Jump to content

How to hack Unity Games | il2cpp resolver [ Level: Beginner ]


31 posts in this topic

Recommended Posts

Updated (edited)

Hello everyone, today i'll show you how to hack Unity Game using il2cpp resolver

Level: Beginner

Game: Subway Surf

Requirements:
- Theos (https://theos.dev/docs/installation)
- DNSpy (https://github.com/dnSpy/dnSpy) / IlSpy (https://github.com/icsharpcode/ILSpy)
- Batchh Mod Menu Template (Template)
- Follow the tutorial carefully! 

What we will make:
Will make this: Subway Surf All Version Hack
SOO Let's START!!!

Step 1 (Dump our game):
- What "Dump our game" means: Dumping is extracting data or code from a binary file for analysis or modification. IL2CPPDumper is a tool used to extract metadata and code from Unity games that use the IL2CPP scripting backend.
- To perform the dump we'll use: https://armconverter.com/il2cppdumper but first we need to get our decrypter game, from here https://armconverter.com/decryptedappstore/us/Subway surf
- Now to perform the dump just extract the zip of the decrypted game, and you need to get two files: UnityFramework and global-metadata.dat
- UnityFramework is located in "Frameworks/UnityFramework.framework/"
- global-metadata.dat is located in "Data/Managed/Metadata"
- Drop the UnityFramework (Executable) on the left box and drop the global-metadata.dat in the right box
- Wait and then download the results! 
(If you're lazy here the dumped zip: https://iosddl.net/07d83ef42134a41e/com.kiloo.subwaysurfers-3.31.0-Decrypted.ipa-il2cppdumper.zip)

Step 2 (Open the dumped data):
- Open DNSpy / ILSpy then choose files and open the folder where you extracted the dump zip you need to select all the file insinde DummyDll

Step 2.5 (Open the Batchh mod menu template):
- Theos need to be installed!
- To open the mod menu template you simply run this command in your terminal inside the folder you want your mods:

$THEOS/bin/nic.pl

- Fill all the information required, for the information about the app they can be found in: https://armconverter.com/appinfo

Step 3 (Let's search values in the DNSpy/ILSpy):

- Open a txt file to write down what we find! (it will be useful after)
- What we want to achieve is: Unlimited Jumps, Unlimited currency, No Collision 
- But first let's change our search options to "Method", for our purpose:
Screenshot-2024-07-06-at-19-19-02.png
- Let's search for "Jump", maybe we can the checker that handles the jump:
Screenshot-2024-07-06-at-19-20-58.png
- As you can see there are alot, so how can we find it? After some time it will became more easy to find! My though process for unlimited jump is to find the handler of "can jump", so let's search it!
Screenshot-2024-07-06-at-19-24-06.png
- We found two result, the first one is the right one! "System....", that is not correlate with what we want. So double click the "CanJump" Method:
Screenshot-2024-07-06-at-19-26-32.png
As you can see we get direct to the Class that contains out method, also in the left you can open the toggle arrow to reveal all the methods and fields inside the class. 
- So let's write down in our txt file, the Assembly we're in, this can be found by scrolling all the way up:
Screenshot-2024-07-06-at-19-29-45.png
- Right now we are in "Assembly-CSharp.dll", now let's write down our Class, namespace, method name, to find this scroll all the way up inside the CanJump class:
Screenshot-2024-07-06-at-19-32-15.png
- We see that our Namespace is "SYBO.RunnerCore.Character", our Class is "CharacterMotor", our Method name is "get_CanJump".
- Before searching for Unlimited currency or No Collision let's explore class CharacterMotor and see if we can find anything.
- In this class we can find two methods related to collision "CheckFrontalImpact" and "CheckSideImpact", we will use this for our no collision, also as you can see in these two there are 1 arguments "impactState", write it down that too.
- Let's search for the currency, the first thing it comes to my mind is to search GetCurrency:
Screenshot-2024-07-06-at-19-38-25.png

- Note that also this one has 1 argument "CurrencyType" it indicates the type of currency
- We also need Class, namespace, do as before! Namespace = SYBO.Subway.Meta, Class = WalletModel

Step 4 (Coding):
I've made my template as simple as possible, all the changes and coding will be done in Cheat/ folder, for this particular hack we'll use Patches.h and Offset.h
First let's change our Offset.h this is where all the offsets are stored, with my new method "il2cpp resolver" we now don't need to hard code the offset anymore!
 

//Offset.h
namespace offset
{
    namespace CharacterMotor
    {
        uint64_t CheckSideImpact = 0x0;
        uint64_t CheckFrontalImpact = 0x0;
        uint64_t get_CanJump = 0x0;
    }

    namespace WalletModel
    {
        uint64_t GetCurrency = 0x0;
    } 
}

- So as you can see from the code i defined with Class and Method inside them, this will be for having more clarity! You can do how you like it, this is my method of storing them. 
- Now let's go to Patches.h where the real code begin (Don't worry it's not hard, even if you don't know how to code!)
 

//Patches.h
#ifndef PATCHES_H
#define PATCHES_H

#include "../KittyMemory/MemoryPatch.hpp"
#include "Offset.h"
#include "Settings.h"
#include "Util.h"
#include "il2cpp.h"

struct PatchInfo {
    MemoryPatch patch;
    bool* setting;
};

std::vector<PatchInfo> patch_infos;

void addNewPatch(uintptr_t offset, const char* hexPattern, bool* setting) {
    MemoryPatch newPatch = createUnityFrameworkPatch(offset, hexPattern);
    if (!newPatch.isValid()) return;
    patch_infos.push_back({newPatch, setting});
}

void initPatch() {
    //here init your patches
}
#endif // PATCHES_H

- This is how it should look like, now let's edit it! All the edit will be inside the initPatch function.
- For this hack we'll use as i said my Il2cpp resolver what does that do? Retrieve information of the game based on Assembly, Class, Method, and other stuff we'll cover in next tutorial!
- So let's finish our code!
 

void initPatch() {

    Il2CppAttach();

    Il2CppMethod AsmMethod("Assembly-CSharp.dll");

    offset::CharacterMotor::CheckSideImpact = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("CheckSideImpact", 1);
    offset::CharacterMotor::CheckFrontalImpact = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("CheckFrontalImpact", 1);
    offset::CharacterMotor::get_CanJump = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("get_CanJump", 0);

    offset::WalletModel::GetCurrency = AsmMethod.getClass("SYBO.Subway.Meta", "WalletModel").getMethod("GetCurrency", 1);

}

- As you can see this uses all the information we gathered before! What does this do? Retrieve information!
- Now we need to execute the hack! How? by calling function patch(offset, modify)
 

void initPatch() {

    Il2CppAttach();

    Il2CppMethod AsmMethod("Assembly-CSharp.dll");

    offset::CharacterMotor::CheckSideImpact = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("CheckSideImpact", 1);
    offset::CharacterMotor::CheckFrontalImpact = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("CheckFrontalImpact", 1);
    offset::CharacterMotor::get_CanJump = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("get_CanJump", 0);

    offset::WalletModel::GetCurrency = AsmMethod.getClass("SYBO.Subway.Meta", "WalletModel").getMethod("GetCurrency", 1);

    //ADD PATCHES
    patch(offset::CharacterMotor::CheckSideImpact, "C0035FD6"); //return so it doesn't execute the check
    patch(offset::CharacterMotor::CheckFrontalImpact, "C0035FD6"); //return
    patch(offset::CharacterMotor::get_CanJump, "20008052C0035FD6"); //Set the can jump to 'true'
    patch(offset::WalletModel::GetCurrency, "007C009B007C009BC0035FD6"); //Multiply the value by it self 2 times
}

- And this is it! the hack are already enabled it! On the next tutorial we'll see how to add options, and use checkboxes 
- Now it's you're turn to add more hacks to it!
- I know you are wondering what is "C0035FD6", "2008052C0035FD6" those are assembly code, how can you get them? from using this converter: https://armconverter.com/

Step 5 (Bonus arm code):
- C0035FD6 = ret = return
- 20008052 = movz w0, #1 = set boolean to true
- 00008052 = movz w0, #0 = set boolean to false
- 00F0271E = fmov s0, #31 = High float value
- 007C009B = mul x0, x0, x0 = Multiply int
- 00E284D2 = mov x0, #10000 = Set int to 10k
- You can figure out the rest or google it! :) 

This is the end! Thanks for reading and hope this will help you create a Unity hack on your own, if you need any help feel free to comment, i'll try to respond to everyone! :) 

Credits:
- @batchh

Updated by batchh
  • Like 11
  • Winner 6
  • Thanks 1
Posted

Very detail tutorial, thank you batchh!!!

  • Like 1
Posted
4 hours ago, sukiop said:

If I use this method does it mean that I don't need to use hook update to modify the set_ function

In the next tutorial, I’ll show invoke function for it

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Puzzle & Dragons (English) v22.3.0 Jailed Cheats +2
      Modded/Hacked App: Puzzle & Dragons (English) By GungHo Online Entertainment, INC.
      Bundle ID: jp.gungho.padEN
      iTunes Store Link: https://apps.apple.com/us/app/puzzle-dragons-english/id563474464?uo=4


      Hack Features:
      - God Mode
      - One Hit Kill


      Jailbreak required hack(s): https://iosgods.com/topic/133984-puzzle-dragons-japan-english-cheats-all-versions-3/


      iOS Hack Download Link: https://iosgods.com/topic/135066-puzzle-dragons-english-v1931-jailed-cheats-2/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 316 replies
    • [ Puzzle & Dragons KR ] 퍼즐앤드래곤 v22.3.0 Jailed Cheats +2
      Modded/Hacked App: 퍼즐앤드래곤 By GungHo Online Entertainment, INC.
      Bundle ID: jp.gungho.padKO
      iTunes Store Link: https://apps.apple.com/kr/app/%ED%8D%BC%EC%A6%90%EC%95%A4%EB%93%9C%EB%9E%98%EA%B3%A4/id588637521?uo=4


      Hack Features:
      - God Mode
      - One Hit Kill


      Jailbreak required hack(s): https://iosgods.com/topic/133984-puzzle-dragons-japan-english-cheats-all-versions-3/


      iOS Hack Download Link: https://iosgods.com/topic/146388-puzzle-dragons-korea-%ED%8D%BC%EC%A6%90%EC%95%A4%EB%93%9C%EB%9E%98%EA%B3%A4-v1920-jailed-cheats-2/
        • Agree
        • Thanks
        • Winner
        • Like
      • 23 replies
    • Skullgirls Fighting RPG V7.3.3 [ +6 Jailed ] Auto Win
      Modded/Hacked App: Skullgirls: Fighting RPG By Autumn Games, LLC
      Bundle ID: com.autumn.skullgirls
      iTunes Store Link: https://apps.apple.com/us/app/skullgirls-fighting-rpg/id1280762571?uo=4


      Hack Features:

      - Auto win

      - Damage [ One HiT WiN ]

      - Energy Max

      - Skill

      - Enemy Disable

      - Goals Claimed [ Free Pass Only ]
        • Informative
        • Thanks
        • Winner
        • Like
      • 38 replies
    • Skullgirls Fighting RPG V7.3.3 [ +6 Cheats ] Auto Win
      Modded/Hacked App: Skullgirls: Fighting RPG By Autumn Games, LLC
      Bundle ID: com.autumn.skullgirls
      iTunes Store Link: https://apps.apple.com/us/app/skullgirls-fighting-rpg/id1280762571?uo=4


      Hack Features:
      - Auto win

      - Damage [ One HiT WiN ]

      - Energy Max

      - Skill

      - Enemy Disable

      - Goals Claimed [ Free Pass Only ]
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 127 replies
    • Fortress Saga: AFK RPG Cheats v1.8.09 +5
      Modded/Hacked App: Fortress Saga: AFK RPG By cookapps
      Bundle ID: com.cookapps.bm.fortresssaga
      iTunes Store Link: https://apps.apple.com/us/app/fortress-saga-afk-rpg/id6446308106?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Damage Multiplier
      - Defense Multiplier
      - Freeze Currencies
      - PREMIUM
      - No Ads

       

      Non-Jailbroken Hack: https://iosgods.com/topic/184193-fortress-saga-afk-rpg-v1800-jailed-cheats-3/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/178933-fortress-saga-afk-rpg-cheats-v1801-5/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 364 replies
    • Prison Empire Tycoon-Idle Game Cheats v3.9.2 +2
      Modded/Hacked App: Prison Empire Tycoon-Idle Game by Digital Things Sociedad Limitada
      Bundle ID: com.codigames.idle.prison.empire.manager.tycoon
      iTunes Store Link: https://apps.apple.com/us/app/prison-empire-tycoon-idle-game/id1508490923?uo=4&at=1010lce4


      Hack Features:
      - Infinite Cash
      - No Ads


      Non-Jailbroken & No Jailbreak required hack(s):  https://iosgods.com/topic/128324-arm64-prison-empire-tycoon%EF%BC%8Didle-game-v102-jailed-cheats-2/

       
      iOS Hack Download Link: https://iosgods.com/topic/128322-arm64-prison-empire-tycoon%EF%BC%8Didle-game-cheats-all-versions-2/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,161 replies
    • Left to Survive: Zombie Games Cheats v7.6.0 +10 Hacks
      Modded/Hacked App: Left to Survive: Zombie TPS By MY COM
      Bundle ID: com.glu.zbs
      iTunes Store Link: https://apps.apple.com/us/app/left-to-survive-zombie-tps/id1090501422

      Hack Features:
      - No Bullet Disperse 
      - Unlimited Ammo
      - No Recoil
      - Increased Fire-rate 

      - One Hit Campaign 
      - Grenades and Med-kits Dont Subtract
      - God Mode
      - God Mode PVP

      - Unlock Chapters early 
      - Weapons Unlocked Ready to buy 


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/

        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,592 replies
    • [ Seven Deadly Sins KR ] 일곱 개의 대죄: GRAND CROSS Cheats v8.6.72 +5
      Modded/Hacked App: 일곱 개의 대죄: GRAND CROSS By Netmarble Corporation
      Bundle ID: com.netmarble.nanakr
      iTunes Store Link: https://apps.apple.com/kr/app/%EC%9D%BC%EA%B3%B1-%EA%B0%9C%EC%9D%98-%EB%8C%80%EC%A3%84-grand-cross/id1449552940?uo=4


      Hack Features:
      - God Mode
      - One Hit Kill
      - Multiply Attack
      - Multiply Defense
      - Make Enemies God Mode for some quests


      iOS Hack Download Link: https://iosgods.com/topic/154899-seven-deadly-sins-kr-%EC%9D%BC%EA%B3%B1-%EA%B0%9C%EC%9D%98-%EB%8C%80%EC%A3%84-grand-cross-cheats-v750-5/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 177 replies
    • Zooba: Zoo Battle Royale Game v5.19.0 Jailed Cheats +2
      Modded/Hacked App: Zooba: Zoo Battle Royale Games By Wildlife Studios Limited
      Bundle ID: com.fungames.battleroyale
      iTunes Store Link: https://apps.apple.com/us/app/zooba-zoo-battle-royale-games/id1459402952?uo=4


      Hack Features:
      - Map Hacks
      - Allow Shoot in Water


      Jailbreak required hack(s): https://iosgods.com/topic/131104-arm64-zooba-zoo-battle-royale-game-cheats-all-versions-2/


      iOS Hack Download Link: https://iosgods.com/topic/131134-arm64-zooba-zoo-battle-royale-game-v320-jailed-cheats-2/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,301 replies
    • The Seven Deadly Sins Cheats v2.81.0 +5
      Modded/Hacked App: The Seven Deadly Sins by Netmarble Corporation
      Bundle ID: com.netmarble.nanagb
      iTunes Store Link: https://apps.apple.com/us/app/the-seven-deadly-sins/id1475440231?uo=4&at=1010lce4


      Hack Features:
      - God Mode
      - OHK
      - Infinite MP


      iOS Hack Download Link: https://iosgods.com/topic/131686-arm64-the-seven-deadly-sins-cheats-v117-3/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 2,051 replies
    • Zombastic: Time to Survive v1.12.4 [ +1+++ Jailed ] Currency Max
      Modded/Hacked App: Zombastic: Time to Survive By Playmotional Limited
      Bundle ID: com.playmotional.survival
      iTunes Store Link: https://apps.apple.com/us/app/zombastic-time-to-survive/id6475173073?uo=4


      Hack Features:
      - Currency & Resources Unlimited [ Disable When Playing ] 





      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Thanks
        • Winner
        • Like
      • 52 replies
    • Zombastic: Time to Survive v1.12.4 [ +1+++ Cheats ] Currency Max
      Modded/Hacked App: Zombastic: Time to Survive By Playmotional Limited
      Bundle ID: com.playmotional.survival
      iTunes Store Link: https://apps.apple.com/us/app/zombastic-time-to-survive/id6475173073?uo=4


      Hack Features:
      - Currency & Resources Unlimited [ Disable When Playing ] 





      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 50 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines