Jump to content

5 posts in this topic

Recommended Posts

Posted

So, I like so start with thanks @arthurdapaz  and @shmoo for the detail TuT on how to start Cydia Substrate journey

I am now able to build deb, get it running and get the UI, the next step is of course, try on real game. 

For a game I am trying to start, I know what I want to change at HeX editor, and noticed there seems to be some pre-fix there so the actual offset at binary should minus 0x4000

 

__text:0094083C _Equipment_get_Attack_m171674799 ; CODE XREF: _AutoEquipLogic_GetAutoEquip_m241924269+3C6�p
__text:0094083C ; _AutoEquipLogic_GetAutoEquip_m241924269+3DC�p ...
__text:0094083C 00 6C LDR R0, [R0,#0x40]
__text:0094083E 70 47 BX LR
__text:0094083E ; End of function _Equipment_get_Attack_m171674799

 

The offset on IDA appeared as 0094083C but the actual offset at HxD is 0x93C83C, and I tried to change it to 58 46

On @arthurdapaz's template, I write it like this

    NSDictionary *hacks =
    @{
        @"k01BasicSwitcher":@{
            @"offsets": @[@"0x93C83C"],
            @"orig":    @[@"0x006C"],
            @"patched": @[@"0x5846"],
            @"desc": @"God Power",
            @"label": @"God Power"
            },

    };

The result is game crash.. :wallbash:

 

Can I get some love and please let me know where went wrong? 

The original Tweak.xm attached. 
 

#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>

/*
// 
// You can use: [mm getFloat:@"SOME HACK KEY"];
// You can use: [mm getBool:@"SOME HACK KEY"];
// 
// For customizing the hack inside your hooks
// see an example below:
// 
// EXAMPLE OF HOOK FUNCTIONS
// THAT GETS THE VALUE DEFINED
// OF AN INTERFACE "KEY" ELEMENT
   

float (*orig_func)(void *self);

float new_func(void *self)
{
    float newValue = [mm getFloat:@"aSliderKey"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}

*/


%ctor
{
    // the mod menu core
    mm = [APMenu sharedInstance];

    // a writeData.h rewritten to my APMenu
    mp = [MemoryPatcher sharedInstance];

    NSDictionary *hacks =
    @{
        @"k01BasicSwitcher":@{
            @"offsets": @[@"0x0093C83C"],
            @"orig":    @[@"0x006C"],
            @"patched": @[@"0x5846"],
            @"desc": @"God Power",
            @"label": @"God Power"
            },

    };


    // HERE IS WHERE ALL THE FUN BEGINS :)
    [mm init:hacks
                openAfter: 1                                                                          // seconds (I like to use average game loading time)               (OBLIGATORY)
                    width: 260                                                                        // width in pixels                                                 (OBLIGATORY)
        maxVisibleToggles: 5                                                                          // only shows N first hacks, the others needs to be scrolled       (OBLIGATORY)
                    theme: rgb(0xbef7d9)                                                              // the main color for you hack menu (you can use any color :)      (OBLIGATORY)
                    title: @"MY VALANTFORCE GAME HACK"                                                            // your hack titlebar text upper case is better :) (OBLIGATORY)
                    credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"     // pretty self explicative, no? (Leave @"" for empty)
                    creditsURL: nil                                                                        // a URL for the user to visit on credits menu screen @"http://www.myblog.com" or simple: nil

                // CHOOSE YOUR INTERFACE TOGGLE GESTURE
                // APGestureTwoFingerTap
                // APGestureThreeFingerTap
                // APGestureFourFingerTap
                // APGestureTwoFingerSwipeUp
                // APGestureTwoFingerSwipeDown
                // APGestureTwoFingerSwipeLeft
                // APGestureTwoFingerSwipeRight
                // APGestureThreeFingerSwipeUp
                // APGestureThreeFingerSwipeDown
                // APGestureThreeFingerSwipeLeft
                // APGestureThreeFingerSwipeRight
                  gesture: APGestureThreeFingerTap
            onFirstLaunch:^{

            // this method listens to Mod Menu controller changes
            // and gets it's values according to the type of
            // UIControl you are dealing with
            // if you don't need this, just comment or remove these lines
            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                    /* SIMPLE EXAMPLE OF USING THIS
                        switch (value)
                        {
                            case 1:
                                [mp write:0xbadf00d data:0xf33dbac];
                            break;

                            case 2:
                                [mp write:0xbadf00d data:0xf33dbac];
                            break;

                            ...
                        }
                    */
                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;

                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];


        /* DO SOMETHING AFTER HACK INTERFACE LAUNCH 
        designed for customized hooks or you can popup an alert to warn the user
        that hack is already active and maybe send an UIAlertControl informing Gesture you have used
        

        ******** THIS IS HOW TO HOOK
        ******** (if you need hooking some internal function):
        ********
        ******** MSHookFunction((void*)[mp calculateAddress:0xb4df00d], (void*)new_func, (void**)&orig_func);
        ********
        ******** Please, notice that new_func and orig_func are declared at
        ******** the top of the file (before %ctor)

        */

        NSLog(@"Initialized");
    }];
}

 

Posted

You're supposed to use 94083C and not the HEX editor offset. :)

So, +0x4000

Posted (edited)

Firsts things first:

1) Crack the binary
2) Remove the ASLR protection

Doing that you're dealing with "real" offsets instead of shifted ones.

It crashes because you patching some offset with some unaccepted or not contextualized ARM instruction. You need understand assembler basics to avoid this crashes on researching for hacks!

Use GDB / GamePlayer / GameGem / iGameGuardian for start, and you will get some real offsets to play with

 

 

 

__text:0094083C _Equipment_get_Attack_m171674799 ; CODE XREF: _AutoEquipLogic_GetAutoEquip_m241924269+3C6�p

PRO TIP: you don't need to use OFFSETS if it's an Objective C exposed function. You can hook it directly:

MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);

 

Now, if you only want to patch this function, work with the offset IDA shows you (it's already shifted +0x4000, it is a default shifting for iOS apps mostly)

Updated by arthurdapaz
Posted

@DiDA   Thank you for help out.. I am still learning all this MSHook stuff.. 

@arthurdapaz

thanks!  The more I study the less I know.. ;(.. Do you mind

 

1. Take a look of my Tweak.xm and see if I understand  this correctly?  Cause it still crash when I try to enter the battle.

2. If you can share a living sample of Tweak.xm that got your widget and its hacking code? (this will helps much better)

3. Lastly.. where to see NSLog?  :sad:

#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>


float (*orig_func)(void *self);

float new_func(void *self)
{
    float newValue = [mm getFloat:@"k05SimpleUiSlider"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}




%ctor
{

    mm = [APMenu sharedInstance];
    mp = [MemoryPatcher sharedInstance];

    NSDictionary *hacks =
    @{

        @"k05SimpleUiSlider":@{
            @"type": @"modslider",
            @"typecfg": @{
                    @"minimumValue":@0,
                    @"maximumValue":@99999
                },
            @"desc": @"Normal UI Slider",
            @"label": @"Normal UI Slider"
            },
    };

    [mm init:hacks
                openAfter: 1                                                                          
                    width: 260                                                                        
        maxVisibleToggles: 5                                                                          
                    theme: rgb(0xbef7d9)                                                              
                    title: @"MY VALANTFORCE GAME HACK"                                                
					credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"     
					creditsURL: nil                                                             
					gesture: APGestureThreeFingerTap	
				onFirstLaunch:^{

            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;

                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];


		MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);
        NSLog(@"Initialized");
    }];
}

 

Posted

I will answer myself so if anyone meet similar questions like I do, you can get some lights here. Still million appreciation to @arthurdapaz and @DiDA. Could not done this without your TuT and guide

 

Q: NSLog, where to read and how?

A:  Install ondeviceconsole on Cydia, SSH in and run command 

Q: So how the code goes that make it works?
#import <APMenu.h>
#import <CoreFoundation/CoreFoundation.h>
#import <substrate.h>
#import <Foundation/Foundation.h>
float (*orig_func)(void *self);
float new_func(void *self)
{
    float newValue = [mm getFloat:@"k05SimpleUiSlider"];
    if (newValue)
        return newValue;
    else
        return orig_func(self);
}
%ctor
{
    mm = [APMenu sharedInstance];
    mp = [MemoryPatcher sharedInstance];
    NSDictionary *hacks =
    @{

        @"k05SimpleUiSlider":@{
            @"type": @"modslider",
            @"typecfg": @{
                    @"minimumValue":@0,
                    @"maximumValue":@99999
                },
            @"desc": @"God Power",
            @"label": @"Normal UI Slider"
            },
    };
    [mm init:hacks
					openAfter: 1 
                    width: 260
					maxVisibleToggles: 5
                    theme: rgb(0xbef7d9)
                    title: @"MY GAME HACK"
					credits: @"Hack by ada1016. Thanks to DiDA n' shmoo for inspiration <3"
					creditsURL: nil

                  gesture: APGestureThreeFingerTap
		onFirstLaunch:^{
            [mm listenChanges:^(id sender)
            {
                if ([mm ismodtext:sender])
                {
                    UIKeyTextField *textField = (UIKeyTextField*) sender;
                    NSString *key             = textField.featureKey;
                    float value               = textField.text.floatValue;

                    NSLog(@"Value of modtext %@: %f", key, value);
                }
                if ([mm ismodslider:sender])
                {
                    UIKeySlider *slider = (UIKeySlider*) sender;
                    NSString *key       = slider.featureKey;
                    float value         = slider.value;

                    NSLog(@"Value of modslider %@: %f", key, value);

                }
                if ([mm ismodswitcher:sender])
                {
                    UIViewSwitcher *switcher = (UIViewSwitcher*) sender;
                    NSString *key            = switcher.featureKey;
                    BOOL value               = switcher.isOn;
                    NSLog(@"Value of modslider %@: %d", key, value);
                }
            }];

		MSHookFunction(MSFindSymbol(NULL,"_Equipment_get_Attack_m171674799"), (void*)new_func, (void**)&orig_func);
        NSLog(@"Initialized");
    }];
}

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Our picks

    • Hunters Origin v1.2.3 +8 Jailed Cheats [ Damage & Defence ]
      Modded/Hacked App: Hunters Origin By BoomBit, Inc.
      Bundle ID: com.hunters.legacy
      iTunes Store Link: https://apps.apple.com/pl/app/hunters-origin/id6473918865

       
       

      🤩 Hack Features

      - Damage Multiplier
      - God Mode
      - Skip Tutorial

      VIP
      - Gold Modifier
      - Diamonds Modifier
      - Seasonal Points Modifier
      - Speed Multiplier
      - XP Multiplier
      - VIP Enabled
      - Premium Pass Enabled
      - No Clip
      - Cheat Mode

      You risk your account being banned using this cheat. Play it safe and you should be okay.
      If you expose yourself using cheats then that's on you.
      • 46 replies
    • Hunters Origin v1.2.3 +8 Cheats [ Damage & Defence ]
      Modded/Hacked App: Hunters Origin By BoomBit, Inc.
      Bundle ID: com.hunters.legacy
      iTunes Store Link: https://apps.apple.com/pl/app/hunters-origin/id6473918865

       


      🤩 Hack Features

      - Damage Multiplier
      - God Mode
      - Skip Tutorial

      VIP
      - Gold Modifier
      - Diamonds Modifier
      - Seasonal Points Modifier
      - Speed Multiplier
      - XP Multiplier
      - VIP Enabled
      - Premium Pass Enabled
      - No Clip
      - Cheat Mode

      You risk your account being banned using this cheat. Play it safe and you should be okay.
      If you expose yourself using cheats then that's on you.
      • 22 replies
    • Royal Kingdom v22800 +4 Jailed Cheats [ Coins + More ]
      Modded/Hacked App: Royal Kingdom By Dream Games
      Bundle ID: com.dreamgames.royalkingdom
      iTunes Store Link: https://apps.apple.com/ph/app/royal-kingdom/id1606549505
       

      Hack Features:
      - Freeze Coins
      - Freeze Lives
      - Freeze Boosters
      - Freeze Moves


      Jailbreak required hack(s): [Mod Menu Hack] Royal Kingdom v3987 +4 Cheats [ Unlimited Coins ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Thanks
      • 159 replies
    • Royal Kingdom v22800 +4 Cheats [ Coins + More ]
      Modded/Hacked App: Royal Kingdom By Dream Games
      Bundle ID: com.dreamgames.royalkingdom
      iTunes Store Link: https://apps.apple.com/ph/app/royal-kingdom/id1606549505
       

      Hack Features:
      - Freeze Coins
      - Freeze Lives
      - Freeze Boosters
      - Freeze Moves


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Royal Kingdom v3987 +4 Jailed Cheats [ Unlimited Coins ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
      • 115 replies
    • Royal Match v31832 +10 Jailed Cheats [ Coins + More ]
      Modded/Hacked App: Royal Match By Dream Games Teknoloji Anonim Sirketi
      Bundle ID: com.dreamgames.royalmatch
      iTunes Store Link: https://apps.apple.com/us/app/royal-match/id1482155847?uo=4


      Mod Requirements:
      - Non-Jailbroken/Jailed or Jailbroken iPhone/iPad/iPod Touch.
      - Sideloadly / Cydia Impactor or alternatives.
      - A Computer Running Windows/macOS/Linux with iTunes installed.


      Hack Features:
      - Freeze Coins
      - Freeze Lives
      - Freeze Stars
      - Freeze Boosters
      - Freeze Time
      - Freeze Moves
      - Unlock VIP Badges
      - Unlock VIP Name Styles
      - Unlock VIP Frames
      - Auto Win -> Quit the level.


      Jailbreak required hack(s): [Mod Menu Hack] Royal Match v26455 +11 Cheats [ Unlimited Coins + More ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
      • 432 replies
    • Good Coffee, Great Coffee v1.6.5 +8 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Coffee, Great Coffee By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.coffeebusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-coffee-great-coffee/id1603584945?uo=4
       


      🤩 Hack Features

      - Unlimited Cash
      - Unlimited Gems
      - Unlimited Energy
      - Unlimited Brew Points
      - Unlimited Daily Rewards
      - All Decor Unlocked
      - All Equipment Unlocked
      - All Equipment Upgrades Unlocked
      - All Shop Upgrades Unlocked
      - Perfect Drinks
      • 119 replies
    • Good Coffee, Great Coffee v1.6.5 +8 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Coffee, Great Coffee By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.coffeebusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-coffee-great-coffee/id1603584945?uo=4

       
       

      🤩 Hack Features

      - Unlimited Cash
      - Unlimited Gems
      - Unlimited Energy
      - Unlimited Brew Points
      - Unlimited Daily Rewards
      - All Decor Unlocked
      - All Equipment Unlocked
      - All Equipment Upgrades Unlocked
      - All Shop Upgrades Unlocked
      - Perfect Drinks
      • 88 replies
    • Blade of God X: Orisols v2.4.1 +4 Jailed Cheats [ God / O-HK ]
      Modded/Hacked App: Blade of God X: Orisols By Pangu Games Digital Entertainment Limited
      Bundle ID: com.game.BOGX.hkios
      iTunes Store Link: https://apps.apple.com/us/app/blade-of-god-x-orisols/id6550905404?uo=4

       

      🔧 Mod Requirements

      - Non-Jailbroken/Jailed or Jailbroken iPhone or iPad.
      - Sideloadly or alternatives.
      - Computer running Windows/macOS/Linux with iTunes installed.

       

      🚀 Hack Features

      - God Mode
      - One-Hit Kill
      - Kill All Enemies -> Attack or be attacked to trigger.
      - Move Speed Multiplier
      • 41 replies
    • Blade of God X: Orisols v2.4.1 +4 Cheats [ God / O-HK ]
      Modded/Hacked App: Blade of God X: Orisols By Pangu Games Digital Entertainment Limited
      Bundle ID: com.game.BOGX.hkios
      iTunes Store Link: https://apps.apple.com/us/app/blade-of-god-x-orisols/id6550905404?uo=4

       

      🔧 Mod Requirements

      - Jailbroken iPhone or iPad.
      - iGameGod / Filza / iMazing.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak (from Cydia, Sileo or Zebra).

       

      🚀 Hack Features

      - God Mode
      - One-Hit Kill
      - Kill All Enemies -> Attack or be attacked to trigger.
      - Move Speed Multiplier
      • 111 replies
    • Royal Match v31832 +10 Cheats [ Coins + More ]
      Modded/Hacked App: Royal Match By Dream Games Teknoloji Anonim Sirketi
      Bundle ID: com.dreamgames.royalmatch
      iTunes Store Link: https://apps.apple.com/us/app/royal-match/id1482155847?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, ElleKit, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - Freeze Coins
      - Freeze Lives
      - Freeze Stars
      - Freeze Boosters
      - Freeze Time
      - Freeze Moves
      - Unlock VIP Badges
      - Unlock VIP Name Styles
      - Unlock VIP Frames
      - Auto Win -> Quit the level.


      Non-Jailbroken & No Jailbreak required hack(s): [IPA Mod Menu] Royal Match v26455 +11 Jailed Cheats [ Unlimited Coins + More ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Haha
      • 550 replies
    • Good Pizza, Great Pizza v5.37.2 +8 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Pizza, Great Pizza By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.pizzabusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-pizza-great-pizza/id911121200?uo=4


      Hack Features:
      - Unlimited Cash
      - Unlimited Diamonds
      - Unlimited Pizza Pass Claim -> Only works if you haven't claimed that reward yet.

      VIP
      - Unlimited Pizza Pass Tokens
      - Chef Pass Unlocked
      - Max Pizza Pass Level
      - Starter Bundle Unlocked
      - All Achievements Completed
      • 406 replies
    • Good Pizza, Great Pizza v5.37.2 +8 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Pizza, Great Pizza By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.pizzabusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-pizza-great-pizza/id911121200?uo=4


      Hack Features:
      - Unlimited Cash
      - Unlimited Diamonds
      - Unlimited Pizza Pass Claim -> Only works if you haven't claimed that reward yet. 

      VIP
      - Unlimited Pizza Pass Tokens 
      - Chef Pass Unlocked 
      - Max Pizza Pass Level 
      - Starter Bundle Unlocked 
      - All Achievements Completed
      • 209 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines