Tool [NIC] iOS Mod Menu Template - iOS 15 Supported!

Theo · July 13, 2020

Nicee

Lukicha0160 · October 4, 2020

Hi

n1ce0n3 · October 9, 2020

Can any1 help me, I'm looking for a way to make a button or an empty switch inside the mod menu, and by clicking on it to call a function e.g.

void(*ctor)(void *instance)= (void(*) (void *))getRealOffset(0x135CDD8);

on that button\switch click I want it to execute ctor(instance);

and I cant seem to find a way to do it

Updated October 9, 2020 by n1ce0n3

LeePham · November 20, 2020

[switches addOffsetSwitch:@"One Hit Kill"
              description:@"Enemy will die instantly!"
                offsets:{0x1001BB2C0, 0x1002CB3B0}
                  bytes:{0x00E0BF12C0035FD6, 0xC0035FD6}];

what is bytes @Ted2 ? i added you in Discord but not Accept

Ted2 · November 20, 2020

1 hour ago, Leeberlin said:


[switches addOffsetSwitch:@"One Hit Kill"
              description:@"Enemy will die instantly!"
                offsets:{0x1001BB2C0, 0x1002CB3B0}
                  bytes:{0x00E0BF12C0035FD6, 0xC0035FD6}];

what is bytes @Ted2 ? i added you in Discord but not Accept

use armconverter to get bytes

0xSolana · November 20, 2020

3 hours ago, Leeberlin said:


[switches addOffsetSwitch:@"One Hit Kill"
              description:@"Enemy will die instantly!"
                offsets:{0x1001BB2C0, 0x1002CB3B0}
                  bytes:{0x00E0BF12C0035FD6, 0xC0035FD6}];

what is bytes @Ted2 ? i added you in Discord but not Accept

As ted2 said its what u get from armconverter.

example :

You want to RET a fonction (that the fonction dose not happen), in arm converter you would type :

RET --> C0035FD6 // This is the RET fonction in HEX/BYTES that arm converter will send u

So, now that we know the bytes of our "RET" we will patch the offset that u got from IDA / lldb or anywhere

[switches addOffsetSwitch:@"One Hit Kill"
              description:@"Enemy will die instantly!"
                offsets:{0x1001BB2C0} // adress of IDA or anuwhere you got
                  bytes:{0xC0035FD6}]; // the bytes u got from armconverter.com

// So, the fonction at 0x1001BB2C0 will be "delete" by our 0xC0035FD6 (RET)

see arm knloegde here :

https://iosgods.com/topic/45417-tutorial-basic-arm-instruction-explanation-with-image/

Updated November 20, 2020 by D red