Solved Just another LGL Menu Help Request with Hooking

[shifty+]

Hello,
I am having an annoying difficult time getting the LGL menu to properly hook and patch Unity games I am modding.
The LGL menu works just fine. I can use toggles and inputs in the menu to create custom Toasts for the game, so the LGL framework is working correctly.
However, every time I use the PATCH_LIB_SWITCH macro to modify a function (usually to make it return early with 00 00 00 E3 1E FF 2F E1) it causes the game to crash on the function call.
At the very least that means i am targeting the right offset, since it crashes only on the patched function call.
Additionally, my use of the HOOK macro doesn't appear to work at all. the functions supposed to be replaced using the HOOK macro are never called, and the original function runs normally. I've already checked and made certain the HOOK and PATCH macros are being called.


Here is an example code snippet of my attempt at hooking a function that opens an Equipment window UI.
the toggleEnable just caused a Toast to trigger, signaling the method was called, but the toggleEnable stayed at false.

void (*old_OpenEquipment)(void* instance, bool pause);
void OpenEquipment(void* instance, bool pause){
    toggleEnable = true;
    old_OpenEquipment(instance,pause);
}
void *hack_thread(void *) {
    ...
    HOOK( "0x929C18", OpenEquipment, old_OpenEquipment);
    ...
}

later on I used the PATCH_SWITCH on the same code (after disabling the hook) to immediately return. This caused the game to stall then crash after I tried opening the equipment menu. (though this might have been because the function performed a necessary function that caused a crash on interruption.)

I was hoping someone with more experience with HOOKs on Android could help me figure out how to best bugfix this issue.
Just to reiterate, it isnt an issue with LGL itself most likely, but an issue with how im handling the HOOK/PATCHing. I just dont have the experience with Android modding to easily diagnose the exact problem.

 

[shifty+]

Addendum:
I've also tried using HOOKSYM, but I for the life of me cannot figure out how to correctly name the function symbol to get it called, so the game always crashes on hack_thread when I use HOOKSYM.

I've looked through what seems to be every tutorial but none of them show how to use the symbols directly.

 

[8BIT]

[Not A Fix For The Toggle Being False]

There Are No Instance != Null Checks In The Code Provided

[Suggestion]
You Cant Use Logger.h To Log Function Triggers Instead Of Using Toast Which Is A Hassle
Example:

LOGE("Called");


//LOGE -> Error

//LOGI -> Info

//LOGD -> Debug

//LOGW -> Warn

This Will Print "Called" having A Tag Thats Defined In Logger.h(If Not Modified It Will Be Mod_Menu)

Just Use
Catlog
set Log Level To Error
Clear Previous Logs
Launch The Game
Try Triggering The Func
Check Logs
Or Use
adb logcat *:E

 

[shifty+]

Thank you for the suggestion. I was able to use adb logcat to record and search output logs. Unfortunately it is as I feared, and the functions are never being called.

Combined with the failed patches I am beginning to suspect that the functions themselves have been obfuscated in some way. However I have no clue how to check that. I'll just have to try to mod a different game and see if that works.

is there some way to find and view the smali for the Assembly-CSharp.dll file (where the game code is) to get the method info details?

 

[shifty+]

Well I got the hooks to function on a different Android game, even though they didnt work properly on the first 2 games I tried.
The first 2 games dont appear to have any form of obfuscation though so I'm wondering why they dont work properly... (the games in question were b100x and Hero's Quest).

It doesnt look like either of these games have any form of anti-cheat function scrambling, so i have no clue why i couldn't get it to work on those games.

Either way, i got it to work as expected.
Thank you for your suggestions 8BIT as they saved a decent amount of development time!

 

[8BIT]

smali for the Assembly-CSharp.dll

Smali Is Disassembled Dex

Java Src -> Dex(Generated By dx/d8 tool ) -> Smali(Disassembled Dex Which Is Somewhat Readble)

You Are Refering To Native Files(Simply .so files) Which Cannot Be Disassembled To Smali For Analysis.
For Natives Use IDA(Paid But You Know were to find it)/Ghidra(Open Source)