Jump to content

Learn how to hack games with IDA, CodeInject and HooKfunction (with example!)


132 posts in this topic

Recommended Posts

Updated (edited)
Hello there:)
Today I want to tell you about Code Inject and MSHook Hacking.
I will explain with a practical example for clarity!
I thank this community and leave this guide. 
Thank you!
 
✔Requirements
Spoiler
IDA PRO
Knowledge about C++ 
 
✔Binary
Spoiler
1.Add this repo http://cydia.iphonecake.com/
2.Install CrackerXI.
3.Turn on all in Settings.
4.Slect app which you want to get binary in Applist.
5.It will save to /var/mobile/Documents/CrackerXI
 
✔Note about Tweak.xm
Spoiler
The latest version of Theos uses Tweak.x instead of Tweak.xm.
These differences are explained at this page:
This can cause errors when compiling code found on the net. (In my case when compiling the code for PrefBundle)
So follow this:
1.Change name from Tweak.x to Tweak.xm
2.Change <ProjectName> _FILES = Tweak.x to <ProjectName> _FILES = Tweak.xm in Makefile.
 
✔ASLR Slide
Spoiler

There is ASLR slide is ARM64 binary, so IDA offset and actual binary offset are shifted by ASLR value.

※You can give IDA offset to vm_WriteData because ASLR considered Automatically in vm_WriteData.h
#import <mach-o/dyld.h>
uint64_t getRealOffset(uint64_t offset){
return _dyld_get_image_vmaddr_slide(0)+offset;
}

✔ARM Insructions

Spoiler

Load

MOV r0, r1 
Move the value of r1 to r0
LDR r0, [r1]
Load from memory r1 to register r0
STR r0, [r1]
Store the value of r0 into r1
Store memory r1 with value of register r0 
 
Branch
Compare previous CMP values
BEQ label
jump to label if values are equal
BNE label
jump to label if values are not equal
etc...
CBZ r0, label
jump to label if r0 is 0
CBNZ r0, label
jump to label if r0 is not 0

 

 
✔CodeInject
Spoiler

Place vm_WriteData.h in your project.

And add this to beginning of the code  
#import <vm_writeData.h>
 
Identify the part to change
1.Change the return value
Look at the processing at the bottom of the function (the part load to X0)
MOV X0, 100
2.Change branch
BEQ X0, label
Change the branch to always jump to any label:
B X0, label (BAL is also ok)
Change the branch to never jump to any label:
NOP
Convert to Hex
1.Load
2.Branch
Enter ARM instruction and copy ARM64 HEX.
Apply Changes
vm_WriteData(0x100000000, 0x00000000);
Change the memory starting from 0x100000000 to 00000000.
 
Ex1:Change instruction to change damage
Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link. 👀

Ex2:Change branch to change accuracy of weapon

Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link. 👀

Where should I actually write

Spoiler

It is good to write in %ctor. You can write it like this:

#import <vm_writeData.h>
%ctor {
  vm_WriteData(0x1002B55D8, 0x953E80D2);
}
 
✔MS(Object-C func)
Spoiler

Class name depends on the game Use class name which has applicationDidBecomeActive method!

(Easy to find on Flex)
%hook AppController // class name
-(void)applicationDidBecomeActive:(id)argument { // (type od return value) and method name and (type of argument)
    UIAlertView *alert = [[UIAlertView alloc] initWithTitle:@"test" message:@"Detected App opened!" delegate:nil cancelButtonTitle:@"Continue" otherButtonTitles:nil];
    [alert show];
    return %orig(argument);
}
%end
%orig holds the original function. Since we only want to add processing, we also call the original function.
※You can change the process by changing the argument.
This way is only available for Object-C functions, so if you want to hook a native function you can see in IDA and use MSHook!
 
✔MSHook(Native func)
Spoiler

Import substrate at beginning of code.

#import <substrate.h>
Hook function with offset
MSHookFunction((void *)getRealOffset(0x100000000), (void *)func, (void **)&org_func);
func
func - Function that has a process that you want to overwrite.
org_func - Function that keeps the original processing.
Since MSHookFuntion's void is cast and passed to void type, it is always void.
argument
Be sure to include this pointer first.
 
Ex1:Increase Damage
Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link. 👀

 

✔NSLog

Spoiler

To check NSLog on a device.

Add Flexing from the BigBoss repository.
You can display the log by pressing and holding three fingers on the application you want to see logs.
It can be used by tapping System Log and enabling it from Setting in the upper right.
NSLog(@"Your Log Text Here");
To display argument values:
%d int
%f float
%c unsigned char
%hi short
 
Ex:Display argument values
Spoiler

You can add it in the function definition that overrides like this.

int getDamage(void* this_, void* UserInfor, unsigned char arg0, float arg1) {
  NSLog(@"getDamage Called! arg0: %c, arg1: %f", arg0, arg1);
  return org_getDamage(this_, UserInfor, arg0, arg1);
}
 
✔Call the native func
 
Ex:Call a function to get user information
Spoiler

Hidden Content

React or reply to this topic to see the hidden content & download link. 👀

✔PrefBundle

Spoiler

https://iosgods.com/topic/444-tutorial-how-to-make-a-preference-bundle/

You can learn about PredBundle easily from the link above.
I only mention here how to add icons.
How to add icons
Add icon.png file to <project>/<prefbundl_project>/Resources/
You have to export with these size:
> icon.png - 29×29
[email protected] - 58×58
[email protected] - 87×87
You can export icon in here: https://appiconmaker.co/
 
p.s. A knowledgeable person would think why I don't talk about debuggers. Unfortunately gdb is displayed as BadCPUType in my environment and watch-point does not work properly in lldb.
Here are some great tutorials if you are interested in them:
 
If there are any mistakes please point in reply !
Enjoy :)
Updated by princessXZ
some stuff
  • Like 276
  • Winner 22
  • Thanks 26
  • Haha 6
  • Agree 8
  • Informative 21
Posted
7 hours ago, mafusuke said:
STR r0, [r1]
Load the value of r0 into r1

Nicely written, note thought that STR stands for store, so it's storing it.
Generally, LDR is used to load something from memory to a register, and STR is used to store something from a register to a memory address.

Posted
3 hours ago, Ted2 said:

Nicely written, note thought that STR stands for store, so it's storing it.
Generally, LDR is used to load something from memory to a register, and STR is used to store something from a register to a memory address.

Thank you! I'll fix that 🙂

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Bully: Anniversary Edition Cheats v1.4.1 +1 [ Dev Menu ]
      Modded/Hacked App: Bully: Anniversary Edition by Rockstar Games, Inc.
      Bundle ID: com.rockstargames.bully
      iTunes Store Link: https://apps.apple.com/us/app/bully-anniversary-edition/id1148321705?uo=4&at=1010lce4


      Hack Features:
      Jump to (will lose current progress)
      - Ability to jump to any Mission in-game. From Chapter 1 to Chapter 6.
      - Ability to jump to any Classes in-game. Art, Biology, Gym, Geography, Math, English, Chemistry, Music, Photography, Shop.
      - Ability to play any Minigames such as Arcade, Mowing House 1/2/3, Mowing Part 1/2/3, Paper Route Intro, Paper Route, Keep Ups, Penalty Shots, Bike Store & Tattoos.
      - Teleport to any location in-game. Asylum (Ouside), Blue Skies Industrial Part (Trailer Part), Bullworth Town (Outside), Carnival (Outside), New Coventry (Outside), Old Bullworth Gardens (Park), Old Bullworth Vale (Town), High Striker (Carnival Games), etc, etc. 
       
      Interrupt time-space continuum
      - Ability to Change Time.
      - Ability to Change Season. Summer, Fall, Winter, Spring.
      - Cycle Weather.
       
      Cheats
      - Toggle FPS (Display and Frames Per Second counter at the bottom of your screen).
      - Heal (Heal yourself).
      - Give Money (Give yourself unlimited money. The more you tap on this option the more money you will get).
      - Disable Crime
      - Give Bike
      - Invulnerability a.k.a God Mode / Never Die
      - Unlimited Sprint
      - Unlimited Ammo
      - Max Ammo
      - One Shot Kills
      - All Pranks
      - All Weapons
      - All Moves
      - All Grapples
      - All Clothing
      - Pass mission (Pass your current mission with success).
      - Fail mission (Fail your current mission).
       

      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/135424-bully-anniversary-edition-v11-jailed-cheats-1-debug-menu/


      iOS Hack Download Link: https://iosgods.com/topic/113583-bully-anniversary-edition-cheats-v11-1-dev-menu/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,321 replies
    • SimCity BuildIt Cheats v1.66.1 +1 [ Freeze Currencies ]
      Modded/Hacked App: SimCity BuildIt By EA Swiss Sarl
      Bundle ID: com.ea.simcitymobile.bv
      iTunes Store Link: https://apps.apple.com/us/app/simcity-buildit/id913292932?uo=4


      Hack Features:
      - Infinite Currencies


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/124792-arm64-simcity-buildit-v1412-jailed-cheats-1/


      iOS Hack Download Link: https://iosgods.com/topic/157687-simcity-buildit-cheats-v1415-1/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 669 replies
    • Aqua Match Cheats v0.230.1 +5
      Modded/Hacked App: Aqua Match By PLR Worldwide Sales Limited
      Bundle ID: com.playrix.aquamatch
      App Store Link: https://apps.apple.com/us/app/aqua-match/id6502511364?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Freeze Moves
      - Freeze Life
      - Freeze Boosters
      - Freeze Coins
      - Freeze Gems



      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/196699-aqua-match-cheats-v02301-5/
        • Like
      • 2 replies
    • Star Wars™: Galaxy of Heroes Cheats v0.36.8 +8
      Modded/Hacked App: Star Wars™: Galaxy of Heroes By Electronic Arts
      Bundle ID: com.ea.starwarscapital.bv
      iTunes Link: https://itunes.apple.com/us/app/star-wars-galaxy-of-heroes/id921022358?mt=8&uo=4&at=1010lce4


      Mod Requirements
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate (from Cydia).
      - PreferenceLoader (from Cydia).


      Hack Features
      - No Skill Cooldown time / Skill Always Available. Linked with enemy. Enable when it's your turn, disable when it's enemies turn. Timing is key.
      - One Hit Kill / Very High Damage. This is linked with you and the enemy, use with Skip Enemy Turn feature or enable disable when you attack via the In-Game Mod Menu! Do not kill the last enemy with OHK otherwise the game will crash. This feature is only for x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.
      - Always Your Turn / Skip Enemy Turn. It's always your turn, you're always attacking.
      - Auto Win. You must use this with One Hit Kill in order for it to work. Kill 1 Enemy and you will auto win the battle.
      - Only 1 Encounter on All Missions.
      -- God Mode / Never Die thanks to the features above.

      This hack is now an In-Game Mod Menu. This means you can toggle switches on/off while in a fight. Since God Mode is linked, turn it off when you're attacking and turn it on when the enemy is attacking to do damage but not receive damage. Same goes for the other features.
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 3,130 replies
    • Homematch - Home Design Games v2.17.2 +2 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Homematch - Home Design Games By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.homecraft
      iTunes Store Link: https://apps.apple.com/us/app/homematch-home-design-games/id1438898374?uo=4


      Hack Features:
      - Unlimited Coins
      - Unlimited Gems


      Jailbreak required hack(s): [Mod Menu Hack] Homematch - Home Design Games v1.92.3 +2 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Like
      • 13 replies
    • Homematch - Home Design Games v2.17.2 +2 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Homematch - Home Design Games By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.homecraft
      iTunes Store Link: https://apps.apple.com/us/app/homematch-home-design-games/id1438898374?uo=4


      Hack Features:
      - Unlimited Coins
      - Unlimited Gems


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Homematch - Home Design Games v1.92.3 +2 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 7 replies
    • Hero's Adventure v1.2.117 +6 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Hero's Adventure By X.D. Network Inc.
      Bundle ID: com.xd.dxlzz.global
      iTunes Store Link: https://apps.apple.com/us/app/heros-adventure/id6711347049?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - Give All Items -> Head into Settings > Other and toggle the User Agreement button.
      - Unlock All Achievements -> Head into Settings > Other and toggle the Privacy Policy button.
      -- All DLC Purchased
      -- Guest Login Enabled
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 140 replies
    • Hero's Adventure v1.2.117 +6 Cheats [ Damage & Defence ]
      Modded/Hacked App: Hero's Adventure By X.D. Network Inc.
      Bundle ID: com.xd.dxlzz.global
      iTunes Store Link: https://apps.apple.com/us/app/heros-adventure/id6711347049?uo=4

       
       

      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - Give All Items -> Head into Settings > Other and toggle the User Agreement button.
      - Unlock All Achievements -> Head into Settings > Other and toggle the Privacy Policy button.
      -- All DLC Purchased
      -- Guest Login Enabled
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 31 replies
    • Pal Go: Tower Defense TD v0.3.86 [+7 Cheats]
      Modded/Hacked App: Pal Go: Tower Defense TD By Playwind Ltd
      Bundle ID: com.playwindgames.freedefender
      iTunes Store Link: https://apps.apple.com/us/app/pal-go-tower-defense-td/id6479316663?uo=4


       

      🚀 Hack Features

      - [VIP] Freeze Currency (Currency will not decrease when used)

      - [VIP] Currency Always Enough (Buy even when you don't have enough currency)

      - [Free] Higher Recruit Energy (Gives 500 Recruit Energy Every Wave)

      - [Free] Always Can Drag Hero

      - [Free] Skip Ads

      - [Free] No Attack Cooldown

      - [Free] Global Speed Multiplier (Enable Inside Battle)

       

      Warning


      Do not use on main account. There is a chance of ban. Not responsible for any bans.

       


      🍏 For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/forum/79-no-jailbreak-section/
      🤖 Modded Android APK(s): https://iosgods.com/forum/68-android-section/
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 54 replies
    • Pal Go: Tower Defense TD v0.3.86 [+7 Jailed Cheats]
      Modded/Hacked App: Pal Go: Tower Defense TD By Playwind Ltd
      Bundle ID: com.playwindgames.freedefender
      iTunes Store Link: https://apps.apple.com/us/app/pal-go-tower-defense-td/id6479316663?uo=4


       

      Hack Features

      - [VIP] Freeze Currency (Currency will not decrease when used)

      - [VIP] Currency Always Enough (Buy even when you don't have enough currency)

      - [Free] Higher Recruit Energy (Gives 500 Recruit Energy Every Wave)

      - [Free] Always Can Drag Hero

      - [Free] Skip Ads

      - [Free] No Attack Cooldown

      - [Free] Global Speed Multiplier (Enable Inside Battle)

       

      Warning


      Do not use on main account. There is a chance of ban. Not responsible for any bans.

       

      Jailbreak required iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APKs: https://iosgods.com/forum/68-android-section/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 79 replies
    • Exfil: Loot & Extract v6.1.1 Debug Menu [+10 Cheats]
      Modded/Hacked App: Exfil: Loot & Extract By Kwalee Ltd
      Bundle ID: com.eightsec.roguehero
      iTunes Store Link: https://apps.apple.com/us/app/exfil-loot-extract/id6448720577?uo=4


       

      🤩 Hack Features

      - Debug Menu (Enable and debug menu will appear)
       
        • Agree
        • Thanks
        • Winner
        • Like
      • 18 replies
    • Exfil: Loot & Extract v6.1.1 Debug Menu [+10 Jailed Cheats]
      Modded/Hacked App: Exfil: Loot & Extract By Kwalee Ltd
      Bundle ID: com.eightsec.roguehero
      iTunes Store Link: https://apps.apple.com/us/app/exfil-loot-extract/id6448720577?uo=4

       

      🤩 Hack Features

      - Debug Menu (Enable and debug menu will appear)
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 18 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines