Jump to content

3 posts in this topic

Recommended Posts

Posted

Hi All,

I'm currently creating a series of mod menu's using Ted2's template - I'm bumping into similar issues for a couple of mods.

I'm looking for a way to modify a field.

Hypothetical Example:

Assume we have this decompiled from il/dnSpy

[Token(Token = "0x2000342")]
public class Item {
  [Token(Token = "0x400131B")]
  [FieldOffset(Offset = "0x1C")]
  public int Amount;

  [Token(Token = "0x4001313")]
  [FieldOffset(Offset = "0x30")]
  public bool IsUnlimited;

  [Address(RVA = "0x1ABB3A8", Offset = "0x1ABB3A8", VA = "0x1ABB3A8")]
  public void Init(CRefItem refMain, int amount = 0, bool is_attached = false)
  {
  }
  
  ...
}

There is no getter or setter for the Amount or IsUnlimited field.

Goal:

Forceable set Amount  to 9999 for all Items.

Forceable set IsUnlimited to True for all Items.

 

Attempts and Theory:

In Ted2's template, the best approach i've been able to figure out to get anywhere close to a meaningful outcome is hooking to the init function and pass in desired Amount argument.

However,

Tweak.xm Doesnt know what a CRefItem is, So I cant pass this param into my reinterpreted cast

 

Heres an example Tweak.xm to show this

offset for the init function is 0x1ABB3A8

#import "Macros.h"

auto modInit = reinterpret_cast<void(*) (void *, CRefItem, int, bool)>(getRealOffset(0x1ABB3A8));
  
void(*oldInit)(void *this_);
void newInit(void *this_) {
    if ([switches isSwitchOn:@"9999 Items"]) {
      modInit(this_, ???????? ,9999, false);
      return;
    }
  
    old_Init(this_);
}
  
// SETUP
void setup() {
  HOOK(0x1ABB3A8, newInit, oldInit);
  
  [switches addSwitch:@"9999 Items"
    description:@"Enable on Oppenents Turn"
  ];
}
  
... Rest of Ted2 Stuff

Notice: This isnt working code - this is just an example of whats going through my mind :D

Issues I see:

1) I'm not too sure what to hook onto in the setup as i've already got a casted reference to the Init function - hooking into something im casting to and calling again seems like a bad idea.

2) Im not too sure how to pass the CRefItem argument into the modInit call.

3) IsAttached arg will always be False - which may not always be the case - would be nice to know how to get the original passed args

4) Does not deal with IsUnlimited field

5) I could go up the tree in the decompiled code and cast to functions elsewhere but they all require types which I dont understand how to pass (Vector3, CRefItem...)

 

Reading From Other NIC Templates:

I'v been digging around and noticed something in R16s template called UIKeyPatch, From the docs it seems like you're able to set the value of a field using the fields offset

//call these inside ur own custom functions
*(int*)[UIKeyPatch address:@"0x1C" ptr:this_] = 9999;
*(bool*)[UIKeyPatch address:@"0x30" ptr:this_] = true;

As we don't have UIKeyPatch in Ted2 and the R16 repo seems to be offline, I can't find out how UIKeyPatch was implemented. The example doesnt show what would be hooked into in the setup function in Tweak.xm as I assume the offsets wouldnt work be different if I hooked into the Init function. Correct me if im wrong.

 

Ask

I hope the above examples highlights the gaps in my knowledge and give enough info on what I'm trying to achieve. As I'm using Ted2 and given the R16 Nic Template is unavailable. I've come here to seek help on making this happen. Any advice which can put me on the right path will be greatly appreciated :)

Posted

Mhh Mhh okay that's what i would try, im not a pro, but this is what i would do :

35 minutes ago, rafgeekee said:

Forceable set Amount  to 9999 for all Items.

 

You can maybe try to get the field with the Update() function (if there is). else, ive seen somwhere on the web where you can use other function from the class but i didn't tried, Lmk if it worked. :)

So, if no Update() function :

//just a poc to get the idear
void(*old_func)(void *instance);
void func(void *instance) {
        if ([switches isSwitchOn:@"9999 Items"]) {
            //int Amount
            *(int *) ((uint64_t) instance + 0x1C) = 9999;
    }
    old_func(instance);
}

setup(){
	//a function in the same class. use Update if there is, if not try another function (Init for ex)
	HOOK(0x1ABB3A8, func, old_func);
}

 

42 minutes ago, rafgeekee said:

Forceable set IsUnlimited to True for all Items.

 

do the same thing.

 

43 minutes ago, rafgeekee said:
auto modInit = reinterpret_cast<void(*) (void *, CRefItem, int, bool)>(getRealOffset(0x1ABB3A8));

Afaik, when there is a Type and you don't have his definition, just make a pointer to it like this ;

//taking ur code
auto modInit = reinterpret_cast<void(*) (void *, void *, int, bool)>(getRealOffset(0x1ABB3A8));

replace the CRefItem with void *,  that way it gonna make a pointer on the undifined type and with luck it not gonna crash hahaa

 

50 minutes ago, rafgeekee said:
//this_ is probably a func where this_ + 0x1C = int Amount;
//you can't patch a field without its pointer. like search for "0x1C" in your dump.cs you gonna have a tons of results.
// but if u have pointer + 0x1C, its unique

*(int*)[UIKeyPatch address:@"0x1C" ptr:this_] = 9999;

 

using this is the same as . 

*(int *) ((uint64_t) instance + 0x1C) = 9999;

 

53 minutes ago, rafgeekee said:

3) IsAttached arg will always be False - which may not always be the case - would be nice to know how to get the original passed args

 

i guess, once you hooked Init, you can easly called it and put "true" on the func parameter, it gonna overwrite it probably.

//POC
modInit(this_, paramName ,9999, true);

 

Hope it could help you, tho all this is my knowledge, things might not be 100% right PepeCoffee

  • Thanks 1
  • Informative 1
Posted
On 1/16/2023 at 6:01 PM, ꞋꞌꞋꞌꞋꞌꞋꞌ said:

Mhh Mhh okay that's what i would try, im not a pro, but this is what i would do :

You can maybe try to get the field with the Update() function (if there is). else, ive seen somwhere on the web where you can use other function from the class but i didn't tried, Lmk if it worked. :)

So, if no Update() function :

//just a poc to get the idear
void(*old_func)(void *instance);
void func(void *instance) {
        if ([switches isSwitchOn:@"9999 Items"]) {
            //int Amount
            *(int *) ((uint64_t) instance + 0x1C) = 9999;
    }
    old_func(instance);
}

setup(){
	//a function in the same class. use Update if there is, if not try another function (Init for ex)
	HOOK(0x1ABB3A8, func, old_func);
}

 

do the same thing.

 

Afaik, when there is a Type and you don't have his definition, just make a pointer to it like this ;

//taking ur code
auto modInit = reinterpret_cast<void(*) (void *, void *, int, bool)>(getRealOffset(0x1ABB3A8));

replace the CRefItem with void *,  that way it gonna make a pointer on the undifined type and with luck it not gonna crash hahaa

 

using this is the same as . 

*(int *) ((uint64_t) instance + 0x1C) = 9999;

 

i guess, once you hooked Init, you can easly called it and put "true" on the func parameter, it gonna overwrite it probably.

//POC
modInit(this_, paramName ,9999, true);

 

Hope it could help you, tho all this is my knowledge, things might not be 100% right PepeCoffee

Thanks @ꞋꞌꞋꞌꞋꞌꞋꞌ This has helped get me in the right direction :) - As I've hooked into an instance, I'm able to reference the field pointer using the offest as described :). Although I am having difficulty getting my hook kick in at the right time. This is mostly down to finding a function which is called in a timely fasion which I need to dig more to find. 

This line has been a great help

*(int *) ((uint64_t) instance + 0x1C) = 9999;

For reference to anybody looking for similar help, This can be changed to any type, an example of a bool and float below:

*(bool *) ((uint64_t) instance + 0x1C) = true;

 

*(float *) ((uint64_t) instance + 0x1C) = 1.0f;

--

In view of Unknown types like CRefItem, passing in a void still needs the pointer which I'm struggling to understand. Could you help further on this?

Here is the code I'm looking at

auto modInit = reinterpret_cast<void(*) (void *, void *, int, bool)>(getRealOffset(0x1ABB3A8));
  
void(*oldInit)(void *this_);
void newInit(void *this_) {
    if ([switches isSwitchOn:@"9999 Items"]) {
      modInit(this_, paramName ,9999, false);
      return;
    }
  
    old_Init(this_);
}
  
// SETUP
void setup() {
  HOOK(0x1ABB3A8, newInit, oldInit);
  
  [switches addSwitch:@"9999 Items"
    description:@"Enable on Oppenents Turn"
  ];
}

Could you help me understand how i'd pull and pass paramName with the correct CRefItem pointer?

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Royal Kingdom v21296 +4 Jailed Cheats [ Coins + More ]
      Modded/Hacked App: Royal Kingdom By Dream Games
      Bundle ID: com.dreamgames.royalkingdom
      iTunes Store Link: https://apps.apple.com/ph/app/royal-kingdom/id1606549505
       

      Hack Features:
      - Freeze Coins
      - Freeze Lives
      - Freeze Boosters
      - Freeze Moves


      Jailbreak required hack(s): [Mod Menu Hack] Royal Kingdom v3987 +4 Cheats [ Unlimited Coins ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 152 replies
    • Royal Kingdom v21296 +4 Cheats [ Coins + More ]
      Modded/Hacked App: Royal Kingdom By Dream Games
      Bundle ID: com.dreamgames.royalkingdom
      iTunes Store Link: https://apps.apple.com/ph/app/royal-kingdom/id1606549505
       

      Hack Features:
      - Freeze Coins
      - Freeze Lives
      - Freeze Boosters
      - Freeze Moves


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Royal Kingdom v3987 +4 Jailed Cheats [ Unlimited Coins ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 108 replies
    • Pudgy Party - Battle Royale v0.12.2 +7 Jailed Cheats [ Speed, Gravity + More ]
      Modded/Hacked App: Pudgy Party - Battle Royale By Mythical, Inc.
      Bundle ID: com.mythical.pudgyparty
      App Store Link: https://apps.apple.com/us/app/pudgy-party-battle-royale/id6744258913?uo=4

       
       

      🤩 Hack Features

      - Jump Height Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Gravity Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Speed Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Friction Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Freeze Bots
      - Dumb Bots
      - Free In-App Purchases
      • 8 replies
    • Pudgy Party - Battle Royale v0.12.2 +7 Cheats [ Speed, Gravity + More ]
      Modded/Hacked App: Pudgy Party - Battle Royale By Mythical, Inc.
      Bundle ID: com.mythical.pudgyparty
      App Store Link: https://apps.apple.com/us/app/pudgy-party-battle-royale/id6744258913?uo=4

       


      🤩 Hack Features

      - Jump Height Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Gravity Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Speed Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Friction Multiplier -> Affects bots too. Use with Freeze/Dumb Bots.
      - Freeze Bots
      - Dumb Bots
      - Free In-App Purchases
      • 19 replies
    • Subway Surfers City v1.26.0 +10 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Subway Surfers City By Sybo Games ApS
      Bundle ID: com.sybogames.subway.surfers.game
      iTunes Store Link: https://apps.apple.com/ca/app/subway-surfers-city/id6504188939?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - Unlimited Coins -> Earn or spend some.
      - Unlimited Keys -> Earn or spend some.
      - Unlimited Revives - Earn or spend some.
      - Unlimited Tokens -> Earn or spend some.
      - All Boards Unlocked
      - All Surfers Unlocked
      - Max Level -> Earn some XP.
      - God Mode
      - Unlimited Score
      - Unlimited Jumps


      Jailbreak required hack(s): [Mod Menu Hack] Subway Surfers City v1.13.2 +7 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 211 replies
    • Subway Surfers City v1.26.0 +10 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Subway Surfers City By Sybo Games ApS
      Bundle ID: com.sybogames.subway.surfers.game
      iTunes Store Link: https://apps.apple.com/ca/app/subway-surfers-city/id6504188939?uo=4


      Hack Features:
      - Unlimited Coins
      - Unlimited Keys
      - Unlimited Revives
      - All Boards Unlocked
      - All Surfers Unlocked
      - Max Level -> Earn some XP.
      - God Mode


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Subway Surfers City v1.13.2 +5 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 71 replies
    • City Of Survivors v1.5.3 [+6 Jailed Cheats]
      Modded/Hacked App: City Of Survivors By Chengdu Pengfei Network Technology Co., Ltd.
      Bundle ID: com.gatherfun.cityofsurvivors
      App Store Link: https://apps.apple.com/us/app/city-of-survivors/id6743288723?uo=4



      Important


      Do not enable feautures on loading screen or do not keep enabled if you leave game.

      If you leave game without disabling features or enable on loading screen game will be crash.

       

      🤩 Hack Features

      - Add Gold
      - Add Diamond
      - Add Wood
      - Add Plank 
      - Add Explore Token
      - Add Skip Ads Coupon
      • 20 replies
    • City Of Survivors v1.5.3 [+6 Cheats]
      Modded/Hacked App: City Of Survivors By Chengdu Pengfei Network Technology Co., Ltd.
      Bundle ID: com.gatherfun.cityofsurvivors
      App Store Link: https://apps.apple.com/us/app/city-of-survivors/id6743288723?uo=4



      Important


      Do not enable feautures on loading screen or do not keep enabled if you leave game.

      If you leave game without disabling features or enable on loading screen game will be crash.

       

      🤩 Hack Features

      - Add Gold
      - Add Diamond
      - Add Wood
      - Add Plank 
      - Add Explore Token
      - Add Skip Ads Coupon
        • Agree
      • 37 replies
    • Heroes Crew: Strategy Defense v1.3.52 [+12 Cheats]
      Modded/Hacked App: Heroes Crew: Strategy Defense By AlohaFactory
      Bundle ID: com.overdogs.heroes
      App Store Link: https://apps.apple.com/us/app/heroes-crew-strategy-defense/id6744350078?uo=4



      🤩 Hack Features

      - Add Currency
      - Unlimited Items
      - Unlimited Property (Heroes, Relic etc)
      - Activate VVip (Use after tutorial and only in main menu)
      - Activate Premium Hunt Pass (Use after tutorial and only in main menu)
      - Unlimited Battle Currency (Always Will Increase)
      • 119 replies
    • Heroes Crew: Strategy Defense v1.3.52 [+12 Jailed Cheats]
      Modded/Hacked App: Heroes Crew: Strategy Defense By AlohaFactory
      Bundle ID: com.overdogs.heroes
      App Store Link: https://apps.apple.com/us/app/heroes-crew-strategy-defense/id6744350078?uo=4



      🤩 Hack Features

      - Add Currency
      - Unlimited Items
      - Unlimited Property (Heroes, Relic etc)
      - Activate VVip (Use after tutorial and only in main menu)
      - Activate Premium Hunt Pass (Use after tutorial and only in main menu)
      - Unlimited Battle Currency (Always Will Increase)
      • 49 replies
    • MU: Pocket Knights v0.0.5 +3 Jailed Cheats [ Damage + More ]
      Modded/Hacked App: MU: Pocket Knights By WEBZEN INC.
      Bundle ID: com.webzen.muidle.ios
      App Store Link: https://apps.apple.com/ph/app/mu-pocket-knights/id6742208743?uo=4

       
       

      🤩 Hack Features

      - Damage Multiplier
      - God Mode
      - Speed Multiplier
      • 29 replies
    • MU: Pocket Knights v0.0.5 +3 Cheats [ Damage + More ]
      Modded/Hacked App: MU: Pocket Knights By WEBZEN INC.
      Bundle ID: com.webzen.muidle.ios
      App Store Link: https://apps.apple.com/ph/app/mu-pocket-knights/id6742208743?uo=4

       
       

      🤩 Hack Features

      - Damage Multiplier
      - God Mode
      - Speed Multiplier
      • 14 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines