Help/Support Any guidance for modifying IPA with non-jailbreak device

kitykathy · July 22

Hi everyone,

I am curious about learning how to hack game, and i have IPA of that game in game. I dont have any jail broken device, where can i start? Thank you.

Laxus · July 22

@Cashlaz mayhe can help, he modding using his non-jb device only which is insane

Cashlaz · July 22

4 hours ago, kitykathy said:

Hi everyone,

I am curious about learning how to hack game, and i have IPA of that game in game. I dont have any jail broken device, where can i start? Thank you.

If you're interested in learning how to hack or reverse engineer iOS games without a jailbroken device, you can start by unpacking the IPA file and checking if the game uses IL2CPP (Unity game). Unity games are easy to start. For IL2CPP games, use IL2CPP Dumper to extract metadata and analyze it with tools like IDA, Ghidra or DnSpy. You can also use Frida for dynamic hooking or Theos Jailed to create tweaks on non-jailbroken devices. Once modified, sideload the IPA back to your device using tools like Sideloadly.

Aizen · July 22

5 hours ago, Cashlaz said:

If you're interested in learning how to hack or reverse engineer iOS games without a jailbroken device, you can start by unpacking the IPA file and checking if the game uses IL2CPP (Unity game). Unity games are easy to start. For IL2CPP games, use IL2CPP Dumper to extract metadata and analyze it with tools like IDA, Ghidra or DnSpy. You can also use Frida for dynamic hooking or Theos Jailed to create tweaks on non-jailbroken devices. Once modified, sideload the IPA back to your device using tools like Sideloadly.

can we patch offset directly from dump.cs or IDA pro in live offset patcher , for some reason its not working for me
just wanna confirm if it works or not, most of the time RVA and offset in dump.cs are saem so can we patch that directly in live offset patcher or no

Cashlaz · July 22

1 minute ago, Aizen_ said:

can we patch offset directly from dump.cs or IDA pro in live offset patcher , for some reason its not working for me
just wanna confirm if it works or not, most of the time RVA and offset in dump.cs are saem so can we patch that directly in live offset patcher or no

You can but live offset patcher require JIT enabled. I didn’t used though.

Aizen · July 22

1 minute ago, Cashlaz said:

You can but live offset patcher require JIT enabled. I didn’t used though.

Yeah for soem strange reasons last time static patching worked for me but live offset didnt
anyway thanks for the reply cash

kenzusik · August 1

On 22.07.2025 at 21:24, Aizen_ said:

Yeah for soem strange reasons last time static patching worked for me but live offset didnt
anyway thanks for the reply cash

App keeps crashing when I patch with the IDA offset.
You know any fix for this?

Updated August 1 by kenzusik

Aizen · August 1

1 hour ago, kenzusik said:

App keeps crashing when I patch with the IDA offset.
You know any fix for this?

that because u may have patched it at the wrong place , patching things that is essential for game to run so thats why its crashing

1 hour ago, kenzusik said:

App keeps crashing when I patch with the IDA offset.
You know any fix for this?

+ yoi cannot just patch anywhere it will casue crash

kenzusik · August 2

10 hours ago, Aizen_ said:

that because u may have patched it at the wrong place , patching things that is essential for game to run so thats why its crashing

+ yoi cannot just patch anywhere it will casue crash

I'm not patching random stuff — I'm specifically patching the DreamBlast.Inventory::GetCoins function

Here’s how it looks in IDA:

il2cpp:0000000001ADA504 ; DreamBlast.Inventory::GetCoins
il2cpp:0000000001ADA504                 SUB     SP, SP, #0x40
il2cpp:0000000001ADA508                 STP     X22, X21, [SP,#0x30+var_20]
il2cpp:0000000001ADA50C                 STP     X20, X19, [SP,#0x30+var_10]
...
il2cpp:0000000001ADA5B0                 RET

It just returns the coin count using GetItemCount and Mathf.Max

I try to patch it like this

MOV     W0, #99999
RET

Or in hex:

20 0B 80 D2   ; MOV W0, #99999
C0 03 5F D6   ; RET

But after patching, the app immediately crashes. The address is correct, and I’m only replacing the start of the function

Aizen · August 2

27 minutes ago, kenzusik said:
I'm not patching random stuff — I'm specifically patching the DreamBlast.Inventory::GetCoins function

Here’s how it looks in IDA:
il2cpp:0000000001ADA504 ; DreamBlast.Inventory::GetCoins
il2cpp:0000000001ADA504                 SUB     SP, SP, #0x40
il2cpp:0000000001ADA508                 STP     X22, X21, [SP,#0x30+var_20]
il2cpp:0000000001ADA50C                 STP     X20, X19, [SP,#0x30+var_10]
...
il2cpp:0000000001ADA5B0                 RET
It just returns the coin count using GetItemCount and Mathf.Max

I try to patch it like this
MOV     W0, #99999
RET
Or in hex:
20 0B 80 D2   ; MOV W0, #99999
C0 03 5F D6   ; RET
But after patching, the app immediately crashes. The address is correct, and I’m only replacing the start of the function

Your game is crashing because of the way you patched the function. The instruction you used:

MOV W0, #99999
RET

doesn’t work for values bigger than 65535 on ARM64. MOV W0, #imm can only handle 16‑bit immediates, so when you put 99999, the instruction isn’t encoded properly and the app blows up when it runs.

If you want to force it to return 99999, you need to build that value in two steps using MOVZ and MOVK, like this:

MOVZ W0, #34463 ; lower 16 bits of 99999 (0x869F)
MOVK W0, #1, LSL #16 ; upper bits
RET

something like this i think