Help! Hook not working on ARM64v8

derzost2

Platinian
Original poster
Apr 15, 2022
16
3
3
31
RU
Good evening.
I ran into a problem, I'm modifying the game Jurassic World Alive, the previous version worked on ARMv7 and there were no problems, after updating ARMv7 it stopped running.
Therefore, I began to make hooks on ARM64v8, everything works fine on Nox x64, and as soon as I launch Samsung Galaxy S20 Ultra (it is also x64) on the phone, the hook does not work.

I've spent about 30 hours solving this problem, hundreds of code compilations, apk rebuilds, application signing and installs.

I was looking for other hook options, for example:
Shadowhook - GitHub - bytedance/android-inline-hook: ShadowHook is an Android inline hook library which supports thumb, arm32 and arm64.
Whale - GitHub - asLody/whale: Hook Framework for Android/IOS/Linux/MacOS
But the experience was not enough to connect them to the LgL Mod Menu project.

I updated everything to the latest version, Android studio, Sdk, Ndk, apktool didn't help.

I downloaded other people's mods, for example from ***,
So is platinmods - Jurassic World Alive Ver. 2.20.25 MOD Menu APK | Inf. Battery | Inf. Darts | Map Hack | Instant Kill Dino & MORE - Platinmods.com - Android & iOS MODs, Mobile Games & Apps vip purchased,
just to check if other versions will work on my phone.
Other mods work but mine doesn't.

I searched the entire platinmods forum and didn't find anything similar.

With this topic, I wanted to ask you for help. But there were not enough 5 messages to create a topic.
In the end, I solved the problem, but I still have a question, why is that?
Below I will describe my solution, maybe it will be useful to someone.

I began to look at how the getAbsoluteAddress function works,
it uses the findLibrary method, which reads data from /proc/self/maps

Got this information from Nox via adb shell, adb used from Nox

cd "C:\Program Files (x86)\Nox\bin"
nox_adb devices

List of devices attached
127.0.0.1:62025 device
nox_adb -s "127.0.0.1:62025" shell

ps | grep jw2
u0_a62 2783 1486 3324932 823732 7f84d922172a S com.ludia.jw2
cat /proc/2783/maps | grep il2cpp
0d000000-11c0d000 r-xp 00000000 08:13 819436 /data/app/com.ludia.jw2-2/lib/arm64/libil2cpp.so
11c0d000-11fbd000 rwxp 04c0d000 08:13 819436 /data/app/com.ludia.jw2-2/lib/arm64/libil2cpp.so
7f2d48608000-7f2d4d5c6000 r--p 00000000 08:13 819436 /data/app/com.ludia.jw2-2/lib/arm64/libil2cpp.so
Well, the findLibrary function takes 1 address and the hook will eventually be installed on it (0d000000+offset)
Now we need to see what is happening on the phone, since it is not rooted, I had to make a copy of findLibrary and rewrite it, (well, personally, I'm bad at android logs, so I sent the received information with a post request to my hosting)

Here's what I got

7891636000-78965f4000 r--p 00000000 103:10 1138735 /data/app/~~U2P_QM-VH0yjuCGXpZVk4Q==/com.ludia.jw2-xs4XitlXaqCH92z4E_hhdA==/lib/arm64/libil2cpp.so
79ca610000-79cc425000 r--p 00000000 103:10 1138735 /data/app/~~U2P_QM-VH0yjuCGXpZVk4Q==/com.ludia.jw2-xs4XitlXaqCH92z4E_hhdA==/lib/arm64/libil2cpp.so
79cc425000-79ceedb000 r-xp 01e15000 103:10 1138735 /data/app/~~U2P_QM-VH0yjuCGXpZVk4Q==/com.ludia.jw2-xs4XitlXaqCH92z4E_hhdA==/lib/arm64/libil2cpp.so
79ceedb000-79cf21d000 r--p 048cb000 103:10 1138735 /data/app/~~U2P_QM-VH0yjuCGXpZVk4Q==/com.ludia.jw2-xs4XitlXaqCH92z4E_hhdA==/lib/arm64/libil2cpp.so
79cf21d000-79cf5cd000 rw-p 04c0d000 103:10 1138735 /data/app/~~U2P_QM-VH0yjuCGXpZVk4Q==/com.ludia.jw2-xs4XitlXaqCH92z4E_hhdA==/lib/arm64/libil2cpp.so
So, what I immediately noticed is that the first and second lines are similar, we should try to hook on the second line.
And it worked, I edited findLibrary and made it so that when the option is enabled in the menu mod, it skips 1 found line.


Utils.h
C++:
int findLibrarySkip=0;

void setFindLibrarySkip(int skip) {
    findLibrarySkip=skip;
}

DWORD findLibrary(const char *library) {
    char filename[0xFF] = {0},
            buffer[1024] = {0};
    FILE *fp = NULL;
    DWORD address = 0;
    int counter=0;

    sprintf(filename, OBFUSCATE("/proc/self/maps"));

    fp = fopen(filename, OBFUSCATE("rt"));
    if (fp == NULL) {
        perror(OBFUSCATE("fopen"));
        goto done;
    }

    while (fgets(buffer, sizeof(buffer), fp)) {
        if (strstr(buffer, library)) {
            address = (DWORD) strtoul(buffer, NULL, 16);
            if (!findLibrarySkip||findLibrarySkip==counter) goto done;
            counter++;
        }
    }

    done:

    if (fp) {
        fclose(fp);
    }

    return address;
}
Main.cpp
C++:
//before hack_thread
int findLibrarySkipInt=0;
//before hooks (in hack_thread)
setFindLibrarySkip(findLibrarySkipInt);
//features
OBFUSCATE("0_Toggle_HookMethod2"),
//featNum
case 0:
findLibrarySkipInt=boolean?1:0;
break;
As a result, the question is why other people's mods worked without all this, and mine gives out 2 lines, am I doing something wrong?

P.S. Sorry for my English, translated through a translator.
 
Last edited:

AbangBlues

Rookie
Nov 25, 2019
3
0
3
30
Malaysia
I know this thread is old,but maybe someone at here have a similar problem like me.

Hooking on 32bit working as expected.
But when i implement at 64bit,there are something weird......

My situation is a bit different from OP problem.

Hook is working.But in a few run after relaunching the game (Loading screen),it will crash because Null Pointer Defference.Sometimes it will go through and sometimes it will crash.

Following #Raebydett suggestion,i increase the delay.

But unfortunately,when i increase the delay,it seem
 

AbangBlues

Rookie
Nov 25, 2019
3
0
3
30
Malaysia
( Sorry, accidentally pressing the post button without finishing my sentence )

Following #Raebydett suggestion,when i increase the delay,it not work.Playing around with the delay,the thing i notice is it need to be hook immediately within 2 sec after the lib load .

At here,i just wondering usually how most of you do a debugging to see either the lib is attached and it hooking the offset.