 10k Gold
      - Turbo Mode Add Energy
      - Set Backpack Level
      - Set Pickaxe Level
      - Set Weapon Level
      - Unlock All Caves
      - Unlock Museum
      - Unlock Arena
      - Unlock Cave Hub Lever
      - Unlock Skills
      - Unlock Tavern
      - Infinite Gems
      - Dumb Enemies
      - High Mining Damage


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      • 65 replies
    • Questopia v1.3.8 +7 [Currency Hack]
      Modded/Hacked App: Questopia By SOZAP AB
      Bundle ID: com.sozap.questopia
      iTunes Store Link: https://apps.apple.com/us/app/questopia/id6447611293?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - No Ads
      - God Mode
      - Infinite Cash
      - Infinite Resources
      - Freeze Ground Enemies
      - Disable Shark
      - All Characters Unlocked


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


        • Agree
      • 55 replies
    • Questopia v1.3.8 +7 [Currency Hack]
      Modded/Hacked App: Questopia By SOZAP AB
      Bundle ID: com.sozap.questopia
      iTunes Store Link: https://apps.apple.com/us/app/questopia/id6447611293?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - No Ads
      - God Mode
      - Infinite Cash
      - Infinite Resources
      - Freeze Ground Enemies
      - Disable Shark
      - All Characters Unlocked


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      • 43 replies
    • Tap Away 3D v145.0.2 +4 [Infinite Moves]
      Modded/Hacked App: Tap Away 3D By Popcore GmbH
      Bundle ID: com.jctswbglsm.SwipeAway
      iTunes Store Link: https://apps.apple.com/us/app/tap-away-3d/id1568058543?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - No Ads
      - Infinite Moves
      - Freeze Challenge Moves
      - Disable Timer for Challenge


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/

      • 44 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines