Jump to content

How to call the function? (iOS jailbreak)


nngot44
Go to solution Solved by Saitama,

10 posts in this topic

Recommended Posts

Hi I'm trying to call a function in the game Hide N Seek : Mini Games.

Here is my code, (I just need to call any function):

function dump:

//RVA: 0x11FE288 Offset: 0x11FE288 VA: 0x11FE288
   private void Update() { }


#include <unistd.h>
#include <dispatch/dispatch.h>
#include <mach-o/dyld.h>

uintptr_t getExecAddr(uintptr_t addr)
{
 const struct mach_header* header = _dyld_get_image_header(341); // this is the library index, it's so big because I'm              using a debugger so far.
 if (header == NULL){return 0;}

 uintptr_t libLoadAddr = (uintptr_t)header;
 uintptr_t exec_addr = libLoadAddr + addr;

 return exec_addr;
}

void (*Update)();

%ctor { 

 dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{

  sleep(15); // wait for all libraries to load

  Update = (void(*)())getExecAddr(0x11FE288);

  Update();

 });
 
}

The game crashes when the moment comes to call the function. What am I doing wrong? :(

Link to comment
Share on other sites

Keep It Simple - using this one


u dont need header index etc
u need library name
 

[menu setFrameworkName:"UnityFramework"];


next is

void (*Update)(void *inst) = (void(*)(void *))getRealOffset(0x11FE288);

and call of this is

Update(inst);


Why inst?
Because its not static function - and this function is called from some class
*inst is a class that has this function and the first arg is for call

  • Informative 1
Link to comment
Share on other sites

20 hours ago, nngot44 said:

Thanks for the answer! but i did not understand where to call the function, if this is done in the same place where the pointer is declared, the compiler will gile the error "use of undeclared identifier 'inst'' for Update(inst);

because u dont declare this variable and dont get the pointer of object created by this class

also dont know why u need to call exact this function 
in Unity games this function basically called automatically each frame (if the class inherits MonoBehaviour class)
 

Link to comment
Share on other sites

  • Solution

the main logic is
var someClass = new SomeClass(); //or other c# initialisation 
someClass.SomeMethod();

SomeMethod() cant be called from no where

Example #1

public class SomeClass : MonoBehaviour 
{
	// Fields
	...

	// Properties
	...

	// Methods
	...
	// RVA: 0x100400 Offset: 0x100400 VA: 0x100400
	public static SomeClass get_Instance() { }

	// RVA: 0x100500 Offset: 0x100500 VA: 0x100500
	public void SomeMethod() // address 0x100500

	// RVA: 0x100600 Offset: 0x100600 VA: 0x100600
	public static void SomeStaticMethod() // address 0x100600
	...
}

 

void* (*SomeClass$$get_Instance)() = (void(*)())getRealOffset(0x100400);
void (*SomeClass$$SomeMethod)(void *SomeClass) = (void(*)(void *))getRealOffset(0x100500);

void* SomeClassInstance = SomeClass$$get_Instance();
SomeClass$$SomeMethod(SomeClassInstance);

 

void (*SomeClass$$SomeStaticMethod)() = (void(*)())getRealOffset(0x100600);

SomeClass$$SomeStaticMethod();

Example #2

public class SomeOtherClass : MonoBehaviour 
{
	// Fields
	...

	// Properties
	...

	// Methods
	...
	// RVA: 0x100300 Offset: 0x100300 VA: 0x100300
	public void InitWithSomeClass(SomeClass someClassInstance) { }
	...
}

 

void* SomeClassInstance = NULL;
void (*SomeOtherClass$$InitWithSomeClass_original)(void *SomeOtherClassInstance, void* someClassInstance);
void _SomeOtherClass$$InitWithSomeClass_hook(void *SomeOtherClassInstance, void* someClassInstance) 
{
	SomeClassInstance = someClassInstance;
	SomeOtherClass$$InitWithSomeClass_original(SomeOtherClassInstance, someClassInstance);
}

HOOK(0x100300, _SomeOtherClass$$InitWithSomeClass_hook, SomeOtherClass$$InitWithSomeClass_original);

 

Updated by Saitama
  • Winner 1
Link to comment
Share on other sites

Example #3

public class SomeThirdClass : MonoBehaviour 
{
	// Fields
	...
	public SomeClass SomeClassField // 0x100
	...

	// Properties
	...

	// Methods
	...
	// RVA: 0x100200 Offset: 0x100200 VA: 0x100200
	public void Update() { }
	...
}

 

void* SomeClassInstance = NULL;
void (*SomeThirdClass$$Update_original)(void *SomeThirdClassInstance);
void _SomeThirdClass$$Update_hook(void *SomeThirdClassInstance) 
{
	void* someClassInstance = *(void **)((uint64_t)SomeThirdClassInstance + 0x100);
	if(someClassInstance != NULL)
    {
		SomeClassInstance = someClassInstance;
    }
	SomeThirdClass$$Update_hook(SomeThirdClassInstance);
}

HOOK(0x100200, _SomeThirdClass$$Update_hook, SomeThirdClass$$Update_original);

 

 

Updated by Saitama
  • Winner 1
Link to comment
Share on other sites

I used your advice and wrote this code (i hope my method returns the correct address) :

#include <unistd.h>
#include <dispatch/dispatch.h>
#include <mach-o/dyld.h>

uintptr_t getExecAddr(uintptr_t addr)
{
    const struct mach_header* header = _dyld_get_image_header(341);
    if (header == NULL){return 0;}

    uintptr_t libLoadAddr = (uintptr_t)header;
    uintptr_t exec_addr = libLoadAddr + addr;

    return exec_addr;
}

%ctor 
{

	dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{

		sleep(150);

		void* (*VELights$$get_Instance)() = (void* (*)())getExecAddr(0x12FD104);
		void (*VELights$$ResetMainSunLightAngle)(void *VELights) = (void(*)(void *))getExecAddr(0x12FD4B8);

		void* VELightsInstance = VELights$$get_Instance();
		VELights$$ResetMainSunLightAngle(VELightsInstance);
		
	});	

}	

 

In the debugger, I always get rather strange errors, for example, from the libobjc.A.dylib'objc_retain library. 

I thought it would be easier for me if it was possible to disable ASLR for this game. Is it possible to do this on iOS 13?

 

Updated by nngot44
Link to comment
Share on other sites

basically start from doing some easier things
for example change values from 
public int get_someGold();
and setter
public void set_someGold(int goldVal);

its will be easier to understand that call some function

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below. For more information, please read our Posting Guidelines.
Reply to this topic... Posting Guidelines

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Our picks

    • [iOS 17/18 Support] Plants vs. Zombies™ 2 v11.5.1 +3 Jailed Cheats [Unlimited Currencies]
      Modded/Hacked App: Plants vs. Zombies™ 2 By PopCap
      Bundle ID: com.popcap.ios.PvZ2
      iTunes Store Link: https://itunes.apple.com/us/app/plants-vs-zombies-2/id597986893
       

      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Cydia Impactor.
      - A Computer Running Windows/Mac/Linux.


      Hack Features:
      - Unlimited Coins
      - Unlimited Gems
      - Unlimited Mints
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 3,477 replies
    • Plants vs. Zombies™ 2 (All Versions) +4 Cheats [Unlimited Currencies]
      Modded/Hacked App: Plants vs. Zombies™ 2 By PopCap
      Bundle ID: com.popcap.ios.PvZ2
      iTunes Store Link: https://itunes.apple.com/us/app/plants-vs-zombies-2/id597986893

       

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate (from Cydia).
      - PreferenceLoader (from Cydia).


      Hack Features:
      - Unlimited Coins
      - Unlimited Gems
      - Unlimited Mints
      - Unlimited Sun - Will increase instead of decrease.
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 4,010 replies
    • Jurassic World Alive v3.7.32 - [ Dino Don't Move & More ]
      Modded/Hacked App: Jurassic World Alive By Ludia
      Bundle ID: com.ludia.jw2
      iTunes Store Link: https://apps.apple.com/us/app/jurassic-world-alive/id1231085864

      Hack Features:
      - Dino Don't Move
      - Inf.Battery
      - VIP Enabled

      This hack works on the latest x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, SE, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.


      Jailbreak required hack(s): https://iosgods.com/topic/103431-jurassic-world-alive-v1829-dino-dont-move-more/?tab=comments#comment-3107135
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,579 replies
    • Jurassic World Alive v3.7.32 - [ Dino Don't Move & More ]
      Modded/Hacked App: Jurassic World Alive By Ludia
      Bundle ID: com.ludia.jw2
      iTunes Store Link: https://apps.apple.com/us/app/jurassic-world-alive/id1231085864


      Hack Features:
      - Dino Don't Move
      - Inf. Battery
      - VIP Enabled

      This hack is an In-Game Mod Menu (iGMM). In order to activate the Mod Menu, tap on the iOSGods button found inside the app. This hack works on the latest x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, SE, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,495 replies
    • Modded/Hacked App: Kritika: The White Knights by GAMEVIL Inc.
      Bundle ID: com.gamevil.kritikam.ios.apple.global.normal
      iTunes Store Link: https://apps.apple.com/us/app/kritika-the-white-knights/id865958296

      Hack Features:
      - Infinite Potions (Increase instead of decrease)
      - Infinite Mana
      - No Potion Cooldown
      - Instant EX Gauge Fill
      - God Mode / Never Die
      - No Stage Timer -> Added upon request.

      This hack works on the latest x64 or ARM64 & ARM64e iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, 11, 11 Pro, 11 Pro Max, 12, 12 Pro, 12 Pro Max, 12 Mini, 13, 13 Pro, 13 Pro Max, 13 Mini, 14, 14 Plus, 14 Pro, 14 Pro Max, SE, iPod Touch 6G, 7G, iPad Air, Air 2, iPad Pro & iPad Mini 2, 3, 4, 5, 6 and later.
      Jailbroken version of this hack: https://iosgods.com/topic/44092-vip-exclusive-kritika-the-white-knights-v2412-15-cheats/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,330 replies
    • Kritika: The White Knights v5.5.2 +3 [God Mode & Set Damage Multiplier]
      Modded/Hacked App: Kritika: The White Knights By GAMEVIL Inc.
      Bundle ID: com.gamevil.kritikam.ios.apple.global.normal
      iTunes Store Link: https://itunes.apple.com/us/app/kritika-the-white-knights/id865958296
       

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate or Substitute.
      - PreferenceLoader (from Cydia or Sileo).


      Hack Features:
      - God Mode Works Everywhere
      - Set Damage Multiplier - Do not set it too high, you will get kicked out if you do.
      - No Skill Cooldown 

      All features are unlinked!
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,860 replies
    • Bullet Force v1.100.7 +3 Jailed Cheats [Radar Hack]
      Modded/Hacked App: Bullet Force by Blayze Games, L.L.C.
      Bundle ID: com.blayzegames.iosfps
      iTunes Store Link: https://itunes.apple.com/us/app/bullet-force/id1009134067

      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Cydia Impactor.
      - A Computer Running Windows/Mac/Linux.


      Hack Features:
      - Radar Hack - Shows all enemies on the radar.
      - Instant Reload
      - Anti-Flash - Flashbangs have no effect.
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 524 replies
    • [FREE] Bullet Force v1.100.7 +10 Cheats [Shoot Through Walls]
      Modded/Hacked App: Bullet Force By Blayze Games, L.L.C.
      Bundle ID: com.blayzegames.iosfps
      iTunes Store Link: https://itunes.apple.com/us/app/bullet-force/id1009134067


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate (from Cydia).
      - PreferenceLoader (from Cydia).


      Hack Features:
      - Unlimited Ammo + Increased Fire Rate - Both are linked. I can't unlink them, sorry.
      - Shoot Through Walls - Doesn't work for all walls.
      - ESP - Shows enemies nametags through walls.
      - Radar Hack - Shows all enemies on the radar.
      - Unlock All Perks
      - Instant Reload
      - Anti-Flash - Flashbangs have no effect.
      - Unlimited Throwables - Will not decrease. Works online, kinda.
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 3,695 replies
    • [ViP-Exclusive] Kritika: The White Knights v5.5.2 +10 Cheats
      Hacked App: Kritika: The White Knights By GAMEVIL Inc.
      iTunes Link: https://itunes.apple.com/us/app/kritika-the-white-knights/id865958296
      Bundle ID: com.gamevil.kritikam.ios.apple.global.normal


      Hack Features
      - Infinite Potions (Increase instead of decrease)
      - Infinite Mana
      - No Potion Cooldown
      - Instant EX Gauge Fill
      - God Mode in Stage Mode
      - God Mode in Tower & Monster Wave
      - God Mode in Arena & PvP (Untested)
      - Timer Hack*
      - Mao Support Always Active
      - 1 Hit Kill in Monster -> One Hit Kill was Replaced with "Monster Level 1"
      - Enemy Doesn't Attack
      - Boss Doesn't Attack
      - Enemy Doesn't Move
      - Boss Doesn't Move
      - Monster Level 1 -> Easy kills
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 3,043 replies
    • DRAGON BALL LEGENDS v5.5.1- [ Enemies Don't Attack & More ]
      Modded/Hacked App: DRAGON BALL LEGENDS By BANDAI NAMCO Entertainment Inc.
      Bundle ID: jp.co.bandainamcoent.BNEI0334
      iTunes Store Link: https://itunes.apple.com/us/app/dragon-ball-legends/id1358222641


      Mod Requirements:
      - Jailbroken or Non-Jailbroken iPhone/iPad/iPod Touch.
      - Cydia Impactor.
      - A Computer Running Windows/Mac/Linux.


      Hack Features:
      - Enemies Don't Attack
      - No Ki Cost
      - Unlimited Ki
      - Tutorial Bypassed - No Need To Play Tutorial
      - No Character Swap CoolDown
      - No Vanish CoolDown
      - Auto Complete All Challenges - Currency/Chrono Crystals Hack! 
      - Always Critical
      - All Cards Give DragonBall 
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 2,507 replies
    • DRAGON BALL LEGENDS v5.5.1 +3 Jailed Cheats [No Ki Cost + More]
      Modded/Hacked App: DRAGON BALL LEGENDS By BANDAI NAMCO Entertainment Inc.
      Bundle ID: jp.co.bandainamcoent.BNEI0334
      iTunes Store Link: https://itunes.apple.com/us/app/dragon-ball-legends/id1358222641


      Mod Requirements:
      - Jailbroken or Non-Jailbroken iPhone/iPad/iPod Touch.
      - Cydia Impactor.
      - A Computer Running Windows/Mac/Linux.


      Hack Features:
      - No Ki Cost
      - No Character Swap Cooldown
      - No Vanish Cooldown
      - Tutorial Bypassed
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 4,880 replies
    • DRAGON BALL LEGENDS v5.5.1 +7 FREE Cheats
      Modded/Hacked App: DRAGON BALL LEGENDS by BANDAI NAMCO Entertainment Inc.
      Bundle ID: jp.co.bandainamcoent.BNEI0334
      iTunes Store Link: https://apps.apple.com/us/app/dragon-ball-legends/id1358222641


      Hack Features:
      - No Swap Cooldown
      - No Vanish Cooldown
      - No KI Cost
      -  Auto Complete all Challenges
      - Always Critical
      - Tutorial Bypassed
      - Enemies don't Attack


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/70408-ios-13-support-dragon-ball-legends-v2110-3-jailed-cheats-no-ki-cost-more/
      Japanese Version: https://iosgods.com/topic/75598-dbl-%E3%83%89%E3%83%A9%E3%82%B4%E3%83%B3%E3%83%9C%E3%83%BC%E3%83%AB-%E3%83%AC%E3%82%B8%E3%82%A7%E3%83%B3%E3%82%BA-by-bandai-namco-entertainment-inc-v2100-instant-win-more/?
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 3,049 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines