HOOK C++ FUNCTION

cat.cpp

#include <iostream>      // for cout and cin

using namespace std;

class Cat                   // begin declaration of the class
{
  public:                    // begin public section
    Cat(int initialAge);     // constructor
    ~Cat();                  // destructor
    int GetAge();            // accessor function
    void SetAge(int age);    // accessor function
    void Meow();
 private:                   // begin private section
    int itsAge;              // member variable
    char * string;
};

 // constructor of Cat,
Cat::Cat(int initialAge)
{
  itsAge = initialAge;
  string = new char[10];
}

// GetAge, Public accessor function
// returns value of itsAge member
int Cat::GetAge()
{
   return itsAge;
}

Cat::~Cat(){}

// Definition of SetAge, public
// accessor function

 void Cat::SetAge(int age)
{
   // set member variable its age to
   // value passed in by parameter age
   itsAge = age;
}

// definition of Meow method
// returns: void
// parameters: None
// action: Prints "meow" to screen
void Cat::Meow()
{
   cout << "Meow.\n";
}

// create a cat, set its age, have it
// meow, tell us its age, then meow again.
int main()
{
  dlopen("/var/root/tmp/cat.dylib", RTLD_NOW);
  int Age;
  cout<<"How old is Frisky? ";
  cin>>Age;
  Cat Frisky(Age);
  Frisky.Meow();
  cout << "Frisky is a cat who is " ;
  cout << Frisky.GetAge() << " years old.\n";
  Frisky.Meow();
  Age++;
  Frisky.SetAge(Age);
  cout << "Now Frisky is " ;
  cout << Frisky.GetAge() << " years old.\n";
  return 0;
}

Makefile

SDK=/var/root/code/iPhoneOS7.1.sdk

CCPP=clang++ -isysroot $(SDK)
CC=clang -isysroot $(SDK)

all: cat cat.dylib
clean:
	rm -f cat cat.dylib

cat: cat.cpp
	$(CCPP) cat.cpp -o cat

cat.dylib: tweak.m
	$(CC) tweak.m /usr/lib/libsubstrate.dylib -I/usr/include -dynamiclib -o cat.dylib

tweak.m

#import <substrate.h>
#import <stdio.h>

__attribute__((__unused__)) static void (*orig_setAge)(void *self, int age);
static void hook_setAge(void *self, int age)
{
    orig_setAge(self, 2000);
}

MSHook(void, setAge, void *self, int age)
{
    _setAge(self, 2000);
}

__attribute__((constructor))
static void initialize()
{
    void *func = dlsym(RTLD_DEFAULT, "_ZN3Cat6SetAgeEi");
    //this one crashes
    //MSHookFunction(func, (void *)hook_setAge, (void **)orig_setAge);
    //this one works
    MSHookFunction(func, MSHake(setAge));
    
    printf("hooked!!!!111111\n");
}

im

fucking

_dumb_.

 //this one crashes
MSHookFunction(func, (void *)hook_setAge, (void **)&orig_setAge); 

MSHookFunction(func, (void *)hook_setAge, (void **)&orig_setAge); 

(void **)&orig_setAge); 

&orig_setAge

&

GG, 2 hours of my life

arm64 c++ use X8 reg to save this ptr
MSHookFunction use X8 reg to save func ptr

u wot m8??