search

vfsfitvnm / frida-il2cpp-bridge

A Frida module to dump, trace or hijack any Il2Cpp application at runtime, without needing the global-metadata.dat file.
https://github.com/vfsfitvnm/frida-il2cpp-bridge/wiki
MIT License
974 stars 199 forks source link

Do not use hardcoded IL2CPP constant values #286

Closed vfsfitvnm closed 1 year ago

vfsfitvnm commented 1 year ago

Right now, frida-il2cpp-bridge depends on few IL2CPP constant values (e.g. these ones).

However, if any of these values change (either for a major IL2CPP update or a customized IL2CPP source code), frida-il2cpp-bridge would just break (already tested).

So, as we are IL2CPP-structs free already (we don't have to know the struct layouts, which is awesome), we should also become IL2CPP-constants free!

Regarding the feasibility, it shouldn't be hard to implement.

vfsfitvnm commented 1 year ago

It doesn't look like FIELD_ATTRIBUTE_*, METHOD_ATTRIBUTE_* and METHOD_IMPL_ATTRIBUTE_* constants can be modified with ease - i.e. they must follow System.Reflection.FieldAttributes, System.Reflection.MethodAttributes and System.Reflection.MethodImplAttributes.

For instance, swapping FIELD_ATTRIBUTE_STATIC (0x0010) and FIELD_ATTRIBUTE_INIT_ONLY (0x0020) leads to a crash upon initialization; whereas swapping FIELD_ATTRIBUTE_LITERAL (0x0040) and FIELD_ATTRIBUTE_NOT_SERIALIZED (0x0080) breaks some IL2CPP internals.

This might be an interesting counter offensive on their side, i.e. breaking "non-critical for them, but critical for us" IL2CPP internals on purpose. However, in such unlikely to happen scenario, we just have to use System.Reflection.* instead of il2cpp_ internals (sure, we still need the bare minimum il2cpp_* stuff, though).