Locating Offsets - Unity

Guide on how to locate offsets for games

- Download the game you want to hack from armconverter decrypted appstore
- Open the new downloaded IPA in WinRAR & open the Data folder
-- If no Data folder exists, game = Non-Unity. Harder to hack & requires IDA OR debug to hack it.
- Drag the global-metadata to desktop and head back to main directory (where Data folder is)
- Look for a folder called Frameworks
-- If no Frameworks exists, binary file will be the LARGEST (usually) file in the main directory
- Drag that binary to your desktop too. Now you should have the binary file & global-metadata file

- Open il2cppDumper and locate the binary file THEN the global-metadata file and let the game be dumped
- Open the dump.cs file in Notepad++ or vscode and start searching!

-- Look for things like coins, softcurrency, hardcurrency, premiumcurrecy, health, damage, gold, gems
-- Make sure as well to look for get_ or get functions. Usually, coins/whatever will start with these.
-- Also search in public classes too. Examples - class Currency (Big one), class Wallet, class Currencies, class Player, class User etc.
-- Please note, this is all trial & error. I don't go into hacking a game expecting to hack the shit out of it because idk what I will find until I TEST.

-- You have an offset you want to test? Brilliant. Make sure the game is sideloaded via Sideloadly & make sure JIT is enabled!

- Load the game & in offset, type in the offset you want to test & in patch, type in C0035FD6 (RET. This returns the function, making it end instantly.)

-- If nothing happens with C0035FD6, try with E0031D2AC0035FD6 (Mov w0, w29 + RET. This starts the function off with 1.8b value then instantly ends it.)
-- If nothing happens again, try a different offset. Make sure to try and change the value of whatever you're testing first to see if it's done anything.

Why do we use mov w0, w29 then RET?
- Mov w0, w29 + RET starts the function with 1.8b then instantly ends it like I mentioned above. This is useful especially when testing get_Coins, or get_Health.
- We only use RET IF we're editing the first address of the function. If you try using RET after the first line or mid-way through a function, the game will just crash. All the offsets in the dump.cs are the first address of that function.
- If you locate the offset in IDA, you will see that. If you've found a function called void AddCoins(int coin) or some shit, locate the offset and look for ADD/FADD.

-- Use armconverter and type in MOV w0, w29 (1.8b val), Mov w0, #0 (0 value or false parameter), Mov w0, #1 (1 value or true parameter). You can also do MOV w0, #1-65000 (value 1 all the way to 65000. Example - Mov w0, #6969)