vfsfitvnm / frida-il2cpp-bridge

A Frida module to dump, trace or hijack any Il2Cpp application at runtime, without needing the global-metadata.dat file.
https://github.com/vfsfitvnm/frida-il2cpp-bridge/wiki
MIT License
946 stars 194 forks source link

dlopen hook doesn't work on Android 8.1 #360

Closed vfsfitvnm closed 11 months ago

vfsfitvnm commented 11 months ago

https://github.com/vfsfitvnm/frida-il2cpp-bridge/issues/359#issuecomment-1703745592

(I need to find a Unity app I can run on the official Android x86 emulator first)

CC: @Flechaa @thinhbuzz

Flechaa commented 11 months ago

What about this package: com.noodlecake.altosadventure

vfsfitvnm commented 11 months ago

Thanks, I can reproduce.

Flechaa commented 11 months ago

It seems like my device doesn't use those hooks as I get

Error: There are no targets to hook, please file a bug
vfsfitvnm commented 11 months ago

@Flechaa That's very unfortunate. Can you debug it? https://github.com/vfsfitvnm/frida-il2cpp-bridge/blob/ad0a65f6683e8291b7d00442f0378c200e602385/src/utils/native-wait.ts

Flechaa commented 11 months ago

Both of this exports return null, both dlopen and android_dlopen_ext. https://github.com/vfsfitvnm/frida-il2cpp-bridge/blob/ad0a65f6683e8291b7d00442f0378c200e602385/src/utils/native-wait.ts#L41

How could I discover if there's an alternative export? Or is this a problem with frida?

vfsfitvnm commented 11 months ago

Would you try

Module.findExportByName(null, "dlopen" /*and then */ "android_dlopen_ext")
Flechaa commented 11 months ago

Yes! That works, only problem now is that the game seems to hang after that.

vfsfitvnm commented 11 months ago

Hmm that makes things way harder to debug, I doubt there's anything I can do without having access to the physical device :/

I think I'll just add a setInterval-based function instead of relying on dlopen

Flechaa commented 11 months ago

I am using Android 7 as well, not Android 8.1 as described in the issue.

vfsfitvnm commented 11 months ago

Thanks, I could reproduce. Frida can't hook dlopen :P, hence the crash, let me see what I can do