Tutorial MOD Menu for il2cpp and native Android Games

Mr Ikso

Solid & Active Platinian
Original poster
Dec 6, 2017
56
130
33
Ukraine
Hello. I created a mod menu for il2cpp and decided to share it with everyone.
I apologize for bad English
Well, let's begin.
Inexhaustible Instruments
- pc
- NDK
- Android Studio 3.x
- Apktool
- Brains and knowledge of C ++, Java, Smali
1. Start
Clone Floating ModMenu repository by link. Launch Android Studio and open our project. We find there a method
Code:
private void modMenu()
Just in this method it will be necessary to add options for the mod menu. There are already two options, you can use them as an example. In .../FloatingModMenu/app/src/main/jni/src/main.cpp itself, we create functions that will implement the hook. Used library KittyMemory. Next you need to call from the native library and connect them with switches.
Example
Java
Code:
private native void godmode_on ();
private void modMenu ()
addSwitch ("God Mode", new SW () {
            public void OnWrite (boolean isChecked) {
                if (isChecked) {
                    godmode_on ();
                   Toast.makeText (getBaseContext (), "God Mode is activated", Toast.LENGTH_SHORT) .show ();
                } else {
                    godmode_off ();
                    Toast.makeText (getBaseContext (), "God Mode is disabled", Toast.LENGTH_SHORT) .show ();
                }
            }
        });
Next, collect the application.
2. Application parsing and code injection.
After we have added all the necessary options, we need to inject this mod in the application.
Decompiling the application with aptktool and other
Decompiling the game with Aptktool and other.
Go to the folder of the application that was parsed and copy all the files from the assets folder (pictures that you can replace with your own), from the lib/armeabi-v7a/libKittyMemory.so folder to the folder with the parsed game.
Next, we need to add permission to display the application on top of others and the mod-menu service.
Open AndroidManifest.xml from the application folder and AndroidManifest.xml from the game folder and from the first AndroidManifest.xml with copy
Code:
<uses-permission android: name = "android.permission.SYSTEM_ALERT_WINDOW" />
and paste to permissions in AndroidManifest.xml games
Next, copy
Code:
 <service android:enabled="true" android:exported="false" android:name="com.mrikso.modmenu.FloatingModMenuService"/>
and paste in the AndroidManifest.xml game before </ application>
Now the most difficult, you need to inject our menu.
From the smali\com\mrikso\modmenu folder of the parsed application, copy all the files with the name FloatingModMenuService ...
in the smali folder of the game.
Next, we need to register the mod menu call and the libKittyMemory library load. We are looking for the main activity of our game. Usually it is written in <application
<application android:allowBackup="true" android:icon="@mipmap/app_icon" android:isGame="true" android:label="@string/app_name" android:roundIcon="@mipmap/app_icon_round" android:supportsRtl="true" android:theme="@style/UnityThemeSelector" android:usesCleartextTraffic="true">
<activity android:configChanges="density|fontScale|keyboard|keyboardHidden|layoutDirection|locale|mcc|mnc|navigation|orientation|screenLayout|screenSize|smallestScreenSize|touchscreen|uiMode" android:hardwareAccelerated="false" android:label="@string/app_name" android:launchMode="singleTask" android:name="com.unity3d.player.UnityPlayerActivity" android:screenOrientation="sensorLandscape">
<intent-filter>
<action android:name="android.intent.action.MAIN"/>
<category android:name="android.intent.category.LAUNCHER"/>
<action android:name="valhalla.survival.craft.z.StartApp"/>
<category android:name="android.intent.category.DEFAULT"/>
<category android:name="android.intent.category.LEANBACK_LAUNCHER"/>
</intent-filter>
<meta-data android:name="unityplayer.UnityActivity" android:value="true"/>
</activity>
com.unity3d.player.UnityPlayerActivity -> start activity by game.
Go to smali\com\mrikso\modmenu\MainActivity.smali
And we copy in their class to the main class of our game in the # virtual methods

Code:
.method public Start()V
    .locals 3

    .line 23
    const-string v0, "KittyMemory"

    invoke-static {v0}, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V

    .line 24
    sget v0, Landroid/os/Build$VERSION;->SDK_INT:I

    const/16 v1, 0x17

    if-lt v0, v1, :cond_0

    invoke-static {p0}, Landroid/provider/Settings;->canDrawOverlays(Landroid/content/Context;)Z

    move-result v0

    if-nez v0, :cond_0

    .line 25
    new-instance v0, Landroid/content/Intent;

    new-instance v1, Ljava/lang/StringBuilder;

    invoke-direct {v1}, Ljava/lang/StringBuilder;-><init>()V

    const-string v2, "package:"

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    invoke-virtual {p0}, Landroid/app/Activity;->getPackageName()Ljava/lang/String;

    move-result-object v2

    invoke-virtual {v1, v2}, Ljava/lang/StringBuilder;->append(Ljava/lang/String;)Ljava/lang/StringBuilder;

    invoke-virtual {v1}, Ljava/lang/StringBuilder;->toString()Ljava/lang/String;

    move-result-object v1

    invoke-static {v1}, Landroid/net/Uri;->parse(Ljava/lang/String;)Landroid/net/Uri;

    move-result-object v1

    const-string v2, "android.settings.action.MANAGE_OVERLAY_PERMISSION"

    invoke-direct {v0, v2, v1}, Landroid/content/Intent;-><init>(Ljava/lang/String;Landroid/net/Uri;)V

    .line 26
    .local v0, "intent":Landroid/content/Intent;
    const/16 v1, 0x7d2

    invoke-virtual {p0, v0, v1}, Landroid/app/Activity;->startActivityForResult(Landroid/content/Intent;I)V

    .line 27
    .end local v0    # "intent":Landroid/content/Intent;
    goto :goto_0

    .line 28
    :cond_0
    new-instance v0, Landroid/content/Intent;

    const-class v1, Lcom/mrikso/modmenu/FloatingModMenuService;

    invoke-direct {v0, p0, v1}, Landroid/content/Intent;-><init>(Landroid/content/Context;Ljava/lang/Class;)V

    invoke-virtual {p0, v0}, Landroid/app/Activity;->startService(Landroid/content/Intent;)Landroid/content/ComponentName;

    .line 30
    :goto_0
    return-void
.end method

.method public onActivityResult(IILandroid/content/Intent;)V
    .locals 2
    .param p1, "requestCode"    # I
    .param p2, "resultCode"    # I
    .param p3, "data"    # Landroid/content/Intent;

    .line 34
    const/16 v0, 0x7d2

    if-ne p1, v0, :cond_1

    .line 35
    const/4 v0, -0x1

    if-ne p2, v0, :cond_0

    .line 36
    new-instance v0, Landroid/content/Intent;

    const-class v1, Lcom/mrikso/modmenu/FloatingModMenuService;

    invoke-direct {v0, p0, v1}, Landroid/content/Intent;-><init>(Landroid/content/Context;Ljava/lang/Class;)V

    invoke-virtual {p0, v0}, Landroid/app/Activity;->startService(Landroid/content/Intent;)Landroid/content/ComponentName;

    goto :goto_0

    .line 38
    :cond_0
    const/4 v0, 0x0

    const-string v1, "Draw over other app permission not available. Closing the application"

    invoke-static {p0, v1, v0}, Landroid/widget/Toast;->makeText(Landroid/content/Context;Ljava/lang/CharSequence;I)Landroid/widget/Toast;

    move-result-object v0

    invoke-virtual {v0}, Landroid/widget/Toast;->show()V

    .line 39
    invoke-virtual {p0}, Landroid/app/Activity;->finish()V

    goto :goto_0

    .line 42
    :cond_1
    invoke-super {p0, p1, p2, p3}, Landroid/app/Activity;->onActivityResult(IILandroid/content/Intent;)V

    .line 44
    :goto_0
    return-void
.end method
Also in OnCreate, the main activity of our game is inserted
Code:
 invoke-virtual {p0}, Lcom/mrikso/modmenu/MainActivity;->Start()V
com/mrikso/modmenu/MainActivity replace with the main Activity path from our game.
3. We collect the game and check the result.
Screenshot_20190608-011036_Floating%20ModMenu.jpg
Screenshot_20190608-011039_Floating%20ModMenu.jpg
Screenshot_20190608-011047_Floating%20ModMenu.jpg
Screenshot_20190608-011129_Floating%20ModMenu.jpg
All successful modifications of games :)
 
Last edited:

Mr Ikso

Solid & Active Platinian
Original poster
Dec 6, 2017
56
130
33
Ukraine
@superuser hey man, can you give us 1 games that already using that menu? im sure much people can not make it works, and it can be if there is something wrong when you explain it, so if you give 1 example mod with the menu it would be help them!
I understand what you mean. That's what I wrote that we need brains :). I have one game for example, but I need something more simple. Inject menu in the game business for about 10 minutes, not more.
 
  • Like
Reactions: BMD4E

BMD4E

Platinian On Fire
Apr 4, 2017
269
48,943
1,193
33
US
Can this work with non-il2cpp game? I wanted to make menu for NEW LINK that I can on/off auto win
 

Mr Ikso

Solid & Active Platinian
Original poster
Dec 6, 2017
56
130
33
Ukraine
@BMD4E, perhaps along the path /.../FloatingModMenu/app/src/main/jni/src/main.cpp change the name of the library with libil2cpp.so, and write down your offset and the bytes you need to change the game code. Collect the project, decompile and inject into the game.
 
  • Like
Reactions: BMD4E

Whynotme

Platinian
Apr 25, 2019
7
522
78
ANDROID
@superuser i want to ask:
"Just in this method it will be necessary to add options for the mod menu. There are already two options, you can use them as an example. In cpp / main.cpp itself, we create functions that will implement the hook. Used library KittyMemory. Next you need to call from the native library and connect them with switches. "

"cpp / main.cpp itself" - where is it located? Is this thing not:
163252
 

Mr Ikso

Solid & Active Platinian
Original poster
Dec 6, 2017
56
130
33
Ukraine
@superuser i want to ask:
"Just in this method it will be necessary to add options for the mod menu. There are already two options, you can use them as an example. In cpp / main.cpp itself, we create functions that will implement the hook. Used library KittyMemory. Next you need to call from the native library and connect them with switches. "

"cpp / main.cpp itself" - where is it located? Is this thing not:
View attachment 163252
this, it, I was sealed
 
Tags
hack il2cpp mod menu unity