Jump to content

How to hack Unity Games | il2cpp resolver [ Level: Beginner ]


31 posts in this topic

Recommended Posts

Updated (edited)

Hello everyone, today i'll show you how to hack Unity Game using il2cpp resolver

Level: Beginner

Game: Subway Surf

Requirements:
- Theos (https://theos.dev/docs/installation)
- DNSpy (https://github.com/dnSpy/dnSpy) / IlSpy (https://github.com/icsharpcode/ILSpy)
- Batchh Mod Menu Template (Template)
- Follow the tutorial carefully! 

What we will make:
Will make this: Subway Surf All Version Hack
SOO Let's START!!!

Step 1 (Dump our game):
- What "Dump our game" means: Dumping is extracting data or code from a binary file for analysis or modification. IL2CPPDumper is a tool used to extract metadata and code from Unity games that use the IL2CPP scripting backend.
- To perform the dump we'll use: https://armconverter.com/il2cppdumper but first we need to get our decrypter game, from here https://armconverter.com/decryptedappstore/us/Subway surf
- Now to perform the dump just extract the zip of the decrypted game, and you need to get two files: UnityFramework and global-metadata.dat
- UnityFramework is located in "Frameworks/UnityFramework.framework/"
- global-metadata.dat is located in "Data/Managed/Metadata"
- Drop the UnityFramework (Executable) on the left box and drop the global-metadata.dat in the right box
- Wait and then download the results! 
(If you're lazy here the dumped zip: https://iosddl.net/07d83ef42134a41e/com.kiloo.subwaysurfers-3.31.0-Decrypted.ipa-il2cppdumper.zip)

Step 2 (Open the dumped data):
- Open DNSpy / ILSpy then choose files and open the folder where you extracted the dump zip you need to select all the file insinde DummyDll

Step 2.5 (Open the Batchh mod menu template):
- Theos need to be installed!
- To open the mod menu template you simply run this command in your terminal inside the folder you want your mods:

$THEOS/bin/nic.pl

- Fill all the information required, for the information about the app they can be found in: https://armconverter.com/appinfo

Step 3 (Let's search values in the DNSpy/ILSpy):

- Open a txt file to write down what we find! (it will be useful after)
- What we want to achieve is: Unlimited Jumps, Unlimited currency, No Collision 
- But first let's change our search options to "Method", for our purpose:
Screenshot-2024-07-06-at-19-19-02.png
- Let's search for "Jump", maybe we can the checker that handles the jump:
Screenshot-2024-07-06-at-19-20-58.png
- As you can see there are alot, so how can we find it? After some time it will became more easy to find! My though process for unlimited jump is to find the handler of "can jump", so let's search it!
Screenshot-2024-07-06-at-19-24-06.png
- We found two result, the first one is the right one! "System....", that is not correlate with what we want. So double click the "CanJump" Method:
Screenshot-2024-07-06-at-19-26-32.png
As you can see we get direct to the Class that contains out method, also in the left you can open the toggle arrow to reveal all the methods and fields inside the class. 
- So let's write down in our txt file, the Assembly we're in, this can be found by scrolling all the way up:
Screenshot-2024-07-06-at-19-29-45.png
- Right now we are in "Assembly-CSharp.dll", now let's write down our Class, namespace, method name, to find this scroll all the way up inside the CanJump class:
Screenshot-2024-07-06-at-19-32-15.png
- We see that our Namespace is "SYBO.RunnerCore.Character", our Class is "CharacterMotor", our Method name is "get_CanJump".
- Before searching for Unlimited currency or No Collision let's explore class CharacterMotor and see if we can find anything.
- In this class we can find two methods related to collision "CheckFrontalImpact" and "CheckSideImpact", we will use this for our no collision, also as you can see in these two there are 1 arguments "impactState", write it down that too.
- Let's search for the currency, the first thing it comes to my mind is to search GetCurrency:
Screenshot-2024-07-06-at-19-38-25.png

- Note that also this one has 1 argument "CurrencyType" it indicates the type of currency
- We also need Class, namespace, do as before! Namespace = SYBO.Subway.Meta, Class = WalletModel

Step 4 (Coding):
I've made my template as simple as possible, all the changes and coding will be done in Cheat/ folder, for this particular hack we'll use Patches.h and Offset.h
First let's change our Offset.h this is where all the offsets are stored, with my new method "il2cpp resolver" we now don't need to hard code the offset anymore!
 

//Offset.h
namespace offset
{
    namespace CharacterMotor
    {
        uint64_t CheckSideImpact = 0x0;
        uint64_t CheckFrontalImpact = 0x0;
        uint64_t get_CanJump = 0x0;
    }

    namespace WalletModel
    {
        uint64_t GetCurrency = 0x0;
    } 
}

- So as you can see from the code i defined with Class and Method inside them, this will be for having more clarity! You can do how you like it, this is my method of storing them. 
- Now let's go to Patches.h where the real code begin (Don't worry it's not hard, even if you don't know how to code!)
 

//Patches.h
#ifndef PATCHES_H
#define PATCHES_H

#include "../KittyMemory/MemoryPatch.hpp"
#include "Offset.h"
#include "Settings.h"
#include "Util.h"
#include "il2cpp.h"

struct PatchInfo {
    MemoryPatch patch;
    bool* setting;
};

std::vector<PatchInfo> patch_infos;

void addNewPatch(uintptr_t offset, const char* hexPattern, bool* setting) {
    MemoryPatch newPatch = createUnityFrameworkPatch(offset, hexPattern);
    if (!newPatch.isValid()) return;
    patch_infos.push_back({newPatch, setting});
}

void initPatch() {
    //here init your patches
}
#endif // PATCHES_H

- This is how it should look like, now let's edit it! All the edit will be inside the initPatch function.
- For this hack we'll use as i said my Il2cpp resolver what does that do? Retrieve information of the game based on Assembly, Class, Method, and other stuff we'll cover in next tutorial!
- So let's finish our code!
 

void initPatch() {

    Il2CppAttach();

    Il2CppMethod AsmMethod("Assembly-CSharp.dll");

    offset::CharacterMotor::CheckSideImpact = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("CheckSideImpact", 1);
    offset::CharacterMotor::CheckFrontalImpact = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("CheckFrontalImpact", 1);
    offset::CharacterMotor::get_CanJump = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("get_CanJump", 0);

    offset::WalletModel::GetCurrency = AsmMethod.getClass("SYBO.Subway.Meta", "WalletModel").getMethod("GetCurrency", 1);

}

- As you can see this uses all the information we gathered before! What does this do? Retrieve information!
- Now we need to execute the hack! How? by calling function patch(offset, modify)
 

void initPatch() {

    Il2CppAttach();

    Il2CppMethod AsmMethod("Assembly-CSharp.dll");

    offset::CharacterMotor::CheckSideImpact = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("CheckSideImpact", 1);
    offset::CharacterMotor::CheckFrontalImpact = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("CheckFrontalImpact", 1);
    offset::CharacterMotor::get_CanJump = AsmMethod.getClass("SYBO.RunnerCore.Character", "CharacterMotor").getMethod("get_CanJump", 0);

    offset::WalletModel::GetCurrency = AsmMethod.getClass("SYBO.Subway.Meta", "WalletModel").getMethod("GetCurrency", 1);

    //ADD PATCHES
    patch(offset::CharacterMotor::CheckSideImpact, "C0035FD6"); //return so it doesn't execute the check
    patch(offset::CharacterMotor::CheckFrontalImpact, "C0035FD6"); //return
    patch(offset::CharacterMotor::get_CanJump, "20008052C0035FD6"); //Set the can jump to 'true'
    patch(offset::WalletModel::GetCurrency, "007C009B007C009BC0035FD6"); //Multiply the value by it self 2 times
}

- And this is it! the hack are already enabled it! On the next tutorial we'll see how to add options, and use checkboxes 
- Now it's you're turn to add more hacks to it!
- I know you are wondering what is "C0035FD6", "2008052C0035FD6" those are assembly code, how can you get them? from using this converter: https://armconverter.com/

Step 5 (Bonus arm code):
- C0035FD6 = ret = return
- 20008052 = movz w0, #1 = set boolean to true
- 00008052 = movz w0, #0 = set boolean to false
- 00F0271E = fmov s0, #31 = High float value
- 007C009B = mul x0, x0, x0 = Multiply int
- 00E284D2 = mov x0, #10000 = Set int to 10k
- You can figure out the rest or google it! :) 

This is the end! Thanks for reading and hope this will help you create a Unity hack on your own, if you need any help feel free to comment, i'll try to respond to everyone! :) 

Credits:
- @batchh

Updated by batchh
  • Like 11
  • Winner 6
  • Thanks 1
Posted

Very detail tutorial, thank you batchh!!!

  • Like 1
Posted
4 hours ago, sukiop said:

If I use this method does it mean that I don't need to use hook update to modify the set_ function

In the next tutorial, I’ll show invoke function for it

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Galaxiga - Classic 80s Arcade v10.90 [ +7 Jailed ] Energy Max
      Modded/Hacked App: Galaxiga - Classic 80s Arcade By ONESOFT GLOBAL PTE. LTD.
      Bundle ID: com.os.space.force.galaxy.alien
      iTunes Store Link: https://apps.apple.com/us/app/galaxiga-classic-80s-arcade/id1519367184?uo=4


      Hack Features:

      - Premium Pass [ Rewards Only ]

      - Energy Unlimited [ Linked Premium Pass ]

      - Plane Unlocked [ Tire 1 Tire 2 ] 

      - Drone Unlocked [ Tire 1 Tire 2 ]

      - Stone Unlocked [ Tire 1 Tire 2 ] 

      - Unlock Gem Cost 0 [ Plane Drone Stone ]

      - Easy Kill [ Only SP - No PVP ] 

      - Win PvP Select Higher Rank [ Plane Drone Stone ] Easy To Win PvP NO Bannnn


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 48 replies
    • Galaxiga - Classic 80s Arcade v10.90 [ +7 Cheats ] Energy Max
      Modded/Hacked App: Galaxiga - Classic 80s Arcade By ONESOFT GLOBAL PTE. LTD.
      Bundle ID: com.os.space.force.galaxy.alien
      iTunes Store Link: https://apps.apple.com/us/app/galaxiga-classic-80s-arcade/id1519367184?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - Premium Pass [ Rewards Only ]

      - Energy Unlimited [ Linked Premium Pass ]

      - Plane Unlocked [ Tire 1 Tire 2 ] 

      - Drone Unlocked [ Tire 1 Tire 2 ]

      - Stone Unlocked [ Tire 1 Tire 2 ] 

      - Unlock Gem Cost 0 [ Plane Drone Stone ] Maybe Effect PvP 

      - Easy Kill [ Only SP - No PVP ] 

      - Win PvP Select Higher Rank [ Plane Drone Stone ]

      Not3:- Don't Abuse The Hack Incase Banned Lower Chances Maybe


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download Link:

      Hidden Content

      Download Hack
      • 79 replies
    • Galaxy Attack: Alien Shooter v5.12.13 [ +30++ Cheats ] Currency Max
      Modded/Hacked App: Galaxy Attack: Alien Shooter By DINO GAME LIMITED
      Bundle ID: com.alien.shooter.galaxy.attack
      iTunes Store Link: https://apps.apple.com/us/app/galaxy-attack-alien-shooter/id1176011642?uo=4
       

      🚀 Hack Features

      - ADS NO [ Rewards Free ]

      - Gems [ Linked With Battle Pass ]

      - Gold [ Linked With Battle Pass ]

      - Chest [ Linked With Battle Pass ]

      - Monthly Card Normal

      - Monthly Card Super

      - Monthly Card Premium

      - Energy NO Need [ When 0 Play Unlimited ]

      - Evolve Stone

      - Unlimited Ship [ Select Any Ship Before The Battle ]

      - Drone Ticket

      - Terminator Point

      - Tech Point

      - Overload Ball

      - Matrix Max

      - Golden Revive Max

      - Revive Unlimited

      - Campain Revive Cost Gold [ Earn With Gold ]

      - Gems Revive  [Earn With Gems ]

      - Endless Revive Cost Gold [Earn With Gold ]

      - Talent Upgrade Cost  [Earn With Gold ]

      - Battle Pass Premium Active

      - BP Free [ Claim Unlimited ]

      - BP Premium [ Claim Unlimited ]

      - BP Free Rewards Unlimited [ Gold Gems Chest Stone + More ]

      - BP Premium Rewards Unlimited [ Gold Gems Chest Stone + More ]

      - Bullet Max

      - Life Max

      - Damage

      Warning 


      Don"t Abuse The Hack In Case Banned Any Data Lose I'M Not Responsible  

       

      🍏 For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/forum/79-no-jailbreak-section/
      🤖 Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      • 77 replies
    • Galaxy Attack: Alien Shooter v5.12.13 [ +30++ Jailed ] Currency Max
      Modded/Hacked App: Galaxy Attack: Alien Shooter By DINO GAME LIMITED
      Bundle ID: com.alien.shooter.galaxy.attack
      iTunes Store Link: https://apps.apple.com/us/app/galaxy-attack-alien-shooter/id1176011642?uo=4

       

       

      🔧 Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      🚀 Hack Features

      - ADS NO [ Rewards Free ]

      - Gems [ Linked With Battle Pass ]

      - Gold [ Linked With Battle Pass ]

      - Chest [ Linked With Battle Pass ]

      - Monthly Card Normal

      - Monthly Card Super

      - Monthly Card Premium

      - Energy NO Need [ When 0 Play Unlimited ]

      - Evolve Stone

      - Unlimited Ship [ Select Any Ship Before The Battle ]

      - Drone Ticket

      - Terminator Point

      - Tech Point

      - Overload Ball

      - Matrix Max

      - Golden Revive Max

      - Revive Unlimited

      - Campain Revive Cost Gold [ Earn With Gold ]

      - Gems Revive  [Earn With Gems ]

      - Endless Revive Cost Gold [Earn With Gold ]

      - Talent Upgrade Cost  [Earn With Gold ]

      - Battle Pass Premium Active

      - BP Free [ Claim Unlimited ]

      - BP Premium [ Claim Unlimited ]

      - BP Free Rewards Unlimited [ Gold Gems Chest Stone + More ]

      - BP Premium Rewards Unlimited [ Gold Gems Chest Stone + More ]

      - Bullet Max

      - Life Max

      - Damage

      Warning 


      Don"t Abuse The Hack In Case Banned Any Data Lose I'M Not Responsible 


      🍏 Jailbreak iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      🤖 Modded Android APKs: https://iosgods.com/forum/68-android-section/

       

      📥 iOS Hack Download IPA Link


      Hidden Content

      Download via the iOSGods App
      • 61 replies
    • Galaxy Attack Alien Shooter v5.12.13 [ +3 Jailed ] Never Die
      Modded/Hacked App: Galaxy Attack: Alien Shooter By DINO GAME LIMITED
      Bundle ID: com.alien.shooter.galaxy.attack
      iTunes Store Link: https://apps.apple.com/us/app/galaxy-attack-alien-shooter/id1176011642?uo=4


      Hack Features:
      - Max Bullet
      - Max Life
      - DMG



      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 58 replies
    • Galaxy Attack Alien Shooter v5.12.13 [ +3 Cheats ] Never Die
      Modded/Hacked App: Galaxy Attack: Alien Shooter By ABIGAMES PTE. LTD
      Bundle ID: com.alien.shooter.galaxy.attack
      iTunes Store Link: https://apps.apple.com/us/app/galaxy-attack-alien-shooter/id1176011642?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - Max Life 
      - Damage Multi [PvP Use Only Boss ] 
      - Max Bullet



      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download Link:

      Hidden Content

      Download Hack
      • 208 replies
    • [ GrandChase TW] 永恆冒險 Cheats v1.91.2 +3
      Modded/Hacked App: 永恆冒險 By HaoPlay Limited
      Bundle ID: tw.txwy.ios.grandchase
      iTunes Store Link: https://apps.apple.com/tw/app/%E6%B0%B8%E6%81%86%E5%86%92%E9%9A%AA/id1434266148?uo=4


      Hack Features:
      - Multiply Attack
      - Multiply Defense
      - Instant Skills
      - Weak Enemies


      ViP Non-Jailbroken Hack: https://iosgods.com/topic/167594-grandchase-tw-%E6%B0%B8%E6%81%86%E5%86%92%E9%9A%AA-v1744-jailed-cheats-2/


      iOS Hack Download Link: https://iosgods.com/topic/144913-grandchase-tw-%E6%B0%B8%E6%81%86%E5%86%92%E9%9A%AA-cheats-v1812-3/
      • 150 replies
    • [Grandchase KR] 그랜드체이스 Cheats v1.92.3 +3
      Modded/Hacked App: 그랜드체이스 By KOG co., Ltd
      Bundle ID: com.kakaogames.grdchase
      iTunes Store Link: https://apps.apple.com/kr/app/%EA%B7%B8%EB%9E%9C%EB%93%9C%EC%B2%B4%EC%9D%B4%EC%8A%A4/id1312734855?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Multiply Attack
      - Multiply Defense
      - Instant Skills

       

      Non-Jailbroken Hack: https://iosgods.com/topic/106254-grandchase-kr-%EA%B7%B8%EB%9E%9C%EB%93%9C%EC%B2%B4%EC%9D%B4%EC%8A%A4-v1872-weak-enemies-more/

       

      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/132809-grandchase-kr-%EA%B7%B8%EB%9E%9C%EB%93%9C%EC%B2%B4%EC%9D%B4%EC%8A%A4-cheats-v1882-3/
      • 145 replies
    • Groove Journey v5.0.0 Jailed Mod +1
      Modded/Hacked App: Groove Journey By Somtochukwu Mbala
      Bundle ID: com.kaipha.groovejourney
      iTunes Store Link: https://apps.apple.com/us/app/groove-journey/id6736345547?uo=4


      Hack Features:
      - PREMIUM


      iOS Hack Download IPA Link: https://iosgods.com/topic/190862-groove-journey-v311-jailed-mod-1/
      • 107 replies
    • MARVEL Contest of Champions v51.1.1 +11++ Amazing Cheats!
      Modded/Hacked App: MARVEL Contest of Champions By Kabam
      Bundle ID: com.kabam.marvelbattle
      iTunes Link: https://itunes.apple.com/us/app/marvel-contest-of-champions/id896112560?mt=8&uo=4&at=1010lce4


      Hack Features
      - Enemy/AI Doesn't Attack
      - Special Attack/Skill Always Available
      - No Knockbacks When Hit
      - No Knockdowns When Hit
      - Enemy Doesn't Block
      - Auto Win - Whoever Attacks first, loses. Disable AI Doesn't Attack for this to work.
      - One Hit Kill / High Damage - Linked. Attack first or use with Enemy Doesn't Attack.

      Non-Jailbroken version of this hack: https://iosgods.com/topic/44075-marvel-contest-of-champions-v1311-2-cheats-for-jailed-devices/
      • 3,510 replies
    • Caveman Life v1.0.2 Cheat Menu [+5 Cheats]
      Modded/Hacked App: Caveman Life By 24 HIT Riga SIA
      Bundle ID: com.prehistoric.dude
      iTunes Store Link: https://apps.apple.com/us/app/caveman-life/id6739502478?uo=4


       

      🤩 Hack Features

      - Cheat Menu (Enable and hold setting button until cheat menu appear. Password is : 2424)
       
      • 4 replies
    • Caveman Life v1.0.2 Cheat Menu [+5 Jailed Cheats]
      Modded/Hacked App: Caveman Life By 24 HIT Riga SIA
      Bundle ID: com.prehistoric.dude
      iTunes Store Link: https://apps.apple.com/us/app/caveman-life/id6739502478?uo=4



      🤩 Hack Features

      - Cheat Menu (Enable and hold setting button until cheat menu appear. Password is : 2424)

       
      • 3 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines