vfsfitvnm / frida-il2cpp-bridge

A Frida module to dump, trace or hijack any Il2Cpp application at runtime, without needing the global-metadata.dat file.
https://github.com/vfsfitvnm/frida-il2cpp-bridge/wiki
MIT License
1.03k stars 202 forks source link

The good old `special` replacement? #136

Closed TooYoungTooSimp closed 2 years ago

TooYoungTooSimp commented 2 years ago

When I was using v0.6.2, there was a special method after Il2Cpp.trace().sth.commit(). Sometimes I just want to get the parameter of a method call, and onEnter directly fits my need. But in latest version, this feature seems to disappeared. So I'm wondering if there is a replacement for me to get the params easily. Thanks.

vfsfitvnm commented 2 years ago

Hi, I changed the way I used to trace method invocations. "full" now relies on Interceptor.attach, meanwhile "detailed" still uses Il2Cpp.Method::implementation. The latter introduces so much overhead it was not convenient to make "full" keep using it. So, I refactored the whole Il2Cpp.Tracer class and ended up removing special to keep it as simple as possible.

However, what's your use case?

I suspect you were not tracing methods en masse, but just one or two. In this scenario, you could use Il2Cpp.Method::implementation to print the exact parameter you need (this is what the removed API did).

Otherwise, if you need to trace a lot of function, what's preventing you from using "detailed"? The overhead is still the same

TooYoungTooSimp commented 2 years ago

So you mean I should use implementation to make a new function which report specific parameter to host?

My use case is to translate the text in a game. So I need automate transport one parameter to host and translate it by programming.

And then there's another question, what is the best way to call original function in my implementation. Yes I can use invoke with providing its name again but I feel it is somehow inconvenience.

TooYoungTooSimp commented 2 years ago
someClass.method("someFunc").implementation = function (...params) {
        doSth(...params)
        return this.method("someFunc").invoke(...params);
   };

like this? or something else

vfsfitvnm commented 2 years ago

Yes, you are doing it correctly.

However, are you sure there isn't a better way to traslate every string in the game?

TooYoungTooSimp commented 2 years ago

Well, I still need original text to help understanding some wrong translation. So I need to send it to host and use a better online translator with a bilingual display. Thank you for your enthusiastic help. And one last question on this topic. How to avoid writing .method("someFunc") twice? Seems this in implementation means current class instance, and modify someFunc.implementation will not make someFunc to something else? I mean if someFunc.invoke() in my custom implementation will not recursively but directly call the original function?

someFunc.implementation=function(...params){
translate(...params)
return someFunc.invoke(...params)
}

If I understand correctly, the code above should fulfill my needs, right?

vfsfitvnm commented 2 years ago

How to avoid writing .method("someFunc") twice?

If the method is static, you could:

someFunc.implementation = (...params) => {
    // ...
    return someFunc.invoke(...params);
};

(notice the arrow syntax, you can see how this can be left behind).

Seems this in implementation means current class instance

Yes, this refers to either a Il2Cpp.Class or a Il2Cpp.Object.

I mean if someFunc.invoke() in my custom implementation will not recursively but directly call the original function?

Correct observation, however Frida is smart and calls the original code instead!

If I understand correctly, the code above should fulfill my needs, right?

Yes, this is exactly what Il2Cpp.Tracer did.


However, it feels odd you are obliged to intercept a method to translate the text: do you also want to display the translated text? Given the snippet, it doesn't seem so

TooYoungTooSimp commented 2 years ago

Yes, I directly display translated text on my pc lol Thanks again for your answer