vfsfitvnm / frida-il2cpp-bridge

A Frida module to dump, trace or hijack any Il2Cpp application at runtime, without needing the global-metadata.dat file.
https://github.com/vfsfitvnm/frida-il2cpp-bridge/wiki
MIT License
1.03k stars 202 forks source link

Alloc returns null #202

Closed bluewave41 closed 2 years ago

bluewave41 commented 2 years ago

Given the following code

const assembly = Il2Cpp.Domain.tryAssembly("Assembly-CSharp").image;
console.log(assembly.class('QAOverlayDialog'));
const o = assembly.class('QAOverlayDialog').alloc();
console.log(o);

The following is printed out

// Assembly-CSharp class QAOverlayDialog : Screen { MenuTabButton defaultTab; // 0xd0 MenuTabButton[] tabs; // 0xd8 OverlayWidget widget; // 0xe0 System.Void Start(); // 0x0182ace8 System.Void OnClose(); // 0x0182ae7c System.Void .ctor(); // 0x0182ae90 } null

The class exists but null is returned when trying to make a new one. Why might this happen?

vfsfitvnm commented 2 years ago

It prints null because its ToString method returns null itself (in fact, you are just allocating the object: allocation ≠ initialization). The returned object is not null (try console.log(o.handle);).

Also, I don't think creating a fresh QAOverlayDialog object is the right thing to do, unless you know what you are doing.

bluewave41 commented 2 years ago

Also, I don't think creating a fresh QAOverlayDialog object is the right thing to do, unless you know what you are doing.

Probably not but that's beyond the scope of this project. I'm just playing around.

Any other class I've alloc'd prints out the name of the class which confused me as this one doesn't. I'm sure that trying to call the constructor on that alloc'd class crashed before but it doesn't seem to now so maybe I'm just going crazy.

const o = assembly.class('QAOverlayDialog').alloc();
o.method('.ctor').invoke();
console.log(o.handle);
o.method('Start').invoke();
console.log('THIS IS O', o); //never prints

Now prints

0x7902395f00

Yeah just one but that's probably due to some unrelated issue. Closing this as it's not actually an issue.