Jump to content

Hooking functions on iOS jailbreak


nngot44

11 posts in this topic

Recommended Posts

Hello, in this tutorial I will show one of the ways to hook a function. I will be hooking a function from a Unity game.

First you need to find the address at which the beginning of the function is located in real time, this is difficult due to ASLR (address randomization).

First, let's write a method that will return the following address:

// RVA: 0x11FE288 Offset: 0x11FE288 VA: 0x11FE288
    private void Update() { }
  (This is the address and information about the function that is in the compiled game engine)

uint64_t getExecAddr(uint64_t addr, int index)
{
    const struct mach_header* header = _dyld_get_image_header(index);
    if (header == NULL){return 0;}

    uint64_t libLoadAddr = (uint64_t)header;
    uint64_t exec_addr = libLoadAddr + addr;

    return exec_addr;
}

In this example, we are making a method that returns a number of type uint64_t and takes two parameters: the address of the function (for example, the one I gave above) and the library index.

Using the _dyld_get_image_header() method, we get the address from which the library was loaded by its index.

 

How to find the library index? This can be done in two ways: Using the LLDB debugger (image list command) or using another method that we will now write (this method is better than the first one)

uint64_t getLibIndex(const char* que_image)
{
	int i = 0;
	int image_count = _dyld_image_count();

	for(; i < image_count; i++)
	{
		const char* req_image = _dyld_get_image_name(i);

		if(req_image && strcmp(req_image, que_image) == 0)
			{return i;}
	}
	return -1;
}

This method takes a path parameter to the library, we use the _dyld_image_count() method to find out how many libraries are loaded into the game process, then using a loop we compare our path to the library with others, and if the paths match, we return the index.

Okay, there's not much left. Now let's create a pointer to the old function and create a replacement function that will be called instead of the original one:

void (*old_Update)(void *self);

void Update(void *self)
{
 	// "your code here"
  
	old_Update(self);
}

Now let's just make a hook according to a template that can be easily found on the Internet:

%ctor 
{		
	MSHookFunction( (void *)address_to_your_func_with_aslr, (void *)Update, (void **)&old_Update);	
}	

To make it clearer, I will show the full code of my hook:

#include <unistd.h>
#include <dispatch/dispatch.h>
#include <mach-o/dyld.h>
#include <substrate.h>
#include <string.h>

uint64_t getExecAddr(uint64_t addr, int index)
{
    const struct mach_header* header = _dyld_get_image_header(index);
    if (header == NULL){return 0;}

    uint64_t libLoadAddr = (uint64_t)header;
    uint64_t exec_addr = libLoadAddr + addr;

    return exec_addr;
}


uint64_t getLibIndex(const char* que_image)
{
	int i = 0;
	int image_count = _dyld_image_count();

	for(; i < image_count; i++)
	{
		const char* req_image = _dyld_get_image_name(i);

		if(req_image && strcmp(req_image, que_image) == 0)
			{return i;}
	}
	return -1;
}


void (*old_Update)(void *self);

void Update(void *self)
{
	sleep(5);
	old_Update(self);
}


%ctor 
{	
	dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{

		sleep(150);

		int index = getLibIndex("/private/var/containers/Bundle/Application/BAE27894-6809-4743-AFFA-C1F6B93195CB/hidenseek.app/Frameworks/UnityFramework.framework/UnityFramework");
		
		uint64_t address = getExecAddr(0x11fe288, index);

		MSHookFunction( (void *)address, (void *)Update, (void **)&old_Update);

	});	

}	

 

This is my test version of the hook, it works great. (dispatch_async I used to wait until all libraries are loaded) In my example, the hook changes the behavior of the program so that when Update() is called, the game slows down for 5 seconds, this is only a beta version and you can add other logic there :)

If you liked the tutorial, please rate it. I will try to answer questions :)

 

 

Updated by nngot44
  • Like 3
  • Thanks 1
  • Informative 1
Link to comment
Share on other sites

3 hours ago, nngot44 said:
/private/var/containers/Bundle/Application/BAE27894-6809-4743-AFFA-C1F6B93195CB/

Have to be careful here if you plan on releasing this tweak. :) This location is dynamic and changes per device & iOS version.

  • Informative 1
Link to comment
Share on other sites

1 minute ago, 34306 said:

Really nice. Have you try this on Dopamine jailbreak? I got some issue while hooking on Dopamine.

 

What kind of issues? I've seen similar reports after converting rootful to rootless with iGameGod.

Link to comment
Share on other sites

Just now, Rook said:

What kind of issues? I've seen similar reports after converting rootful to rootless with iGameGod.

I have no idea, maybe it's Dopamine issue. Opa said on 1.1 he fixed PPLRW but when i tried to hooking (Unity game). It still crash. I have no idea what's going on..
xVY8cNF.jpg

Link to comment
Share on other sites

Just now, 34306 said:

I have no idea, maybe it's Dopamine issue. Opa said on 1.1 he fixed PPLRW but when i tried to hooking (Unity game). It still crash. I have no idea what's going on..
xVY8cNF.jpg

Shouldn't this be an ElleKit related issue rather than Dopamine?

I tried hooks on palera1n rootless and they seem to work fine.

Link to comment
Share on other sites

Just now, Rook said:

Shouldn't this be an ElleKit related issue rather than Dopamine?

I tried hooks on palera1n rootless and they seem to work fine.

Let me update Ellekit. They already have Substitute, Substrate, Libhooker. And Ellekit such a weird thing...

Report back to you later!

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below. For more information, please read our Posting Guidelines.
Reply to this topic... Posting Guidelines

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Our picks

    • Travel Town - Merge Adventure v2.12.610 Jailed Cheats +1
      Modded/Hacked App: Travel Town - Merge Adventure By Magmatic Games Ltd
      Bundle ID: io.randomco.travel
      iTunes Store Link: https://apps.apple.com/us/app/travel-town-merge-adventure/id1521236603?uo=4


      Hack Features:
      - Infinite Currencies


      iOS Hack Download Link: https://iosgods.com/topic/148953-travel-town-merge-adventure-v212287-jailed-cheats-1/
      • 333 replies
    • HomeScapes v7.1.7 Jailed Cheats +3
      Modded/Hacked App: Homescapes By PLR Worldwide Sales Limited
      Bundle ID: com.playrix.gardenscapes-sweethome
      iTunes Store Link: https://apps.apple.com/us/app/homescapes/id1195621598?uo=4


      Hack Features:
      - Infinite Moves
      - Infinite Booster
      - Infinite Lives
       

      Hack Download Link: https://iosgods.com/topic/71443-arm64-homescapes-483-jailed-cheats-3/
        • Thanks
        • Like
      • 2,300 replies
    • Dragons: Rise of Berk v1.85.8 +6 Cheats
      Modded/Hacked App: Dragons: Rise of Berk By Jam City, Inc.
      Bundle ID: com.ludia.dragons
      iTunes Store Link: https://apps.apple.com/us/app/dragons-rise-of-berk/id667461862?uo=4


      Hack Features:
      - Free Shopping (shows original cost but able to purchase regardless)
      - Free Skipping
      - Free Odin's Market Shopping
      - Odin's Market Packs Never Reduce
      - Currency Hack [Spend to Gain - reverts to zero on next launch]
      - Enable Rider's Club


      Non-Jailbroken & No Jailbreak required hack(s):  https://iosgods.com/topic/79228-dragons-rise-of-berk-v1794-4-cheats-for-jailed-idevices/


      iOS Hack Download Link: https://iosgods.com/topic/139612-dragons-rise-of-berk-v1794-6-cheats/
        • Haha
      • 595 replies
    • Subway Surfers v3.30.2 Jailed Cheats +2
      Modded/Hacked App: Subway Surfers By Sybo Games ApS
      Bundle ID: com.kiloo.subwaysurfers
      iTunes Store Link: https://apps.apple.com/us/app/subway-surfers/id512939461?uo=4


      Hack Features:
      - Infinite Currencies
      - Unlock Characters Outfit


      Jailbreak required hack(s): https://iosgods.com/topic/119793-arm64-subway-surfers-cheats-all-versions-4/


      iOS Hack Download Link: https://iosgods.com/topic/119795-arm64-subway-surfers-v350-jailed-cheats-2/
        • Agree
        • Thanks
        • Winner
        • Like
      • 2,358 replies
    • Toram Online v4.0.38 - [ Custom Move Speed & More ]
      Modded/Hacked App: Toram Online By ASOBIMO,Inc.
      Bundle ID: com.asobimo.toramonline
      iTunes Store Link: https://itunes.apple.com/us/app/toram-online/id988683886?mt=8&uo=4&at=1010lce4
       

      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate or Substitute.
      - PreferenceLoader (from Cydia or Sileo).


      Hack Features:
      - Custom Move Speed
      - God Mode 
      - Fast Attack Speed
      - Fast Cast Speed
      - Always Critical Chance
      - Never Miss Hit 
      - Mobs/Bosses Can't Avoid & Guard 
      - Quick Draw
      - Armor Break
      - Magic Wall - Stun + Full Map Hack 
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 2,443 replies
    • MARVEL Future Fight Cheats v10.1.1 17++
      Modded/Hacked App: MARVEL Future Fight By Netmarble Games Corp.
      Bundle ID: com.netmarble.mheros
      iTunes Link: https://itunes.apple.com/us/app/marvel-future-fight/id955705796?mt=8&uo=4&at=1010lce4



      Hack Features
      - God Mode / Enemy Does 1 Damage / Never Die. May be a bit buggy.
      - High Damage / Damage Multiplier / One Hit Kill. Kill enemies with 1 hit.
      - No Skill Cooldown Time. Instant skill use without having to wait for reuse.
      - No Special Skill Cooldown Time. Instant special skill use without having to wait 120+ seconds to reuse it.
      - No Cooldown Time To Swap Heroes. Swap heroes instantly anytime.
      - Assistant Will Never Leave Once Called. Assistant will be available during the whole map once called.
      - Heroes Level 60. Level 60 heroes have higher HP and Damage output. The hack makes them lvl 60 in-game. However, when turned off, the heroes will be the level they previously were.
      - Infinite Buff Time. When swapping a hero, you gain a shield around him/her. That shield will stay with you throughout the rest of the game thus making you invincible.
      - Enemies Don't Move & Attack! An (better) alternative to God Mode. Enemies do not move or attack you therefore you cannot die.
        • Informative
        • Haha
        • Winner
        • Like
      • 2,826 replies
    • [ ArKnights TW ] 明日方舟 v20.1.01 - [ x Player Damage & More ]
      Modded/Hacked App: 明日方舟 By Longcheng Ltd.
      Bundle ID: tw.txwy.ios.arknights
      iTunes Store Link: https://apps.apple.com/tw/app/明日方舟/id1490985322?uo=4&at=1010lce4


      Hack Features:
      - x Player Damage - x1 - 1000
      - x Player Defense - x1 - 1000
      - x Player Attack Speed - x1 - 10
      - Frozen Enemies
      - Instant - Kill
      - Instant - Win
      - Unlimited Skills
      - No Deploy Cost


      iOS Hack Download Link: https://iosgods.com/topic/129583-arknights-tw-%E6%98%8E%E6%97%A5%E6%96%B9%E8%88%9F-v0902-x-player-damage-more/
      • 423 replies
    • Monster Legends: Collect all Cheats v17.2.3 +8
      Modded/Hacked App: Monster Legends: Breeding RPG By Socialpoint
      Bundle ID: es.socialpoint.MonsterCity
      iTunes Store Link: https://apps.apple.com/us/app/monster-legends-breeding-rpg/id653508448?uo=4


      Hack Features:
      - 1 Hit Kill
      - Skip Enemy Turn
      - Insane Score (Always 3 Stars)
      - No Skill Cost
      - Auto Win


      iOS Hack Download Link: https://iosgods.com/topic/176914-monster-legends-collect-all-v1632-5-cheats/
      • 157 replies
    • Monster Hunter Puzzles v2.00.03 +6 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Monster Hunter Puzzles By CAPCOM Co., Ltd
      Bundle ID: jp.co.capcom.mhpuzzle
      iTunes Store Link: https://apps.apple.com/us/app/monster-hunter-puzzles/id1591864714?uo=4


      Hack Features:
      - Unlimited Acorns -> Earn or spend some.
      - Unlimited Gems -> Earn or spend some.
      - Unlimited Tickets -> Earn or spend some.
      - Unlimited Lives -> Will not decrease.
      - Unlimited Boosters -> Will not decrease.
      - Unlimited Moves -> Will not decrease.


      Jailbreak required hack(s): [Mod Menu Hack] Monster Hunter Puzzles v2.00.03 +7 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 2 replies
    • Monster Hunter Puzzles v2.00.03 +7 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Monster Hunter Puzzles By CAPCOM Co., Ltd
      Bundle ID: jp.co.capcom.mhpuzzle
      iTunes Store Link: https://apps.apple.com/us/app/monster-hunter-puzzles/id1591864714?uo=4


      Hack Features:
      - Unlimited Acorns -> Earn or spend some.
      - Unlimited Gems -> Earn or spend some.
      - Unlimited Tickets -> Earn or spend some.
      - Unlimited Lives -> Will not decrease.
      - Unlimited Boosters -> Will not decrease.
      - Unlimited Moves -> Will not decrease.
      - Auto Win


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Monster Hunter Puzzles v2.00.03 +6 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 2 replies
    • Days After: Zombie Survival v11.4.0 +17 Cheats
      Modded/Hacked App: Days After: Zombie Survival By REACTGAMES STUDIO LIMITED
      Bundle ID: games.alternativa.zombie.survival.shooter
      iTunes Store Link: https://apps.apple.com/us/app/days-after-zombie-survival/id1498731586?uo=4

      Hack Features:
      - Disable Enemy Attacks
      - Custom Damage
      - Unlimited Durability
      - Stupid AI

      * more to come when I get more motivation

      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Like
      • 767 replies
    • DomiNation Asia By NEXON Company v12.1370.1370 - [ Currencies Freeze & More ]
      Modded/Hacked App: ドミネーションズ -文明創造- (DomiNations) By NEXON Company
      Bundle ID: com.nexon.dominations.asia
      iTunes Store Link: https://itunes.apple.com/jp/app/ドミネーションズ-文明創造-dominations/id1012778321


      Hack Features:
      - Unlimited Crowns/Food/Oil/Gold -> Resources will add instead of subtracting. Works with Crowns. Read note inside the feature for more information! This does not work for speeding up buildings.
      - All Achievements Unlocked 
      - Freeze Crowns/Food/Oil/Gold -> Freezes Resources so they do not decrease when used! This does not work for speeding up buildings.
      - No Citizen Cost 
      - 0 Cost to Speed Up Training Troops
      - 0 Cost to Speed Up Tactics
      - 0 Food Cost to Train Troops
      - 0 Food Cost to Upgrade Troops
      - No Timer to Upgrade Troops
      - 0 Food Cost to Train Spells
      - 0 General Train Cost
      - No General Train CoolDown
      - 0 Food Cost to Build Wonder
      - 0 Food Cost to Research Troops
      - 0 Food Cost to Upgrade Tactics
      - No Timer to Library Research
      - No Timer to Upgrade Spells
      - 0 Cost to Upgrade Buildings
      - 0 Workers Required to Upgrade
      - 0 Crown Cost For Peace

      This hack works on the latest x64 or ARM64 & ARM64e iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, 11, 11 Pro, 11 Pro Max, 12, 12 Pro, 12 Pro Max, 12 Mini, 13, 13 Pro, 13 Pro Max, 13 Mini, 14, 14 Plus, 14 Pro, 14 Pro Max, SE, iPod Touch 6G, 7G, iPad Air, Air 2, iPad Pro & iPad Mini 2, 3, 4, 5, 6 and later.


      Global hack(s): https://iosgods.com/topic/50401-ultrahack-dominations-v6660661-40-cheats-iosgods-exclusive/?tab=comments#comment-1582742
        • Agree
        • Winner
        • Like
      • 1,026 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines