Closed ghost closed 10 months ago
Would you run the following?
Il2Cpp.perform(() => {
console.log(`1) ${Il2Cpp.domain.tryAssembly("Assembly-CSharp")?.handle}`);
const assemblyObjects = Il2Cpp.domain.object.method<Il2Cpp.Array<Il2Cpp.Object>>("GetAssemblies").overload().invoke();
const assemblies = Array.from(assemblyObjects)
.map(_ => _.field<NativePointer>("_mono_assembly").value)
.map(_ => new Il2Cpp.Assembly(_));
console.log(`2) ${assemblies.find(_ => _.name == "Assembly-CSharp")?.handle}`);
});
Here is the output
Spawned `com.dgames.g65002002.google`. Resuming main thread!
[G8341::com.dgames.g65002002.google ]-> 1) 0x701228b600
2) undefined
I guess the 0x701228b600
is the memory location so here is the maps file
com.dgames.g65002002.google-maps.txt
So the assembly exists. Unfortunately I don't think there's something I can do. But you can:
Il2Cpp.perform(() => {
Reflect.defineProperty(Il2Cpp.domain, "assemblies", {
value: Il2Cpp.domain.assemblies.concat(Il2Cpp.domain.assembly("Assembly-CSharp"))
});
Il2Cpp.dump();
});
Thank you, it works
Sadly, the offsets are incorrect. There are lots of same offsets
I tried trace, there was no output.
Il2Cpp.perform(() => {
Reflect.defineProperty(Il2Cpp.domain, "assemblies", {
value: Il2Cpp.domain.assemblies.concat(Il2Cpp.domain.assembly("Assembly-CSharp"))
});
Il2Cpp.trace()
.assemblies(Il2Cpp.domain.assembly("Assembly-CSharp"))
.and()
.attach();
});
Interesting - this might be similar to https://github.com/vfsfitvnm/frida-il2cpp-bridge/issues/389#issuecomment-1732342083
We need to inspect the native library I guess
A game that uses some techniques to prevent Assembly-Csharp from being dumped. Can it be fixed? I'm using il2cpp-bridge v0.8.8