sneakyevil / IL2CPP_Resolver

A run-time API resolver for IL2CPP Unity.
https://sneakyevil.gitbook.io/il2cpp-resolver/
The Unlicense
364 stars 67 forks source link

Dealing with Unicode obfuscated class names #43

Closed gobboo closed 9 months ago

gobboo commented 9 months ago

While I am relatively new to il2cpp, I do have a genuine enquiry related to IL2CPP Resolver

My class names are \u0088\u008B\u0092\u0097\u0089\u008F\u008C\u0090\u0087

However, looping through each class and logging the hex of m_pName of an Il2CppClass* yields

C3 82 C2 88 C3 82 C2 8B C3 82 C2 92 C3 82 C2 97 C3 82 C2 89 C3 82 C2 8F C3 82 C2 8C C3 82 C2 90 C3 82 C2 87

Which is unicode, for

\00C2 \0088 \00C2 \008B \00C2 \0092 \00C2 \0097 \00C2 \0089 \00C2 \008F \00C2 \008C \00C2 \0090 \00C2 \0087

I understand this doesn't seem to be an issue with IL2CPP Resolver, but I was wondering how you'd reference the m_pName with this format, as referencing the unicode above doesn't yield any results nor does the first class name above.

I've heard about using tokens to find classes that are otherwise obfuscated, which I'm happy to look into, just wanted some insight on this before hand and how il2cpp reads / stores these class names itself

gobboo commented 9 months ago

Figured it out, seems like it does add that padding, but had to do it in a different escaped format,

const char Class[19] = "\xC2\x9D\xC2\x9F\xC2\x82\xC2\x84\xC2\x8A\xC2\x86\xC2\x87\xC2\x87\xC2\x96";

Which then IL2CPP Can find, weird that it adds some padding ( is what im calling it as it isn't in there in general );

works for me though :)