Work around with libil2cpp and GG using offset

TekMonts · November 12, 2020

Too many guys ask about GG and libil2cpp.so to working with gameguardian.

So I decided to make some guides to working around with it using offset.

Funtion to hack: Show enemy on radar

This game was protected from dumper, so I uses Il2CppInspector to inspect the lib.

Open up the Il2CppInspector.exe and drag the apk to the app GUI then wait a bit:

I exported the Json file to find the function and address, and I want to find where the function to show enemy on rada, I found this:

0x046C37F4 -- here is address holded the function get_ShowEnemyOnRadar()

So what should we do?

We can mod directly in libil2cpp.so, using the hock, create the app to call...

But here, I willshow you how to modify this function using GameGuardian

First, you need the function tohandle the lib, share on Internet and I just copy paste here:

local memFrom, memTo, lib, num, lim, results, src, ok = 0, -1, nil, 0, 32, {}, nil, false
function name(n)
    if lib ~= n then
        lib = n
        local ranges = gg.getRangesList(lib)
        if #ranges == 0 then
            print("⚠ERROR: " .. lib .. " are not found!⚠")
            gg.toast("⚠ERROR: " .. lib .. " are not found!⚠")
            os.exit()
        else
            memFrom = ranges[1].start
            memTo = ranges[#ranges]["end"]
        end
    end
end
function hex2tbl(hex)
    local ret = {}
    hex:gsub(
        "%S%S",
        function(ch)
            ret[#ret + 1] = ch
            return ""
        end
    )
    return ret
end
function original(orig)
    local tbl = hex2tbl(orig)
    local len = #tbl
    if len == 0 then
        return
    end
    local used = len
    if len > lim then
        used = lim
    end
    local s = ""
    for i = 1, used do
        if i ~= 1 then
            s = s .. ";"
        end
        local v = tbl[i]
        if v == "??" or v == "**" then
            v = "0~~0"
        end
        s = s .. v .. "r"
    end
    s = s .. "::" .. used
	
    gg.searchNumber(s, gg.TYPE_BYTE, false, gg.SIGN_EQUAL, memFrom, memTo)
    if len > used then
        for i = used + 1, len do
            local v = tbl[i]
            if v == "??" or v == "**" then
                v = 256
            else
                v = ("0x" .. v) + 0
                if v > 127 then
                    v = v - 256
                end
            end
            tbl[i] = v
        end
    end
    local found = gg.getResultCount()

    results = {}
    local count = 0
    local checked = 0
    while true do
        if checked >= found then
            break
        end
        local all = gg.getResults(8)
        local total = #all
        local start = checked
        if checked + used > total then
            break
        end
        for i, v in ipairs(all) do
            v.address = v.address + myoffset
        end
        gg.loadResults(all)
        while start < total do
            local good = true
            local offset = all[1 + start].address - 1
            if used < len then
                local get = {}
                for i = lim + 1, len do
                    get[i - lim] = {address = offset + i, flags = gg.TYPE_BYTE, value = 0}
                end
                get = gg.getValues(get)
                for i = lim + 1, len do
                    local ch = tbl[i]
                    if ch ~= 256 and get[i - lim].value ~= ch then
                        good = false
                        break
                    end
                end
            end
            if good then
                count = count + 1
                results[count] = offset
                checked = checked + used
            else
                local del = {}
                for i = 1, used do
                    del[i] = all[i + start]
                end
                gg.removeResults(del)
            end
            start = start + used
        end
    end
end
function replaced(repl)
    num = num + 1
    local tbl = hex2tbl(repl)
    if src ~= nil then
        local source = hex2tbl(src)
        for i, v in ipairs(tbl) do
            if v ~= "??" and v ~= "**" and v == source[i] then
                tbl[i] = "**"
            end
        end
        src = nil
    end
    local cnt = #tbl
    local set = {}
    local s = 0
    for _, addr in ipairs(results) do
        for i, v in ipairs(tbl) do
            if v ~= "??" and v ~= "**" then
                s = s + 1
                set[s] = {["address"] = addr + i, ["value"] = v .. "r", ["flags"] = gg.TYPE_BYTE}
            end
        end
    end
    if s ~= 0 then
        gg.setValues(set)
    end
    ok = true
end

Now you need to call the function:

gg.setRanges ( gg .REGION_CODE_APP | gg .REGION_C_DATA) -- usally you only need this region
name('libil2cpp.so')									-- name the lib
myoffset = 0x046C37F4									-- offset you found
original('7F 45 4C 46 01 01 01 00')						-- begin hex, open the libil2cpp.so with HexView and find first 8 bytes of hex
replaced('01 00 A0 E3 1E FF 2F E1')						-- use arm to hex converter, convert "return true" to hex, see https://armconverter.com/?code=mov%20r0,%20%231%0Abx%20lr
gg.toast("Done!")

Put it in your lua and done, you're now can hack the radar using GG and libil2cpp.

Demo:

Demo file: CODHack_Demo.lua

Edited November 12, 2020 by TekMonts

sodaface · November 17, 2020

thanks for this. This is something i've been playing around with and this post is very helpful.

nio04 · December 23, 2020

On 11/12/2020 at 5:02 PM, TekMonts said:

Too many guys ask about GG and libil2cpp.so to working with gameguardian.

So I decided to make some guides to working around with it using offset.

Game: Call of duty - Mobile VN

Funtion to hack: Show enemy on radar

This game was protected from dumper, so I uses Il2CppInspector to inspect the lib.

Open up the Il2CppInspector.exe and drag the apk to the app GUI then wait a bit:

I exported the Json file to find the function and address, and I want to find where the function to show enemy on rada, I found this:


0x046C37F4 -- here is address holded the function get_ShowEnemyOnRadar()

So what should we do?

We can mod directly in libil2cpp.so, using the hock, create the app to call...

But here, I willshow you how to modify this function using GameGuardian

First, you need the function tohandle the lib, share on Internet and I just copy paste here:


local memFrom, memTo, lib, num, lim, results, src, ok = 0, -1, nil, 0, 32, {}, nil, false
function name(n)
    if lib ~= n then
        lib = n
        local ranges = gg.getRangesList(lib)
        if #ranges == 0 then
            print("⚠ERROR: " .. lib .. " are not found!⚠")
            gg.toast("⚠ERROR: " .. lib .. " are not found!⚠")
            os.exit()
        else
            memFrom = ranges[1].start
            memTo = ranges[#ranges]["end"]
        end
    end
end
function hex2tbl(hex)
    local ret = {}
    hex:gsub(
        "%S%S",
        function(ch)
            ret[#ret + 1] = ch
            return ""
        end
    )
    return ret
end
function original(orig)
    local tbl = hex2tbl(orig)
    local len = #tbl
    if len == 0 then
        return
    end
    local used = len
    if len > lim then
        used = lim
    end
    local s = ""
    for i = 1, used do
        if i ~= 1 then
            s = s .. ";"
        end
        local v = tbl[i]
        if v == "??" or v == "**" then
            v = "0~~0"
        end
        s = s .. v .. "r"
    end
    s = s .. "::" .. used
	
    gg.searchNumber(s, gg.TYPE_BYTE, false, gg.SIGN_EQUAL, memFrom, memTo)
    if len > used then
        for i = used + 1, len do
            local v = tbl[i]
            if v == "??" or v == "**" then
                v = 256
            else
                v = ("0x" .. v) + 0
                if v > 127 then
                    v = v - 256
                end
            end
            tbl[i] = v
        end
    end
    local found = gg.getResultCount()

    results = {}
    local count = 0
    local checked = 0
    while true do
        if checked >= found then
            break
        end
        local all = gg.getResults(8)
        local total = #all
        local start = checked
        if checked + used > total then
            break
        end
        for i, v in ipairs(all) do
            v.address = v.address + myoffset
        end
        gg.loadResults(all)
        while start < total do
            local good = true
            local offset = all[1 + start].address - 1
            if used < len then
                local get = {}
                for i = lim + 1, len do
                    get[i - lim] = {address = offset + i, flags = gg.TYPE_BYTE, value = 0}
                end
                get = gg.getValues(get)
                for i = lim + 1, len do
                    local ch = tbl[i]
                    if ch ~= 256 and get[i - lim].value ~= ch then
                        good = false
                        break
                    end
                end
            end
            if good then
                count = count + 1
                results[count] = offset
                checked = checked + used
            else
                local del = {}
                for i = 1, used do
                    del[i] = all[i + start]
                end
                gg.removeResults(del)
            end
            start = start + used
        end
    end
end
function replaced(repl)
    num = num + 1
    local tbl = hex2tbl(repl)
    if src ~= nil then
        local source = hex2tbl(src)
        for i, v in ipairs(tbl) do
            if v ~= "??" and v ~= "**" and v == source[i] then
                tbl[i] = "**"
            end
        end
        src = nil
    end
    local cnt = #tbl
    local set = {}
    local s = 0
    for _, addr in ipairs(results) do
        for i, v in ipairs(tbl) do
            if v ~= "??" and v ~= "**" then
                s = s + 1
                set[s] = {["address"] = addr + i, ["value"] = v .. "r", ["flags"] = gg.TYPE_BYTE}
            end
        end
    end
    if s ~= 0 then
        gg.setValues(set)
    end
    ok = true
end

Now you need to call the function:


gg.setRanges ( gg .REGION_CODE_APP | gg .REGION_C_DATA) -- usally you only need this region
name('libil2cpp.so')									-- name the lib
myoffset = 0x046C37F4									-- offset you found
original('7F 45 4C 46 01 01 01 00')						-- begin hex, open the libil2cpp.so with HexView and find first 8 bytes of hex
replaced('01 00 A0 E3 1E FF 2F E1')						-- use arm to hex converter, convert "return true" to hex, see https://armconverter.com/?code=mov%20r0,%20%231%0Abx%20lr
gg.toast("Done!")

Put it in your lua and done, you're now can hack the radar using GG and libil2cpp.

Demo:

Demo file: CODHack_Demo.lua

holy sht!! this is codm?

i m working on cod hack too. but i m very noob. but already made some simple hacks

you use telegram, sir?

nio04 · December 23, 2020

On 11/12/2020 at 5:02 PM, TekMonts said:

Too many guys ask about GG and libil2cpp.so to working with gameguardian.

So I decided to make some guides to working around with it using offset.

Game: Call of duty - Mobile VN

Funtion to hack: Show enemy on radar

This game was protected from dumper, so I uses Il2CppInspector to inspect the lib.

Open up the Il2CppInspector.exe and drag the apk to the app GUI then wait a bit:

I exported the Json file to find the function and address, and I want to find where the function to show enemy on rada, I found this:


0x046C37F4 -- here is address holded the function get_ShowEnemyOnRadar()

So what should we do?

We can mod directly in libil2cpp.so, using the hock, create the app to call...

But here, I willshow you how to modify this function using GameGuardian

First, you need the function tohandle the lib, share on Internet and I just copy paste here:


local memFrom, memTo, lib, num, lim, results, src, ok = 0, -1, nil, 0, 32, {}, nil, false
function name(n)
    if lib ~= n then
        lib = n
        local ranges = gg.getRangesList(lib)
        if #ranges == 0 then
            print("⚠ERROR: " .. lib .. " are not found!⚠")
            gg.toast("⚠ERROR: " .. lib .. " are not found!⚠")
            os.exit()
        else
            memFrom = ranges[1].start
            memTo = ranges[#ranges]["end"]
        end
    end
end
function hex2tbl(hex)
    local ret = {}
    hex:gsub(
        "%S%S",
        function(ch)
            ret[#ret + 1] = ch
            return ""
        end
    )
    return ret
end
function original(orig)
    local tbl = hex2tbl(orig)
    local len = #tbl
    if len == 0 then
        return
    end
    local used = len
    if len > lim then
        used = lim
    end
    local s = ""
    for i = 1, used do
        if i ~= 1 then
            s = s .. ";"
        end
        local v = tbl[i]
        if v == "??" or v == "**" then
            v = "0~~0"
        end
        s = s .. v .. "r"
    end
    s = s .. "::" .. used
	
    gg.searchNumber(s, gg.TYPE_BYTE, false, gg.SIGN_EQUAL, memFrom, memTo)
    if len > used then
        for i = used + 1, len do
            local v = tbl[i]
            if v == "??" or v == "**" then
                v = 256
            else
                v = ("0x" .. v) + 0
                if v > 127 then
                    v = v - 256
                end
            end
            tbl[i] = v
        end
    end
    local found = gg.getResultCount()

    results = {}
    local count = 0
    local checked = 0
    while true do
        if checked >= found then
            break
        end
        local all = gg.getResults(8)
        local total = #all
        local start = checked
        if checked + used > total then
            break
        end
        for i, v in ipairs(all) do
            v.address = v.address + myoffset
        end
        gg.loadResults(all)
        while start < total do
            local good = true
            local offset = all[1 + start].address - 1
            if used < len then
                local get = {}
                for i = lim + 1, len do
                    get[i - lim] = {address = offset + i, flags = gg.TYPE_BYTE, value = 0}
                end
                get = gg.getValues(get)
                for i = lim + 1, len do
                    local ch = tbl[i]
                    if ch ~= 256 and get[i - lim].value ~= ch then
                        good = false
                        break
                    end
                end
            end
            if good then
                count = count + 1
                results[count] = offset
                checked = checked + used
            else
                local del = {}
                for i = 1, used do
                    del[i] = all[i + start]
                end
                gg.removeResults(del)
            end
            start = start + used
        end
    end
end
function replaced(repl)
    num = num + 1
    local tbl = hex2tbl(repl)
    if src ~= nil then
        local source = hex2tbl(src)
        for i, v in ipairs(tbl) do
            if v ~= "??" and v ~= "**" and v == source[i] then
                tbl[i] = "**"
            end
        end
        src = nil
    end
    local cnt = #tbl
    local set = {}
    local s = 0
    for _, addr in ipairs(results) do
        for i, v in ipairs(tbl) do
            if v ~= "??" and v ~= "**" then
                s = s + 1
                set[s] = {["address"] = addr + i, ["value"] = v .. "r", ["flags"] = gg.TYPE_BYTE}
            end
        end
    end
    if s ~= 0 then
        gg.setValues(set)
    end
    ok = true
end

Now you need to call the function:


gg.setRanges ( gg .REGION_CODE_APP | gg .REGION_C_DATA) -- usally you only need this region
name('libil2cpp.so')									-- name the lib
myoffset = 0x046C37F4									-- offset you found
original('7F 45 4C 46 01 01 01 00')						-- begin hex, open the libil2cpp.so with HexView and find first 8 bytes of hex
replaced('01 00 A0 E3 1E FF 2F E1')						-- use arm to hex converter, convert "return true" to hex, see https://armconverter.com/?code=mov%20r0,%20%231%0Abx%20lr
gg.toast("Done!")

Put it in your lua and done, you're now can hack the radar using GG and libil2cpp.

Demo:

Demo file: CODHack_Demo.lua

holy sht!! this is codm?

i m working on cod hack too. but i m very noob. but already made some simple hacks

you use telegram, sir?

i understood almost everything but

"

original('7F 45 4C 46 01 01 01 00')

replaced('01 00 A0 E3 1E FF 2F E1')

"

this... what is this original & replaced value? how can i find this "original hex value"

TekMonts · December 23, 2020

1 hour ago, nio04 said:

holy sht!! this is codm?

i m working on cod hack too. but i m very noob. but already made some simple hacks

you use telegram, sir?

i understood almost everything but

"

original('7F 45 4C 46 01 01 01 00')

replaced('01 00 A0 E3 1E FF 2F E1')

"

this... what is this original & replaced value? how can i find this "original hex value"

original('7F 45 4C 46 01 01 01 00')	-- begin hex of original file, open the libil2cpp.so with HexView and find first 8 bytes of hex
replaced('01 00 A0 E3 1E FF 2F E1')	-- use arm to hex converter, convert "return true" to hex, see https://armconverter.com/?code=mov%20r0,%20%231%0Abx%20lr   uses the arm code to hack directly, 01 00 A0 E3 1E FF 2F E1 =  mov r0, #1 bx lr = return true

Farmeriscool · January 4, 2021

On 11/12/2020 at 11:02 AM, TekMonts said:

Too many guys ask about GG and libil2cpp.so to working with gameguardian.

So I decided to make some guides to working around with it using offset.

Game: Call of duty - Mobile VN

Funtion to hack: Show enemy on radar

This game was protected from dumper, so I uses Il2CppInspector to inspect the lib.

Open up the Il2CppInspector.exe and drag the apk to the app GUI then wait a bit:

I exported the Json file to find the function and address, and I want to find where the function to show enemy on rada, I found this:


0x046C37F4 -- here is address holded the function get_ShowEnemyOnRadar()

So what should we do?

We can mod directly in libil2cpp.so, using the hock, create the app to call...

But here, I willshow you how to modify this function using GameGuardian

First, you need the function tohandle the lib, share on Internet and I just copy paste here:


local memFrom, memTo, lib, num, lim, results, src, ok = 0, -1, nil, 0, 32, {}, nil, false
function name(n)
    if lib ~= n then
        lib = n
        local ranges = gg.getRangesList(lib)
        if #ranges == 0 then
            print("⚠ERROR: " .. lib .. " are not found!⚠")
            gg.toast("⚠ERROR: " .. lib .. " are not found!⚠")
            os.exit()
        else
            memFrom = ranges[1].start
            memTo = ranges[#ranges]["end"]
        end
    end
end
function hex2tbl(hex)
    local ret = {}
    hex:gsub(
        "%S%S",
        function(ch)
            ret[#ret + 1] = ch
            return ""
        end
    )
    return ret
end
function original(orig)
    local tbl = hex2tbl(orig)
    local len = #tbl
    if len == 0 then
        return
    end
    local used = len
    if len > lim then
        used = lim
    end
    local s = ""
    for i = 1, used do
        if i ~= 1 then
            s = s .. ";"
        end
        local v = tbl[i]
        if v == "??" or v == "**" then
            v = "0~~0"
        end
        s = s .. v .. "r"
    end
    s = s .. "::" .. used
	
    gg.searchNumber(s, gg.TYPE_BYTE, false, gg.SIGN_EQUAL, memFrom, memTo)
    if len > used then
        for i = used + 1, len do
            local v = tbl[i]
            if v == "??" or v == "**" then
                v = 256
            else
                v = ("0x" .. v) + 0
                if v > 127 then
                    v = v - 256
                end
            end
            tbl[i] = v
        end
    end
    local found = gg.getResultCount()

    results = {}
    local count = 0
    local checked = 0
    while true do
        if checked >= found then
            break
        end
        local all = gg.getResults(8)
        local total = #all
        local start = checked
        if checked + used > total then
            break
        end
        for i, v in ipairs(all) do
            v.address = v.address + myoffset
        end
        gg.loadResults(all)
        while start < total do
            local good = true
            local offset = all[1 + start].address - 1
            if used < len then
                local get = {}
                for i = lim + 1, len do
                    get[i - lim] = {address = offset + i, flags = gg.TYPE_BYTE, value = 0}
                end
                get = gg.getValues(get)
                for i = lim + 1, len do
                    local ch = tbl[i]
                    if ch ~= 256 and get[i - lim].value ~= ch then
                        good = false
                        break
                    end
                end
            end
            if good then
                count = count + 1
                results[count] = offset
                checked = checked + used
            else
                local del = {}
                for i = 1, used do
                    del[i] = all[i + start]
                end
                gg.removeResults(del)
            end
            start = start + used
        end
    end
end
function replaced(repl)
    num = num + 1
    local tbl = hex2tbl(repl)
    if src ~= nil then
        local source = hex2tbl(src)
        for i, v in ipairs(tbl) do
            if v ~= "??" and v ~= "**" and v == source[i] then
                tbl[i] = "**"
            end
        end
        src = nil
    end
    local cnt = #tbl
    local set = {}
    local s = 0
    for _, addr in ipairs(results) do
        for i, v in ipairs(tbl) do
            if v ~= "??" and v ~= "**" then
                s = s + 1
                set[s] = {["address"] = addr + i, ["value"] = v .. "r", ["flags"] = gg.TYPE_BYTE}
            end
        end
    end
    if s ~= 0 then
        gg.setValues(set)
    end
    ok = true
end

Now you need to call the function:


gg.setRanges ( gg .REGION_CODE_APP | gg .REGION_C_DATA) -- usally you only need this region
name('libil2cpp.so')									-- name the lib
myoffset = 0x046C37F4									-- offset you found
original('7F 45 4C 46 01 01 01 00')						-- begin hex, open the libil2cpp.so with HexView and find first 8 bytes of hex
replaced('01 00 A0 E3 1E FF 2F E1')						-- use arm to hex converter, convert "return true" to hex, see https://armconverter.com/?code=mov%20r0,%20%231%0Abx%20lr
gg.toast("Done!")

Put it in your lua and done, you're now can hack the radar using GG and libil2cpp.

Demo:

Demo file: CODHack_Demo.lua

Any programs to do this on without pc?

TekMonts · January 9, 2021

On 1/4/2021 at 9:13 PM, Farmeriscool said:

Any programs to do this on without pc?

Nope, you can find the lib share on internet, good luck

NoctisRe · January 9, 2021

can you give me all command like "mov r0, #1 bx" or etc is usefully for hacking?

TekMonts · January 9, 2021

12 hours ago, NoctisRe said:

can you give me all command like "mov r0, #1 bx" or etc is usefully for hacking?

Some return value, for other you can search on internet also.

https://pastebin.com/4DSkN8Fa

Some functions you can work with codm (old version)

https://pastebin.com/5JCxmPH8

Edited January 9, 2021 by TekMonts

Anon463 · January 11, 2021

On 1/4/2021 at 9:13 AM, Farmeriscool said:

Any programs to do this on without pc?

You should really get yourself a laptop or desktop. Doing any tasks on a phone is tedius and time consuming.

Farmeriscool · January 11, 2021

9 hours ago, Anon463 said:

You should really get yourself a laptop or desktop. Doing any tasks on a phone is tedius and time consuming.

Oh I have a laptop and a pc I just dont like going on them

nio04 · February 4, 2021

On 1/9/2021 at 10:48 PM, TekMonts said:

Some return value, for other you can search on internet also.

https://pastebin.com/4DSkN8Fa

Some functions you can work with codm (old version)

https://pastebin.com/5JCxmPH8

wow!! can you provide more codm offset with detail, plz???

i m also inspecting libil2cpp... and sometimes, i get same "function" (ex - recoil) 3/4 times with different offset. wondering, if i should edit them all...!?

plz, sir! if u could guide me something more info. about this... i will be grateful to you....

telegram @nio04

DARK_DEMON_SCRIPTER · September 25, 2022

HELLO GUYS

HOW TO EDIT CONST VALUES IN LIBIL2CPP.SO

eg

public const value = 10

How to search and edit this in gg?

under_score · January 7, 2023

On 9/25/2022 at 2:30 AM, DARK_DEMON_SCRIPTER said:

HELLO GUYS

HOW TO EDIT CONST VALUES IN LIBIL2CPP.SO

eg

public const value = 10

How to search and edit this in gg?

use https://gameguardian.net/forum/files/file/2941-field-offset-finder/

MannyG02021 · January 14, 2023

Please look into Albion Online game. Appreciated.

Sign In

Work around with libil2cpp and GG using offset

Recommended Posts

TekMonts

sodaface

nio04

nio04

TekMonts

Farmeriscool

TekMonts

NoctisRe

TekMonts

Anon463

Farmeriscool

nio04

DARK_DEMON_SCRIPTER

under_score

MannyG02021

Create an account or sign in to comment

Create an account

Sign in

Similar Content

il2cpp RVA offset is not working in Game Gurdian

Field Offset Finder

Calculate offset,xor

convert an offset to a function for patching "hookOne" offsets

convert an offset to a function for patching "hookOne" offsets

Downloads

Activity

My Activity Streams

Important Information