serk11
Solid & Active Platinian
Hello, I have currently created a hook that does exactly what I want with FRIDA, I would now like to adapt it in cpp mod but I do not understand the hook system at all and how to adapt my function
the function allows you to hook a function that manages a character string, I modify the character string at the input of the function.
I am now trying to implement it in the LGLTeam menu mod, but I don't understand how to reproduce the function from my information, could someone help me?
JavaScript:
function awaitForCondition(callback) {
var i = setInterval(function () {
var addr = Module.findBaseAddress('libil2cpp.so');
console.log("Address found:", addr);
if (addr) {
clearInterval(i);
callback(+addr);
}
}, 0);
}
var il2cpp = null;
Java.perform(function () {
awaitForCondition(function (base) {
il2cpp = ptr(base);
Interceptor.attach(il2cpp.add(0x226a8e8), {
onEnter: function (args) {
console.log("Dialog is calling");
this.val = args[0];
console.log(this.val.add(0x14).readUtf16String());
this.val.add(0x14).writeUtf16String('test !');
}
})
})
})the function allows you to hook a function that manages a character string, I modify the character string at the input of the function.
C++:
//Target lib here
#define targetLibName OBFUSCATE("libil2cpp.so")
#include "Includes/Macros.h"
bool feature1, feature2, featureHookToggle, Health;
int sliderValue = 1, level = 0;
void *instanceBtn;
// Hooking examples. Assuming you know how to write hook
void (*AddMoneyExample)(void *instance, int amount);
bool (*old_get_BoolExample)(void *instance);
bool get_BoolExample(void *instance) {
if (instance != NULL && featureHookToggle) {
return true;
}
return old_get_BoolExample(instance);
}
float (*old_get_FloatExample)(void *instance);
float get_FloatExample(void *instance) {
if (instance != NULL && sliderValue > 1) {
return (float) sliderValue;
}
return old_get_FloatExample(instance);
}
int (*old_Level)(void *instance);
int Level(void *instance) {
if (instance != NULL && level) {
return (int) level;
}
return old_Level(instance);
}
void (*old_FunctionExample)(void *instance);
void FunctionExample(void *instance) {
instanceBtn = instance;
if (instance != NULL) {
if (Health) {
*(int *) ((uint64_t) instance + 0x48) = 999;
}
}
return old_FunctionExample(instance);
}
// we will run our hacks in a new thread so our while loop doesn't block process main thread
void *hack_thread(void *) {
LOGI(OBFUSCATE("pthread created"));
//Check if target lib is loaded
do {
sleep(1);
} while (!isLibraryLoaded(targetLibName));
//Anti-lib rename
/*
do {
sleep(1);
} while (!isLibraryLoaded("libYOURNAME.so"));*/
LOGI(OBFUSCATE("%s has been loaded"), (const char *) targetLibName);
#if defined(__aarch64__) //To compile this code for arm64 lib only. Do not worry about greyed out highlighting code, it still works
// Hook example. Comment out if you don't use hook
// Strings in macros are automatically obfuscated. No need to obfuscate!
HOOK("str", FunctionExample, old_FunctionExample);
HOOK_LIB("libFileB.so", "0x123456", FunctionExample, old_FunctionExample);
HOOK_NO_ORIG("0x123456", FunctionExample);
HOOK_LIB_NO_ORIG("libFileC.so", "0x123456", FunctionExample);
HOOKSYM("__SymbolNameExample", FunctionExample, old_FunctionExample);
HOOKSYM_LIB("libFileB.so", "__SymbolNameExample", FunctionExample, old_FunctionExample);
HOOKSYM_NO_ORIG("__SymbolNameExample", FunctionExample);
HOOKSYM_LIB_NO_ORIG("libFileB.so", "__SymbolNameExample", FunctionExample);
// Patching offsets directly. Strings are automatically obfuscated too!
PATCH("0x20D3A8", "00 00 A0 E3 1E FF 2F E1");
PATCH_LIB("libFileB.so", "0x20D3A8", "00 00 A0 E3 1E FF 2F E1");
AddMoneyExample = (void(*)(void *,int))getAbsoluteAddress(targetLibName, 0x123456);
#else //To compile this code for armv7 lib only.
// Hook example. Comment out if you don't use hook
// Strings in macros are automatically obfuscated. No need to obfuscate!
HOOK("str", FunctionExample, old_FunctionExample);
HOOK_LIB("libFileB.so", "0x123456", FunctionExample, old_FunctionExample);
HOOK_NO_ORIG("0x123456", FunctionExample);
HOOK_LIB_NO_ORIG("libFileC.so", "0x123456", FunctionExample);
HOOKSYM("__SymbolNameExample", FunctionExample, old_FunctionExample);
HOOKSYM_LIB("libFileB.so", "__SymbolNameExample", FunctionExample, old_FunctionExample);
HOOKSYM_NO_ORIG("__SymbolNameExample", FunctionExample);
HOOKSYM_LIB_NO_ORIG("libFileB.so", "__SymbolNameExample", FunctionExample);
// Patching offsets directly. Strings are automatically obfuscated too!
PATCH("0x20D3A8", "00 00 A0 E3 1E FF 2F E1");
PATCH_LIB("libFileB.so", "0x20D3A8", "00 00 A0 E3 1E FF 2F E1");
//Restore changes to original
RESTORE("0x20D3A8");
RESTORE_LIB("libFileB.so", "0x20D3A8");
AddMoneyExample = (void (*)(void *, int)) getAbsoluteAddress(targetLibName, 0x226a8e8);
LOGI(OBFUSCATE("Done"));
#endif
//Anti-leech
/*if (!iconValid || !initValid || !settingsValid) {
//Bad function to make it crash
sleep(5);
int *p = 0;
*p = 0;
}*/
return NULL;
}I am now trying to implement it in the LGLTeam menu mod, but I don't understand how to reproduce the function from my information, could someone help me?
