Help! Why my hooks causing freeze of the game?

[TheCraTer]

Hello Everyone,
When i try to hook the offsets of a game the game freezes on loading or when going to the battle section in which i modded offsets...
That's my main.cpp
i need to know the reasons ....

#include <list>
#include <vector>
#include <cstring>
#include <pthread.h>
#include <thread>
#include <cstring>
#include <string>
#include <jni.h>
#include <unistd.h>
#include <fstream>
#include <iostream>
#include <dlfcn.h>
#include "Includes/Logger.h"
#include "Includes/obfuscate.h"
#include "Includes/Utils.hpp"
#include "Menu/Menu.hpp"
#include "Menu/Jni.hpp"
#include "Includes/Macros.h"

float ATKMul = 1.0;
float DEFMul = 1.0;
float SpeedMul = 1.0;
float ArmyMul = 1.0;

struct MemPatches {
// let's assume we have patches for these functions for whatever game
// boolean get_canShoot() function
MemoryPatch ;
// etc...
} gPatches;

// Do not change or translate the first text unless you know what you are doing
// Assigning feature numbers is optional. Without it, it will automatically count for you, starting from 0
// Assigned feature numbers can be like any numbers 1,3,200,10... instead in order 0,1,2,3,4,5...
// ButtonLink, Category, RichTextView and RichWebView is not counted. They can't have feature number assigned
// Toggle, ButtonOnOff and Checkbox can be switched on by default, if you add True_. Example: CheckBox_True_The Check Box
// To learn HTML, go to this page: W3Schools.com

jobjectArray GetFeatureList(JNIEnv *env, jobject context) {
jobjectArray ret;

const char *features[] = {

OBFUSCATE("Category_Cheats"),
OBFUSCATE("1_SeekBar_ATK Multiplier_1_100"),
OBFUSCATE("2_SeekBar_DEF Multiplier_1_100"),
OBFUSCATE("3_SeekBar_Speed Multiplier_1_100"),
OBFUSCATE("4_SeekBar_Army Multiplier_1_100"),
};

int Total_Feature = (sizeof features / sizeof features[0]);
ret = (jobjectArray)
env->NewObjectArray(Total_Feature, env->FindClass(OBFUSCATE("java/lang/String")),
env->NewStringUTF(""));

for (int i = 0; i < Total_Feature; i++)
env->SetObjectArrayElement(ret, i, env->NewStringUTF(features));

return (ret);
}

void Changes(JNIEnv *env, jclass clazz, jobject obj, jint featNum, jstring featName, jint value, jlong Lvalue, jboolean boolean, jstring text) {

switch (featNum) {
case 1:
ATKMul = value;
break;
case 2:
DEFMul = value;
break;
case 3:
SpeedMul = value;
break;
case 4:
ArmyMul = value;
break;
}
}

//CharacterPlayer

float (*old_AttackValue)(void *instance);
float AttackValue(void *instance) {
if (instance != nullptr) {
if (ATKMul > 1.0) {
//*(int *) ((uint64_t) instance + 0x10) *= DMGMul; //Damage
return old_AttackValue(instance)*ATKMul;
}
}
return old_AttackValue(instance);
}

float (*old_DefenseValue)(void *instance);
float DefenseValue(void *instance) {
if (instance != nullptr) {
if (DEFMul > 1.0) {
return old_DefenseValue(instance)*DEFMul;
}
}
return old_DefenseValue(instance);
}

float (*old_SpeedValue)(void *instance);
float SpeedValue(void *instance) {
if (instance != nullptr) {
if (SpeedMul > 1.0) {
return old_SpeedValue(instance)*SpeedMul;
}
}
return old_SpeedValue(instance);
}

float (*old_ArmyValue)(void *instance);
float ArmyValue(void *instance) {
if (instance != nullptr) {
if (ArmyMul > 1.0) {
return old_ArmyValue(instance)*ArmyMul;
}
}
return old_ArmyValue(instance);
}

//Target lib here
#define targetLibName OBFUSCATE("libil2cpp.so")

ElfScanner g_il2cppELF;

// we will run our hacks in a new thread so our while loop doesn't block process main thread
void *hack_thread(void *) {
LOGI(OBFUSCATE("pthread created"));

//Check if target lib is loaded
/*do {
sleep(1);
} while (!isLibraryLoaded(targetLibName));*/

do {
sleep(1);
// getElfBaseMap can also find lib base even if it was loaded from zipped base.apk
g_il2cppELF = ElfScanner::createWithPath(targetLibName);
} while (!g_il2cppELF.isValid());

LOGI(OBFUSCATE("%s has been loaded"), (const char *) targetLibName);

#if defined(__aarch64__)
uintptr_t il2cppBase = g_il2cppELF.base();

HOOK(targetLibName, str2Offset(OBFUSCATE("0x20F0F40")), AttackValue, old_AttackValue);
HOOK(targetLibName, str2Offset(OBFUSCATE("0x20F0F58")), DefenseValue, old_DefenseValue);
HOOK(targetLibName, str2Offset(OBFUSCATE("0x20F0F88")), SpeedValue, old_SpeedValue);
HOOK(targetLibName, str2Offset(OBFUSCATE("0x20F0FA0")), ArmyValue, old_ArmyValue);
//gPatches.FreeShop = MemoryPatch::createWithHex(il2cppBase + str2Offset(OBFUSCATE("0x3977FE8")), "20 00 80 D2 C0 03 5F D6");
//GetPower = (float(*)(void *))getAbsoluteAddress(targetLibName,0x1C41AF0);

#elif defined(__arm__)
//Put your code here if you want the code to be compiled for armv7 only
#endif

LOGI(OBFUSCATE("Done"));
return nullptr;
}

__attribute__((constructor))
void lib_main() {
// Create a new thread so it does not block the main thread, means the game would not freeze
pthread_t ptid;
pthread_create(&ptid, NULL, hack_thread, NULL);
}

 

[TheCraTer]

Up

 

[jaimecd]

"For this code to work, you MUST do 3 things:

1. Fill in the 6 offsets at the top of main.cpp:

static uint32_t OFFSET_ATTACK     = 0x0;  ← put the value from dump.cs
static uint32_t OFFSET_DEFENSE    = 0x0;
static uint32_t OFFSET_SPEED      = 0x0;
...

2. Check each function's return type in dump.cs — if it's int or bool instead of float, you need to change the hook signature. Example:

// dump.cs says "int get_Attack()" → change:
int hook_Attack(void* inst) { ... }  // float → int

3. Compile with NDK and inject into the APK:

ndk-build
apktool d game.apk
copy libmodmenu.so + Loader.smali
apktool b
sign

If you skip any step, the game will crash. The code itself is correct — the error is always a wrong offset, wrong return type, or not compiling/injecting properly."

 

[TheCraTer]

"For this code to work, you MUST do 3 things:

1. Fill in the 6 offsets at the top of main.cpp:

static uint32_t OFFSET_ATTACK     = 0x0;  ← put the value from dump.cs
static uint32_t OFFSET_DEFENSE    = 0x0;
static uint32_t OFFSET_SPEED      = 0x0;
...

2. Check each function's return type in dump.cs — if it's int or bool instead of float, you need to change the hook signature. Example:

// dump.cs says "int get_Attack()" → change:
int hook_Attack(void* inst) { ... }  // float → int

3. Compile with NDK and inject into the APK:

ndk-build
apktool d game.apk
copy libmodmenu.so + Loader.smali
apktool b
sign

If you skip any step, the game will crash. The code itself is correct — the error is always a wrong offset, wrong return type, or not compiling/injecting properly."

Thanks for your reply and i will try this but i have a question please
..
in this part

static uint32_t OFFSET_ATTACK     = 0x0;  ← put the value from dump.cs
static uint32_t OFFSET_DEFENSE    = 0x0;
static uint32_t OFFSET_SPEED      = 0x0;
...

if i use armv8 should i change uint32_t --> into uint64_t?