[PR #194] kb: Cars: Fast as Lightning 1.3.2 (iOS) - unlimited coins/gems by runtime hooking a stripped binary #196

New issue

Open

opened 2026-10-15 20:54:14 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 20:54:14 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/rehan-remade/universal-modder/pull/194
Author: @shimangSB
Created: 10/10/2026
Status: 🔄 Open

Base: main ← Head: kb/cars-fast-as-lightning-ios

📝 Commits (1)

7d26e10 kb: Cars: Fast as Lightning 1.3.2 (iOS) - unlimited coins/gems by runtime hooking a stripped binary

📊 Changes

3 files changed (+266 additions, -1 deletions)

View changed files

📝 knowledge/INDEX.md (+2 -1)
➕ knowledge/games/cars-fast-as-lightning/unlimited-coins-and-gems-in-cars-fast-as-lightning-1-3-2-ios.md (+226 -0)
📝 knowledge/index.json (+38 -0)

📄 Description

First iOS/mobile note in the KB.

What it covers. A Theos tweak for a 2015 Gameloft game (Cars: Fast as Lightning 1.3.2, iOS 16.3.1 rootless jailbreak). The interesting part is not the game but two constraints that decide the whole approach:

The target's C++ symbols are stripped (2120 defined symbols, zero game logic), so %hookf / dyld interposition is a silent no-op. The tweak must resolve image base + fixed offset at runtime and use MSHookFunction.
Balances are XOR-obfuscated inside a 9-slot ring buffer (arr[idx+1] ^ 0x6955634d, little-endian "McUi"), so scanning memory for the number never works - you have to find the accessor.

Also documented: the engine's balance mutators are add, not setters (they clamp and wrap the ring), the custom savegamelib container and its checksum, and the client-to-server direction of balance sync.

Seven gotchas. Three are not game-specific and cost real time:

stripped symbols make %hookf fail silently - the tweak installs and does nothing
MSUnhookFunction does not exist in Theos's substrate.h (compile-time only; tutorials still use it)
.gitattributes must force eol=lf, or a Windows-authored Makefile fails on the macOS CI runner

Verification. Static and byte-exact: every address and constant checked with capstone against the raw slice, cross-read with Ghidra on both armv7 and arm64, and the built .deb unpacked and checked member by member (both arch slices present, LC_CODE_SIGNATURE present, all 165 imports resolving). The functional oracle is the human playing the real game on jailbroken hardware.

Not verified (also stated in the note): the armv7 slice is analysis-only; server-side behaviour is unknowable from client code; the save container's checksum was never exercised.

Honesty. Written by an AI agent; agents: names it. The human supplied the decrypted IPA, installed the result and confirmed it works.

um kb check and um kb check --index both pass locally.

Note: committed through the Contents/Trees API because github.com:443 is unreachable from the authoring network (git-over-HTTPS is impossible there).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/rehan-remade/universal-modder/pull/194 **Author:** [@shimangSB](https://github.com/shimangSB) **Created:** 10/10/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `kb/cars-fast-as-lightning-ios` --- ### 📝 Commits (1) - [`7d26e10`](https://github.com/rehan-remade/universal-modder/commit/7d26e10eac23aee13cf96dc5e13ccb556d8983ba) kb: Cars: Fast as Lightning 1.3.2 (iOS) - unlimited coins/gems by runtime hooking a stripped binary ### 📊 Changes **3 files changed** (+266 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `knowledge/INDEX.md` (+2 -1) ➕ `knowledge/games/cars-fast-as-lightning/unlimited-coins-and-gems-in-cars-fast-as-lightning-1-3-2-ios.md` (+226 -0) 📝 `knowledge/index.json` (+38 -0) </details> ### 📄 Description First iOS/mobile note in the KB. **What it covers.** A Theos tweak for a 2015 Gameloft game (Cars: Fast as Lightning 1.3.2, iOS 16.3.1 rootless jailbreak). The interesting part is not the game but two constraints that decide the whole approach: - The target's C++ symbols are **stripped** (2120 defined symbols, zero game logic), so `%hookf` / dyld interposition is a silent no-op. The tweak must resolve `image base + fixed offset` at runtime and use `MSHookFunction`. - Balances are **XOR-obfuscated inside a 9-slot ring buffer** (`arr[idx+1] ^ 0x6955634d`, little-endian `"McUi"`), so scanning memory for the number never works - you have to find the accessor. Also documented: the engine's balance mutators are `add`, not setters (they clamp and wrap the ring), the custom savegamelib container and its checksum, and the client-to-server direction of balance sync. **Seven gotchas.** Three are not game-specific and cost real time: 1. stripped symbols make `%hookf` fail silently - the tweak installs and does nothing 2. `MSUnhookFunction` does not exist in Theos's `substrate.h` (compile-time only; tutorials still use it) 3. `.gitattributes` must force `eol=lf`, or a Windows-authored `Makefile` fails on the macOS CI runner **Verification.** Static and byte-exact: every address and constant checked with capstone against the raw slice, cross-read with Ghidra on both armv7 and arm64, and the built `.deb` unpacked and checked member by member (both arch slices present, `LC_CODE_SIGNATURE` present, all 165 imports resolving). The functional oracle is the human playing the real game on jailbroken hardware. **Not verified** (also stated in the note): the armv7 slice is analysis-only; server-side behaviour is unknowable from client code; the save container's checksum was never exercised. **Honesty.** Written by an AI agent; `agents:` names it. The human supplied the decrypted IPA, installed the result and confirmed it works. `um kb check` and `um kb check --index` both pass locally. Note: committed through the Contents/Trees API because `github.com:443` is unreachable from the authoring network (git-over-HTTPS is impossible there). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-15 20:54:14 +00:00

bsakaguchi referenced this issue

2026-10-15 20:54:15 +00:00

[PR #196] [MERGED] kb(schedule-i): three more gotchas from 0.4.7f12 #198

bsakaguchi referenced this issue

2026-10-15 20:54:46 +00:00

[PR #247] [MERGED] kb(schedule-i): six gotchas from building a mod menu and chained mixing #249