Help/Support Ted2 Tweak Menu - Pointer Set Help

[rafgeekee 0 iPhone Xs Max 14.8]

Hi All,

I'm currently creating a series of mod menu's using Ted2's template - I'm bumping into similar issues for a couple of mods.

I'm looking for a way to modify a field.

Hypothetical Example:

Assume we have this decompiled from il/dnSpy

[Token(Token = "0x2000342")]
public class Item {
  [Token(Token = "0x400131B")]
  [FieldOffset(Offset = "0x1C")]
  public int Amount;

  [Token(Token = "0x4001313")]
  [FieldOffset(Offset = "0x30")]
  public bool IsUnlimited;

  [Address(RVA = "0x1ABB3A8", Offset = "0x1ABB3A8", VA = "0x1ABB3A8")]
  public void Init(CRefItem refMain, int amount = 0, bool is_attached = false)
  {
  }
  
  ...
}

There is no getter or setter for the Amount or IsUnlimited field.

Goal:

Forceable set Amount  to 9999 for all Items.

Forceable set IsUnlimited to True for all Items.

 

Attempts and Theory:

In Ted2's template, the best approach i've been able to figure out to get anywhere close to a meaningful outcome is hooking to the init function and pass in desired Amount argument.

However,

Tweak.xm Doesnt know what a CRefItem is, So I cant pass this param into my reinterpreted cast

 

Heres an example Tweak.xm to show this

offset for the init function is 0x1ABB3A8

#import "Macros.h"

auto modInit = reinterpret_cast<void(*) (void *, CRefItem, int, bool)>(getRealOffset(0x1ABB3A8));
  
void(*oldInit)(void *this_);
void newInit(void *this_) {
    if ([switches isSwitchOn:@"9999 Items"]) {
      modInit(this_, ???????? ,9999, false);
      return;
    }
  
    old_Init(this_);
}
  
// SETUP
void setup() {
  HOOK(0x1ABB3A8, newInit, oldInit);
  
  [switches addSwitch:@"9999 Items"
    description:@"Enable on Oppenents Turn"
  ];
}
  
... Rest of Ted2 Stuff

Notice: This isnt working code - this is just an example of whats going through my mind

Issues I see:

1) I'm not too sure what to hook onto in the setup as i've already got a casted reference to the Init function - hooking into something im casting to and calling again seems like a bad idea.

2) Im not too sure how to pass the CRefItem argument into the modInit call.

3) IsAttached arg will always be False - which may not always be the case - would be nice to know how to get the original passed args

4) Does not deal with IsUnlimited field

5) I could go up the tree in the decompiled code and cast to functions elsewhere but they all require types which I dont understand how to pass (Vector3, CRefItem...)

 

Reading From Other NIC Templates:

I'v been digging around and noticed something in R16s template called UIKeyPatch, From the docs it seems like you're able to set the value of a field using the fields offset

//call these inside ur own custom functions
*(int*)[UIKeyPatch address:@"0x1C" ptr:this_] = 9999;
*(bool*)[UIKeyPatch address:@"0x30" ptr:this_] = true;

As we don't have UIKeyPatch in Ted2 and the R16 repo seems to be offline, I can't find out how UIKeyPatch was implemented. The example doesnt show what would be hooked into in the setup function in Tweak.xm as I assume the offsets wouldnt work be different if I hooked into the Init function. Correct me if im wrong.

 

Ask

I hope the above examples highlights the gaps in my knowledge and give enough info on what I'm trying to achieve. As I'm using Ted2 and given the R16 Nic Template is unavailable. I've come here to seek help on making this happen. Any advice which can put me on the right path will be greatly appreciated

[0xSolana 24.7k iPhone 14 18.1]

Mhh Mhh okay that's what i would try, im not a pro, but this is what i would do :

35 minutes ago, rafgeekee said:

Forceable set Amount  to 9999 for all Items.

 

You can maybe try to get the field with the Update() function (if there is). else, ive seen somwhere on the web where you can use other function from the class but i didn't tried, Lmk if it worked.

So, if no Update() function :

//just a poc to get the idear
void(*old_func)(void *instance);
void func(void *instance) {
        if ([switches isSwitchOn:@"9999 Items"]) {
            //int Amount
            *(int *) ((uint64_t) instance + 0x1C) = 9999;
    }
    old_func(instance);
}

setup(){
	//a function in the same class. use Update if there is, if not try another function (Init for ex)
	HOOK(0x1ABB3A8, func, old_func);
}

 

42 minutes ago, rafgeekee said:

Forceable set IsUnlimited to True for all Items.

 

do the same thing.

 

43 minutes ago, rafgeekee said:

auto modInit = reinterpret_cast<void(*) (void *, CRefItem, int, bool)>(getRealOffset(0x1ABB3A8));

Afaik, when there is a Type and you don't have his definition, just make a pointer to it like this ;

//taking ur code
auto modInit = reinterpret_cast<void(*) (void *, void *, int, bool)>(getRealOffset(0x1ABB3A8));

replace the CRefItem with void *,  that way it gonna make a pointer on the undifined type and with luck it not gonna crash

 

50 minutes ago, rafgeekee said:

//this_ is probably a func where this_ + 0x1C = int Amount;
//you can't patch a field without its pointer. like search for "0x1C" in your dump.cs you gonna have a tons of results.
// but if u have pointer + 0x1C, its unique

*(int*)[UIKeyPatch address:@"0x1C" ptr:this_] = 9999;

 

using this is the same as . 

*(int *) ((uint64_t) instance + 0x1C) = 9999;

 

53 minutes ago, rafgeekee said:

3) IsAttached arg will always be False - which may not always be the case - would be nice to know how to get the original passed args

 

i guess, once you hooked Init, you can easly called it and put "true" on the func parameter, it gonna overwrite it probably.

//POC
modInit(this_, paramName ,9999, true);

 

Hope it could help you, tho all this is my knowledge, things might not be 100% right 

[rafgeekee 0 iPhone Xs Max 14.8]

On 1/16/2023 at 6:01 PM, ꞋꞌꞋꞌꞋꞌꞋꞌ said:

Mhh Mhh okay that's what i would try, im not a pro, but this is what i would do :

You can maybe try to get the field with the Update() function (if there is). else, ive seen somwhere on the web where you can use other function from the class but i didn't tried, Lmk if it worked.

So, if no Update() function :

//just a poc to get the idear
void(*old_func)(void *instance);
void func(void *instance) {
        if ([switches isSwitchOn:@"9999 Items"]) {
            //int Amount
            *(int *) ((uint64_t) instance + 0x1C) = 9999;
    }
    old_func(instance);
}

setup(){
	//a function in the same class. use Update if there is, if not try another function (Init for ex)
	HOOK(0x1ABB3A8, func, old_func);
}

 

do the same thing.

 

Afaik, when there is a Type and you don't have his definition, just make a pointer to it like this ;

//taking ur code
auto modInit = reinterpret_cast<void(*) (void *, void *, int, bool)>(getRealOffset(0x1ABB3A8));

replace the CRefItem with void *,  that way it gonna make a pointer on the undifined type and with luck it not gonna crash

 

using this is the same as . 

*(int *) ((uint64_t) instance + 0x1C) = 9999;

 

i guess, once you hooked Init, you can easly called it and put "true" on the func parameter, it gonna overwrite it probably.

//POC
modInit(this_, paramName ,9999, true);

 

Hope it could help you, tho all this is my knowledge, things might not be 100% right 

Thanks @ꞋꞌꞋꞌꞋꞌꞋꞌ This has helped get me in the right direction  - As I've hooked into an instance, I'm able to reference the field pointer using the offest as described . Although I am having difficulty getting my hook kick in at the right time. This is mostly down to finding a function which is called in a timely fasion which I need to dig more to find. 

This line has been a great help

*(int *) ((uint64_t) instance + 0x1C) = 9999;

For reference to anybody looking for similar help, This can be changed to any type, an example of a bool and float below:

*(bool *) ((uint64_t) instance + 0x1C) = true;

 

*(float *) ((uint64_t) instance + 0x1C) = 1.0f;

--

In view of Unknown types like CRefItem, passing in a void still needs the pointer which I'm struggling to understand. Could you help further on this?

Here is the code I'm looking at

auto modInit = reinterpret_cast<void(*) (void *, void *, int, bool)>(getRealOffset(0x1ABB3A8));
  
void(*oldInit)(void *this_);
void newInit(void *this_) {
    if ([switches isSwitchOn:@"9999 Items"]) {
      modInit(this_, paramName ,9999, false);
      return;
    }
  
    old_Init(this_);
}
  
// SETUP
void setup() {
  HOOK(0x1ABB3A8, newInit, oldInit);
  
  [switches addSwitch:@"9999 Items"
    description:@"Enable on Oppenents Turn"
  ];
}

Could you help me understand how i'd pull and pass paramName with the correct CRefItem pointer?