vfsfitvnm / frida-il2cpp-bridge

A Frida module to dump, trace or hijack any Il2Cpp application at runtime, without needing the global-metadata.dat file.
https://github.com/vfsfitvnm/frida-il2cpp-bridge/wiki
MIT License
1k stars 200 forks source link

il2cpp.perform not being called #359

Closed zein1414 closed 1 year ago

zein1414 commented 1 year ago

I am using memu emulator.

The Code:

console.log("Frida loaded succesfully !"); Il2Cpp.perform(() => { console.log(Il2Cpp.unityVersion); });

The result:

C:\Users\Work_PC\Desktop\Modding\frida-zads>npm run spawn

frida-zads@1.0.0 spawn frida -U -f com.zads.android -l dist/agent.js

 ____
/ _  |   Frida 16.1.4 - A world-class dynamic instrumentation toolkit

| (_| |

| Commands: // |_| help -> Displays the help system . . . . object? -> Display information about 'object' . . . . exit/quit -> Exit . . . . . . . . More info at https://frida.re/docs/home/ . . . . . . . . Connected to ASUS I005DA (id=127.0.0.1:21503) Spawning com.zads.android... Frida loaded succesfully ! Spawned com.zads.android. Resuming main thread! [ASUS I005DA::com.zads.android ]->

vfsfitvnm commented 1 year ago

Follow #355

thinhbuzz commented 1 year ago

@vfsfitvnm For some reason perform is not called, specifically on the first start when il2cpp has not been called and intercept is not working. I patched it temporarily by waiting for il2cpp, you can take a look at this case. Device: xiaomi mi a2 Android verision: 8.1 Rom link: https://mifirm.net/model/jasmine.ttt#global V9.6.16.0.ODIMIFE https://github.com/vfsfitvnm/frida-il2cpp-bridge/blob/e97fb50ecd8e3e44e5fade24d816809e15325842/src/utils/native-wait.ts#L65

vfsfitvnm commented 1 year ago

@thinhbuzz Are you using frida-gadget or a emulated environment?

thinhbuzz commented 1 year ago

@vfsfitvnm no, i got that error on xiaomi mi a2 device (rooted), start by command: frida -Uf package.name.com -l _.js --runtime=v8

vfsfitvnm commented 1 year ago

Unfortunately I cannot debug it. It looks like a rom/device/vendor specific issue, my take is the library is being loaded by a export I am not aware of. If you are able to pinpoint and solve the issue, please let me know

Flechaa commented 1 year ago

Here's how I fixed it link It seems to happen on Android 8.1 and lower I can replicate it on my device but I haven't looked on how it could be fixed.

vfsfitvnm commented 1 year ago

@Flechaa Thanks. Perhaps I could implement a busy-waiting version of native-wait.ts. However, if it's Android specific, I can definitely try to reproduce on the official android emulator; it's just hard to find a x86 Unity game

Flechaa commented 1 year ago

Indeed it really looks like Android specific, I have tried on a Huawei device running Android 7, @thinhbuzz has the same problem on a Xiaomi device and one of my friends tried it on a Samsung S7 (Android 8) and the same problem also occurs.