djkaty / Il2CppInspector

Powerful automated tool for reverse engineering Unity IL2CPP binaries
http://www.djkaty.com
GNU Affero General Public License v3.0
2.6k stars 422 forks source link

2018.4.30f1 loading bug #174

Closed Zeprus closed 3 years ago

Zeprus commented 3 years ago

It appears that there is a bug for unity version 2018.4.30f1. The metadata does not seem to be obfuscated and on previous versions of the app made in Unity 2018.2.0b9 the Inspector works perfectly fine. Files: il2cppFiles.zip

Il2CppInspector output:

F:\Il2CppInspector\Il2CppInspector.CLI\bin\Release\netcoreapp3.1\win-x64\publish>Il2CppInspector.exe ./libil2cpp.so ./global-metadata.dat
Il2CppInspector Command-Line Edition
Version 2021.1
(c) 2017-2021 Katy Coe - www.djkaty.com - www.github.com/djkaty

Using plugin: IL2CPP API Discovery
Using plugin: Binary metadata field order deobfuscator
Using plugin: Metadata strings XOR decryptor
Using plugin: Binary file XOR decryptor
Detected metadata version 24,1
Processed 820729 relocations
Plugin Binary file XOR decryptor: Detecting encryption
Container format: ELF64
Container endianness: Little
Architecture word size: 64-bit
Instruction set: ARM64
Global offset: 0x0000000000000000
Symbol table(s) found with 141 entries
No matches in symbol table
No matches via code heuristics
Required structures acquired from data heuristics
CodeRegistration struct found at 0x0000000004FB64C0 (file offset 0x027AD4C0)
MetadataRegistration struct found at 0x0000000004FB6540 (file offset 0x027AD540)
Could not analyze IL2CPP data. Ensure that the latest core plugins package is installed and all core plugins are enabled before filing a bug report. The error was: Sequence contains no matching element
Analyze IL2CPP data: 3,29 sec

Note: il2cppdumper also fails

Zeprus commented 3 years ago

Update: Running IL2CPPInspector over the ARM version of the executable works fine. I believe the ARM64 file is just bad and will close this issue. armFiles.zip

F:\Il2CppInspector\Il2CppInspector-2021.1>Il2CppInspector-cli.exe ./libil2cpp.so ./global-metadata.dat
Il2CppInspector Command-Line Edition
Version 2021.1
(c) 2017-2021 Katy Coe - www.djkaty.com - www.github.com/djkaty

Using plugin: IL2CPP API Discovery
Using plugin: Binary metadata field order deobfuscator
Using plugin: Metadata strings XOR decryptor
Using plugin: Binary file XOR decryptor
Detected metadata version 24,1
Processed 843006 relocations
Plugin Binary file XOR decryptor: Detecting encryption
Container format: ELF
Container endianness: Little
Architecture word size: 32-bit
Instruction set: ARM
Global offset: 0x0000000000000000
Symbol table(s) found with 842 entries
No matches in symbol table
Required structures acquired from code heuristics. Initialization function: 0x000000000067B6C0
CodeRegistration struct found at 0x0000000004052338 (file offset 0x04051338)
MetadataRegistration struct found at 0x0000000004052378 (file offset 0x04051378)
IL2CPP binary version 24,1
Analyze IL2CPP data: 3,74 sec
Processing image 0 - ARM / 32-bit
Create .NET type model: 1,70 sec
IL2CPP API discovery was successful
Selected Unity version(s) 2018.4.18 - 2018.4.31 (types: 2018.4.18 - 2018.4.31, APIs: 2018.3.0 - 2018.4.99)
Create C++ application model: 6,81 sec
Generate C# code: 6,04 sec
Generate C++ code: 3,35 sec
Generate JSON metadata: 2,25 sec
Generate IDA Python script: 0,00 sec
Generate .NET assembly shim DLLs: 8,94 sec