Skip to content

Instantly share code, notes, and snippets.

@byteandahalf
Created July 29, 2016 01:16
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save byteandahalf/6cfc4ad3697e3c7776d72e790387689b to your computer and use it in GitHub Desktop.
Save byteandahalf/6cfc4ad3697e3c7776d72e790387689b to your computer and use it in GitHub Desktop.
Adds some symbols to IDA for MCPE iOS 0.15.2
#include <idc.idc>
static symbol(addr, sym) {
MakeFunction(addr, BADADDR);
if(MakeNameEx(addr, sym, SN_NOWARN)) return;
auto i;
for(i = 0; i < 999; i++) if(MakeNameEx(addr, form("%s_%d", sym, i), SN_NOWARN)) return;
}
static main() {
symbol(0x100EEA020, "__ZTV12CreativeMode");
symbol(0x100E72E00, "__ZTV12SurvivalMode");
symbol(0x1006CD5A0, "__ZN8Material11getMaterialE12MaterialType");
symbol(0x100FB45B0, "__ZN5Block7mBlocksE");
symbol(0x100E7AC30, "__ZTV5Block");
symbol(0x1005FDB00, "__ZN5Block10initBlocksEv");
symbol(0x100601DE0, "__ZN5BlockC2ERKSsiRK8Material");
symbol(0x1005CE8FC, "__ZN11BlockSource15setBlockAndDataEiii9FullBlocki");
symbol(0x1005CD0C0, "__ZN11BlockSource15getBlockAndDataERK8BlockPos");
}
@jose-vm
Copy link

jose-vm commented Jul 29, 2016

Player::isHurt?

@byteandahalf
Copy link
Author

That's in the vtable, so why don't I just get the Player vtable address? That way you can hook or call any Player functions.

@jose-vm
Copy link

jose-vm commented Jul 30, 2016

How tho?

@byteandahalf
Copy link
Author

byteandahalf commented Jul 30, 2016

To call:

bool (*isHurt)(Player*) = (bool (*)(Player*)) player_vtable[276];
isHurt(player_instance);

To hook:
isHurt_real = (bool (*)(Player*)) player_vtable[276];
player_vtable[276] = (uintptr_t*) &isHurt_hook;

@jose-vm
Copy link

jose-vm commented Jul 31, 2016

what's the address thingy for the player vtable?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment