Jump to content

5 posts in this topic

Recommended Posts

Posted

So, I like so start with thanks @arthurdapaz  and @shmoo for the detail TuT on how to start Cydia Substrate journey

I am now able to build deb, get it running and get the UI, the next step is of course, try on real game. 

For a game I am trying to start, I know what I want to change at HeX editor, and noticed there seems to be some pre-fix there so the actual offset at binary should minus 0x4000

 

__text:0094083C _Equipment_get_Attack_m171674799 ; CODE XREF: _AutoEquipLogic_GetAutoEquip_m241924269+3C6�p
__text:0094083C ; _AutoEquipLogic_GetAutoEquip_m241924269+3DC�p ...
__text:0094083C 00 6C LDR R0, [R0,#0x40]
__text:0094083E 70 47 BX LR
__text:0094083E ; End of function _Equipment_get_Attack_m171674799

 

The offset on IDA appeared as 0094083C but the actual offset at HxD is 0x93C83C, and I tried to change it to 58 46

On @arthurdapaz's template, I write it like this

    NSDictionary *hacks =
    @{
        @"k01BasicSwitcher":@{
            @"offsets": @[@"0x93C83C"],
            @"orig":    @[@"0x006C"],
            @"patched": @[@"0x5846"],
            @"desc": @"God Power",
            @"label": @"God Power"
            },

    };

The result is game crash.. :wallbash:

 

Can I get some love and please let me know where went wrong? 

The original Tweak.xm attached. 
 

#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>

/*
// 
// You can use: [mm getFloat:@"SOME HACK KEY"];
// You can use: [mm getBool:@"SOME HACK KEY"];
// 
// For customizing the hack inside your hooks
// see an example below:
// 
// EXAMPLE OF HOOK FUNCTIONS
// THAT GETS THE VALUE DEFINED
// OF AN INTERFACE "KEY" ELEMENT
   

float (*orig_func)(void *self);

float new_func(void *self)
{
    float newValue = [mm getFloat:@"aSliderKey"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}

*/


%ctor
{
    // the mod menu core
    mm = [APMenu sharedInstance];

    // a writeData.h rewritten to my APMenu
    mp = [MemoryPatcher sharedInstance];

    NSDictionary *hacks =
    @{
        @"k01BasicSwitcher":@{
            @"offsets": @[@"0x0093C83C"],
            @"orig":    @[@"0x006C"],
            @"patched": @[@"0x5846"],
            @"desc": @"God Power",
            @"label": @"God Power"
            },

    };


    // HERE IS WHERE ALL THE FUN BEGINS :)
    [mm init:hacks
                openAfter: 1                                                                          // seconds (I like to use average game loading time)               (OBLIGATORY)
                    width: 260                                                                        // width in pixels                                                 (OBLIGATORY)
        maxVisibleToggles: 5                                                                          // only shows N first hacks, the others needs to be scrolled       (OBLIGATORY)
                    theme: rgb(0xbef7d9)                                                              // the main color for you hack menu (you can use any color :)      (OBLIGATORY)
                    title: @"MY VALANTFORCE GAME HACK"                                                            // your hack titlebar text upper case is better :) (OBLIGATORY)
                    credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"     // pretty self explicative, no? (Leave @"" for empty)
                    creditsURL: nil                                                                        // a URL for the user to visit on credits menu screen @"http://www.myblog.com" or simple: nil

                // CHOOSE YOUR INTERFACE TOGGLE GESTURE
                // APGestureTwoFingerTap
                // APGestureThreeFingerTap
                // APGestureFourFingerTap
                // APGestureTwoFingerSwipeUp
                // APGestureTwoFingerSwipeDown
                // APGestureTwoFingerSwipeLeft
                // APGestureTwoFingerSwipeRight
                // APGestureThreeFingerSwipeUp
                // APGestureThreeFingerSwipeDown
                // APGestureThreeFingerSwipeLeft
                // APGestureThreeFingerSwipeRight
                  gesture: APGestureThreeFingerTap
            onFirstLaunch:^{

            // this method listens to Mod Menu controller changes
            // and gets it's values according to the type of
            // UIControl you are dealing with
            // if you don't need this, just comment or remove these lines
            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                    /* SIMPLE EXAMPLE OF USING THIS
                        switch (value)
                        {
                            case 1:
                                [mp write:0xbadf00d data:0xf33dbac];
                            break;

                            case 2:
                                [mp write:0xbadf00d data:0xf33dbac];
                            break;

                            ...
                        }
                    */
                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;

                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];


        /* DO SOMETHING AFTER HACK INTERFACE LAUNCH 
        designed for customized hooks or you can popup an alert to warn the user
        that hack is already active and maybe send an UIAlertControl informing Gesture you have used
        

        ******** THIS IS HOW TO HOOK
        ******** (if you need hooking some internal function):
        ********
        ******** MSHookFunction((void*)[mp calculateAddress:0xb4df00d], (void*)new_func, (void**)&orig_func);
        ********
        ******** Please, notice that new_func and orig_func are declared at
        ******** the top of the file (before %ctor)

        */

        NSLog(@"Initialized");
    }];
}

 

Posted

You're supposed to use 94083C and not the HEX editor offset. :)

So, +0x4000

Posted (edited)

Firsts things first:

1) Crack the binary
2) Remove the ASLR protection

Doing that you're dealing with "real" offsets instead of shifted ones.

It crashes because you patching some offset with some unaccepted or not contextualized ARM instruction. You need understand assembler basics to avoid this crashes on researching for hacks!

Use GDB / GamePlayer / GameGem / iGameGuardian for start, and you will get some real offsets to play with

 

 

 

__text:0094083C _Equipment_get_Attack_m171674799 ; CODE XREF: _AutoEquipLogic_GetAutoEquip_m241924269+3C6�p

PRO TIP: you don't need to use OFFSETS if it's an Objective C exposed function. You can hook it directly:

MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);

 

Now, if you only want to patch this function, work with the offset IDA shows you (it's already shifted +0x4000, it is a default shifting for iOS apps mostly)

Updated by arthurdapaz
Posted

@DiDA   Thank you for help out.. I am still learning all this MSHook stuff.. 

@arthurdapaz

thanks!  The more I study the less I know.. ;(.. Do you mind

 

1. Take a look of my Tweak.xm and see if I understand  this correctly?  Cause it still crash when I try to enter the battle.

2. If you can share a living sample of Tweak.xm that got your widget and its hacking code? (this will helps much better)

3. Lastly.. where to see NSLog?  :sad:

#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>


float (*orig_func)(void *self);

float new_func(void *self)
{
    float newValue = [mm getFloat:@"k05SimpleUiSlider"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}




%ctor
{

    mm = [APMenu sharedInstance];
    mp = [MemoryPatcher sharedInstance];

    NSDictionary *hacks =
    @{

        @"k05SimpleUiSlider":@{
            @"type": @"modslider",
            @"typecfg": @{
                    @"minimumValue":@0,
                    @"maximumValue":@99999
                },
            @"desc": @"Normal UI Slider",
            @"label": @"Normal UI Slider"
            },
    };

    [mm init:hacks
                openAfter: 1                                                                          
                    width: 260                                                                        
        maxVisibleToggles: 5                                                                          
                    theme: rgb(0xbef7d9)                                                              
                    title: @"MY VALANTFORCE GAME HACK"                                                
					credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"     
					creditsURL: nil                                                             
					gesture: APGestureThreeFingerTap	
				onFirstLaunch:^{

            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;

                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];


		MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);
        NSLog(@"Initialized");
    }];
}

 

Posted

I will answer myself so if anyone meet similar questions like I do, you can get some lights here. Still million appreciation to @arthurdapaz and @DiDA. Could not done this without your TuT and guide

 

Q: NSLog, where to read and how?

A:  Install ondeviceconsole on Cydia, SSH in and run command 

Q: So how the code goes that make it works?
#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>
float (*orig_func)(void *self);
float new_func(void *self)
{
    float newValue = [mm getFloat:@"k05SimpleUiSlider"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}
%ctor
{
    mm = [APMenu sharedInstance];
    mp = [MemoryPatcher sharedInstance];
    NSDictionary *hacks =
    @{

        @"k05SimpleUiSlider":@{
            @"type": @"modslider",
            @"typecfg": @{
                    @"minimumValue":@0,
                    @"maximumValue":@99999
                },
            @"desc": @"God Power",
            @"label": @"Normal UI Slider"
            },
    };
    [mm init:hacks
					openAfter: 1 
                    width: 260
					maxVisibleToggles: 5
                    theme: rgb(0xbef7d9)
                    title: @"MY GAME HACK"
					credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"
					creditsURL: nil

                  gesture: APGestureThreeFingerTap
		onFirstLaunch:^{
            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;
                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];

		MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);
        NSLog(@"Initialized");
    }];
}

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • 20 Minutes Till Dawn v7.1.b19 [ +12+++ Cheats ] Coins Freeze
      Modded/Hacked App: 20 Minutes Till Dawn By QI YU SG. PTE. LTD.
      Bundle ID: com.flanne.erabit.20minutes.tilldawn.shooting.roguelike.iap.ios
      iTunes Store Link: https://apps.apple.com/us/app/20-minutes-till-dawn/id1635123906?uo=4


      Hack Features:
      - Coins Freeze 

      - Hero Unlocked 

      - Guns Unlocked 

      - Never Die 

      - Ammo Max 

      - No Reload 

      - Rune Unlocked

      - Rune LvL Max

      - Pickup Range [ Linked Rune ] Just Equip

      - DMG Easy Kill [ Linked Rune ] Just Equip

      - Skill CD [ Linked Rune ] Just Equip

      - HP Drop [ Linked Rune ] Just Equip

      - Knockback [ Linked Rune ] Just Equip

      + More Read Status Rune


      Non-Jailbroken & No Jailbreak required hack(s): https://iosgods.com/forum/79-no-jailbreak-section/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Winner
        • Like
      • 39 replies
    • 20 Minutes Till Dawn v7.1.b19 [ +12+++ Jailed ] Coins Freeze
      Modded/Hacked App: 20 Minutes Till Dawn By QI YU SG. PTE. LTD.
      Bundle ID: com.flanne.erabit.20minutes.tilldawn.shooting.roguelike.iap.ios
      iTunes Store Link: https://apps.apple.com/us/app/20-minutes-till-dawn/id1635123906?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:

      - Coins Freeze 

      - Hero Unlocked 

      - Guns Unlocked 

      - Never Die 

      - Ammo Max 

      - No Reload 

      - Rune Unlocked

      - Rune LvL Max

      - Pickup Range [ Linked Rune ] Just Equip

      - DMG Easy Kill [ Linked Rune ] Just Equip

      - Skill CD [ Linked Rune ] Just Equip

      - HP Drop [ Linked Rune ] Just Equip

      - Knockback [ Linked Rune ] Just Equip

      + More Read Status Rune

       
      Jailbreak required hack(s): https://iosgods.com/forum/5-game-cheats-hack-requests/
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/


      iOS Hack Download IPA Link:

      Hidden Content

      Download via the iOSGods App
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 26 replies
    • Hunters Origin v1.2.2 +8 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Hunters Origin By BoomBit, Inc.
      Bundle ID: com.hunters.legacy
      iTunes Store Link: https://apps.apple.com/pl/app/hunters-origin/id6473918865

       
       

      🤩 Hack Features

      - Damage Multiplier
      - God Mode
      - Skip Tutorial

      VIP
      - Gold Modifier
      - Diamonds Modifier
      - Seasonal Points Modifier
      - Speed Multiplier
      - XP Multiplier
      - VIP Enabled
      - Premium Pass Enabled
      - No Clip
      - Cheat Mode

      You risk your account being banned using this cheat. Play it safe and you should be okay.
      If you expose yourself using cheats then that's on you.
        • Agree
        • Winner
        • Like
      • 44 replies
    • Hunters Origin v1.2.2 +8 Cheats [ Damage & Defence ]
      Modded/Hacked App: Hunters Origin By BoomBit, Inc.
      Bundle ID: com.hunters.legacy
      iTunes Store Link: https://apps.apple.com/pl/app/hunters-origin/id6473918865

       


      🤩 Hack Features

      - Damage Multiplier
      - God Mode
      - Skip Tutorial

      VIP
      - Gold Modifier
      - Diamonds Modifier
      - Seasonal Points Modifier
      - Speed Multiplier
      - XP Multiplier
      - VIP Enabled
      - Premium Pass Enabled
      - No Clip
      - Cheat Mode

      You risk your account being banned using this cheat. Play it safe and you should be okay.
      If you expose yourself using cheats then that's on you.
        • Agree
        • Winner
        • Like
      • 21 replies
    • Grimguard Tactics: Fantasy RPG v1.19.2 +3 Jailed Cheats [ Auto Win ]
      Modded/Hacked App: Grimguard Tactics: Fantasy RPG By Outerdawn Limited
      Bundle ID: com.outerdawn.grimguard
      iTunes Store Link: https://apps.apple.com/us/app/grimguard-tactics-fantasy-rpg/id1496893856?uo=4


      Hack Features:
      - Auto Win
      - Unlimited Daily Rewards
      - No Stamina Cost


      Jailbreak required hack(s): [Mod Menu Hack] Grimguard Tactics: Fantasy RPG v1.1.10 +3 Cheats [ Auto Win ] - ViP Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Winner
        • Like
      • 143 replies
    • Grimguard Tactics: Fantasy RPG v1.19.2 +3 Cheats [ Auto Win ]
      Modded/Hacked App: Grimguard Tactics: Fantasy RPG By Outerdawn Limited
      Bundle ID: com.outerdawn.grimguard
      iTunes Store Link: https://apps.apple.com/us/app/grimguard-tactics-fantasy-rpg/id1496893856?uo=4


      Hack Features:
      - Auto Win
      - Unlimited Daily Rewards
      - No Stamina Cost


      Non-Jailbroken & No Jailbreak required hack(s): [IPA Mod Menu] Grimguard Tactics: Fantasy RPG v1.1.10 +3 Jailed Cheats [ Auto Win ] - ViP Non-Jailbroken Hacks & Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Thanks
        • Winner
        • Like
      • 121 replies
    • Hungry Hearts Ramen v1.0.1 +3 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Hungry Hearts Ramen By GAGEX Co.,Ltd.
      Bundle ID: jp.co.gagex.betelgeuse
      App Store Link: https://apps.apple.com/us/app/hungry-hearts-ramen/id6742872242?uo=4

       
       

      🤩 Hack Features

      - Unlimited Coins -> Spend some.
      - Unlimited Hearts -> Spend some.
      • 0 replies
    • Hungry Hearts Ramen v1.0.1 +3 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Hungry Hearts Ramen By GAGEX Co.,Ltd.
      Bundle ID: jp.co.gagex.betelgeuse
      App Store Link: https://apps.apple.com/us/app/hungry-hearts-ramen/id6742872242?uo=4

       
       

      🤩 Hack Features

      - Unlimited Coins -> Spend some.
      - Unlimited Hearts -> Spend some.
      • 0 replies
    • Dawn of Ages: Medieval Games v2.4.3 +5 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Dawn of Ages: total war battle By BoomBit, Inc.
      Bundle ID: com.stratospheregames.dawnofages
      App Store Link: https://apps.apple.com/us/app/dawn-of-ages-total-war-battle/id6477473268?uo=4

       


      🤩 Hack Features

      - Damage Multiplier
      - Defence Multiplier
      - God Mode
      - Dumb Enemy
      - Premium Enabled
        • Agree
        • Winner
        • Like
      • 89 replies
    • Merge Studio: Fashion Makeover v4.0.3 +50++ Jailed Cheats [ Debug Menu ]
      Modded/Hacked App: Merge Studio: Fashion Makeover By Paxie Games Oyun ve Yazilim Anonim Sirketi
      Bundle ID: com.paxiegames.mergestudio
      iTunes Store Link: https://apps.apple.com/us/app/merge-studio-fashion-makeover/id1615964753?uo=4


      Hack Features:
      - Debug Menu -> Head over to Settings and toggle the Sound button.


      Jailbreak required hack(s): [Mod Menu Hack] Merge Studio: Fashion Makeover v2.3.0 +50++ Cheats [ Debug Menu ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 89 replies
    • Merge Studio: Fashion Makeover v4.0.3 +50++ Cheats [ Debug Menu ]
      Modded/Hacked App: Merge Studio: Fashion Makeover By Paxie Games Oyun ve Yazilim Anonim Sirketi
      Bundle ID: com.paxiegames.mergestudio
      iTunes Store Link: https://apps.apple.com/us/app/merge-studio-fashion-makeover/id1615964753?uo=4


      Hack Features:
      - Debug Menu -> Head over to Settings and toggle the Sound button.


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Merge Studio: Fashion Makeover v2.3.0 +50++ Jailed Cheats [ Debug Menu ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 71 replies
    • RuPaul's Drag Race Superstar v1.18.5 +1++ Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: RuPaul's Drag Race Superstar By Eastside Games
      Bundle ID: com.eastsidegames.dragrace
      iTunes Store Link: https://apps.apple.com/us/app/rupauls-drag-race-superstar/id1553517801


      Hack Features:
      - Unlimited Currencies -> Will increase instead of decrease.


      Jailbreak required hack(s): [Mod Menu Hack] RuPaul's Drag Race Superstar ( All Versions ) +1++ Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 270 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines