Help/Support Code Injection doesn't work, except credit popup.

Ted2 · May 4, 2017

Heyyy it's me again..

I used this tutorial also: https://www.dropbox.com/s/y3rcskg8uigt5lm/IDA PRO Code Inject Tutorial.pdf?dl=0

I'm kind of practicing to work with IDA on Pou,

So I figured out how to hack some functions by editing the binary using a hex editor.

Now I wanted to try to make a code injection tweak out of it.

The function is:

; Coins - (int)have
__text:0003EBD4 ; Attributes: bp-based frame
__text:0003EBD4
__text:0003EBD4 ; int __cdecl -[Coins have](struct Coins *self, SEL)
__text:0003EBD4 __Coins_have_                           ; DATA XREF: __objc_const:0045C890o
__text:0003EBD4                 PUSH            {R4-R7,LR}
__text:0003EBD6                 ADD             R7, SP, #0xC
__text:0003EBD8                 MOV             R4, R0
__text:0003EBDA                 MOV             R0, #(_OBJC_IVAR_$_Coins.given - 0x3EBEA) ; int given;
__text:0003EBE2                 MOVW            R1, #:lower16:(selRef_collected - 0x3EBF0)

well the function is longer, but in the hex editor I changed

 ; Coins - (int)have
__text:0003EBD4 ; Attributes: bp-based frame
__text:0003EBD4
__text:0003EBD4 ; int __cdecl -[Coins have](struct Coins *self, SEL)
__text:0003EBD4 __Coins_have_                           ; DATA XREF: __objc_const:0045C890o
__text:0003EBD4                 PUSH            {R4-R7,LR}
__text:0003EBD6                 ADD             R7, SP, #0xC

TO:
 ; Coins - (int)have
__text:0003EBD4 ; Attributes: bp-based frame
__text:0003EBD4
__text:0003EBD4 ; int __cdecl -[Coins have](struct Coins *self, SEL)
__text:0003EBD4 __Coins_have_                           ; DATA XREF: __objc_const:0045C890o
__text:0003EBD4                 MOV            R0,R7
__text:0003EBD6                 BX LR

This worked.

So the HEX Offsets I need are

0003ebd4 & 0003ebd6

Right?

So what I did in my tweak.xm was:

%ctor {
	if(GetPrefBool(@"key1")) {
		writeData(0x3ebd4, 0x38467047);
		writeData(0x3ebd6, 0x7047);
	} else {
}

It had no effect, however I got the credit popup which is automaticly added in the tweak.xm

So after that I tried this, which didn't make sense to me since the BX LR had another hex adress

%ctor {
	if(GetPrefBool(@"key1")) {
		writeData(0x3ebd4, 0x38467047);
	} else {
}

}

but this didn't work either..

It doesn't make any sense I try this on Pou, since this can be hooked too,

but for me it's just practicing & playing around lol

Someone knows what the problem can be?

Am I doing something wrong?

Thankyou in advance!

Rook · May 4, 2017

Seems like you only hacked armv7 and likely didn't think your binary.

If the Pou binary has both armv7 & arm64, you'll likely need to integrate armv7 binary into your deb so it automatically thins it.

According to your profile fields, your iPhone 6s is loading the arm64 portion. But you only hacked armv7 portion so that's why you need to thin it.

Ted2 · May 4, 2017

2 minutes ago, DiDA said:

Seems like you only hacked armv7 and likely didn't think your binary.

If the Pou binary has both armv7 & arm64, you'll likely need to integrate armv7 binary into your deb so it automatically thins it.

According to your profile fields, your iPhone 6s is loading the arm64 portion. But you only hacked armv7 portion so that's why you need to thin it.

I did thin the binary to armv7 using shmoo's tutorial about 'How to perform a Binary patch'

edit: you're right.. I redownloaded because otherwise it would've loaded my hacks still into it. Sh*t man, lol sorry.. I feel so stupidd

My bad & thankyou for helping

Ted2 · May 4, 2017

7 minutes ago, DiDA said:

Seems like you only hacked armv7 and likely didn't think your binary.

If the Pou binary has both armv7 & arm64, you'll likely need to integrate armv7 binary into your deb so it automatically thins it.

According to your profile fields, your iPhone 6s is loading the arm64 portion. But you only hacked armv7 portion so that's why you need to thin it.

ehmm, it still doesn't work.. I've defenitly thinned it this time