Tutorial H5GG Enhanced Menu Tutorial - JSPlug-in 101

Happy Secret · July 19, 2023

While people start cheating with H5GG Enhanced Menu on Unity Game, they might then looking for way to execute the cheat in a convenient way.

JSPlug-in is obviously the ANSWER to this.

JSPlug-in is a framework setup of H5GG Enhanced Menu which allow you to extend the H5GG menu with new features, such as cheat menu for a game.
Under this Framework setup, user can leverage prebuilt H5GG Enhanced Menu function in their own user cheat. This largely simplify the complexity of the script, while having amazing features in it. To name a few:
1. Direct retrieve of Unity object pointers (Covering on Scene User Object, Singleton, any object that could link from object already found)
2. Use Unity dump structure to define the cheat without the need to hard code any offset. This essentially relieve people's headache in preparing cheat updates for game updates, because there is no more script update required.
3. Javascript as base, allow easy create cheat menu

With latest release of H5GG Enhanced Menu v1.8.4 onwards, writing JSPlug-in is getting easier. The introduction of Unity User Object wrapper, seamlessly expose Unity User Object to Javascript.
- User can access to Unity User Object's Fields and Methods directly from Javascript. Get / Set / Call and return, everything becomes so initiative.

Here let's go through a quick example to demonstrate how powerful yet easy, JSPlug-in is.

Game: Subway Surfers (Any version)
Cheat feature: Big Jump (jump up very high)

For those who want to know how to use H5GG Enhanced Menu to cheat this. You may see below tutorial from @impapas.

Spoiler

There are multiple way to implement this with JSPlug-in, it is all available for you to choose from.

Option 1) Minimum number of lines of code. 3 lines only.

Spoiler

var script = initializeUnitySupport();
var aryObj = script.call("findUnityObjectOfType", ["SYBO$RunnerCore$Character$CharacterMotor", true]);
writeFloat(readPtr(Number(aryObj[0])+Number(gUnityClasses.SYBO$RunnerCore$Character$CharacterMotor._config.offset))+Number(gUnityClasses.SYBO$RunnerCore$Character$CharacterMotorConfig.JumpHeight.offset),50)

NOTE:
1. Line 1 initialise the Unity Support in JSPlug-in
2. Line 2 retrieve an array of Unity User Object of type - SYBO$RunnerCore$Character$CharacterMotor. This is the naming convention used in H5GG Enhanced Menu for Class. It essentially replace the dot(.) of Unity namespace and class name into dollar sign($).
e.g. SYBO.RunnerCore.Character.CharacterMotor -> SYBO$RunnerCore$Character$CharacterMotor
This CharacterMotor class is a class that we can easily retrieve its runtime object pointer and has relation with the CharacterMotorConfig class that holds the data we want to cheat
3. Line 3 retrieve CharacterMotorConfig object pointer from CharacterMotor's _config field, then write new value to CharacterMotorConfig's JumpHeight field

Option 2) Easiest to understand. 7 lines (4 lines more) but more readable.

Spoiler

var script = initializeUnitySupport();
var aryObj = script.call("findUnityObjectOfType", ["SYBO$RunnerCore$Character$CharacterMotor", true]);
var CharacterMotor = new UnityObject(aryObj[0])
CharacterMotor.loadFields(['_config'])
var CharacterMotorConfig = new UnityObject(CharacterMotor._config)
CharacterMotorConfig.loadFields(['JumpHeight'])
CharacterMotorConfig.JumpHeight = 50

NOTE:
1. Line 1 and 2, are the same as Option 1
2. Line 3 uses Unity User Object Wrapper (UnityObject) to wrap CharacterMotor's object pointer
3. Line 4 tell JSPlug-in to load _config field's meta data and enable direct access
4. Line 5 uses Unity User Object Wrapper (Unity Object) to wrap CharacterMotorConfig's object pointer retrieved from CharacterMotor._config
YES, dot(.) notation, you can use [] notation as well - CharacterMotor["_config"]
5. Line 6 tell JSPlug-in to load JumpHeight field's meta data and enable direct access
6. Line 7 write new value to CharacterMotorConfig.JumpHeight directly
YES, dot(.) notation, you can use [] notation as well - CharacterMotorConfig["JumpHeight"] = 50

Option 3) Wrap everything with a Cheat Menu.

Spoiler

/*
    H5GG Plugin Mod Menu logic should enable easier Mod Menu development for non-jailbroken. It preserve existing H5GG UI and features, while adding new cheat menu.
    Cheat implemented using a patch free approach, the game binary does not required to patch. 
	
    Contribute by Happy Secret on iOSGods (2023)
*/
var script = initializeUnitySupport();

//[MODIFY] Configure Cheat Here
var cheats = {
    JumpHeight: ["CharacterMotorConfig", "JumpHeight", "50", "SELF", "ON"],
};

var intervalID;
var aryObj
var cheatState = false;
var cheatMode = "recurrent";
var recurrentInterval = 1200; //try not to be small than 1000, prevent system freeze

function toogleCheat() {
    cheatState = !cheatState;
    document.getElementById("applybutton").textContent = ' Toggle OFF ';
    document.getElementById("applybutton").style.backgroundColor = '#E8E8E850';

    if (cheatState) {
        intervalID = setInterval(function () {
            if (cheatState) {
                try {
                    script = initializeUnitySupport();
					//[MODIFY]Find core object object list
                    aryObj = script.call("findUnityObjectOfType", ["SYBO$RunnerCore$Character$CharacterMotor", true]);
                } catch (e) {
                    //reset Unity Support
                    gIl2cppInit = false;
                    var script = initializeUnitySupport();
                    appendLog("Unity support crashed and reset complete");
                }

                if (!aryObj) {
                    appendLog("Cannot find object to cheat. Engine stopped.");
                    cheatState = false;
                    document.getElementById("applybutton").textContent = ' Toggle Cheat ';
                    return;
                } else if (aryObj.length == 0) {
					appendLog("Cheat waiting for core object.");
					return;
				}
				
                for (let i = 0; i < aryObj.length; i++) {
                    //[MODIFY]Start prepare core object for delink / filtering here
                    let CharacterMotor = new UnityObject(aryObj[i]);
                    //debugInfo("BattleCharacter (" + aryObj[i].toString(16) + ") with UnityObject:" + BattleCharacter, [aryObj[i]])
                    CharacterMotor.loadFields(["_config"]);
                    //debugInfo("BattleCharacter (" + aryObj[i].toString(16) + ") with player:" + BattleCharacter.Status, [aryObj[i]])
                    
                    //debugInfo("BattleCharacter (0x" + aryObj[i].toString(16) + ") with CurrentUnitType:" + BattleCharacter.CurrentUnitType, [aryObj[i]])
					
					//[MODIFY]Locate the right object to cheat (SELF)
					let isSelf = true//BattleCharacter.CurrentUnitType==100? true:false;
                    let cheatObj = {};
                    //End prepare core object for delink / filtering here
                    
                    //[MODIFY]Start prepare cheat object here
					let CharacterMotorConfig = new UnityObject(CharacterMotor._config)
					CharacterMotorConfig.loadFields(["JumpHeight"])
                    cheatObj["CharacterMotorConfig"] = CharacterMotorConfig
					
                    //End prepare cheat object
                    for (var prop in cheats) {
                        if (Object.prototype.hasOwnProperty.call(cheats, prop)) {
                            let obj;
                            let addr;
                            let oldValue = 0;
							if (isNaN(cheats[prop][2])){
								switch (cheats[prop][2]){
									case "ONE":
										cheats[prop][2] = 1
										break;
								}
							}
                            if (isSelf && cheats[prop][3] == "SELF" && cheats[prop][4] == "ON") {
                                cheatObj[cheats[prop][0]][cheats[prop][1]] = isNaN(cheats[prop][2]) ? cheatObj[cheats[prop][0]][cheats[prop][2]] : cheats[prop][2];
                            } else if (isSelf==false && cheats[prop][3] == "ENEMY" && cheats[prop][4] == "ON") {
								cheatObj[cheats[prop][0]][cheats[prop][1]] = isNaN(cheats[prop][2]) ? cheatObj[cheats[prop][0]][cheats[prop][2]] : cheats[prop][2];
                            }//end if TURN ON
                        }
                    }//end For cheat item
                }//end For core object list
				appendLog("Cheat applied successfully");
            } else {
                clearInterval(intervalID);
            }
        }, recurrentInterval);
    } else {
        //code will stop on next coming iteration
        document.getElementById("applybutton").textContent = ' Toggle Cheat ';
        appendLog("Cheat stopped");
    }

    if (cheatMode != "recurrent") clearInterval(intervalID);
}

/* Add button on H5GG UI to open the Cheat UI, if it does not exist */
if ($("#cheatpluginmodmenu").length == 0) {
    var btn = $('<button id="cheatpluginmodmenu">Cheat</button>');
    btn.attr("credit", "Happy Secret");
    btn.click(function () {
        $("#cheatpluginpage").show();
    });
    //backward compatible with standard H5GG menu
    if ($("#frontview").length == 0) {
        $('#results_count').after(btn);
    } else {
        $("#frontview").append(btn);
    }
}

/* Create the Cheat UI Layer, if it does not exist */
if ($("#cheatpluginpage").length == 0) {
    var popup_pixelfancheat_html = $('<div id="cheatpluginpage"  style="background-color: #FDFDFD; width:100%; height:100%; position:absolute; left:0; top:0; border:1px solid #B8B8B880; border-radius: 5px; padding: 0px; z-index: 99999;-webkit-user-select: all;-webkit-touch-callout: default;"></div>');
    $(document.body).append(popup_pixelfancheat_html);
}

/* Generate Clean Cheat Menu UI */
var html = '&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Cheat by Happy Secret';
html += '<br><div style="float:right; font-size:16px; font-family: Arial, sans-serif;" onclick="closecheatpluginpage()">&nbsp;X&nbsp;</div>';

/* Prepare Cheat Item */
for (var prop in cheats) {
    if (Object.prototype.hasOwnProperty.call(cheats, prop)) {
		if (isNaN(cheats[prop][2]))
			html += '<label><input name="' + prop + '"type="checkbox" ' + '" onchange="checkchange(this)" checked/>' + prop + '<output>(' + cheats[prop][4] + ')</output></label>';
		else
        	html += '<br><label><input name="' + prop + '"type="range" min="0" max="' + cheats[prop][2] * 2 + '" value="' + cheats[prop][2] + '" style="width:50%" onchange="rangechange(this)" />' + prop + '<output>(' + cheats[prop][2] + ')</output></label>';
    }
}

html += '<p align="center"><button onclick="toogleCheat()" id="applybutton">&nbsp;Toggle Cheat&nbsp;</button>';
html += '</hr><div id="cheatpluginpagelog" class="scrollbar" ></div>';


$("#cheatpluginpage").html(html);
$("#cheatpluginpage").hide();

function closecheatpluginpage() {
    $("#cheatpluginpage").hide();
}

function rangechange(input) {
    cheats[input.name][2] = Number(input.value);

    input.nextElementSibling.value = '(' + input.value + ')';
    //input.previousElementSibling.value = '(' + input.value + ')';

    //Change Apply Button Color to remind user to press Apply
    document.getElementById("applybutton").style.backgroundColor = 'yellow';
}

function checkchange(input) {
    cheats[input.name][4] = input.checked ? "ON" : "OFF"

    input.nextElementSibling.value = '(' + cheats[input.name][4] + ')';

    //Change Apply Button Color to remind user to press Apply
    document.getElementById("applybutton").style.backgroundColor = 'yellow';
}

/* Create Cheat Log */
function appendLog(msg) {
    var oldmsg = $("#cheatpluginpagelog").html();
    if (oldmsg.length > 300) oldmsg = "";
    oldmsg = getCurTime() + ' - ' + msg + '<br>' + oldmsg;
    $("#cheatpluginpagelog").html(oldmsg);
}

NOTE:
1. This is a simple cheat menu template. It will automatically create Slider or Checkbox for cheats. It automatically run the cheat every 1200 milliseconds.
2. You do not need to understand the entire menu code in order to use it. There essentially 5 Steps to use this template script

STEP 1) Define what you want to cheat with the script

//[MODIFY] Configure Cheat Here
var cheats = {
    JumpHeight: ["CharacterMotorConfig", "JumpHeight", "50", "SELF", "ON"],
};

- First JumpHeight is the label of the slider
- CharacterMotorConfig is the name of the class that hold the field you want to change
- Second JumpHeight is the field name to change
- 50 is the value to change. Use "ONE" for cheat that only need to enable/disable without a numeral value.
- SELF is for de-link, it used to tell which group of object should apply this cheat on (Filtering condition)
- ON is a switch to turn on and off the cheat

STEP 2) Change the root object of interest, which should able to link to your other cheat object

//[MODIFY]Find core object object list
aryObj = script.call("findUnityObjectOfType", ["SYBO$RunnerCore$Character$CharacterMotor", true]);

Change the “SYBO$RunnerCore$Character$CharacterMotor” to an object class that you can find object link with Unity Static Analyzer. You need to full long name with those $.

STEP 3) Create the Unity User Object wrapper object from a Root Object instance address, and enable the linking field access

//[MODIFY]Start prepare core object for delink / filtering here
let CharacterMotor = new UnityObject(aryObj[i]);
CharacterMotor.loadFields(["_config"]);

Here create the base Unity Object, you just need to name it and identify that Field In this object you are going to use

STEP 4) Define the scope of the cheat, certain cheat we do not want to globally apply. (Filtering condition or Grouping)

//[MODIFY]Locate the right object to cheat (SELF)
let isSelf = true; //BattleCharacter.CurrentUnitType==100? true:false;

This is used to delink. Delink mean, cheat apply to certain object not all. Say, only on myself but not enemy. We want to amplify our team's attack but not enemy's team.

STEP 5) Create the Unity User Object wrapper object from a Root Object instance address, and enable the linking field access

//[MODIFY]Start prepare cheat object here
let CharacterMotorConfig = new UnityObject(CharacterMotor._config)
CharacterMotorConfig.loadFields(["JumpHeight"])
cheatObj["CharacterMotorConfig"] = CharacterMotorConfig

Like the earlier step, you setup the cheat Unity Object here and put it under the cheatObj
If you have 3 different Unity User Objects, which holds 5 fields you want to cheat. Here, you will have 3 set of above logics with each defines one of the Unity User Object.
Just to remember, EVERY SINGLE field we use, we need to load them explicitly.

With this 5 Steps, you should able to create simple Cheat Menu for Simple Unity Games.

This is obviously not for all Unity Games. Some Unity Games can't be cheated without Patching / Hooking.

New Badge

1. As they are JSPlug-in, in order to enable autoload on these script when H5GG startup and trigger. You need to define the name with prefix "H5JSPlugin - " with extension ".js".
e.g. H5JSPlugin - Subway Surfers.js
2. And you will need to put this Javascript file either in Document folder or .app folder (app bundle).

Please read Release note of H5GG Enhanced Menu for detail

Updated July 19, 2023 by Happy Secret

iosdevice · July 19, 2023

Amazing Tutorial! :yes:

Gay 228 · July 19, 2023

is it possible to run in h5gg to test the feature?

Gay 228 · July 19, 2023

Spoiler

JSError in:Index line:4310 column:52
TypeError: undefined is not an object
(evaluating 'this._objectDetails ["field-
Details"')

does anyone know how to solve? the object is the correct PlayerManager, but the script says no

Upd:error in spoiler

Updated July 19, 2023 by Gay 228
A

Happy Secret · July 19, 2023

4 hours ago, Gay 228 said:

Hide contents

JSError in:Index line:4310 column:52
TypeError: undefined is not an object
(evaluating 'this._objectDetails ["field-
Details"')

does anyone know how to solve? the object is the correct PlayerManager, but the script says no

Upd:error in spoiler

This normally happens when you have wrong object pointer, class name, or field name.

Happy Secret · July 19, 2023

7 hours ago, Gay 228 said:

is it possible to run in h5gg to test the feature?

Not sure what you mean. Of course the script need to run with H5GG

AmIaGodYet · July 20, 2023

!!

Gay 228 · July 20, 2023

7 hours ago, Happy Secret said:

This normally happens when you have wrong object pointer, class name, or field name.

I did everything like normal, the name of the object is CCDrivenController and the name of the field is m_JumpHeight
not work(

Happy Secret · July 20, 2023

1 hour ago, Gay 228 said:

I did everything like normal, the name of the object is CCDrivenController and the name of the field is m_JumpHeight
not work(

Can you share your few lines of code to wrap the object and load the field? Or simply share the entire script

Gay 228 · July 20, 2023

24 минуты назад Happy Secret сказал:

Можете ли вы поделиться своими несколькими строками кода, чтобы обернуть объект и загрузить поле? Или просто поделитесь всем сценарием

Спойлер

/*
H5GG Plugin Mod Menu logic should enable easier Mod Menu development for non-jailbroken. It preserve existing H5GG UI and features, while adding new cheat menu.
Cheat implemented using a patch free approach, the game binary does not required to patch.

Contribute by Happy Secret on iOSGods (2023)
*/
var script = initializeUnitySupport();

//[MODIFY] Configure Cheat Here
var cheats = {
JumpHeight: ["CCDrivenController", "m_JumpHeight", "50", "SELF", "ON"],
};

var intervalID;
var aryObj
var cheatState = false;
var cheatMode = "recurrent";
var recurrentInterval = 1200; //try not to be small than 1000, prevent system freeze

function toogleCheat() {
cheatState = !cheatState;
document.getElementById("applybutton").textContent = ' Toggle OFF ';
document.getElementById("applybutton").style.backgroundColor = '#E8E8E850';

if (cheatState) {
intervalID = setInterval(function () {
if (cheatState) {
try {
script = initializeUnitySupport();
//[MODIFY]Find core object object list
aryObj = script.call("findUnityObjectOfType", ["Oxide$CCDrivenController", true]);
} catch (e) {
//reset Unity Support
gIl2cppInit = false;
var script = initializeUnitySupport();
appendLog("Unity support crashed and reset complete");
}

if (!aryObj) {
appendLog("Cannot find object to cheat. Engine stopped.");
cheatState = false;
document.getElementById("applybutton").textContent = ' Toggle Cheat ';
return;
} else if (aryObj.length == 0) {
appendLog("Cheat waiting for core object.");
return;
}

for (let i = 0; i < aryObj.length; i++) {
//[MODIFY]Start prepare core object for delink / filtering here
let CharacterMotor = new UnityObject(aryObj[i]);
//debugInfo("BattleCharacter (" + aryObj[i].toString(16) + ") with UnityObject:" + BattleCharacter, [aryObj[i]])
CharacterMotor.loadFields(["_config"]);
//debugInfo("BattleCharacter (" + aryObj[i].toString(16) + ") with player:" + BattleCharacter.Status, [aryObj[i]])

//debugInfo("BattleCharacter (0x" + aryObj[i].toString(16) + ") with CurrentUnitType:" + BattleCharacter.CurrentUnitType, [aryObj[i]])

//[MODIFY]Locate the right object to cheat (SELF)
let isSelf = true//BattleCharacter.CurrentUnitType==100? true:false;
let cheatObj = {};
//End prepare core object for delink / filtering here

//[MODIFY]Start prepare cheat object here
let CharacterMotorConfig = new UnityObject(CharacterMotor._config)
CharacterMotorConfig.loadFields(["m_JumpHeight"])
cheatObj["CCDrivenController"] = CharacterMotorConfig

//End prepare cheat object
for (var prop in cheats) {
if (Object.prototype.hasOwnProperty.call(cheats, prop)) {
let obj;
let addr;
let oldValue = 0;
if (isNaN(cheats[prop][2])){
switch (cheats[prop][2]){
case "ONE":
cheats[prop][2] = 1
break;
}
}
if (isSelf && cheats[prop][3] == "SELF" && cheats[prop][4] == "ON") {
cheatObj[cheats[prop][0]][cheats[prop][1]] = isNaN(cheats[prop][2]) ? cheatObj[cheats[prop][0]][cheats[prop][2]] : cheats[prop][2];
} else if (isSelf==false && cheats[prop][3] == "ENEMY" && cheats[prop][4] == "ON") {
cheatObj[cheats[prop][0]][cheats[prop][1]] = isNaN(cheats[prop][2]) ? cheatObj[cheats[prop][0]][cheats[prop][2]] : cheats[prop][2];
}//end if TURN ON
}
}//end For cheat item
}//end For core object list
appendLog("Cheat applied successfully");
} else {
clearInterval(intervalID);
}
}, recurrentInterval);
} else {
//code will stop on next coming iteration
document.getElementById("applybutton").textContent = ' Toggle Cheat ';
appendLog("Cheat stopped");
}

if (cheatMode != "recurrent") clearInterval(intervalID);
}

/* Add button on H5GG UI to open the Cheat UI, if it does not exist */
if ($("#cheatpluginmodmenu").length == 0) {
var btn = $('<button id="cheatpluginmodmenu">Cheat</button>');
btn.attr("credit", "Happy Secret");
btn.click(function () {
$("#cheatpluginpage").show();
});
//backward compatible with standard H5GG menu
if ($("#frontview").length == 0) {
$('#results_count').after(btn);
} else {
$("#frontview").append(btn);
}
}

/* Create the Cheat UI Layer, if it does not exist */
if ($("#cheatpluginpage").length == 0) {
var popup_pixelfancheat_html = $('<div id="cheatpluginpage" style="background-color: #FDFDFD; width:100%; height:100%; position:absolute; left:0; top:0; border:1px solid #B8B8B880; border-radius: 5px; padding: 0px; z-index: 99999;-webkit-user-select: all;-webkit-touch-callout: default;"></div>');
$(document.body).append(popup_pixelfancheat_html);
}

/* Generate Clean Cheat Menu UI */
var html = '      Cheat by Happy Secret';
html += '<br><div style="float:right; font-size:16px; font-family: Arial, sans-serif;" onclick="closecheatpluginpage()"> X </div>';

/* Prepare Cheat Item */
for (var prop in cheats) {
if (Object.prototype.hasOwnProperty.call(cheats, prop)) {
if (isNaN(cheats[prop][2]))
html += '<label><input name="' + prop + '"type="checkbox" ' + '" onchange="checkchange(this)" checked/>' + prop + '<output>(' + cheats[prop][4] + ')</output></label>';
else
html += '<br><label><input name="' + prop + '"type="range" min="0" max="' + cheats[prop][2] * 2 + '" value="' + cheats[prop][2] + '" style="width:50%" onchange="rangechange(this)" />' + prop + '<output>(' + cheats[prop][2] + ')</output></label>';
}
}

html += '<p align="center"><button onclick="toogleCheat()" id="applybutton"> Toggle Cheat </button>';
html += '</hr><div id="cheatpluginpagelog" class="scrollbar" ></div>';

$("#cheatpluginpage").html(html);
$("#cheatpluginpage").hide();

function closecheatpluginpage() {
$("#cheatpluginpage").hide();
}

function rangechange(input) {
cheats[input.name][2] = Number(input.value);

input.nextElementSibling.value = '(' + input.value + ')';
//input.previousElementSibling.value = '(' + input.value + ')';

//Change Apply Button Color to remind user to press Apply
document.getElementById("applybutton").style.backgroundColor = 'yellow';
}

function checkchange(input) {
cheats[input.name][4] = input.checked ? "ON" : "OFF"

input.nextElementSibling.value = '(' + cheats[input.name][4] + ')';

//Change Apply Button Color to remind user to press Apply
document.getElementById("applybutton").style.backgroundColor = 'yellow';
}

/* Create Cheat Log */
function appendLog(msg) {
var oldmsg = $("#cheatpluginpagelog").html();
if (oldmsg.length > 300) oldmsg = "";
oldmsg = getCurTime() + ' - ' + msg + '<br>' + oldmsg;
$("#cheatpluginpagelog").html(oldmsg);
}

yes, of course, the script is in the spoiler