Jump to content

5 posts in this topic

Recommended Posts

Posted

So, I like so start with thanks @arthurdapaz  and @shmoo for the detail TuT on how to start Cydia Substrate journey

I am now able to build deb, get it running and get the UI, the next step is of course, try on real game. 

For a game I am trying to start, I know what I want to change at HeX editor, and noticed there seems to be some pre-fix there so the actual offset at binary should minus 0x4000

 

__text:0094083C _Equipment_get_Attack_m171674799 ; CODE XREF: _AutoEquipLogic_GetAutoEquip_m241924269+3C6�p
__text:0094083C ; _AutoEquipLogic_GetAutoEquip_m241924269+3DC�p ...
__text:0094083C 00 6C LDR R0, [R0,#0x40]
__text:0094083E 70 47 BX LR
__text:0094083E ; End of function _Equipment_get_Attack_m171674799

 

The offset on IDA appeared as 0094083C but the actual offset at HxD is 0x93C83C, and I tried to change it to 58 46

On @arthurdapaz's template, I write it like this

    NSDictionary *hacks =
    @{
        @"k01BasicSwitcher":@{
            @"offsets": @[@"0x93C83C"],
            @"orig":    @[@"0x006C"],
            @"patched": @[@"0x5846"],
            @"desc": @"God Power",
            @"label": @"God Power"
            },

    };

The result is game crash.. :wallbash:

 

Can I get some love and please let me know where went wrong? 

The original Tweak.xm attached. 
 

#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>

/*
// 
// You can use: [mm getFloat:@"SOME HACK KEY"];
// You can use: [mm getBool:@"SOME HACK KEY"];
// 
// For customizing the hack inside your hooks
// see an example below:
// 
// EXAMPLE OF HOOK FUNCTIONS
// THAT GETS THE VALUE DEFINED
// OF AN INTERFACE "KEY" ELEMENT
   

float (*orig_func)(void *self);

float new_func(void *self)
{
    float newValue = [mm getFloat:@"aSliderKey"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}

*/


%ctor
{
    // the mod menu core
    mm = [APMenu sharedInstance];

    // a writeData.h rewritten to my APMenu
    mp = [MemoryPatcher sharedInstance];

    NSDictionary *hacks =
    @{
        @"k01BasicSwitcher":@{
            @"offsets": @[@"0x0093C83C"],
            @"orig":    @[@"0x006C"],
            @"patched": @[@"0x5846"],
            @"desc": @"God Power",
            @"label": @"God Power"
            },

    };


    // HERE IS WHERE ALL THE FUN BEGINS :)
    [mm init:hacks
                openAfter: 1                                                                          // seconds (I like to use average game loading time)               (OBLIGATORY)
                    width: 260                                                                        // width in pixels                                                 (OBLIGATORY)
        maxVisibleToggles: 5                                                                          // only shows N first hacks, the others needs to be scrolled       (OBLIGATORY)
                    theme: rgb(0xbef7d9)                                                              // the main color for you hack menu (you can use any color :)      (OBLIGATORY)
                    title: @"MY VALANTFORCE GAME HACK"                                                            // your hack titlebar text upper case is better :) (OBLIGATORY)
                    credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"     // pretty self explicative, no? (Leave @"" for empty)
                    creditsURL: nil                                                                        // a URL for the user to visit on credits menu screen @"http://www.myblog.com" or simple: nil

                // CHOOSE YOUR INTERFACE TOGGLE GESTURE
                // APGestureTwoFingerTap
                // APGestureThreeFingerTap
                // APGestureFourFingerTap
                // APGestureTwoFingerSwipeUp
                // APGestureTwoFingerSwipeDown
                // APGestureTwoFingerSwipeLeft
                // APGestureTwoFingerSwipeRight
                // APGestureThreeFingerSwipeUp
                // APGestureThreeFingerSwipeDown
                // APGestureThreeFingerSwipeLeft
                // APGestureThreeFingerSwipeRight
                  gesture: APGestureThreeFingerTap
            onFirstLaunch:^{

            // this method listens to Mod Menu controller changes
            // and gets it's values according to the type of
            // UIControl you are dealing with
            // if you don't need this, just comment or remove these lines
            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                    /* SIMPLE EXAMPLE OF USING THIS
                        switch (value)
                        {
                            case 1:
                                [mp write:0xbadf00d data:0xf33dbac];
                            break;

                            case 2:
                                [mp write:0xbadf00d data:0xf33dbac];
                            break;

                            ...
                        }
                    */
                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;

                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];


        /* DO SOMETHING AFTER HACK INTERFACE LAUNCH 
        designed for customized hooks or you can popup an alert to warn the user
        that hack is already active and maybe send an UIAlertControl informing Gesture you have used
        

        ******** THIS IS HOW TO HOOK
        ******** (if you need hooking some internal function):
        ********
        ******** MSHookFunction((void*)[mp calculateAddress:0xb4df00d], (void*)new_func, (void**)&orig_func);
        ********
        ******** Please, notice that new_func and orig_func are declared at
        ******** the top of the file (before %ctor)

        */

        NSLog(@"Initialized");
    }];
}

 

Posted

You're supposed to use 94083C and not the HEX editor offset. :)

So, +0x4000

Posted (edited)

Firsts things first:

1) Crack the binary
2) Remove the ASLR protection

Doing that you're dealing with "real" offsets instead of shifted ones.

It crashes because you patching some offset with some unaccepted or not contextualized ARM instruction. You need understand assembler basics to avoid this crashes on researching for hacks!

Use GDB / GamePlayer / GameGem / iGameGuardian for start, and you will get some real offsets to play with

 

 

 

__text:0094083C _Equipment_get_Attack_m171674799 ; CODE XREF: _AutoEquipLogic_GetAutoEquip_m241924269+3C6�p

PRO TIP: you don't need to use OFFSETS if it's an Objective C exposed function. You can hook it directly:

MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);

 

Now, if you only want to patch this function, work with the offset IDA shows you (it's already shifted +0x4000, it is a default shifting for iOS apps mostly)

Updated by arthurdapaz
Posted

@DiDA   Thank you for help out.. I am still learning all this MSHook stuff.. 

@arthurdapaz

thanks!  The more I study the less I know.. ;(.. Do you mind

 

1. Take a look of my Tweak.xm and see if I understand  this correctly?  Cause it still crash when I try to enter the battle.

2. If you can share a living sample of Tweak.xm that got your widget and its hacking code? (this will helps much better)

3. Lastly.. where to see NSLog?  :sad:

#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>


float (*orig_func)(void *self);

float new_func(void *self)
{
    float newValue = [mm getFloat:@"k05SimpleUiSlider"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}




%ctor
{

    mm = [APMenu sharedInstance];
    mp = [MemoryPatcher sharedInstance];

    NSDictionary *hacks =
    @{

        @"k05SimpleUiSlider":@{
            @"type": @"modslider",
            @"typecfg": @{
                    @"minimumValue":@0,
                    @"maximumValue":@99999
                },
            @"desc": @"Normal UI Slider",
            @"label": @"Normal UI Slider"
            },
    };

    [mm init:hacks
                openAfter: 1                                                                          
                    width: 260                                                                        
        maxVisibleToggles: 5                                                                          
                    theme: rgb(0xbef7d9)                                                              
                    title: @"MY VALANTFORCE GAME HACK"                                                
					credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"     
					creditsURL: nil                                                             
					gesture: APGestureThreeFingerTap	
				onFirstLaunch:^{

            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;

                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];


		MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);
        NSLog(@"Initialized");
    }];
}

 

Posted

I will answer myself so if anyone meet similar questions like I do, you can get some lights here. Still million appreciation to @arthurdapaz and @DiDA. Could not done this without your TuT and guide

 

Q: NSLog, where to read and how?

A:  Install ondeviceconsole on Cydia, SSH in and run command 

Q: So how the code goes that make it works?
#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>
float (*orig_func)(void *self);
float new_func(void *self)
{
    float newValue = [mm getFloat:@"k05SimpleUiSlider"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}
%ctor
{
    mm = [APMenu sharedInstance];
    mp = [MemoryPatcher sharedInstance];
    NSDictionary *hacks =
    @{

        @"k05SimpleUiSlider":@{
            @"type": @"modslider",
            @"typecfg": @{
                    @"minimumValue":@0,
                    @"maximumValue":@99999
                },
            @"desc": @"God Power",
            @"label": @"Normal UI Slider"
            },
    };
    [mm init:hacks
					openAfter: 1 
                    width: 260
					maxVisibleToggles: 5
                    theme: rgb(0xbef7d9)
                    title: @"MY GAME HACK"
					credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"
					creditsURL: nil

                  gesture: APGestureThreeFingerTap
		onFirstLaunch:^{
            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;
                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];

		MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);
        NSLog(@"Initialized");
    }];
}

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Bully: Anniversary Edition Cheats v1.4.1 +1 [ Dev Menu ]
      Modded/Hacked App: Bully: Anniversary Edition by Rockstar Games, Inc.
      Bundle ID: com.rockstargames.bully
      iTunes Store Link: https://apps.apple.com/us/app/bully-anniversary-edition/id1148321705?uo=4&at=1010lce4


      Hack Features:
      Jump to (will lose current progress)
      - Ability to jump to any Mission in-game. From Chapter 1 to Chapter 6.
      - Ability to jump to any Classes in-game. Art, Biology, Gym, Geography, Math, English, Chemistry, Music, Photography, Shop.
      - Ability to play any Minigames such as Arcade, Mowing House 1/2/3, Mowing Part 1/2/3, Paper Route Intro, Paper Route, Keep Ups, Penalty Shots, Bike Store & Tattoos.
      - Teleport to any location in-game. Asylum (Ouside), Blue Skies Industrial Part (Trailer Part), Bullworth Town (Outside), Carnival (Outside), New Coventry (Outside), Old Bullworth Gardens (Park), Old Bullworth Vale (Town), High Striker (Carnival Games), etc, etc. 
       
      Interrupt time-space continuum
      - Ability to Change Time.
      - Ability to Change Season. Summer, Fall, Winter, Spring.
      - Cycle Weather.
       
      Cheats
      - Toggle FPS (Display and Frames Per Second counter at the bottom of your screen).
      - Heal (Heal yourself).
      - Give Money (Give yourself unlimited money. The more you tap on this option the more money you will get).
      - Disable Crime
      - Give Bike
      - Invulnerability a.k.a God Mode / Never Die
      - Unlimited Sprint
      - Unlimited Ammo
      - Max Ammo
      - One Shot Kills
      - All Pranks
      - All Weapons
      - All Moves
      - All Grapples
      - All Clothing
      - Pass mission (Pass your current mission with success).
      - Fail mission (Fail your current mission).
       

      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/135424-bully-anniversary-edition-v11-jailed-cheats-1-debug-menu/


      iOS Hack Download Link: https://iosgods.com/topic/113583-bully-anniversary-edition-cheats-v11-1-dev-menu/
      • 1,321 replies
    • SimCity BuildIt Cheats v1.66.1 +1 [ Freeze Currencies ]
      Modded/Hacked App: SimCity BuildIt By EA Swiss Sarl
      Bundle ID: com.ea.simcitymobile.bv
      iTunes Store Link: https://apps.apple.com/us/app/simcity-buildit/id913292932?uo=4


      Hack Features:
      - Infinite Currencies


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/topic/124792-arm64-simcity-buildit-v1412-jailed-cheats-1/


      iOS Hack Download Link: https://iosgods.com/topic/157687-simcity-buildit-cheats-v1415-1/
      • 669 replies
    • Aqua Match Cheats v0.230.1 +5
      Modded/Hacked App: Aqua Match By PLR Worldwide Sales Limited
      Bundle ID: com.playrix.aquamatch
      App Store Link: https://apps.apple.com/us/app/aqua-match/id6502511364?uo=4

       

      📌 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Sileo, Cydia or Zebra).

       

      🤩 Hack Features

      - Freeze Moves
      - Freeze Life
      - Freeze Boosters
      - Freeze Coins
      - Freeze Gems



      ⬇️ iOS Hack Download Link: https://iosgods.com/topic/196699-aqua-match-cheats-v02301-5/
      • 2 replies
    • Star Wars™: Galaxy of Heroes Cheats v0.36.8 +8
      Modded/Hacked App: Star Wars™: Galaxy of Heroes By Electronic Arts
      Bundle ID: com.ea.starwarscapital.bv
      iTunes Link: https://itunes.apple.com/us/app/star-wars-galaxy-of-heroes/id921022358?mt=8&uo=4&at=1010lce4


      Mod Requirements
      - Jailbroken iPhone/iPad/iPod Touch.
      - iFile / Filza / iFunBox / iTools or any other file managers for iOS.
      - Cydia Substrate (from Cydia).
      - PreferenceLoader (from Cydia).


      Hack Features
      - No Skill Cooldown time / Skill Always Available. Linked with enemy. Enable when it's your turn, disable when it's enemies turn. Timing is key.
      - One Hit Kill / Very High Damage. This is linked with you and the enemy, use with Skip Enemy Turn feature or enable disable when you attack via the In-Game Mod Menu! Do not kill the last enemy with OHK otherwise the game will crash. This feature is only for x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.
      - Always Your Turn / Skip Enemy Turn. It's always your turn, you're always attacking.
      - Auto Win. You must use this with One Hit Kill in order for it to work. Kill 1 Enemy and you will auto win the battle.
      - Only 1 Encounter on All Missions.
      -- God Mode / Never Die thanks to the features above.

      This hack is now an In-Game Mod Menu. This means you can toggle switches on/off while in a fight. Since God Mode is linked, turn it off when you're attacking and turn it on when the enemy is attacking to do damage but not receive damage. Same goes for the other features.
      • 3,130 replies
    • Homematch - Home Design Games v2.17.2 +2 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Homematch - Home Design Games By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.homecraft
      iTunes Store Link: https://apps.apple.com/us/app/homematch-home-design-games/id1438898374?uo=4


      Hack Features:
      - Unlimited Coins
      - Unlimited Gems


      Jailbreak required hack(s): [Mod Menu Hack] Homematch - Home Design Games v1.92.3 +2 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 13 replies
    • Homematch - Home Design Games v2.17.2 +2 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Homematch - Home Design Games By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.homecraft
      iTunes Store Link: https://apps.apple.com/us/app/homematch-home-design-games/id1438898374?uo=4


      Hack Features:
      - Unlimited Coins
      - Unlimited Gems


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Homematch - Home Design Games v1.92.3 +2 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 7 replies
    • Hero's Adventure v1.2.117 +6 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Hero's Adventure By X.D. Network Inc.
      Bundle ID: com.xd.dxlzz.global
      iTunes Store Link: https://apps.apple.com/us/app/heros-adventure/id6711347049?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - Give All Items -> Head into Settings > Other and toggle the User Agreement button.
      - Unlock All Achievements -> Head into Settings > Other and toggle the Privacy Policy button.
      -- All DLC Purchased
      -- Guest Login Enabled
      • 140 replies
    • Hero's Adventure v1.2.117 +6 Cheats [ Damage & Defence ]
      Modded/Hacked App: Hero's Adventure By X.D. Network Inc.
      Bundle ID: com.xd.dxlzz.global
      iTunes Store Link: https://apps.apple.com/us/app/heros-adventure/id6711347049?uo=4

       
       

      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - Give All Items -> Head into Settings > Other and toggle the User Agreement button.
      - Unlock All Achievements -> Head into Settings > Other and toggle the Privacy Policy button.
      -- All DLC Purchased
      -- Guest Login Enabled
      • 31 replies
    • Pal Go: Tower Defense TD v0.3.86 [+7 Cheats]
      Modded/Hacked App: Pal Go: Tower Defense TD By Playwind Ltd
      Bundle ID: com.playwindgames.freedefender
      iTunes Store Link: https://apps.apple.com/us/app/pal-go-tower-defense-td/id6479316663?uo=4


       

      🚀 Hack Features

      - [VIP] Freeze Currency (Currency will not decrease when used)

      - [VIP] Currency Always Enough (Buy even when you don't have enough currency)

      - [Free] Higher Recruit Energy (Gives 500 Recruit Energy Every Wave)

      - [Free] Always Can Drag Hero

      - [Free] Skip Ads

      - [Free] No Attack Cooldown

      - [Free] Global Speed Multiplier (Enable Inside Battle)

       

      Warning


      Do not use on main account. There is a chance of ban. Not responsible for any bans.

       


      🍏 For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/forum/79-no-jailbreak-section/
      🤖 Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      • 54 replies
    • Pal Go: Tower Defense TD v0.3.86 [+7 Jailed Cheats]
      Modded/Hacked App: Pal Go: Tower Defense TD By Playwind Ltd
      Bundle ID: com.playwindgames.freedefender
      iTunes Store Link: https://apps.apple.com/us/app/pal-go-tower-defense-td/id6479316663?uo=4


       

      Hack Features

      - [VIP] Freeze Currency (Currency will not decrease when used)

      - [VIP] Currency Always Enough (Buy even when you don't have enough currency)

      - [Free] Higher Recruit Energy (Gives 500 Recruit Energy Every Wave)

      - [Free] Always Can Drag Hero

      - [Free] Skip Ads

      - [Free] No Attack Cooldown

      - [Free] Global Speed Multiplier (Enable Inside Battle)

       

      Warning


      Do not use on main account. There is a chance of ban. Not responsible for any bans.

       

      Jailbreak required iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APKs: https://iosgods.com/forum/68-android-section/
      • 79 replies
    • Exfil: Loot & Extract v6.1.1 Debug Menu [+10 Cheats]
      Modded/Hacked App: Exfil: Loot & Extract By Kwalee Ltd
      Bundle ID: com.eightsec.roguehero
      iTunes Store Link: https://apps.apple.com/us/app/exfil-loot-extract/id6448720577?uo=4


       

      🤩 Hack Features

      - Debug Menu (Enable and debug menu will appear)
       
      • 18 replies
    • Exfil: Loot & Extract v6.1.1 Debug Menu [+10 Jailed Cheats]
      Modded/Hacked App: Exfil: Loot & Extract By Kwalee Ltd
      Bundle ID: com.eightsec.roguehero
      iTunes Store Link: https://apps.apple.com/us/app/exfil-loot-extract/id6448720577?uo=4

       

      🤩 Hack Features

      - Debug Menu (Enable and debug menu will appear)
      • 18 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines