Help/Support Libspecter's inline hooking crashing

fr3shworks · May 26

Hi im using Batchh's libspecter, but when i try to inline hook it crashes me. Idk why and iOS Didnt provide crash logs

Im jailed too, BRK Hooks work but I need to call orig functions on some methods

void *BasicHacks::HacksThread(void *arg) {

(void)arg;

mem_init("UnityFramework", NULL);

uintptr_t unityBase = GetImageBase("UnityFramework");

if (!unityBase) {

return nullptr;

}

uintptr_t recoilAddr =

Offsets::Weapon::addRecoil;

uint64_t handle;

uintptr_t trampoline;

mem_hook_install(Offsets::Weapon::addRecoil, (uintptr_t)hook_AddRecoil, &trampoline, &handle);

orig_AddRecoil = (AddRecoil_t)trampoline;

return nullptr;

}

@BatchCan you help me out?

Batch · May 26

Ye that expected behaviour for jailed, inline hooks crashes because of sandbox policy. The best way to do this is using breakpoints, and to call origin function you need to suspend and resume, but it seems i forgot to expose to the APIs, updating now! thanks for the report

Also for these issues it's best if you open a issue in github https://github.com/Batchhh/libspecter/issues because i can miss notification here, i get too many ahah

Batch · May 26

https://github.com/Batchhh/libspecter/releases/tag/v1.0.6 Download latest and then you can do something like:

using AddRecoil_t = void (*)(void *self, float amount);

static uint64_t g_addRecoilBrk = 0;
static AddRecoil_t orig_AddRecoil = nullptr;

void hook_AddRecoil(void *self, float amount) {
    if (orig_AddRecoil) {
        CHECK(mem_brk_suspend_self());
        orig_AddRecoil(self, amount);
        CHECK(mem_brk_resume_self());
    }
}

void install() {
    CHECK(mem_init("UnityFramework", nullptr));

    CHECK(mem_brk_install(0x123,
                          reinterpret_cast<uintptr_t>(hook_AddRecoil),
                          &g_addRecoilBrk));

    uintptr_t absolute = 0;
    CHECK(mem_brk_target(g_addRecoilBrk, &absolute));
    orig_AddRecoil = reinterpret_cast<AddRecoil_t>(absolute);
}