search

vfsfitvnm / frida-il2cpp-bridge

A Frida module to dump, trace or hijack any Il2Cpp application at runtime, without needing the global-metadata.dat file.
https://github.com/vfsfitvnm/frida-il2cpp-bridge/wiki
MIT License
946 stars 194 forks source link

Access Violation #391

Closed edward1224 closed 10 months ago

edward1224 commented 10 months ago

Hi, I got a weird error while trying to dump this game:

Spawned com.example.application. Resuming main thread! [XXXX::com.example.application]-> Error: access violation accessing 0x123456(tweaked the offset manually) at initialize (il2cpp/module.ts:43)

Package id as above log. Please remove the package id once you have seen it :)

More details: frida-il2cpp-bridge: v0.8.7 frida: v16.1.4 frida-tools: v12.2.1 python: v3.11.4 ARM64 device

vfsfitvnm commented 10 months ago

Would you take a look at https://github.com/vfsfitvnm/frida-il2cpp-bridge/issues/333?

edward1224 commented 10 months ago

Hi, I took a look on that issue, I have upgraded my frida and python but it didn't help. Tried using v0.8.5 of frida-il2cpp-bride but it didn't help. I am just guessing here, is the result varying across devices? It would be great if you can confirm that it is dump-able on a different device then at least I know the issue is on my end.

ghost commented 10 months ago

This issue can be replicated when you sideload the game via adb or other source. But if you download the game from Play store, it works fine

APK link: https://apkcombo.com/downloader/#package=com.dgames.g65002002.google&arches=arm64-v8a

vfsfitvnm commented 10 months ago

@edward1224 Yes, that game can be dumped. I encountered that error as well, and it happens when invoking (any?) IL2CPP export during initialization. It seems they customized their IL2CPP source code.

However, you can just reload the script and everything will be just fine