Jump to content

11 posts in this topic

Recommended Posts

Updated (edited)

Hello, in this tutorial I will show one of the ways to hook a function. I will be hooking a function from a Unity game.

First you need to find the address at which the beginning of the function is located in real time, this is difficult due to ASLR (address randomization).

First, let's write a method that will return the following address:

// RVA: 0x11FE288 Offset: 0x11FE288 VA: 0x11FE288
    private void Update() { }
  (This is the address and information about the function that is in the compiled game engine)

uint64_t getExecAddr(uint64_t addr, int index)
{
    const struct mach_header* header = _dyld_get_image_header(index);
    if (header == NULL){return 0;}

    uint64_t libLoadAddr = (uint64_t)header;
    uint64_t exec_addr = libLoadAddr + addr;

    return exec_addr;
}

In this example, we are making a method that returns a number of type uint64_t and takes two parameters: the address of the function (for example, the one I gave above) and the library index.

Using the _dyld_get_image_header() method, we get the address from which the library was loaded by its index.

 

How to find the library index? This can be done in two ways: Using the LLDB debugger (image list command) or using another method that we will now write (this method is better than the first one)

uint64_t getLibIndex(const char* que_image)
{
	int i = 0;
	int image_count = _dyld_image_count();

	for(; i < image_count; i++)
	{
		const char* req_image = _dyld_get_image_name(i);

		if(req_image && strcmp(req_image, que_image) == 0)
			{return i;}
	}
	return -1;
}

This method takes a path parameter to the library, we use the _dyld_image_count() method to find out how many libraries are loaded into the game process, then using a loop we compare our path to the library with others, and if the paths match, we return the index.

Okay, there's not much left. Now let's create a pointer to the old function and create a replacement function that will be called instead of the original one:

void (*old_Update)(void *self);

void Update(void *self)
{
 	// "your code here"
  
	old_Update(self);
}

Now let's just make a hook according to a template that can be easily found on the Internet:

%ctor 
{		
	MSHookFunction( (void *)address_to_your_func_with_aslr, (void *)Update, (void **)&old_Update);	
}	

To make it clearer, I will show the full code of my hook:

#include <unistd.h>
#include <dispatch/dispatch.h>
#include <mach-o/dyld.h>
#include <substrate.h>
#include <string.h>

uint64_t getExecAddr(uint64_t addr, int index)
{
    const struct mach_header* header = _dyld_get_image_header(index);
    if (header == NULL){return 0;}

    uint64_t libLoadAddr = (uint64_t)header;
    uint64_t exec_addr = libLoadAddr + addr;

    return exec_addr;
}


uint64_t getLibIndex(const char* que_image)
{
	int i = 0;
	int image_count = _dyld_image_count();

	for(; i < image_count; i++)
	{
		const char* req_image = _dyld_get_image_name(i);

		if(req_image && strcmp(req_image, que_image) == 0)
			{return i;}
	}
	return -1;
}


void (*old_Update)(void *self);

void Update(void *self)
{
	sleep(5);
	old_Update(self);
}


%ctor 
{	
	dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{

		sleep(150);

		int index = getLibIndex("/private/var/containers/Bundle/Application/BAE27894-6809-4743-AFFA-C1F6B93195CB/hidenseek.app/Frameworks/UnityFramework.framework/UnityFramework");
		
		uint64_t address = getExecAddr(0x11fe288, index);

		MSHookFunction( (void *)address, (void *)Update, (void **)&old_Update);

	});	

}	

 

This is my test version of the hook, it works great. (dispatch_async I used to wait until all libraries are loaded) In my example, the hook changes the behavior of the program so that when Update() is called, the game slows down for 5 seconds, this is only a beta version and you can add other logic there :)

If you liked the tutorial, please rate it. I will try to answer questions :)

 

 

Updated by nngot44
  • Like 4
  • Thanks 1
  • Informative 1
Posted

Very good tutorial for beginner, easy to read and detailed

Thank you for posting

Posted
3 hours ago, nngot44 said:
/private/var/containers/Bundle/Application/BAE27894-6809-4743-AFFA-C1F6B93195CB/

Have to be careful here if you plan on releasing this tweak. :) This location is dynamic and changes per device & iOS version.

  • Informative 1
Posted

Really nice. Have you try this on Dopamine jailbreak? I got some issue while hooking on Dopamine.

 

Posted
1 minute ago, 34306 said:

Really nice. Have you try this on Dopamine jailbreak? I got some issue while hooking on Dopamine.

 

What kind of issues? I've seen similar reports after converting rootful to rootless with iGameGod.

Posted
Just now, Rook said:

What kind of issues? I've seen similar reports after converting rootful to rootless with iGameGod.

I have no idea, maybe it's Dopamine issue. Opa said on 1.1 he fixed PPLRW but when i tried to hooking (Unity game). It still crash. I have no idea what's going on..
xVY8cNF.jpg

Posted
Just now, 34306 said:

I have no idea, maybe it's Dopamine issue. Opa said on 1.1 he fixed PPLRW but when i tried to hooking (Unity game). It still crash. I have no idea what's going on..
xVY8cNF.jpg

Shouldn't this be an ElleKit related issue rather than Dopamine?

I tried hooks on palera1n rootless and they seem to work fine.

Posted
Just now, Rook said:

Shouldn't this be an ElleKit related issue rather than Dopamine?

I tried hooks on palera1n rootless and they seem to work fine.

Let me update Ellekit. They already have Substitute, Substrate, Libhooker. And Ellekit such a weird thing...

Report back to you later!

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Cat Quest III v1.4.6 +14 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Cat Quest III By The Gentlebros Pte. Ltd.
      Bundle ID: com.thegentlebros.project-star
      App Store Link: https://apps.apple.com/us/app/cat-quest-iii/id1551304183?uo=4

       


      🤩 Hack Features

      - God Mode
      - One-Hit Kill
      - Speed Multiplier
      - Time Scale Multiplier
      - Unlimited Gold -> Head into Settings and toggle the Restore Purchases button.*
      - Unlimited Crystals -> Head into Settings and toggle the Restore Purchases button.*
      - Unlock All Equipment -> Head into Settings and toggle the Restore Purchases button.*
      - Unlock All Skills -> Head into Settings and toggle the Restore Purchases button.*
      - Unlock All Quest Items -> Head into Settings and toggle the Restore Purchases button.*
      - Level Up x1 -> Head into Settings and toggle the Restore Purchases button.*
      - Level Up x10 -> Head into Settings and toggle the Restore Purchases button.*
      - Level Up x50 -> Head into Settings and toggle the Restore Purchases button.*
      - Unlock All Ship Blueprints -> Head into Settings and toggle the Restore Purchases button.*

      * - Only enable 1 feature at a time.
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 10 replies
    • Cat Quest III v1.4.6 +14 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Cat Quest III By The Gentlebros Pte. Ltd.
      Bundle ID: com.thegentlebros.project-star
      App Store Link: https://apps.apple.com/us/app/cat-quest-iii/id1551304183?uo=4

       
       

      🤩 Hack Features

      - God Mode
      - One-Hit Kill
      - Speed Multiplier
      - Time Scale Multiplier
      - Unlimited Gold -> Head into Settings and toggle the Restore Purchases button.*
      - Unlimited Crystals -> Head into Settings and toggle the Restore Purchases button.*
      - Unlock All Equipment -> Head into Settings and toggle the Restore Purchases button.*
      - Unlock All Skills -> Head into Settings and toggle the Restore Purchases button.*
      - Unlock All Quest Items -> Head into Settings and toggle the Restore Purchases button.*
      - Level Up x1 -> Head into Settings and toggle the Restore Purchases button.*
      - Level Up x10 -> Head into Settings and toggle the Restore Purchases button.*
      - Level Up x50 -> Head into Settings and toggle the Restore Purchases button.*
      - Unlock All Ship Blueprints -> Head into Settings and toggle the Restore Purchases button.*

      * - Only enable 1 feature at a time.
        • Thanks
        • Winner
        • Like
      • 9 replies
    • Prince of Persia Lost Crown v1.1.2 +13 Cheats [ God / O-HK ]
      Modded/Hacked App: Prince of Persia Lost Crown By Ubisoft
      Bundle ID: com.ubisoft.princeofpersia.thelostcrown.mobile.action.adventure.platform
      iTunes Store Link: https://apps.apple.com/us/app/prince-of-persia-lost-crown/id6504011865?uo=4

       
       

      🤩 Hack Features

      - God Mode
      - One-Hit Kill -> Linked. Use with God Mode.
      -- Full Game Unlocked
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 195 replies
    • Raise a Joseon Hunter ( 조선헌터 키우기 ) v1.4.2 +6 Jailed Cheats [ Mega Hack ]
      Modded/Hacked App: 조선헌터 키우기 By GROUP1024 Co., Ltd
      Bundle ID: com.group1024.korea
      App Store Link: https://apps.apple.com/kr/app/%EC%A1%B0%EC%84%A0%ED%97%8C%ED%84%B0-%ED%82%A4%EC%9A%B0%EA%B8%B0/id6746847732?uo=4

       


      🤩 Hack Features

      - God Mode
      - One-Hit Kill
      - Attack Speed
      - Unlimited MP
      - Gold Multiplier
      - XP Multiplier
      • 5 replies
    • Raise a Joseon Hunter ( 조선헌터 키우기 ) v1.4.2 +6 Cheats [ Mega Hack ]
      Modded/Hacked App: 조선헌터 키우기 By GROUP1024 Co., Ltd
      Bundle ID: com.group1024.korea
      App Store Link: https://apps.apple.com/kr/app/%EC%A1%B0%EC%84%A0%ED%97%8C%ED%84%B0-%ED%82%A4%EC%9A%B0%EA%B8%B0/id6746847732?uo=4

       


      🤩 Hack Features

      - God Mode
      - One-Hit Kill
      - Attack Speed
      - Unlimited MP
      - Gold Multiplier
      - XP Multiplier
      • 2 replies
    • Coop TD v1.4.3 +3 Jailed Cheats [ Damage + More ]
      Modded/Hacked App: Coop TD By Supermagic Inc.
      Bundle ID: com.supermagic.ios.cooptd
      iTunes Store Link: https://apps.apple.com/us/app/coop-td/id6503702666?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Unlimited In-Game Gold
      - Unlimited In-Game Main Stones
        • Informative
        • Thanks
        • Winner
        • Like
      • 63 replies
    • Coop TD v1.4.3 +3 Cheats [ Damage + More ]
      Modded/Hacked App: Coop TD By Supermagic Inc.
      Bundle ID: com.supermagic.ios.cooptd
      iTunes Store Link: https://apps.apple.com/us/app/coop-td/id6503702666?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Unlimited In-Game Gold
      - Unlimited In-Game Main Stones
        • Informative
        • Agree
        • Winner
        • Like
      • 86 replies
    • Idle Zombie Miner: Gold Tycoon v2.252.2070 +1++ Jailed Cheat [ Currencies ]
      Modded/Hacked App: Idle Zombie Miner: Gold Tycoon By VISTREX LIMITED
      Bundle ID: com.zombie.idleminertycoon
      iTunes Store Link: https://apps.apple.com/us/app/idle-zombie-miner-gold-tycoon/id6471983323?uo=4


      Hack Features:
      - Unlimited Currencies -> Will increase instead of decrease.


      Jailbreak required hack(s): [Mod Menu Hack] Idle Zombie Miner: Gold Tycoon v2.53.1001 +1++ Cheat [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 116 replies
    • Idle Zombie Miner: Gold Tycoon v2.252.2070 +1++ Cheat [ Currencies ]
      Modded/Hacked App: Idle Zombie Miner: Gold Tycoon By VISTREX LIMITED
      Bundle ID: com.zombie.idleminertycoon
      iTunes Store Link: https://apps.apple.com/us/app/idle-zombie-miner-gold-tycoon/id6471983323?uo=4


      Hack Features:
      - Unlimited Currencies -> Will increase instead of decrease.


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Idle Zombie Miner: Gold Tycoon v2.53.1001 +1++ Jailed Cheat [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 76 replies
    • MeChat - Interactive Stories v4.37.2 +5 Jailed Cheats [ Unlimited Gems ]
      Modded/Hacked App: MeChat - Interactive Stories By IMPONILOX LIMITED
      Bundle ID: world.playme.mechat
      App Store Link: https://apps.apple.com/us/app/mechat-interactive-stories/id1536157979?uo=4

       

      📌 Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      🤩 Hack Features

      - Unlimited Gems -> Will increase instead of decrease.
      - Unlock All Photos
      - Unlock All Audio Clips
      -- VIP Enabled

      VIP
      - Unlimited Gems -> Earn some then disable this feature. DO NOT SPEND ANY GEMS WHILST THIS FEATURE IS ENABLED!
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 809 replies
    • MeChat - Interactive Stories v4.37.2 +5 Cheats [ Unlimited Gems ]
      Modded/Hacked App: MeChat - Interactive Stories By IMPONILOX LIMITED
      Bundle ID: world.playme.mechat
      App Store Link: https://apps.apple.com/us/app/mechat-interactive-stories/id1536157979?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Unlimited Gems -> Will increase instead of decrease.
      - Unlock All Photos
      - Unlock All Audio Clips
      -- VIP Enabled

      VIP
      - Unlimited Gems -> Earn some then disable this feature. DO NOT SPEND ANY GEMS WHILST THIS FEATURE IS ENABLED!
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 327 replies
    • Hero Blitz: RPG Roguelike v2.1.0 +5 Jailed Cheats
      Modded/Hacked App: Hero Blitz: RPG Roguelike By ONDI TECHNOLOGY JSC
      Bundle ID: com.ondi.swordroguelite
      iTunes Store Link: https://apps.apple.com/us/app/hero-blitz-rpg-roguelike/id6711344267?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - Damage Multiplier
      - Defense Multiplier
      - Unlimited Currencies → Spend/Gain
      - Unlimited Ads Skip


      Jailbreak required hack(s): 


      iOS Hack Download IPA Link:

      Hidden Content

      Download via the iOSGods App








      PC Installation Instructions:
      STEP 1: If necessary, uninstall the app if you have it installed on your iDevice. Some hacked IPAs will install as a duplicate app. Make sure to back it up so you don't lose your progress.
      STEP 2: Download the pre-hacked .IPA file from the link above to your computer. To download from the iOSGods App, see this tutorial topic.
      STEP 3: Download Sideloadly and install it on your PC.
      STEP 4: Open/Run Sideloadly on your computer, connect your iOS Device, and wait until your device name shows up.
      STEP 5: Once your iDevice appears, drag the modded .IPA file you downloaded and drop it inside the Sideloadly application.
      STEP 6: You will now have to enter your iTunes/Apple ID email login, press "Start" & then you will be asked to enter your password. Go ahead and enter the required information.
      STEP 7: Wait for Sideloadly to finish sideloading/installing the hacked IPA. If there are issues during installation, please read the note below.
      STEP 8: Once the installation is complete and you see the app on your Home Screen, you will need to go to Settings -> General -> Profiles/VPN & Device Management. Once there, tap on the email you entered from step 6, and then tap on 'Trust [email protected]'.
      STEP 9: Now go to your Home Screen and open the newly installed app and everything should work fine. You may need to follow further per app instructions inside the hack's popup in-game.

      NOTE: iOS/iPadOS 16 and later, you must enable Developer Mode. For free Apple Developer accounts, you will need to repeat this process every 7 days. Jailbroken iDevices can also use Sideloadly/Filza/IPA Installer to normally install the IPA with AppSync. If you have any questions or problems, read our Sideloadly FAQ section of the topic and if you don't find a solution, please post your issue down below and we'll do our best to help! If the hack does work for you, post your feedback below and help out other fellow members that are encountering issues.


      Credits:
      - AlyssaX64


      Cheat Video/Screenshots:

      N/A
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 91 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines