Jump to content

5 posts in this topic

Recommended Posts

Posted

So, I like so start with thanks @arthurdapaz  and @shmoo for the detail TuT on how to start Cydia Substrate journey

I am now able to build deb, get it running and get the UI, the next step is of course, try on real game. 

For a game I am trying to start, I know what I want to change at HeX editor, and noticed there seems to be some pre-fix there so the actual offset at binary should minus 0x4000

 

__text:0094083C _Equipment_get_Attack_m171674799 ; CODE XREF: _AutoEquipLogic_GetAutoEquip_m241924269+3C6�p
__text:0094083C ; _AutoEquipLogic_GetAutoEquip_m241924269+3DC�p ...
__text:0094083C 00 6C LDR R0, [R0,#0x40]
__text:0094083E 70 47 BX LR
__text:0094083E ; End of function _Equipment_get_Attack_m171674799

 

The offset on IDA appeared as 0094083C but the actual offset at HxD is 0x93C83C, and I tried to change it to 58 46

On @arthurdapaz's template, I write it like this

    NSDictionary *hacks =
    @{
        @"k01BasicSwitcher":@{
            @"offsets": @[@"0x93C83C"],
            @"orig":    @[@"0x006C"],
            @"patched": @[@"0x5846"],
            @"desc": @"God Power",
            @"label": @"God Power"
            },

    };

The result is game crash.. :wallbash:

 

Can I get some love and please let me know where went wrong? 

The original Tweak.xm attached. 
 

#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>

/*
// 
// You can use: [mm getFloat:@"SOME HACK KEY"];
// You can use: [mm getBool:@"SOME HACK KEY"];
// 
// For customizing the hack inside your hooks
// see an example below:
// 
// EXAMPLE OF HOOK FUNCTIONS
// THAT GETS THE VALUE DEFINED
// OF AN INTERFACE "KEY" ELEMENT
   

float (*orig_func)(void *self);

float new_func(void *self)
{
    float newValue = [mm getFloat:@"aSliderKey"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}

*/


%ctor
{
    // the mod menu core
    mm = [APMenu sharedInstance];

    // a writeData.h rewritten to my APMenu
    mp = [MemoryPatcher sharedInstance];

    NSDictionary *hacks =
    @{
        @"k01BasicSwitcher":@{
            @"offsets": @[@"0x0093C83C"],
            @"orig":    @[@"0x006C"],
            @"patched": @[@"0x5846"],
            @"desc": @"God Power",
            @"label": @"God Power"
            },

    };


    // HERE IS WHERE ALL THE FUN BEGINS :)
    [mm init:hacks
                openAfter: 1                                                                          // seconds (I like to use average game loading time)               (OBLIGATORY)
                    width: 260                                                                        // width in pixels                                                 (OBLIGATORY)
        maxVisibleToggles: 5                                                                          // only shows N first hacks, the others needs to be scrolled       (OBLIGATORY)
                    theme: rgb(0xbef7d9)                                                              // the main color for you hack menu (you can use any color :)      (OBLIGATORY)
                    title: @"MY VALANTFORCE GAME HACK"                                                            // your hack titlebar text upper case is better :) (OBLIGATORY)
                    credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"     // pretty self explicative, no? (Leave @"" for empty)
                    creditsURL: nil                                                                        // a URL for the user to visit on credits menu screen @"http://www.myblog.com" or simple: nil

                // CHOOSE YOUR INTERFACE TOGGLE GESTURE
                // APGestureTwoFingerTap
                // APGestureThreeFingerTap
                // APGestureFourFingerTap
                // APGestureTwoFingerSwipeUp
                // APGestureTwoFingerSwipeDown
                // APGestureTwoFingerSwipeLeft
                // APGestureTwoFingerSwipeRight
                // APGestureThreeFingerSwipeUp
                // APGestureThreeFingerSwipeDown
                // APGestureThreeFingerSwipeLeft
                // APGestureThreeFingerSwipeRight
                  gesture: APGestureThreeFingerTap
            onFirstLaunch:^{

            // this method listens to Mod Menu controller changes
            // and gets it's values according to the type of
            // UIControl you are dealing with
            // if you don't need this, just comment or remove these lines
            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                    /* SIMPLE EXAMPLE OF USING THIS
                        switch (value)
                        {
                            case 1:
                                [mp write:0xbadf00d data:0xf33dbac];
                            break;

                            case 2:
                                [mp write:0xbadf00d data:0xf33dbac];
                            break;

                            ...
                        }
                    */
                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;

                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];


        /* DO SOMETHING AFTER HACK INTERFACE LAUNCH 
        designed for customized hooks or you can popup an alert to warn the user
        that hack is already active and maybe send an UIAlertControl informing Gesture you have used
        

        ******** THIS IS HOW TO HOOK
        ******** (if you need hooking some internal function):
        ********
        ******** MSHookFunction((void*)[mp calculateAddress:0xb4df00d], (void*)new_func, (void**)&orig_func);
        ********
        ******** Please, notice that new_func and orig_func are declared at
        ******** the top of the file (before %ctor)

        */

        NSLog(@"Initialized");
    }];
}

 

Posted

You're supposed to use 94083C and not the HEX editor offset. :)

So, +0x4000

Posted (edited)

Firsts things first:

1) Crack the binary
2) Remove the ASLR protection

Doing that you're dealing with "real" offsets instead of shifted ones.

It crashes because you patching some offset with some unaccepted or not contextualized ARM instruction. You need understand assembler basics to avoid this crashes on researching for hacks!

Use GDB / GamePlayer / GameGem / iGameGuardian for start, and you will get some real offsets to play with

 

 

 

__text:0094083C _Equipment_get_Attack_m171674799 ; CODE XREF: _AutoEquipLogic_GetAutoEquip_m241924269+3C6�p

PRO TIP: you don't need to use OFFSETS if it's an Objective C exposed function. You can hook it directly:

MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);

 

Now, if you only want to patch this function, work with the offset IDA shows you (it's already shifted +0x4000, it is a default shifting for iOS apps mostly)

Updated by arthurdapaz
Posted

@DiDA   Thank you for help out.. I am still learning all this MSHook stuff.. 

@arthurdapaz

thanks!  The more I study the less I know.. ;(.. Do you mind

 

1. Take a look of my Tweak.xm and see if I understand  this correctly?  Cause it still crash when I try to enter the battle.

2. If you can share a living sample of Tweak.xm that got your widget and its hacking code? (this will helps much better)

3. Lastly.. where to see NSLog?  :sad:

#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>


float (*orig_func)(void *self);

float new_func(void *self)
{
    float newValue = [mm getFloat:@"k05SimpleUiSlider"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}




%ctor
{

    mm = [APMenu sharedInstance];
    mp = [MemoryPatcher sharedInstance];

    NSDictionary *hacks =
    @{

        @"k05SimpleUiSlider":@{
            @"type": @"modslider",
            @"typecfg": @{
                    @"minimumValue":@0,
                    @"maximumValue":@99999
                },
            @"desc": @"Normal UI Slider",
            @"label": @"Normal UI Slider"
            },
    };

    [mm init:hacks
                openAfter: 1                                                                          
                    width: 260                                                                        
        maxVisibleToggles: 5                                                                          
                    theme: rgb(0xbef7d9)                                                              
                    title: @"MY VALANTFORCE GAME HACK"                                                
					credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"     
					creditsURL: nil                                                             
					gesture: APGestureThreeFingerTap	
				onFirstLaunch:^{

            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;

                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];


		MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);
        NSLog(@"Initialized");
    }];
}

 

Posted

I will answer myself so if anyone meet similar questions like I do, you can get some lights here. Still million appreciation to @arthurdapaz and @DiDA. Could not done this without your TuT and guide

 

Q: NSLog, where to read and how?

A:  Install ondeviceconsole on Cydia, SSH in and run command 

Q: So how the code goes that make it works?
#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>
float (*orig_func)(void *self);
float new_func(void *self)
{
    float newValue = [mm getFloat:@"k05SimpleUiSlider"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}
%ctor
{
    mm = [APMenu sharedInstance];
    mp = [MemoryPatcher sharedInstance];
    NSDictionary *hacks =
    @{

        @"k05SimpleUiSlider":@{
            @"type": @"modslider",
            @"typecfg": @{
                    @"minimumValue":@0,
                    @"maximumValue":@99999
                },
            @"desc": @"God Power",
            @"label": @"Normal UI Slider"
            },
    };
    [mm init:hacks
					openAfter: 1 
                    width: 260
					maxVisibleToggles: 5
                    theme: rgb(0xbef7d9)
                    title: @"MY GAME HACK"
					credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"
					creditsURL: nil

                  gesture: APGestureThreeFingerTap
		onFirstLaunch:^{
            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;
                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];

		MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);
        NSLog(@"Initialized");
    }];
}

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Zombastic: Time to Survive v1.16.2 [ +3 Jailed ] Good MOD
      Modded/Hacked App: Zombastic: Time to Survive By Playmotional Limited
      Bundle ID: com.playmotional.survival
      iTunes Store Link: https://apps.apple.com/us/app/zombastic-time-to-survive/id6475173073?uo=4


      Hack Features:
      - Currency & Resources Unlimited [ Disable When Playing ] 





      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 74 replies
    • Zombastic: Time to Survive v1.16.2 [ +3 Cheats ] Good MOD
      Modded/Hacked App: Zombastic: Time to Survive By Playmotional Limited
      Bundle ID: com.playmotional.survival
      iTunes Store Link: https://apps.apple.com/us/app/zombastic-time-to-survive/id6475173073?uo=4


      Hack Features:
      - Currency & Resources Unlimited [ Disable When Playing ] 





      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 66 replies
    • Snake.io - Fun Online Snake V1.21.8 [ +12 Jailed ] AI Stupid
      Modded/Hacked App: Snake.io - Fun Online Snake By Kooapps
      Bundle ID: com.amelosinteractive.snake
      iTunes Store Link: https://apps.apple.com/us/app/snake-io-fun-online-snake/id1104692136?uo=4


      Hack Features:

      - No ADS

      - AI Stupid 

      - Skin Unlocked 

      - Revive Unlimited

      - Immortal 

      - Wall Hack

      - Boss [ Size Small ] Only Event 

      - Boss [ HP 1 ] Easy Kill [ Only Event ]

      - Eat Radius

      - Eat Multiplier 

      - Eat Size Big 🔴🔵⚫ 

      - Score Multiplier [ Linked - Eat Multiplier & Eat Size & Eat Radius ]


      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download IPA Link:

      Hidden Content

      Download via the iOSGods App
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 120 replies
    • Lollipop Sweet Heroes Match3 v25.0901.01 [ +5 Cheats ] Auto Win
      Modded/Hacked App: Lollipop 3: Match 3 Puzzles By Puzzle1Studio,inc.
      Bundle ID: com.puzzle1studio.ap.lollipopsweetheroesmatch3
      iTunes Store Link: https://apps.apple.com/us/app/lollipop-3-match-3-puzzles/id1634326372?uo=4
       

      🤩 Hack Features

      - Coins

      - Lives

      - Booster

      - Moves

      - Auto Win 
        • Winner
        • Like
      • 11 replies
    • Lollipop Sweet Heroes Match3 v25.0901.01 [ +5 Jailed ] Auto Win
      Modded/Hacked App: Lollipop 3: Match 3 Puzzles By Puzzle1Studio,inc.
      Bundle ID: com.puzzle1studio.ap.lollipopsweetheroesmatch3
      iTunes Store Link: https://apps.apple.com/us/app/lollipop-3-match-3-puzzles/id1634326372?uo=4

       

       

      📌 Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      🤩 Hack Features

      - Coins

      - Lives

      - Booster

      - Moves

      - Auto Win 

       

      ⬇️ iOS Hack Download IPA Link


      Hidden Content

      Download via the iOSGods App
        • Winner
        • Like
      • 15 replies
    • Snake.io - Fun Online Snake V1.21.8 [ +12 Cheats ] AI Stupid
      Modded/Hacked App: Snake.io - Fun Online Snake By Kooapps
      Bundle ID: com.amelosinteractive.snake
      iTunes Store Link: https://apps.apple.com/us/app/snake-io-fun-online-snake/id1104692136?uo=4


      Hack Features:
      - No ADS

      - AI Stupid 

      - Skin Unlocked 

      - Revive Unlimited

      - Immortal 

      - Wall Hack

      - Boss [ Size Small ] Only Event 

      - Boss [ HP 1 ] Easy Kill [ Only Event ]

      - Eat Radius

      - Eat Multiplier 

      - Eat Size Big 🔴🔵⚫ 

      - Score Multiplier [ Linked - Eat Multiplier & Eat Size & Eat Radius ]


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 96 replies
    • Heroes vs. Hordes: Survivor v5.8.2 [ +11 Cheats ] Currency Max
      Modded/Hacked App: Heroes vs. Hordes: Survivor By Swift Games GmbH
      Bundle ID: com.swiftgames.roguelikesurvival
      iTunes Store Link: https://apps.apple.com/us/app/heroes-vs-hordes-survivor/id1608898173?uo=4

       
      Hack Features

      - Currency

      - Resource

      - Gold Unlimited [ Bonus Wave ]

      - Ch Unlocked [ Play All Off ]

      - Always Last Wave

      - Talents Cost 0

      - Hero DMG Only

      - HP & DMG [ Just Equip & Unequip ]

      - Enemy Freeze

      - Enemy ATK NO

       
      For Non-Jailbroken & No Jailbreak required hacks: https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
        • Agree
        • Thanks
        • Winner
        • Like
      • 91 replies
    • Heroes vs. Hordes: Survivor v5.8.2 [ +11 Jailed ] Currency Max
      Modded/Hacked App: Heroes vs. Hordes: Survivor By Swift Games GmbH
      Bundle ID: com.swiftgames.roguelikesurvival
      iTunes Store Link: https://apps.apple.com/us/app/heroes-vs-hordes-survivor/id1608898173?uo=4

       

       

      Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      Hack Features

      - Currency

      - Resource

      - Gold Unlimited [ Bonus Wave ]

      - Ch Unlocked [ Play All Off ]

      - Always Last Wave

      - Talents Cost 0

      - Hero DMG Only

      - HP & DMG [ Just Equip & Unequip ]

      - Enemy Freeze

      - Enemy ATK NO


      Jailbreak required iOS hacks: https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APKs: https://iosgods.com/forum/68-android-section/

       

      iOS Hack Download IPA Link


      Hidden Content

      Download via the iOSGods App
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 107 replies
    • House Flipper Home Design v1.555 +2 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: House Flipper Home Design By PLAYWAY SPOLKA AKCYJNA
      Bundle ID: com.imaginalis.HouseFlipperMobile
      iTunes Store Link: https://apps.apple.com/us/app/house-flipper-home-design/id1517373437
       

      Hack Features:
      - Unlimited Cash -> Exchange Flipcoins for Cash to earn an unlimited amount.
      - Unlimited Flipcoins -> Exchange Flipcoins for Cash to earn an unlimited amount.


      Jailbreak required hack(s): https://iosgods.com/topic/169137-exclusive-house-flipper-home-design-all-versions-2-cheats-unlimited-currencies/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 150 replies
    • House Flipper Home Design v1.555 +2 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: House Flipper Home Design By PLAYWAY SPOLKA AKCYJNA
      Bundle ID: com.imaginalis.HouseFlipperMobile
      iTunes Store Link: https://apps.apple.com/us/app/house-flipper-home-design/id1517373437
       

      Hack Features:
      - Unlimited Cash -> Exchange Flipcoins for Cash to earn an unlimited amount.
      - Unlimited Flipcoins -> Exchange Flipcoins for Cash to earn an unlimited amount. 


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 141 replies
    • Starbrew Cafe: Mystical Merge v1.53.2 [ +4 Jailed ] Currency Max
      Modded/Hacked App: Starbrew Cafe: Mystical Merge By Extra Dimension Games Inc.
      Bundle ID: games.extradimension.cafemerge
      App Store Link: https://apps.apple.com/us/app/starbrew-cafe-mystical-merge/id6456751444?uo=4
       

      🤩 Hack Features

      - Gems  --- In Store Buy Items [ Items Sale Price ] Show Free When You Buy Then Get Gems
      - Coins
      - Energy [ Buy Cost 0 ]
      - All Order Completed
        • Winner
      • 4 replies
    • Unromantic Demon Queen: Otome v1.0.10 +1 Jailed Cheat [ Free Premium Choices ]
      Modded/Hacked App: Unromantic Demon Queen : Otome By Storytaco.inc
      Bundle ID: com.storytaco.c7client
      iTunes Store Link: https://apps.apple.com/us/app/unromantic-demon-queen-otome/id6446239496?uo=4


      Hack Features:
      - Free Premium Choices


      Jailbreak required hack(s): [Mod Menu Hack] Unromantic Demon Queen: Otome v1.0.8 +1 Cheat [ Free Premium Choices ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Haha
        • Winner
        • Like
      • 8 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines