[PR #193] [CLOSED] kb: Cars: Fast as Lightning 1.3.2 (iOS) - unlimited coins/gems by runtime hooking a stripped binary #197

New issue

Closed

opened 2026-10-15 20:54:14 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 20:54:14 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/rehan-remade/universal-modder/pull/193
Author: @shimangSB
Created: 10/10/2026
Status: ❌ Closed

Base: main ← Head: kb/cars-fast-as-lightning-unlimited-coins-and-gems-in-cars-fast-as-lightning-1-3

📝 Commits (3)

58e4554 kb: add Cars: Fast as Lightning field note (via API; git host unreachable)
cf6a3b3 kb: add Cars: Fast as Lightning field note (via API; git host unreachable)
41e0e04 kb: add Cars: Fast as Lightning field note

📊 Changes

3 files changed (+266 additions, -1 deletions)

View changed files

📝 knowledge/INDEX.md (+2 -1)
➕ knowledge/games/cars-fast-as-lightning/unlimited-coins-and-gems-in-cars-fast-as-lightning-1-3-2-ios.md (+226 -0)
📝 knowledge/index.json (+38 -0)

📄 Description

First iOS/mobile note in the KB.

What it covers. A Theos tweak for a 2015 Gameloft game (Cars: Fast as Lightning 1.3.2, iOS 16.3.1 rootless jailbreak). The interesting part is not the game but two constraints that determine the whole approach:

The target's C++ symbols are stripped (2120 defined symbols, zero game logic), so %hookf / dyld interposition is a silent no-op. The tweak must resolve image base + fixed offset and use MSHookFunction.
Balances are XOR-obfuscated inside a 9-slot ring buffer (arr[idx+1] ^ 0x6955634d, little-endian "McUi"), so scanning memory for the number never works - you have to find the accessor.

Also documented: the engine's balance mutators are add (not setters) with clamps and ring wrap, the custom savegamelib container and its checksum, and the client-to-server direction of balance sync.

Seven gotchas, including three that cost real time and are not game-specific:

stripped symbols make %hookf fail silently
MSUnhookFunction does not exist in Theos's substrate.h (compile-time only, tutorials still use it)
.gitattributes must force eol=lf or a Windows-authored Makefile fails on the macOS CI runner

Verification. Static and byte-exact: every address/constant checked with capstone against the raw slice, cross-read with Ghidra on both armv7 and arm64, and the built .deb unpacked and checked member by member (both arch slices, LC_CODE_SIGNATURE present, all 165 imports resolving). The functional oracle is the human playing the real game on jailbroken hardware.

Not verified (stated in the note): the armv7 slice is analysis-only; server-side behaviour is unknowable from client code; the save container's checksum was never exercised.

Honesty. Written by an AI agent; the agents: field names it. The human supplied the decrypted IPA, installed the result and confirmed it works.

um kb check and um kb check --index both pass locally (45 notes).

Note: pushed via the Contents API because github.com:443 is unreachable from the authoring network, so this branch has three API commits rather than one.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/rehan-remade/universal-modder/pull/193 **Author:** [@shimangSB](https://github.com/shimangSB) **Created:** 10/10/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `kb/cars-fast-as-lightning-unlimited-coins-and-gems-in-cars-fast-as-lightning-1-3` --- ### 📝 Commits (3) - [`58e4554`](https://github.com/rehan-remade/universal-modder/commit/58e4554f0b39b8412870ff1edefd88fd9ea2740c) kb: add Cars: Fast as Lightning field note (via API; git host unreachable) - [`cf6a3b3`](https://github.com/rehan-remade/universal-modder/commit/cf6a3b3f9d5fcfb360daf4bbbc7435c61ac62ac3) kb: add Cars: Fast as Lightning field note (via API; git host unreachable) - [`41e0e04`](https://github.com/rehan-remade/universal-modder/commit/41e0e04b8ac986a056e134dbda4b37a753c42d64) kb: add Cars: Fast as Lightning field note ### 📊 Changes **3 files changed** (+266 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `knowledge/INDEX.md` (+2 -1) ➕ `knowledge/games/cars-fast-as-lightning/unlimited-coins-and-gems-in-cars-fast-as-lightning-1-3-2-ios.md` (+226 -0) 📝 `knowledge/index.json` (+38 -0) </details> ### 📄 Description First iOS/mobile note in the KB. **What it covers.** A Theos tweak for a 2015 Gameloft game (Cars: Fast as Lightning 1.3.2, iOS 16.3.1 rootless jailbreak). The interesting part is not the game but two constraints that determine the whole approach: - The target's C++ symbols are **stripped** (2120 defined symbols, zero game logic), so `%hookf` / dyld interposition is a silent no-op. The tweak must resolve `image base + fixed offset` and use `MSHookFunction`. - Balances are **XOR-obfuscated inside a 9-slot ring buffer** (`arr[idx+1] ^ 0x6955634d`, little-endian `"McUi"`), so scanning memory for the number never works - you have to find the accessor. Also documented: the engine's balance mutators are `add` (not setters) with clamps and ring wrap, the custom savegamelib container and its checksum, and the client-to-server direction of balance sync. **Seven gotchas**, including three that cost real time and are not game-specific: 1. stripped symbols make `%hookf` fail silently 2. `MSUnhookFunction` does not exist in Theos's `substrate.h` (compile-time only, tutorials still use it) 3. `.gitattributes` must force `eol=lf` or a Windows-authored `Makefile` fails on the macOS CI runner **Verification.** Static and byte-exact: every address/constant checked with capstone against the raw slice, cross-read with Ghidra on both armv7 and arm64, and the built `.deb` unpacked and checked member by member (both arch slices, `LC_CODE_SIGNATURE` present, all 165 imports resolving). The functional oracle is the human playing the real game on jailbroken hardware. **Not verified** (stated in the note): the armv7 slice is analysis-only; server-side behaviour is unknowable from client code; the save container's checksum was never exercised. **Honesty.** Written by an AI agent; the `agents:` field names it. The human supplied the decrypted IPA, installed the result and confirmed it works. `um kb check` and `um kb check --index` both pass locally (45 notes). Note: pushed via the Contents API because `github.com:443` is unreachable from the authoring network, so this branch has three API commits rather than one. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 20:54:14 +00:00