[Beginer-Intro]Lesson 2:MS Hacking

Requirements:
-iDevide
- iOS 7+
- Flex 2
- Developer mode in Cydia (In Cydia, go to Sources, Settings and change User/Hacker to Developer)

You can check how to make theos for windows in HERE

I.Required Packages:

PLEASE BE EXTRA CAREFUL, PEOPLE HAVE ACTUALLY LOST THEIR JAILBREAK AND HAD TO RESTORE W/BY NOT FOLLOWING INSTRUCTIONS:

1. BigBoss Recommended Tools
Install BigBoss Recommended Tools from the BigBoss Repo. Be patient, it may take a while.
Also download GNU C Compiler and libgcc (both are in saurik's repo or BigBoss)
2. $THEOS
Go to Cydia, and install Darwin CC Tools from the BigBoss repo, then install iOS Toolchain.
3. MobileTerminal
You can install MobileTerminal for free from the BigBoss repo. It is currently compatible with iOS 3.2+, iOS 4, iOS 5, and iOS 6. For iOS 7, Install MobileTerminal from this repo:

Now that you have MobileTerminal and type:


su
alpine
cd /var
git clone git://github.com/coolstar/theos.git

And now you have $THEOS installed.

4. iFile:
You can get iFile 2.0.1-1 on BigBoss for a free trial, or buy and support the dev with a simple $2.99 donation
5. SDK:
To install the latest SDK, run these commands:

su
alpine
curl -k -L http://iphone.howett.net/sdks/dl/iPhoneOS7.1.sdk.tbz2' | tar -x -j -v -C /var/theos/sdks
Finally Install Perl from coolstars repo. This is a newer perl and you don't need to use a dirty hack for it to work on A6 & A7 Devices, and that's it.

You are now ready to start making tweaks!

A7 devices have to perform a fix here:

Fix:
Go to /var/theos/makefiles/targets and rename the 'Darwin-arm' Folder to 'Darwin-arm64'
Go to /var/theos/makefiles/platform and rename 'Darwin-arm.mk' to 'Darwin-arm64.mk'

Now you should be able to compile, but it will not work yet, since ld64 is b******* around about the architecture!

Making all for tweak Tweak64...
Preprocessing Tweak.xm...
Compiling Tweak.xm...
Linking tweak Tweak64...
ld: unknown/unsupported architecture name for: -arch arm //<-the linker error

Note: in Objective-C (the language for making these tweaks, go learn it) // and /* */ are comments, they are ignored by the compiler

Fix:

Open /var/theos/bin/bootstrap.sh (using nano or another text editor)

Search for

if [[ "$(uname -s)" == "Darwin" && "$(uname -p)" != "arm" ]]; then[code]

And then change 

[code]"$(uname -p)" != "arm"[/code]
to

[code]"$(uname -p)" != "arm64"[/code]

basically 'arm' to 'arm64' again

This should be all for now!

NOTE: In case you get an Illegal Instruction Error: 4, you can fix this by doing this:

(only do it if you get an Illegal Instruction: 4 - error)

[code]sed -i 's/\x00\x30\x93\xe4/\x00\x30\x93\xe5/g;s/\x00\x30\xd3\xe4/\x00\x30\xd3\xe5/g;' FILE_WHICH_CAUSES_THE_ERROR
If you do not know where the file is, install 'find utilities', run 'updatedb' as root and then 'locate FILE_NAME'

It will show you the path and then you can run the 'sed' command as shown above to fix the illegal instruction: 4 - error

This should be all!

@DRM (@sharedRoutine)

6.Perl


7.Flex 2(Search in cydia)

8.Clutch

 Add http://cydia.iphonecake.com/  and install clutch

II.Cracking the game

 After Installing Clutch, go to Mobile Terminal and type this:

su
alpine
Clutch


This loads a list of application names (CFBundleExecutables). Now try and find your application. Here the applicationname will be referred to as AppName. In Mobile Terminal:

Clutch "AppName" (Apostraphes are included)



This should crack the application and that will be stored in /var/root/Documents/Cracked/

Installing the IPA:


1. Install the Safari/Mail Fix (iOS 7 Only)
2. Install AppSync for iOS 7 (iOS 7), AppSync for iOS 5&6 (iOS 5&6), AppSync for iOS 4.2 (iOS 4.2), AppSync for iOS 4.1 (iOS 4.1), AppSync for iOS 4.0 (iOS 4)
3. This installs AppCake, or AppCake 4.2 or lower
4. Install IPA Installer from the BigBoss repo.
5. Open it, and GO to Settings, IPA Installer, and check Force Installation
6. Go back and go /var/root/Documents/Cracked/ and install it.

III.Class Dump

You're now ready to hack your game. Thanks to HackJack, we now have an app to ClassDump an app for us instead of doing a complicated process in MobileTerminal. To get the app, Install this Deb file

http://www.mediafire.com/download/ir7x1vye02zz8b2/ClassDumpApp.deb



(Go to iFile: /var/mobile/Documents/ClassDumpApp.deb click on this file and choose "Installer") And Reboot twice. If you don't see the app, I recommends to uninstall app from Cydia (search ClassDump) and reinstall it the .deb above

IV.Creating The Tweak:
Go to iFile:
/var/mobile/Applications/ToBeHackedApp/ToBeHacked.app/info.plist
open with Property List viewer
Now find the CFBundleExecutable and remeber the name

Open MobileTerminal, and type:


su
alpine
$THEOS/bin/nic.pl
5

Some,people have also been reporting another error where $THEOS/bin/nic.pl returns with this:

Fortunately, there is a fix:


su
alpine
/var/theos/bin/nic.pl
5

1. First it will ask you for Project Name, this name will be used as the dylib name.
2. Then it will ask you for the Package Identifier, or Package Name (this time in a new format). On ioscheaters, we follow this format, com.name.Projectname
3. Then it will ask you For the Author Name
4. After that, is the important part, It will ask you for the MobileSubstrate Bundle Filter. Now type the CFBundleExecutable you were supposed to remember. If you forgot, just type in a random identifier.
5. Now it will ask you for what processes it should kill upon installation, type this "-"
6. You're Done now go to /var/mobile/(Project name, All lowercase)


Note: If you forgot the identifier:

1.Go to iFile: /var/mobile/Applications/HackInProgressApp/HackInProgress.app/info.plist
open with Property List viewer
2.Now find the CFBundleIdentifier and remember the name.
3.Go to iFile: /var/mobile/(Projectname)/Projectname.plist
9 edit bundle filter to that of CFBundleIdentifier

V. Explanation of the Different Kinds of Functions:
After looking at the headers, you can find functions that look important, and hack them. However most of you probably don't know the meanings of all those ints and bools. So I will cover a couple of different types of function types here:

1. Int:
An int, or (int) is short for an integer and is a direct value. Function like setMoney, setGold, setAmmo are (int)
An example of a hacked (int) can be found here:

-(int)setGold {
return 999999;
}
2. Bool:
A Bool or (BOOL) is a true or false function, it can be used for a function like "isLevel30Completed" which can be used to unlock maybe something in the shop, a new world, a new gameplay mode etc.
An example of a hacked (BOOL) can be found here:

-(BOOL)isItemUnlocked {
return true;
}
3. Floats:
A float is a method of representing an approximation of a real number, like 255.3 It can be used in functions like zombiesReleasedInAMinute
An Example of a hacked (float) can be found here:


-(float)getSniperAccuracy {
return 9999.0f;
}
Note: When you return a float you always have to put a decimal point and something after it, beacuse after all its only a approximation.

4. Voids:
Voids cant be hacked directly, instead they rely on (int), (BOOL), and (float) (the parameters) to represent a value which of course can be hacked
You can use the above guides for hacking each function to do voids, I'll use integer as an example.
An example of a hacked (void) can be found here:

-(void)setGoldAmount:(int)Amount {
%orig(9999);
}
%orig(9999);


Because there is -(void) before the -(int) we cant run a return, so what we do is execute a %orig; (runs the original command) with an argument of 9999, therefore writing 9999 to (int)amount :D

So now all you need to do is find the functions you want to hack, make sure to follow the Tweak format correctly, and you're ready to go on and finish your hack! :D

VI.Grep -i:
Grep is used in terminal to search for functions without manually looking through all the ClassDump files.
To use grep, execute these commands in MobileTerminal:


su
alpine
cd /var/mobile/ClassDump/(name of the folder)
grep -i "search term" *.*
(NOTE: the apostaphes for your search term ARE included)


Some good searches would be: (can also be used for enemy health)
Player's Life: life,health,damage,hp,live,power

example - takeDamage

example - removeHealth

Points: points,score,mp

example - UpdatePoints

example - AddPoints

example - loadScore

Ammo: ammo,shoot,shot,fire,weapon:
example - processShooting

example - setfire (Maybe speed of firing)

example - setAmmo

If you have other things like 'speed' or 'suns' or something just try different options

Extras:

-powerups - megajump,doodlejump

-some keywords depend on the game.. rpg,action,fun,... etc.

-kill - splinter cell

- Unlock is an very important keyword *

VII. Testing your Functions
Now that you know and have found the functions you want to hack, You need to test it:
Steps:

1. Open Flex 2 and create a Patch by clicking on the + icon at the top right section of screen
2. Choose your game
3. Click on Add Units . . ., and process the Executable by pressing on it.
4. Once Processed, search for you function
5. Make sure it is the right function by looking at its Class, which is the header where the function is located
6. Select it by clicking on it
7. Go back to the Add Units . . . Screen. Override those functions to what you overrode the value to
8. Go back once more and "check" the Patch.
9. Relaunch the Game. Hopefully what you wanted to happen works, or otherwise have to start over :(


VIII.Making the Tweak:
To create the tweak, Open Tweak.xm in /var/mobile/(ProjectName)/tweak.xm and this is where all your code will go. To start you need to hook a header. The Header is where the functions are located. If you used grep, It is on the left side of function that it has in MobileTerminal (example ScoreWidget.h). All headers end with .h

So an example would be:



%hook Header1                        
- (int)hackOne
{                       
    return 9999;                             
}                                              

- (BOOL)hackTwo
{
    return true;
}

- (float)hackThree
{
    return 9999.0f;
}
%end                                       

%hook Header2
- (int)hackFour
{
    return 9999;
}

- (void)HackFive:(int)fiveAmount
{
    %orig(9999); //This runs the original command with an argument of 9999, technically two lines in one ;)
}
%end

Lets Explain this^^ :


%hook Header1
this "hooks" onto the header, which is basically a file containing all the functions. Now that you've "hooked" onto the header, you can hack any function within it.
-(int)hackOne {
this line here specifies which function (within the header, header 1 in this case) we're hacking
return 9999;
this "returns" the value 9999, always to the function you specified earlier
}
This says were done hacking the function you specified earlier.
%end
this says we're done hacking ALL the functions within the header you "hooked" on earlier

Using (id):
Ids are complicated in MS hacking as they can represent just about any value, a-z, 0-9, true/false, emoticons etc. Because of this, They are used for functions that need to be random. Here's and example of a hacked Id:

-(void)ItemCost:(id)cost {
%orig(0);
}
%end
NOTE: Ids are almost always attached to voids, which is a good thing to keep in mind
You may be wondering where I got numberWithInt from, well when finding your function, you need to find what it is exactly like a NSNumber etc. To do that make a new tweak for the game youre hacking:

(add in the new Tweak.xm)


%hook yourClass
-(void)yourMethod:(id)arg {
UIAlertView *className = [[UIAlertView alloc] initWithTitle:@"Title" message:[NSString stringWithFormat:@"exampleID is a %@",[ExampleID class]] delegate:nil cancelButtonTitle:@"Okay" otherButtonTitles:nil];
[className show];
[className release];
%orig;
}
%end


NOTE: Replace ExampleID with the actual (id) function name like Cost

Also add this to top of Tweak.xm:


include <UIKit/UIKit.h>


And this to Makefile in /var/mobile/(tweak):



tweaknamehere_FRAMEWORKS = UIKit
Compile by executing:

su
alpine
cd /var/mobile/(Tweak here, all lowercase)
Make package

This will make a .deb package for your users for easy Insatllation!

Now when you launch the game, it should tell you what Class it is in. In our case we got NSNumber. Here is Apple's description of NSNumber:
NSNumber is a subclass of NSValue that offers a value as any C scalar (numeric) type. It defines a set of methods specifically for setting and accessing the value as a signed or unsigned char, short int, int, long int, long long int, float, or double or as a BOOL. (Note that number objects do not necessarily preserve the type they are created with.) It also defines a compare: method to determine the ordering of two NSNumber objects.

Now we can change the function, but wait; we still dont know what numberWithInt is. numberWithInt is just an example of the couple of functions there are you can choose from:

- numberWithBool:
- numberWithChar:
- numberWithDouble:
- numberWithFloat:
- numberWithInt:
- numberWithInteger:
- numberWithLong:
- numberWithLongLong:
- numberWithShort:
- numberWithUnsignedChar:
- numberWithUnsignedInt:
- numberWithUnsignedInteger:
- numberWithUnsignedLong:
- numberWithUnsignedLongLong:
- numberWithUnsignedShort:

Now we choose a value. Remember that values like floats need to be returned like 9999.99.
Here's final result:

- (void)ItemCost:(id)Cost
{
    %orig(0);
}
NOTE: Replace numberWithInt with the class you chose

9. Compiling Your Tweak:
You're almost done now! Just go in to terminal and type these commands:


su
alpine
cd /var/mobile/tweakfolder
make package


You will find your deb file in the obj folder. Use Installer and respring
Now You're done... almost ;) !

When You open up the app, you should see what type it is, implement it in your tweak.xm and you're done!

 X. Credit Popups:
For those who've used MS Hacks, you may know that the many hackers use credit Popups
These are little popups that show at the app launching to credit themselves.

A Normal UIAlertView Popup can be created with the following code:



-(void)applicationDidBecomeActive:(id)arg {
        UIAlertView *credits = [[UIAlertView alloc] initWithTitle:@"Title"
        message:@"Message"
        delegate:nil
        cancelButtonTitle:@"Ok"
        otherButtonTitles:nil];
	[credits show];
	[credits release];
%orig;
}
%end

NOTE: The apostrophes only indicate what you can change
NOTE: When you use an Object with UI, you have to change a little bit in your Tweak.xm (in your Projectfolder)


At the very top add this:

import <UIKit/UIKit.h>
NOTE: So Now you have to find a Header which contains one of this methods: (mostly its a header with AppNameAppDelegate.h) Go to /var/mobile/ClassDump/(AppName)/AppNameAppDelegate.h or any header which has delegate in its name:
-(void)applicationDidFinishLaunching:(id)arg {
- Alert when launching app
-(void)applicationDidBecomeActive(id)arg {
- Alert when app becomes active, eg. 
Exit the app, go to safari, come back, normally no alert, but with this one, another alert

Then you can add the alertview in one of theses methods and you have a credit popup when the game starts!



%hook AppDelgateNameHere
-(void)applicationDidBecomeActive:(id)arg {
	UIAlertView *credits = [[UIAlertView alloc] initWithTitle:@"Title"
	message:@"Message"
	delegate:nil
	cancelButtonTitle:@"Ok"
	otherButtonTitles:nil];
	[credits show];
	[credits release];
	%orig;
}
%end
AppDelegate


Usually, the header is called AppDelegate, but sometimes, it can also be called SpotifyAppDelegate (example) UnityAppController (controller, delegate, ALWAYS pick those headers)

XI.Compiling:
You're done now! so why not compile :P

1. This is just to make a .dylib
make
2. This makes a .deb for easy installation by your users:
make package
3. This not only makes a deb, but installs it as well for you: (RECOMMENDED)
make package install

Troubleshooting:

1. /usr/bin/arm-apple-darwin9-gcc+ no such file or directory
Possible Causes & Solutions:

-You didn't install GNU C Compiler and libgcc: These tweaks help to compile your software. TO FIX THIS: Install GNU C Compiler and libgcc from BigBoss repo or Saurik's repo
2. Permission denied
Possible Causes and Solutions:

- Terminal was not able to access the file: the file is important if you want to compile. TO FIX THIS: Make sure you're logged in as root Go to the file and change the permission to 0777 (Read, Write, and Execute for User, Group, and World

3. Weird errors from UIAlertView:
Possible Causes & Solutions:

-$THEOS did not recognize the format and/or syntax: it could not read the file; hence couldn't compile. TO FIX THIS: Go back and look at the correct syntax of the UIAlertView, or you didn't add
#include <UIKit/UIKit.h>
in your tweak.xm. If you keep getting issues, ask me, or someone from the cheating team. They will be glad to help  :)

4. Target not Specified
Possible Causes & Solutions:

- You did not specify the target to hack: $THEOS didn't understand a word you said :P, hence couldn't compile. TO FIX THIS: Go back and look at the correct format tweak.xmIf you keep getting issues, ask me, or someone from the cheating team. They will be glad to help :)

5. Your current SYSROOT, "/var/mobile/projectname/theos/sdks/iPhoneOS7.1.sdk", appears to be missing.
Possible Causes & Solutions:

-You did NOT place the .sdk file you were supposed to download, in /var/theos/sdks: $THEOS can't compile without the sdk. TO FIX THIS: Go back to the very top and follow the instructions to get the sdk

You can check next lesson How To Make Preference Bundles in HERE

0 comments:

Subscribe to: Post Comments (Atom)