TuT [Tutorial] How to Hack with MSHook (new way)

February 3, 2015

Hello everybody, this is shmoo with his first tutorial on hacking. I prefer this way over regular MS hacking and sub_x hacking because it is not too easy or too hard. This is an updated way of hacking with MSHook, meaning it is less tedious than the regular way. Assuming you already have everything installed (theos, an sdk, etc), that you know how to crack iOS games, know what bool's, int's, etc. are, and create a new project with NIC, we can begin. If you are just starting out hacking, start with regular MobileSubstrate, there are many tutorials on this forum.

I will be using Real Racing 3 for this tutorial.

First of all, you will need Clutch Beta (version 1.4.7-2) from the insanelyi repo. I use this because it won't give you the Trace/BPT trap error, and that it only packages the cracked binary, and nothing else. Now we can move on to actually doing it

Hidden Content

Instructions:

1. Load the binary into IDA Pro. (duh)

2. Finding the thing to hack.

Once it is loaded, you should see a functions window to your left. You can keep it there, or you can drag it next to "exports" for a better view.

Right click and create a quick filter:

Now, search for the thing that you want to hack, no need to press enter. In my case, it will be money.

You should get a lot of results, but this will vary on your game. Double click on the result that you think will be the correct one to hack.

Here is the function:

And here it is when I double click on it.

This will be the thing you want to hack. It is __ZN10Characters5Money8GetValueEv. You can click on it and do a ctrl + c to copy it.

3. Putting everything together in your Tweak.xm

In your Tweak.xm, copy and paste this template into it.

%ctor{
MSHookFunction(((void*)MSFindSymbol(NULL, "")),(void*), NULL);
}

Something you should know about this way of hacking with MSHook: you don't change the void's to anything else. Just keep them as void's no matter what.

This way of hacking with MSHook will allow you to have much less text in your Tweak.xm, and you can also name the functions to what you want. Here is where everything will go:

%ctor{
MSHookFunction(((void*)MSFindSymbol(NULL, "the thing that you are hacking will go here")),(void*)your function name goes here, NULL);
}

The finished result of the template should look like this:

%ctor{
MSHookFunction(((void*)MSFindSymbol(NULL, "__ZN10Characters5Money8GetValueEv")),(void*)getMoney, NULL);
}

That's not all, we have to override the thing that we are hacking. With this method, void's can be overridden like an int, bool, etc. So above the %ctor, put this:

int getMoney()
{
return 9999;
}

VERY IMPORTANT: Above everything else in your Tweak.xm, put this:

#include <substrate.h>

Once you are done, your finished Tweak.xm should look like this:

#include <substrate.h>

int getMoney()
{
return 9999;
}

%ctor{
MSHookFunction(((void*)MSFindSymbol(NULL, "__ZN10Characters5Money8GetValueEv")),(void*)getMoney, NULL);
}

And you are good to compile! Good luck

KNOWN PROBLEMS:

If you get an error like this:

Go to this thread: http://iosgods.com/topic/1986-use-of-undeclared-identifier-msfindsymbol/#entry23807 and use CosnotraLF's solution (you should see it right after you click the link, don't scroll down)

If you are following my tutorial and using Real Racing 3 just like I am, you need to add

ARCHS = armv7 arm64

at the top of your Makefile because it just occurred to me that Real Racing 3 has an arm64 portion of the code now, and if you don't add that, your hack will not work.

See how much simpler it is? Much cleaner also. This method of hacking can be as good as sub_x, also