Perfare / Il2CppDumper

Unity il2cpp reverse engineer
MIT License
6.94k stars 1.37k forks source link

Potential wrong 64bit addresses #530

Closed feuerball11 closed 2 years ago

feuerball11 commented 2 years ago
Perfare commented 2 years ago

I don't think there is any error in the address, you should confirm that the base address of libil2cpp.so you obtained is correct.

feuerball11 commented 2 years ago

My base address should be correct. I'm getting it directly from /proc/self/maps in android. Here is the code I use for that (based on other projects):

uintptr_t get_libStart (const char* lib)
{
    uintptr_t basePtr = 0;
    char line[1024];
    FILE* fp = fopen("/proc/self/maps", "re");

    if(fp) {
        while(fgets(line, sizeof line, fp)) {
            if(strstr(line, lib)) {
                __android_log_print(ANDROID_LOG_DEBUG,"Hook", "getLibStartLine: %s",line);
                //7cdd288000-7cdd478000 rw-p
                basePtr = std::stoul(line, NULL, 16);
                __android_log_print(ANDROID_LOG_DEBUG,"Hook", "BasePtr: %p",basePtr);
                return basePtr;
            }
        }
    }
    return basePtr;
}

and here is the logcat output:

2021-12-04 14:08:00.328 18531-18531/? D/Hook: getLibStartLine: 73cc251000-73d0000000 r--p 00000000 fd:08 63796                          /data/app/~~tfk1pCnLlIIILYBGG20MTg==/com.handsomeoldtree.idlefirefightertycoon-3ovTS1wBzKW-nli3i9998A==/lib/arm64/libil2cpp.so
2021-12-04 14:08:00.328 18531-18531/? D/Hook: BasePtr: 0x73cc251000

I can't see anything wrong here. Or am I missing something? The same code also works fine on 32 bit.

I'm then calculating the real address with this function:

uintptr_t getRealOffset(uintptr_t address) {
    if (libBase == 0) libBase = get_libStart(libName);
    if (libBase == 0)
        return 0;
    return (libBase + address);
}

If the base address is correct, and the pointers I get are correct, and the same code works fine on 32 bit. I'm not sure anymore what potentially goes wrong here.

Any help would be much appreciated, though I could understand if that ticket will be closed, as this seems to be an issue in my code then, and not in yours.

Perfare commented 2 years ago

73cc251000-73d0000000 r--p 00000000 fd:08 63796

Obviously this is wrong. I suggest you print out the complete maps. The flag of the base address should be r-xp instead of r--p.

feuerball11 commented 2 years ago

Interesting. Here is a dump of /proc/self/maps: https://pastebin.com/asuYZ4AT

I'll now check if I can find an entry with r-xp. Thanks for this tipp. I sadly miss a lot of knowledge around this, and just now start to figure everything out.

feuerball11 commented 2 years ago

OMG, It worked! You're my hero now :-) I had this issue for months now and was nearly giving up on it. Thanks a lot!