While people start cheating with H5GG Enhanced Menu on Unity Game, they might then looking for way to execute the cheat in a convenient way.
JSPlug-in is obviously the ANSWER to this.
JSPlug-in is a framework setup of H5GG Enhanced Menu which allow you to extend the H5GG menu with new features, such as cheat menu for a game.
Under this Framework setup, user can leverage prebuilt H5GG Enhanced Menu function in their own user cheat. This largely simplify the complexity of the script, while having amazing features in it. To name a few:
1. Direct retrieve of Unity object pointers (Covering on Scene User Object, Singleton, any object that could link from object already found)
2. Use Unity dump structure to define the cheat without the need to hard code any offset. This essentially relieve people's headache in preparing cheat updates for game updates, because there is no more script update required.
3. Javascript as base, allow easy create cheat menu
With latest release of H5GG Enhanced Menu v1.8.4 onwards, writing JSPlug-in is getting easier. The introduction of Unity User Object wrapper, seamlessly expose Unity User Object to Javascript.
- User can access to Unity User Object's Fields and Methods directly from Javascript. Get / Set / Call and return, everything becomes so initiative.
Here let's go through a quick example to demonstrate how powerful yet easy, JSPlug-in is.
Game: Subway Surfers (Any version)
Cheat feature: Big Jump (jump up very high)
For those who want to know how to use H5GG Enhanced Menu to cheat this. You may see below tutorial from @impapas.
Spoiler
There are multiple way to implement this with JSPlug-in, it is all available for you to choose from.
Option 1) Minimum number of lines of code. 3 lines only.
Spoiler
var script = initializeUnitySupport();var aryObj = script.call("findUnityObjectOfType", ["SYBO$RunnerCore$Character$CharacterMotor", true]);writeFloat(readPtr(Number(aryObj[0])+Number(gUnityClasses.SYBO$RunnerCore$Character$CharacterMotor._config.offset))+Number(gUnityClasses.SYBO$RunnerCore$Character$CharacterMotorConfig.JumpHeight.offset),50)
NOTE:
1. Line 1 initialise the Unity Support in JSPlug-in
2. Line 2 retrieve an array of Unity User Object of type -SYBO$RunnerCore$Character$CharacterMotor. This is the naming convention used in H5GG Enhanced Menu for Class. It essentially replace the dot(.) of Unity namespace and class name into dollar sign($).
e.g.SYBO.RunnerCore.Character.CharacterMotor ->SYBO$RunnerCore$Character$CharacterMotor
ThisCharacterMotor class is a class that we can easily retrieve its runtime object pointer and has relation with the CharacterMotorConfig class that holds the data we want to cheat
3. Line 3 retrieve CharacterMotorConfig object pointer from CharacterMotor's _config field, then write new value toCharacterMotorConfig'sJumpHeightfield
Option 2) Easiest to understand. 7 lines (4 lines more) but more readable.
Spoiler
var script = initializeUnitySupport();var aryObj = script.call("findUnityObjectOfType", ["SYBO$RunnerCore$Character$CharacterMotor", true]);var CharacterMotor = new UnityObject(aryObj[0])CharacterMotor.loadFields(['_config'])var CharacterMotorConfig = new UnityObject(CharacterMotor._config)CharacterMotorConfig.loadFields(['JumpHeight'])CharacterMotorConfig.JumpHeight = 50
NOTE:
1. Line 1 and 2, are the same as Option 1
2. Line 3 uses Unity User Object Wrapper (UnityObject) to wrapCharacterMotor's object pointer
3. Line 4 tell JSPlug-in to load_config field's meta data and enable direct access
4. Line 5 uses Unity User Object Wrapper (Unity Object) to wrapCharacterMotorConfig'sobject pointer retrieved fromCharacterMotor._config
YES, dot(.) notation, you can use [] notation as well -CharacterMotor["_config"]
5.Line 6 tell JSPlug-in to loadJumpHeightfield's meta data and enable direct access
6. Line 7 write new value toCharacterMotorConfig.JumpHeight directly
YES, dot(.) notation, you can use [] notation as well -CharacterMotorConfig["JumpHeight"] = 50
Option 3) Wrap everything with a Cheat Menu.
Spoiler
/* H5GG Plugin Mod Menu logic should enable easier Mod Menu development for non-jailbroken. It preserve existing H5GG UI and features, while adding new cheat menu. Cheat implemented using a patch free approach, the game binary does not required to patch. Contribute by Happy Secret on iOSGods (2023)*/var script = initializeUnitySupport();//[MODIFY] Configure Cheat Herevar cheats = { JumpHeight: ["CharacterMotorConfig", "JumpHeight", "50", "SELF", "ON"],};var intervalID;var aryObjvar cheatState = false;var cheatMode = "recurrent";var recurrentInterval = 1200; //try not to be small than 1000, prevent system freezefunction toogleCheat() { cheatState = !cheatState; document.getElementById("applybutton").textContent = ' Toggle OFF '; document.getElementById("applybutton").style.backgroundColor = '#E8E8E850'; if (cheatState) { intervalID = setInterval(function () { if (cheatState) { try { script = initializeUnitySupport();//[MODIFY]Find core object object list aryObj = script.call("findUnityObjectOfType", ["SYBO$RunnerCore$Character$CharacterMotor", true]); } catch (e) { //reset Unity Support gIl2cppInit = false; var script = initializeUnitySupport(); appendLog("Unity support crashed and reset complete"); } if (!aryObj) { appendLog("Cannot find object to cheat. Engine stopped."); cheatState = false; document.getElementById("applybutton").textContent = ' Toggle Cheat '; return; } else if (aryObj.length == 0) {appendLog("Cheat waiting for core object.");return;} for (let i = 0; i < aryObj.length; i++) { //[MODIFY]Start prepare core object for delink / filtering here let CharacterMotor = new UnityObject(aryObj[i]); //debugInfo("BattleCharacter (" + aryObj[i].toString(16) + ") with UnityObject:" + BattleCharacter, [aryObj[i]]) CharacterMotor.loadFields(["_config"]); //debugInfo("BattleCharacter (" + aryObj[i].toString(16) + ") with player:" + BattleCharacter.Status, [aryObj[i]]) //debugInfo("BattleCharacter (0x" + aryObj[i].toString(16) + ") with CurrentUnitType:" + BattleCharacter.CurrentUnitType, [aryObj[i]])//[MODIFY]Locate the right object to cheat (SELF)let isSelf = true//BattleCharacter.CurrentUnitType==100? true:false; let cheatObj = {}; //End prepare core object for delink / filtering here //[MODIFY]Start prepare cheat object herelet CharacterMotorConfig = new UnityObject(CharacterMotor._config)CharacterMotorConfig.loadFields(["JumpHeight"]) cheatObj["CharacterMotorConfig"] = CharacterMotorConfig //End prepare cheat object for (var prop in cheats) { if (Object.prototype.hasOwnProperty.call(cheats, prop)) { let obj; let addr; let oldValue = 0;if (isNaN(cheats[prop][2])){switch (cheats[prop][2]){case "ONE":cheats[prop][2] = 1break;}} if (isSelf && cheats[prop][3] == "SELF" && cheats[prop][4] == "ON") { cheatObj[cheats[prop][0]][cheats[prop][1]] = isNaN(cheats[prop][2]) ? cheatObj[cheats[prop][0]][cheats[prop][2]] : cheats[prop][2]; } else if (isSelf==false && cheats[prop][3] == "ENEMY" && cheats[prop][4] == "ON") {cheatObj[cheats[prop][0]][cheats[prop][1]] = isNaN(cheats[prop][2]) ? cheatObj[cheats[prop][0]][cheats[prop][2]] : cheats[prop][2]; }//end if TURN ON } }//end For cheat item }//end For core object listappendLog("Cheat applied successfully"); } else { clearInterval(intervalID); } }, recurrentInterval); } else { //code will stop on next coming iteration document.getElementById("applybutton").textContent = ' Toggle Cheat '; appendLog("Cheat stopped"); } if (cheatMode != "recurrent") clearInterval(intervalID);}/* Add button on H5GG UI to open the Cheat UI, if it does not exist */if ($("#cheatpluginmodmenu").length == 0) { var btn = $('<button id="cheatpluginmodmenu">Cheat</button>'); btn.attr("credit", "Happy Secret"); btn.click(function () { $("#cheatpluginpage").show(); }); //backward compatible with standard H5GG menu if ($("#frontview").length == 0) { $('#results_count').after(btn); } else { $("#frontview").append(btn); }}/* Create the Cheat UI Layer, if it does not exist */if ($("#cheatpluginpage").length == 0) { var popup_pixelfancheat_html = $('<div id="cheatpluginpage" style="background-color: #FDFDFD; width:100%; height:100%; position:absolute; left:0; top:0; border:1px solid #B8B8B880; border-radius: 5px; padding: 0px; z-index: 99999;-webkit-user-select: all;-webkit-touch-callout: default;"></div>'); $(document.body).append(popup_pixelfancheat_html);}/* Generate Clean Cheat Menu UI */var html = ' Cheat by Happy Secret';html += '<br><div style="float:right; font-size:16px; font-family: Arial, sans-serif;" onclick="closecheatpluginpage()"> X </div>';/* Prepare Cheat Item */for (var prop in cheats) { if (Object.prototype.hasOwnProperty.call(cheats, prop)) {if (isNaN(cheats[prop][2]))html += '<label><input name="' + prop + '"type="checkbox" ' + '" onchange="checkchange(this)" checked/>' + prop + '<output>(' + cheats[prop][4] + ')</output></label>';else html += '<br><label><input name="' + prop + '"type="range" min="0" max="' + cheats[prop][2] * 2 + '" value="' + cheats[prop][2] + '" style="width:50%" onchange="rangechange(this)" />' + prop + '<output>(' + cheats[prop][2] + ')</output></label>'; }}html += '<p align="center"><button onclick="toogleCheat()" id="applybutton"> Toggle Cheat </button>';html += '</hr><div id="cheatpluginpagelog" class="scrollbar" ></div>';$("#cheatpluginpage").html(html);$("#cheatpluginpage").hide();function closecheatpluginpage() { $("#cheatpluginpage").hide();}function rangechange(input) { cheats[input.name][2] = Number(input.value); input.nextElementSibling.value = '(' + input.value + ')'; //input.previousElementSibling.value = '(' + input.value + ')'; //Change Apply Button Color to remind user to press Apply document.getElementById("applybutton").style.backgroundColor = 'yellow';}function checkchange(input) { cheats[input.name][4] = input.checked ? "ON" : "OFF" input.nextElementSibling.value = '(' + cheats[input.name][4] + ')'; //Change Apply Button Color to remind user to press Apply document.getElementById("applybutton").style.backgroundColor = 'yellow';}/* Create Cheat Log */function appendLog(msg) { var oldmsg = $("#cheatpluginpagelog").html(); if (oldmsg.length > 300) oldmsg = ""; oldmsg = getCurTime() + ' - ' + msg + '<br>' + oldmsg; $("#cheatpluginpagelog").html(oldmsg);}
NOTE:
1. This is a simple cheat menu template. It will automatically create Slider or Checkbox for cheats. It automatically run the cheat every 1200 milliseconds.
2. You do not need to understand the entire menu code in order to use it. There essentially 5 Steps to use this template script
STEP 1) Define what you want to cheat with the script
//[MODIFY] Configure Cheat Herevar cheats = { JumpHeight: ["CharacterMotorConfig", "JumpHeight", "50", "SELF", "ON"],};
- First JumpHeight is the label of the slider
-CharacterMotorConfig is the name of the class that hold the field you want to change
-Second JumpHeight is the field name to change
-50 is the value to change. Use "ONE" for cheat that only need to enable/disable without a numeral value.
-SELF is for de-link, it used to tell which group of object should apply this cheat on (Filtering condition)
-ON is a switch to turn on and off the cheat
STEP 2) Change the root object of interest, which should able to link to your other cheat object
//[MODIFY]Find core object object listaryObj = script.call("findUnityObjectOfType", ["SYBO$RunnerCore$Character$CharacterMotor", true]);
Change the “SYBO$RunnerCore$Character$CharacterMotor” to an object class that you can find object link with Unity Static Analyzer. You need to full long name with those $.
STEP 3) Create the Unity User Object wrapper object from a Root Object instance address, and enable the linking field access
//[MODIFY]Start prepare core object for delink / filtering herelet CharacterMotor = new UnityObject(aryObj[i]);CharacterMotor.loadFields(["_config"]);
Here create the base Unity Object, you just need to name it and identify that Field In this object you are going to use
STEP 4) Define the scope of the cheat, certain cheat we do not want to globally apply. (Filtering condition or Grouping)
//[MODIFY]Locate the right object to cheat (SELF)let isSelf = true; //BattleCharacter.CurrentUnitType==100? true:false;
This is used to delink. Delink mean, cheat apply to certain object not all. Say, only on myself but not enemy. We want to amplify our team's attack but not enemy's team.
STEP 5) Create the Unity User Object wrapper object from a Root Object instance address, and enable the linking field access
//[MODIFY]Start prepare cheat object herelet CharacterMotorConfig = new UnityObject(CharacterMotor._config)CharacterMotorConfig.loadFields(["JumpHeight"])cheatObj["CharacterMotorConfig"] = CharacterMotorConfig
Like the earlier step, you setup the cheat Unity Object here and put it under the cheatObj
If you have 3 different Unity User Objects, which holds 5 fields you want to cheat. Here, you will have 3 set of above logics with each defines one of the Unity User Object.
Just to remember, EVERY SINGLE field we use, we need to load them explicitly.
With this 5 Steps, you should able to create simple Cheat Menu for Simple Unity Games.
This is obviously not for all Unity Games. Some Unity Games can't be cheated without Patching / Hooking.
New Badge
1. As they are JSPlug-in, in order to enable autoload on these script when H5GG startup and trigger. You need to define the name with prefix "H5JSPlugin - " with extension ".js".
e.g.H5JSPlugin - Subway Surfers.js
2. And you will need to put this Javascript file either in Document folder or .app folder (app bundle).
Please read Release note ofH5GG Enhanced Menu for detail
Updated by Happy Secret