Jump to content

H5GG Full Tutorial [Offset Patching + Hooking] for Non-Jailbroken/Jailbreak Devices !


128 posts in this topic

Recommended Posts

Hello Hello,

Here is finally a tutorial to patch or even hook on Non-JB/JB

This tutorial will cover the non-JB way because that's what's interesting :happydance:, but this way can work on JB.

 

We will see the complete installation of H5GG, and an example of offset patching, and another with hooking. The source code will also be provided. Nothing better to feel in paradise. PepeCoffee

 

Requirements:
- PC (or a way of managing iPA files)
- Sideloadly
- 3u Tools to view the app documents
- Subway Surfer

 

  • 1)

Since Critical Strike has serious issues with their games, I can't base my tutorial on this game. So let's go on a new one : Subway Surfer

First, download the Subway Surfer iPA : HERE

Then we will need 3 other files specific to H5GG for offset patching / hooking:

Simply see the instruction : HERE

You can delete the "hookme.test.dylib" cuz we don't need it.

You should have this :

 xnHQkxz.png

Now, simply extract the iPA, copy the 3 files and move to the .app folder and paste it there. It should look like this :

P15AzgU.png

Now simply ZIP the Payload, and rename it To WhatEver.ipa

Now we need to download the .deb that we gonna inject to the iPA : HERE

Now, we gonna need to Sideload the iPA WITH these settings :

sPQGERy.png

We will need to use File Sharing later in the tutorial, so enable it. Don't forget to inject the H5GG.deb file.

We did like 50% of the work now hehe PepeBusiness

 

  • 2)

Now, we gonna code (or Ctrl+C, Ctrl+V) :

I use EasyHTML app on the AppStore to code it.

Offset Patching/Hooking on H5GG is done by injecting a .js script so, let's write it. you have a sample: HERE

Below is an edited version to work on Subway Surfer 3.6.0.

Offset Patching code :

h5gg.require(7.9); 
var h5frida=h5gg.loadPlugin("h5frida", "h5frida-15.1.24.dylib");
if(!h5frida) throw "Failed to load h5frida plugin";

function ActiveCodePatch(fpath, vaddr, bytes) {
    if(!h5frida.ActiveCodePatch(fpath, vaddr, bytes)) {
        var result = h5frida.ApplyCodePatch(fpath, vaddr, bytes);
        alert(fpath+":0x"+vaddr.toString(16)+"-修改失败!\n" + fpath+":0x"+vaddr.toString(16)+"-PatchFailed!\n" + result);return false;
    } return true;
}
function DeactiveCodePatch(fpath, vaddr, bytes) {
    return h5frida.DeactiveCodePatch(fpath, vaddr, bytes);
}

/*HERE IS OUR OFFSET PATCHING CODE*/

//public bool get_CanJump() -> 0x1B39598
//Enable a hack at 0x1B39598 with HEX : 200080D2C0035FD6
ActiveCodePatch("Frameworks/UnityFramework.framework/UnityFramework", 0x1B39598, "200080D2C0035FD6");

Well here we arn't using a template, we just want to patch our offset so we will enable it by default.

If you are using a template, just make a if statement, and use this code to disable the Offset Patching :

//this is just a POC
if (switch_Jump) {
    ActiveCodePatch("Frameworks/UnityFramework.framework/UnityFramework", 0x1B39598, "200080D2C0035FD6");
} else {
    //when you desactivate a patch, it need to be the same HEX that you use to enable the hack.
    DeactiveCodePatch("Frameworks/UnityFramework.framework/UnityFramework", 0x1B39598, "200080D2C0035FD6");
}

Now, inject the script with H5GG by clicking the "Scripts" button, and select the JavaScript file from there.

Information

The first JS run is just to prepare the Framework file and get a new one. This step is mandatory.

More details under.

Once this done, you should see this "error" (my offset is not the same on the picture, its normal i was testing another one. Ignore it):

ArBrUt9.jpg

A big alert for just telling us to overwrite a file LUL, dont panic haha we gonna fix it !

If you want to replace the file without PC :

In theory, just change the UnityFramework given by H5GG with the old one. detailed step :

So this is where we need 3uTools. Go to the applications on your phone using 3utools, and select subway surfer then "view" (because you normally activated File Sharing). you should be able to see this :

ehqJd4H.png

Navigate to the directory until you find the UnityFramework file. then copy it, and replace it with the one of the Playload folder of the iPA. like this :

We don't see it on the pic, but the file patch is :

Payload\SubwaySurf.app\Frameworks\UnityFramework.framework

4052GYg.png

Ofc, delete the old one. i kept it & renamed just for demonstration.

Then, simply delete the app on your device, repack the new Payload folder and again Sideload the new iPA with the edited UnityFramework. you don't need to enable file sharing exept if you want to patch a new offset. but no need if you follow the tutorial

Then run the script again on the new sideloaded iPA, and you should be able to Jump every time due to the Offset Patching :happydance:.

Now, lets go to Hooking !

I will make a new script with this content (an edited version of the github one) :

h5gg.require(7.9); //设定最低需求的H5GG版本号//min version support for H5GG
var h5frida=h5gg.loadPlugin("h5frida", "h5frida-15.1.24.dylib");
if(!h5frida) throw "加载h5frida插件失败\n\nFailed to load h5frida plugin";
if(!h5frida.loadGadget("frida-gadget-15.1.24.dylib"))
    throw "加载frida-gadget守护模块失败\n\nFailed to load frida-gadget daemon module";
var procs = h5frida.enumerate_processes();
if(!procs || !procs.length) throw "frida无法获取进程列表\n\nfrida can't get process list";
var pid = -1; //pid=-1, 使用自身进程来调用OC/C/C++函数, 也可以附加到其他APP进程来调用
var found = false;
for(var i=0;i<procs.length;i++) {
    if(procs[i].pid==pid) {
        if(procs[i].name!='Gadget') throw "免越狱测试请卸载frida-server的deb然后重启当前APP\nFor non-jailbreak tests, please uninstall the frida-server deb and restart the current APP";
        found = true;
    }
}
if(!found) throw "frida无法找到目标进程\n\nfrida cannot find the target process";
var session = h5frida.attach(pid);
if(!session) throw "frida附加进程失败\n\nfrida attach process failed";

//监听frida目标进程连接状态, 比如异常退出
session.on("detached", function(reason) {
    alert("frida目标进程会话已终止(frida target process session terminated):\n"+reason);
});

var frida_script_line = frida_script("getline"); //safari console will auto add 2 line
var frida_script_code = "("+frida_script.toString()+")()"; //将frida脚本转换成字符串
var script = session.create_script(frida_script_code); //注入frida的js脚本代码

if(!script) throw "frida注入脚本失败\n\nfrida inject script failed!";
script.on('message', function(msg) {
    if(msg.type=='error') {
        script.unload(); //如果脚本发生错误就停止frida脚本
        try {if(msg.fileName=="/frida_script.js") msg.lineNumber += frida_script_line-1;} catch(e) {}
        if(Array.isArray(msg.info)) msg.info.map(function(item){ try { if(item.fileName=="/frida_script.js")
            item.lineNumber += frida_script_line-1;} catch(e) {}; return item;});
        var errmsg = JSON.stringify(msg,null,1).replace(/\/frida_script\.js\:(\d+)/gm,
            function(m,c,o,a){return "/frida_script.js:"+(Number(c)+frida_script_line-1);});
        alert("frida(脚本错误)script error:\n"+errmsg.replaceAll("\\n","\n"));
    }
    
    if(msg.type=='send')
        alert("frida(脚本消息)srcipt msg:\n"+JSON.stringify(msg.payload,null,1));
    if(msg.type=='log')
        alert("frida(脚本日志)script log:\n"+msg.payload);
});

if(!script.load()) throw "frida启动脚本失败\n\nfrida load script failed"; //启动脚本
function frida_script() { if(arguments.length) return new Error().line; 
                         
                         
            /*HERE IS OUR HOOKING*/
                         
                         
var Jump = h5frida.StaticInlineHookFunction("Frameworks/UnityFramework.framework/UnityFramework",
    0x1B39598,
    "bool",
    ["pointer"],
    function(instance) {
        //return 1 for true, 0 for false
        return 1;
    }
);
                        
   
}

You can hook any function type, just change the return type of the function.

//public float get_SpeedModifier() -> 0x1234567
var Speed = h5frida.StaticInlineHookFunction("Frameworks/UnityFramework.framework/UnityFramework",
    0x1234567,
    "float",
    ["pointer"],
    function(instance) {
        return 9999;
    }

);

Well, that's all hehe, hope you could achieve your goals ! PepeCoffee

Usefull
To "Enable" all your offset at once, you can just call the ActiveCodePatch function as much as u need on the script. it will proceed each offset at once, so that u need to replace the UnityFramework file once only

 

ActiveCodePatch("Frameworks/UnityFramework.framework/UnityFramework", 0x1212121, "YOUR HEX");
ActiveCodePatch("Frameworks/UnityFramework.framework/UnityFramework", 0x8989898, "YOUR HEX");
ActiveCodePatch("Frameworks/UnityFramework.framework/UnityFramework", 0x6565656, "YOUR HEX");

 

Usefull

Better would be to make a full working mod menu on JB, and convert it to H5GG after, cuz its a pain to test offset with H5GG lol

 

Credits :

@tuancc H5GG tool

- Me for the tuto

 

Feel free to ask questions about it if its related to the topic

If your app is crashing, you can see this 

 

H5GG Discord : https://discord.gg/h5gg

H5GG Github : https://github.com/H5GG/H5GG

Maybe usefull : 

 

 

Updated by 𓄼 . f v c k . 𓄹
made it cleaner
  • Like 85
  • Winner 7
  • Thanks 1
  • Haha 4
  • Agree 16
  • Informative 11

This is brilliant. Let me follow exactly what you done here.

 

Not sure why my try with another game was not successful. The patched instruction is not the instruction I want. Odd.

let me follow yours and see how it works.

 

thanks again in creating this. 

  • Like 1

Quick test result:

1. I also got the the UnityFramework patched by h5frida and stored inside static-inline-hook folder

2. With a detail look into it, the hex code of the instruction (patched) doesn't look right to me.

Orignal at 0x1B39598 is FD7BBFA9FD030091

- stp x29, x30, [sp, #-0x10]!
- mov x29, sp

After patch at 0x1B39598 is CF2A9914FD030091

- b #0x264ab4c
- mov x29, sp

What we are expecting at 0x1B39598 is 200080D2C0035FD6, Right??

- mov x0, #1
- ret 

Tested in game, always Can Jump is not working. Same as my try in another game these few days. 

I am using iPadOS 16.2 (non-jailbreak) with iPad Pro 2nd Gen.  

Updated by Happy Secret

Update on the hook:

Not sure why I got hook fail as well.

Index
frida(脚本日志)script log:
Frameworks/UnitFramework.frame-work/UnitvFramework:0x1b39598-
HOOK失敗!
Frameworks/UnityFramework.frame-work/UnityFramework:0x1b39598-HOOK-Failed!
未签名该地址,修补文件将生成在APP的
Documents/static-inline-hook目录中,请将该目录中所有文件替换到 ipa中的.app目录并重新签名安装!
The offset has not been patched, the patched file will be generated in the Documents/static-inline-hook directory of the APP, please replace all the files in this directory to the app directory in the ipa and re-sign and reinstall!

Issue for me is: The h5frida internal function find_hook_block always return NULL, and reporting “cannot parse hook info!” In NSLog.

This internal function is being use for ActiveCodePatch and StaticInlineHookFunction.

I don’t know how to debug further.

Updated by Happy Secret
  • Like 1
4 hours ago, Happy Secret said:

Quick test result:

1. I also got the the UnityFramework patched by h5frida and stored inside static-inline-hook folder

2. With a detail look into it, the hex code of the instruction (patched) doesn't look right to me.

Orignal at 0x1B39598 is FD7BBFA9FD030091

- stp x29, x30, [sp, #-0x10]!
- mov x29, sp

After patch at 0x1B39598 is CF2A9914FD030091

- b #0x264ab4c
- mov x29, sp

What we are expecting at 0x1B39598 is 200080D2C0035FD6, Right??

- mov x0, #1
- ret 

Tested in game, always Can Jump is not working. Same as my try in another game these few days. 

I am using iPadOS 16.2 (non-jailbreak) with iPad Pro 2nd Gen.  

Mhh i did the tutorial on an A14, iOS 15.1 and the patch/hook worked well.

maybe H5GG doesn't support iOS 16 atm, but it's weard since we hook the app framework and not any device framework.

i don't understand how you got the bytes at 0x1B39598, i didn't used ida, i simply checked the function on dnSpy, patched it on JB with the LOP tool from iOSGods, it worked so i did it on H5GG, and it worked too 

 

edit :

oh you mean the UnityFramework patched ? well i didn't looked at the data at the offset 0x1B...98, but it's seems normal to me that's it's not 2000...FD6, otherwise it will always be enable. i think that it creates another function on the UnityFramework (at another place) and at 0x1B...98, it calls it.

so if there is no script running, we shouldn't be able to jump always, but when we load our script, it probably jump to our created function in the UnityFramework, and so it return 2000..FD6 at our function (maybe at 0x264ab4c) and if we unload the script, the original bytes in the memory will load again making "normal jumps"

 

(this is my personal analysis, it may not be 100% right but this is how i visual it) 

video https://streamable.com/5g6nvz

Updated by ꞋꞌꞋꞌꞋꞌꞋꞌ

Haven't tested hooks yet but code patching works! Tested on Iphone 12 Pro Max, 16.1.2

 

everything seems to work! thank you for this awesome tutorial!!!

Updated by papastweak
  • Informative 1

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below. For more information, please read our Posting Guidelines.
Reply to this topic... Posting Guidelines

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Our picks

    • Hunt Royale: Action RPG Battle v3.3.1 +3 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Hunt Royale: Action RPG Battle By BoomBit, Inc.
      Bundle ID: com.hunt.royale
      iTunes Store Link: https://apps.apple.com/us/app/hunt-royale-action-rpg-battle/id1537379121?uo=4

       
       

      🚀 Hack Features

      - Dumb Enemies

      VIP
      - Damage Multiplier
      - Defence Multiplier


      🍏 Jailbreak iOS hacks: [Mod Menu Hack] Hunt Royale: Action RPG Battle v3.2.7 +3 Cheats [ Damage & Defence ] - Free Jailbroken Cydia Cheats - iOSGods
      🤖 Modded Android APKs: https://iosgods.com/forum/68-android-section/
      • 28 replies
    • Hunt Royale: Action RPG Battle v3.3.1 +3 Cheats [ Damage & Defence ]
      Modded/Hacked App: Hunt Royale: Action RPG Battle By BoomBit, Inc.
      Bundle ID: com.hunt.royale
      iTunes Store Link: https://apps.apple.com/us/app/hunt-royale-action-rpg-battle/id1537379121?uo=4

       
       

      🚀 Hack Features

      - Dumb Enemies

      VIP
      - Damage Multiplier
      - Defence Multiplier


      🍏 For Non-Jailbroken & No Jailbreak required hacks: [IPA Mod Menu] Hunt Royale: Action RPG Battle v3.2.7 +3 Jailed Cheats [ Damage & Defence ] - Free Non-Jailbroken IPA Cheats - iOSGods
      🤖 Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      • 24 replies
    • Loot Heroes v1.3.4 +8 Jailed Cheats [ Unlimited Currencies + More ]
      Modded/Hacked App: Loot Heroes: Fantasy RPG Games By BoomBit, Inc.
      Bundle ID: com.bbp.lootheroes
      iTunes Store Link: https://apps.apple.com/us/app/loot-heroes-fantasy-rpg-games/id6642699678?uo=4


      Hack Features:
      - Freeze Currencies
      - Unlimited Currencies [ VIP ]
      - God Mode -> Traps still cause damage.
      - One-Hit Kill
      - All Heroes Unlocked
      - Auto Win [ VIP ]
      - Battle Pass Unlocked [ VIP ]


      Jailbreak required hack(s): [Mod Menu Hack] Loot Heroes v1.1.5 +8 Cheats [ Unlimited Currencies + More ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 39 replies
    • Loot Heroes v1.3.4 +8 Cheats [ Unlimited Currencies + More ]
      Modded/Hacked App: Loot Heroes By BoomBit, Inc.
      Bundle ID: com.bbp.lootheroes
      iTunes Store Link: https://apps.apple.com/us/app/loot-heroes/id6642699678?uo=4


      Hack Features:
      - Freeze Currencies
      - Unlimited Currencies [ VIP ]
      - God Mode -> Traps still cause damage.
      - One-Hit Kill
      - All Heroes Unlocked
      - Auto Win [ VIP ]
      - Battle Pass Unlocked [ VIP ]


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 158 replies
    • Good Coffee, Great Coffee v1.0.1 +2 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Coffee, Great Coffee By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.coffeebusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-coffee-great-coffee/id1603584945?uo=4
       
       

      🤩 Hack Features

      - Unlimited Cash
      - Unlimited Gems
      • 3 replies
    • Good Coffee, Great Coffee v1.0.1 +2 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Coffee, Great Coffee By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.coffeebusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-coffee-great-coffee/id1603584945?uo=4

       
       

      🤩 Hack Features

      - Unlimited Cash
      - Unlimited Gems
      • 11 replies
    • Smashero.io - Hack N Slash RPG v1.13.0 +2 Jailed Cheats [ God / O-HK ]
      Modded/Hacked App: Smashero.io - Hack N Slash RPG By CANNON CRACKER, Inc.
      Bundle ID: com.cc.Smashero
      iTunes Store Link: https://apps.apple.com/us/app/smashero-io-hack-n-slash-rpg/id6505129091?uo=4


      Hack Features:
      - God Mode
      - One-Hit Kill


      Jailbreak required hack(s): [Mod Menu Hack] Smashero.io - Hack N Slash RPG v3.3 +2 Cheats [ God / O-HK ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 19 replies
    • Smashero.io - Hack N Slash RPG v1.13.0 +2 Cheats [ God / O-HK ]
      Modded/Hacked App: Smashero.io - Hack N Slash RPG By CANNON CRACKER, Inc.
      Bundle ID: com.cc.Smashero
      iTunes Store Link: https://apps.apple.com/us/app/smashero-io-hack-n-slash-rpg/id6505129091?uo=4


      Hack Features:
      - God Mode
      - One-Hit Kill


      Non-Jailbroken & No Jailbreak required hack(s): [No Jailbreak Required] Smashero.io - Hack N Slash RPG v3.3 +2 Jailed Cheats [ God / O-HK ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 49 replies
    • Modded/Hacked App: Hexapolis - Civilization game By NOXGAMES s.r.o.
      Bundle ID: com.noxgames.hex.polis.civilization.empire
      iTunes Store Link: https://apps.apple.com/us/app/hexapolis-civilization-game/id1559236448?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - IAP FREE [ Buy Anything Gems Gold ]

      - Max DMG [ Upgrade Trop ]

      - Max HP [ Upgrade Trop ]

      - Max DEF [ Upgrade Trop ]

      - ATK Range

      - Max Population

      - Silver Coins [ End Turn ]

      - No Fogg Map [ Just Move Trop ]

      - XP Reward + NO LVL POPUP [ Win Battle ]


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 31 replies
    • Hexapolis - Civilization game V2.3.0 [ +9 Jailed ] DMG
      Modded/Hacked App: Hexapolis - Civilization game By NOXGAMES s.r.o.
      Bundle ID: com.noxgames.hex.polis.civilization.empire
      iTunes Store Link: https://apps.apple.com/us/app/hexapolis-civilization-game/id1559236448?uo=4

       

       

      🔧 Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      🚀 Hack Features

      - IAP FREE [ Buy Anything Gems Gold ]

      - Max DMG [ Upgrade Trop ]

      - Max HP [ Upgrade Trop ]

      - Max DEF [ Upgrade Trop ]

      - ATK Range

      - Max Population

      - Silver Coins [ End Turn ]

      - No Fogg Map [ Just Move Trop ]

      - XP Reward + NO LVL POPUP [ Win Battle ]


      🍏 Jailbreak iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      🤖 Modded Android APKs: https://iosgods.com/forum/68-android-section/
        • Like
      • 8 replies
    • Modded/Hacked App: Lollipop 3: Match 3 Puzzles By Puzzle1Studio,inc.
      Bundle ID: com.puzzle1studio.ap.lollipopsweetheroesmatch3
      iTunes Store Link: https://apps.apple.com/us/app/lollipop-3-match-3-puzzles/id1634326372?uo=4

       

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Coins

      - Lives

      - Booster

      - Moves

      - Auto Win 

       

      ⬇️ iOS Hack Download Link


      Hidden Content

      Download Hack
      • 0 replies
    • Lollipop 3: Match 3 Puzzles v25.0226.00 [ +5 Jailed ] Auto Win
      Modded/Hacked App: Lollipop 3: Match 3 Puzzles By Puzzle1Studio,inc.
      Bundle ID: com.puzzle1studio.ap.lollipopsweetheroesmatch3
      iTunes Store Link: https://apps.apple.com/us/app/lollipop-3-match-3-puzzles/id1634326372?uo=4

       

       

      📌 Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      🤩 Hack Features

      - Coins

      - Lives

      - Booster

      - Moves

      - Auto Win 

       

      ⬇️ iOS Hack Download IPA Link


      Hidden Content

      Download via the iOSGods App
      • 0 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines