Help/Support Bypass _OBJ_CLASS_$NSNumber.

[Ted2 39k iPhone 13 Pro 16.0 Donor]

Hi,

 

I've hacked this game before using this function:

BLX.W           _objc_retainAutoreleasedReturnValue
__text:003E936C                 STR             R0, [SP,#0x4108+var_40E0]
__text:003E936E                 MOV             R1, R8
__text:003E9370                 STR.W           R0, [SP,#0x4108+var_3950]
__text:003E9374                 MOV             R0, #(cfstr_Ghost_0 - 0x3E9382) ; "ghost"
__text:003E937C                 MOVS            R2, #0
__text:003E937E                 ADD             R0, PC  ; "ghost"
__text:003E9380                 STR.W           R0, [SP,#0x4108+var_3988]
__text:003E9384                 LDR             R0, [R5]
__text:003E9386                 BLX.W           _objc_msgSend
__text:003E938A                 MOV             R7, R

 

Now the function is this:

 

BLX.W           _objc_retainAutoreleasedReturnValue
__text:003E936C                 STR             R0, [SP,#0x4108+var_40E0]
__text:003E936E                 MOV             R1, R8
__text:003E9370                 STR.W           R0, [SP,#0x4108+var_3950]
__text:003E9374                 MOV             R0, #(cfstr_Ghost_0 - 0x3E9382) ; "ghost"
__text:003E937C                 MOVS            R2, #0
__text:003E937E                 ADD             R0, PC  ; "ghost"
__text:003E9380                 STR.W           R0, [SP,#0x4108+var_3988]
__text:003E9384                 LDR             R0, [R5] ; _OBJC_CLASS_$_NSNumber   <--------------->
__text:003E9386                 BLX.W           _objc_msgSend
__text:003E938A                 MOV             R7, R

 

Before I Changed MOVS R2, #0 to MOVS R2, #1.

Now this causes a crash

then i saw one thing has changed, something is added _OBJ_CLASS_$NSNumber.

 

I tried nop it, still crash

Then i tried movs r2, #1 bxlr, still crash..

 

Anyone know how I can bypass/delete the function that's added.

 

I tried xref but it's used for lot's of things