DIY Hack Critical Strike - DIY Offsets

[Endrit1020 1 iPad Air 2 14.8]

Critical Strike - DIY Offsets

Quote

The offsets are outdated please look at the bottom of this post on how to get newer ones. also, please use theos

Modded/Hacked App: Critical Strike CS: Online FPS By VERTIGOGAMES OU
Bundle ID: com.vertigo.criticalforce
App Store Link: https://apps.apple.com/us/app/critical-strike-cs-online-fps/id1467648713?uo=4

Version: 14.1003

Decrypt using https://armconverter.com/ or https://decrypt.day/ if armconverter doesnt have the version.

Here are offsets for Critical Strike, all are RVAs (relative-virtual-addresses so you will need to calculate them within the base address like this to get the absolute address to hook:

  uintptr_t get_image_base(const char* image_name) {
        uint32_t count = _dyld_image_count();
        for (uint32_t i = 0; i < count; i++) {
            const char* name = _dyld_get_image_name(i);
            if (name && strstr(name, image_name)) {
                const struct mach_header_64* header = (struct mach_header_64*)_dyld_get_image_header(i);
                return (uintptr_t)header;
            }
        }
        return 0;
    }
    
    uintptr_t getAbsoluteAddressFromRVA(const char* imageName, uintptr_t rva) {
        uintptr_t base = get_image_base(imageName);
        if (base) {
            return base + rva;
        }
        return 0;
    }

Lets get straight to it:

Disabling Ads:

- use NextDNS/AdguardDNS .mobileconfig file to disable the ads, you can tell users to install it aswell.

ESP:

Instead of having issues making your ESP, use https://github.com/xS3Cx/IOS-ESP-AutoUpdate it comes with IMGUI aswell so you can start your menu with it, normally you need to change the ESPConfig.h but somehow the Skeleton ESP works perfectly for critical strike, showing lines and distance is more complicated you'll have to find the PlayerClass (use dnspy & il2cppdumper)

Spoiler

Binary: /Frameworks/UnityFramework.framework/UnityFramework

Tested Offsets: (Works)

0x2087F8 (DamageModifier Getter)

0x207948 (SpeedModifier Getter)

0x2073CC (ReloadTimeModifier Getter)

Untested Offsets:

0x202E64 (IsDead Getter)

0x2099AC (Health Getter)

0x2099BC (Armor Getter)

This version is outdated though, you might want new offsets but i cannot provide them right now, so use il2cppdumper to dump the newer .ipa, then use DNSpy to search Methods. Look for UnityEngine.CharacterController for Character Modification Offsets, and in PlayerStats for Damage Modifier, ReloadTimeModifier getter and more, then use those RVA offsets.