Hooking functions on iOS jailbreak

Hello, in this tutorial I will show one of the ways to hook a function. I will be hooking a function from a Unity game. First you need to find the address at which the beginning of the function is located in real time, this is difficult due to ASLR (address randomization). First, let's write a method that will return the following address: // RVA: 0x11FE288 Offset: 0x11FE288 VA: 0x11FE288 private void Update() { } (This is the address and information about the function that is in the compiled game engine) uint64_t getExecAddr(uint64_t addr, int index) { const struct mach_header* header = _dyld_get_image_header(index); if (header == NULL){return 0;} uint64_t libLoadAddr = (uint64_t)header; uint64_t exec_addr = libLoadAddr + addr; return exec_addr; } In this example, we are making a method that returns a number of type uint64_t and takes two parameters: the address of the function (for example, the one I gave above) and the library index. Using the _dyld_get_image_header() method, we get the address from which the library was loaded by its index. How to find the library index? This can be done in two ways: Using the LLDB debugger (image list command) or using another method that we will now write (this method is better than the first one) uint64_t getLibIndex(const char* que_image) { int i = 0; int image_count = _dyld_image_count(); for(; i < image_count; i++) { const char* req_image = _dyld_get_image_name(i); if(req_image && strcmp(req_image, que_image) == 0) {return i;} } return -1; } This method takes a path parameter to the library, we use the _dyld_image_count() method to find out how many libraries are loaded into the game process, then using a loop we compare our path to the library with others, and if the paths match, we return the index. Okay, there's not much left. Now let's create a pointer to the old function and create a replacement function that will be called instead of the original one: void (*old_Update)(void *self); void Update(void *self) { // "your code here" old_Update(self); } Now let's just make a hook according to a template that can be easily found on the Internet: %ctor { MSHookFunction( (void *)address_to_your_func_with_aslr, (void *)Update, (void **)&old_Update); } To make it clearer, I will show the full code of my hook. #include <unistd.h> #include <dispatch/dispatch.h> #include <mach-o/dyld.h> #include <substrate.h> #include <string.h> uint64_t getExecAddr(uint64_t addr, int index) { const struct mach_header* header = _dyld_get_image_header(index); if (header == NULL){return 0;} uint64_t libLoadAddr = (uint64_t)header; uint64_t exec_addr = libLoadAddr + addr; return exec_addr; } uint64_t getLibIndex(const char* que_image) { int i = 0; int image_count = _dyld_image_count(); for(; i < image_count; i++) { const char* req_image = _dyld_get_image_name(i); if(req_image && strcmp(req_image, que_image) == 0) {return i;} } return -1; } void (*old_Update)(void *self); void Update(void *self) { sleep(5); old_Update(self); } %ctor { dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{ sleep(150); int index = getLibIndex("/private/var/containers/Bundle/Application/BAE27894-6809-4743-AFFA-C1F6B93195CB/hidenseek.app/Frameworks/UnityFramework.framework/UnityFramework"); uint64_t address = getExecAddr(0x11fe288, index); MSHookFunction( (void *)address_to_your_func_with_aslr, (void *)Update, (void **)&old_Update); }); } This is my test version of the hook, it works great. (dispatch_async I used to wait until all libraries are loaded) In my example, the hook changes the behavior of the program so that when Update() is called, the game slows down for 5 seconds, this is only a beta version and you can add other logic there If you liked the tutorial, please rate it. I will try to answer questions

from iOSGods RSS Feed https://ift.tt/dPThpFI

App crashes upon launch

I'm pretty familiar with Sideload and getting ipa to install. The IPA I got it from the iosgod decrypted. Game: Widgetable Device: iPhone 13 Pro Max Firmware: 16.3.1 Steps taken to produce the issue: 1) Download the decrypted ipa from: https://ift.tt/Q3pWFTR 2) Launch sideload, load the ipa, and install the decrypted ipa. Install successfully. 3) Go to General > Settings > Profile > Trust the profile. 4) Exit Settings and launch the game. It loads for a quick 1-2 seconds then auto closes it. Another metthod has been tested on one of my jailbreak device. 1) Download the decrypted ipa. 2) Upload to one of the folder on my iphone via ssh. 3) Use Filza to install the ipa. Install successfully. 4) However run the app will auto close at 1/2 seconds. Workaround: 1) Download the official ipa from App Store. 2) Use igg to decrypt it. Note: However this defeats the purpose of trying to transfer over to my older iPhone device (Jailbreak) as it's current firmware is only at 14.1. The app alone does not want to install b/c the app minimum version if set to 15. Lowerinstall or igg spoof does not work on this game app. I cannot modify the ipa b/c the newer iphone is not a jailbreak iphone so therefore I can't use igg to decrypt it.

from iOSGods RSS Feed https://ift.tt/Cm2p89r

Bleach Brave Souls JB Mod Assistance.

I'm trying to figure out if anyone else is having a problem with the game crashing before you can get into a match with the hacks turned on, while using the bleach brave souls jb mod with sideloadly. I followed all the instructions, I don't have a jailbroken phone but I was told it says that you can still use it. I was able to download and run everything successfully, but it crashes everytime I try to enter a match with one of the hacks on. I would really appreciate assistance

from iOSGods RSS Feed https://ift.tt/du6fFhY

The Era of Overman : Idle RPG Hack

Hack Features: - God Mode   App Installation Instructions: 1. If necessary, uninstall the App Store version of the app if you have it installed on your iDevice. Make sure to back it up so you don't lose your progress. Alternatively, you can use the 'Custom Install' option to install the new app as a duplicate without having to overwrite or uninstall the original. 2. Once the installation is complete and you see the app on your Home Screen, you will now need to go to Settings -> General -> Profiles/VPN & Device Management. Once there, you will need to trust the new certificate that is related to the app you just installed. Then simply open the (hacked) app. Trusting the app is not required if downloading via the iOSGods App+. Developer Mode must be enabled to be able to install apps outside of the iOS App Store. If you require more information or help, please read our Frequently Asked Questions topic on iOSGods.com. Download this app from the iOSGods App. No Computer, No Cydia & No Jailbreak Required! The best app for Tweaked & Hacked iOS/iPhone/iPad Apps & Games!

from iOSGods RSS Feed https://ift.tt/3emv4Yy

The Era of Overman : Idle RPG v1.1.6 +2 Cheats

Modded/Hacked App: The Era of Overman : Idle RPG By DAERI SOFT Bundle ID: com.daerigame.overmanglobal iTunes Store Link: https://ift.tt/k3KVAhH Mod Requirements: - Jailbroken iPhone/iPad/iPod Touch. - iGameGod / Filza / iMazing or any other file managers for iOS. - Cydia Substrate, Substitute or libhooker depending on your jailbreak. - PreferenceLoader (from Cydia, Sileo or Zebra). Hack Features: - Damage Multiplier - God Mode Non-Jailbroken & No Jailbreak required hack(s): https://ift.tt/9mK0XU3 Modded Android APK(s): https://ift.tt/BMOYy3z For more fun, check out the Club(s): https://ift.tt/lMVGL7n iOS Hack Download Link: [Hidden Content] Installation Instructions: STEP 1: Download the .deb Cydia hack file from the link above. Use Safari/Google Chrome or other iOS browsers to download. STEP 2: Once the file has downloaded, tap on it and then you will be prompted on whether you want to open the deb with iGameGod or copy it to Filza. STEP 3: If necessary, tap on the downloaded file, and then, you will need to press 'Install' from the options on your screen. STEP 4: Let iGameGod/Filza finish the cheat installation. Make sure it successfully installs, otherwise see the note below. STEP 5: If the hack is a Mod Menu — which is usually the case nowadays — the cheat features can be toggled in-game. Some cheats have options that can be enabled from your iDevice settings. STEP 6: Turn on the features you want and play the game. You may need to follow further instructions inside the hack's popup in-game. NOTE: If you have any questions or problems, read our Troubleshooting topic & Frequently Asked Questions & Answers topic. If you still haven't found a solution, post your issue down below and we'll do our best to help! If the hack does work for you, please post your feedback below and help out other fellow members that are encountering issues. Credits: - AlyssaX64 Cheat Video/Screenshots: N/A

from iOSGods RSS Feed https://ift.tt/lgx4XIH