Jump to content

11 posts in this topic

Recommended Posts

Updated (edited)

Hello, in this tutorial I will show one of the ways to hook a function. I will be hooking a function from a Unity game.

First you need to find the address at which the beginning of the function is located in real time, this is difficult due to ASLR (address randomization).

First, let's write a method that will return the following address:

// RVA: 0x11FE288 Offset: 0x11FE288 VA: 0x11FE288
    private void Update() { }
  (This is the address and information about the function that is in the compiled game engine)

uint64_t getExecAddr(uint64_t addr, int index)
{
    const struct mach_header* header = _dyld_get_image_header(index);
    if (header == NULL){return 0;}

    uint64_t libLoadAddr = (uint64_t)header;
    uint64_t exec_addr = libLoadAddr + addr;

    return exec_addr;
}

In this example, we are making a method that returns a number of type uint64_t and takes two parameters: the address of the function (for example, the one I gave above) and the library index.

Using the _dyld_get_image_header() method, we get the address from which the library was loaded by its index.

 

How to find the library index? This can be done in two ways: Using the LLDB debugger (image list command) or using another method that we will now write (this method is better than the first one)

uint64_t getLibIndex(const char* que_image)
{
	int i = 0;
	int image_count = _dyld_image_count();

	for(; i < image_count; i++)
	{
		const char* req_image = _dyld_get_image_name(i);

		if(req_image && strcmp(req_image, que_image) == 0)
			{return i;}
	}
	return -1;
}

This method takes a path parameter to the library, we use the _dyld_image_count() method to find out how many libraries are loaded into the game process, then using a loop we compare our path to the library with others, and if the paths match, we return the index.

Okay, there's not much left. Now let's create a pointer to the old function and create a replacement function that will be called instead of the original one:

void (*old_Update)(void *self);

void Update(void *self)
{
 	// "your code here"
  
	old_Update(self);
}

Now let's just make a hook according to a template that can be easily found on the Internet:

%ctor 
{		
	MSHookFunction( (void *)address_to_your_func_with_aslr, (void *)Update, (void **)&old_Update);	
}	

To make it clearer, I will show the full code of my hook:

#include <unistd.h>
#include <dispatch/dispatch.h>
#include <mach-o/dyld.h>
#include <substrate.h>
#include <string.h>

uint64_t getExecAddr(uint64_t addr, int index)
{
    const struct mach_header* header = _dyld_get_image_header(index);
    if (header == NULL){return 0;}

    uint64_t libLoadAddr = (uint64_t)header;
    uint64_t exec_addr = libLoadAddr + addr;

    return exec_addr;
}


uint64_t getLibIndex(const char* que_image)
{
	int i = 0;
	int image_count = _dyld_image_count();

	for(; i < image_count; i++)
	{
		const char* req_image = _dyld_get_image_name(i);

		if(req_image && strcmp(req_image, que_image) == 0)
			{return i;}
	}
	return -1;
}


void (*old_Update)(void *self);

void Update(void *self)
{
	sleep(5);
	old_Update(self);
}


%ctor 
{	
	dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{

		sleep(150);

		int index = getLibIndex("/private/var/containers/Bundle/Application/BAE27894-6809-4743-AFFA-C1F6B93195CB/hidenseek.app/Frameworks/UnityFramework.framework/UnityFramework");
		
		uint64_t address = getExecAddr(0x11fe288, index);

		MSHookFunction( (void *)address, (void *)Update, (void **)&old_Update);

	});	

}	

 

This is my test version of the hook, it works great. (dispatch_async I used to wait until all libraries are loaded) In my example, the hook changes the behavior of the program so that when Update() is called, the game slows down for 5 seconds, this is only a beta version and you can add other logic there :)

If you liked the tutorial, please rate it. I will try to answer questions :)

 

 

Updated by nngot44
  • Like 4
  • Thanks 1
  • Informative 1
Posted

Very good tutorial for beginner, easy to read and detailed

Thank you for posting

Posted
3 hours ago, nngot44 said:
/private/var/containers/Bundle/Application/BAE27894-6809-4743-AFFA-C1F6B93195CB/

Have to be careful here if you plan on releasing this tweak. :) This location is dynamic and changes per device & iOS version.

  • Informative 1
Posted

Really nice. Have you try this on Dopamine jailbreak? I got some issue while hooking on Dopamine.

 

Posted
1 minute ago, 34306 said:

Really nice. Have you try this on Dopamine jailbreak? I got some issue while hooking on Dopamine.

 

What kind of issues? I've seen similar reports after converting rootful to rootless with iGameGod.

Posted
Just now, Rook said:

What kind of issues? I've seen similar reports after converting rootful to rootless with iGameGod.

I have no idea, maybe it's Dopamine issue. Opa said on 1.1 he fixed PPLRW but when i tried to hooking (Unity game). It still crash. I have no idea what's going on..
xVY8cNF.jpg

Posted
Just now, 34306 said:

I have no idea, maybe it's Dopamine issue. Opa said on 1.1 he fixed PPLRW but when i tried to hooking (Unity game). It still crash. I have no idea what's going on..
xVY8cNF.jpg

Shouldn't this be an ElleKit related issue rather than Dopamine?

I tried hooks on palera1n rootless and they seem to work fine.

Posted
Just now, Rook said:

Shouldn't this be an ElleKit related issue rather than Dopamine?

I tried hooks on palera1n rootless and they seem to work fine.

Let me update Ellekit. They already have Substitute, Substrate, Libhooker. And Ellekit such a weird thing...

Report back to you later!

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Journey Home: Merge & Stories v 2.1.6 [ +3 Cheats ] Currency Max
      Modded/Hacked App: Journey Home: Merge & Stories By Wixot Bilgi Teknolojileri Sanayi Ve Ticaret Limited Sirketi
      Bundle ID: com.wixot.merge
      App Store Link: https://apps.apple.com/us/app/journey-home-merge-stories/id1635526159?uo=4



      🤩 Hack Features

      - Cash
      - Gems
      - Energy
      • 2 replies
    • Journey Home: Merge & Stories v2.1.6 [ +3 Jailed ] Currency Max
      Modded/Hacked App: Journey Home: Merge & Stories By Wixot Bilgi Teknolojileri Sanayi Ve Ticaret Limited Sirketi
      Bundle ID: com.wixot.merge
      App Store Link: https://apps.apple.com/us/app/journey-home-merge-stories/id1635526159?uo=4


      🤩 Hack Features

      - Cash
      - Gems
      - Energy
      • 2 replies
    • Squishmallows Match v0.8.0 [ +2 Cheats ] Auto Win
      Modded/Hacked App: Squishmallows Match By East Side Games Inc
      Bundle ID: com.eastsidegames.squishmallows
      App Store Link: https://apps.apple.com/ph/app/squishmallows-match/id6450057167?uo=4

       

      🤩 Hack Features

      - Auto Win
      - Lives [ 0 Play Unlimited ]

      • 8 replies
    • Squishmallows Match v0.8.0 [ +2 Jailed ] Auto Win
      Modded/Hacked App: Squishmallows Match By East Side Games Inc
      Bundle ID: com.eastsidegames.squishmallows
      App Store Link: https://apps.apple.com/ph/app/squishmallows-match/id6450057167?uo=4
       

      🤩 Hack Features

      - Auto Win
      - Lives [ 0 Play Unlimited ]

      • 11 replies
    • Spin Squad! v1.6.3 [ +2 Cheats ] Battle Coins
      Modded/Hacked App: Lucky Offense By Crater Co., Ltd.
      Bundle ID: com.percent.ios.luckyrolling
      iTunes Store Link: https://apps.apple.com/us/app/lucky-offense/id6511224968?uo=4


      🤩 Hack Features

      - Battle Coins
      - ATK
      - ATK Range
      - ATK Speed

      ATK Linked Enemy
        • Like
      • 90 replies
    • Disney Realm Breakers v20008 [+3 Jailed Cheats]
      Modded/Hacked App: Disney Realm Breakers By JOYCITY Corp
      Bundle ID: com.joycity.drb
      App Store Link: https://apps.apple.com/ph/app/disney-realm-breakers/id6462846874?uo=4



      🤩 Hack Features

      - No Skill Cooldown
      - Auto Win (Enable inside battle)
      - Add Battle Gold (Enable inside battle)
        • Thanks
      • 29 replies
    • Disney Realm Breakers v20008 [+3 Cheats]
      Modded/Hacked App: Disney Realm Breakers By JOYCITY Corp
      Bundle ID: com.joycity.drb
      App Store Link: https://apps.apple.com/ph/app/disney-realm-breakers/id6462846874?uo=4



      🤩 Hack Features

      - No Skill Cooldown
      - Auto Win (Enable inside battle)
      - Add Battle Gold (Enable inside battle)
       
      • 25 replies
    • Train of Hope: Survival Game v1.10.1 +5 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Train of Hope: Survival Game By Samfinaco LLC
      Bundle ID: com.samfinaco.tos
      iTunes Store Link: https://apps.apple.com/us/app/train-of-hope-survival-game/id6636482655?uo=4

       
       

      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Unlimited Resources -> Will increase instead of decrease.
      - Unlimited Hero Experience -> Will increase instead of decrease.
        • Like
      • 64 replies
    • Train of Hope: Survival Game v1.10.1 +5 Cheats [ Damage & Defence ]
      Modded/Hacked App: Train of Hope: Survival Game By Samfinaco LLC
      Bundle ID: com.samfinaco.tos
      iTunes Store Link: https://apps.apple.com/us/app/train-of-hope-survival-game/id6636482655?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Unlimited Resources -> Will increase instead of decrease.
      - Unlimited Hero Experience -> Will increase instead of decrease.
      • 46 replies
    • Good Pizza, Great Pizza v5.33.1 +8 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Pizza, Great Pizza By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.pizzabusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-pizza-great-pizza/id911121200?uo=4


      Hack Features:
      - Unlimited Cash
      - Unlimited Diamonds
      - Unlimited Pizza Pass Claim -> Only works if you haven't claimed that reward yet.

      VIP
      - Unlimited Pizza Pass Tokens
      - Chef Pass Unlocked
      - Max Pizza Pass Level
      - Starter Bundle Unlocked
      - All Achievements Completed
        • Agree
        • Haha
        • Winner
        • Like
      • 370 replies
    • Good Pizza, Great Pizza v5.33.1 +8 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Pizza, Great Pizza By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.pizzabusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-pizza-great-pizza/id911121200?uo=4


      Hack Features:
      - Unlimited Cash
      - Unlimited Diamonds
      - Unlimited Pizza Pass Claim -> Only works if you haven't claimed that reward yet. 

      VIP
      - Unlimited Pizza Pass Tokens 
      - Chef Pass Unlocked 
      - Max Pizza Pass Level 
      - Starter Bundle Unlocked 
      - All Achievements Completed
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 195 replies
    • Good Coffee, Great Coffee v1.3.2 +8 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Coffee, Great Coffee By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.coffeebusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-coffee-great-coffee/id1603584945?uo=4
       


      🤩 Hack Features

      - Unlimited Cash
      - Unlimited Gems
      - Unlimited Energy
      - Unlimited Brew Points
      - Unlimited Daily Rewards
      - All Decor Unlocked
      - All Equipment Unlocked
      - All Equipment Upgrades Unlocked
      - All Shop Upgrades Unlocked
      - Perfect Drinks
        • Informative
        • Like
      • 101 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines