search

vfsfitvnm / frida-il2cpp-bridge

A Frida module to dump, trace or hijack any Il2Cpp application at runtime, without needing the global-metadata.dat file.
https://github.com/vfsfitvnm/frida-il2cpp-bridge/wiki
MIT License
1.06k stars 205 forks source link

Assembly-Csharp is missing #395

Closed ghost closed 1 year ago

ghost commented 1 year ago

A game that uses some techniques to prevent Assembly-Csharp from being dumped. Can it be fixed? I'm using il2cpp-bridge v0.8.8

     ____
    / _  |   Frida 16.1.4 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to G8341 (id=QV702XTV0X)
Spawned `com.dgames.g65002002.google`. Resuming main thread!
[G8341::com.dgames.g65002002.google ]-> il2cpp: dumping mscorlib...
il2cpp: dumping System.Xml...
il2cpp: dumping UnityEngine.UIElementsModule...
il2cpp: dumping UnityEngine.CoreModule...
il2cpp: dumping System.Runtime.Serialization...
il2cpp: dumping System...
il2cpp: dumping Unity.Mathematics...
il2cpp: dumping Main...
il2cpp: dumping Newtonsoft.Json...
il2cpp: dumping System.Data...
il2cpp: dumping Unity.RenderPipelines.Universal.Runtime...
il2cpp: dumping System.Core...
il2cpp: dumping UniTask...
il2cpp: dumping Grpc.Core...
il2cpp: dumping Unity.TextMeshPro...
il2cpp: dumping Unity.Collections...
il2cpp: dumping Unity.RenderPipelines.Core.Runtime...
il2cpp: dumping Google.Protobuf...
il2cpp: dumping LCXSDK...
il2cpp: dumping spine-unity...
il2cpp: dumping Unity.Burst...
il2cpp: dumping Cinemachine...
il2cpp: dumping CriWare...
il2cpp: dumping UnityEngine.UI...
il2cpp: dumping ICSharpCode.SharpZipLib...
il2cpp: dumping UnityEngine.TextCoreTextEngineModule...
il2cpp: dumping DOTween...
il2cpp: dumping UnityEngine.IMGUIModule...
il2cpp: dumping StompyRobot.SRDebugger...
il2cpp: dumping Mono.Security...
il2cpp: dumping Unity.Timeline...
il2cpp: dumping UnityEngine.Physics2DModule...
il2cpp: dumping StompyRobot.SRF...
il2cpp: dumping IFix.Core...
il2cpp: dumping System.ServiceModel.Internals...
il2cpp: dumping UnityEngine...
il2cpp: dumping UnityEngine.AnimationModule...
il2cpp: dumping UnityEngine.AndroidJNIModule...
il2cpp: dumping Takasho.Core...
il2cpp: dumping UnityEngine.PhysicsModule...
il2cpp: dumping UnityEngine.ParticleSystemModule...
il2cpp: dumping Unity.2D.Animation.Runtime...
il2cpp: dumping DOTween.Modules...
il2cpp: dumping Grpc.Core.Api...
il2cpp: dumping System.Numerics...
il2cpp: dumping System.Xml.Linq...
il2cpp: dumping UnityEngine.AudioModule...
il2cpp: dumping Unity.Notifications.Android...
il2cpp: dumping UnityEngine.UIElementsNativeModule...
il2cpp: dumping UnityEngine.AIModule...
il2cpp: dumping UnityEngine.UnityWebRequestModule...
il2cpp: dumping UnityEngine.TextCoreFontEngineModule...
il2cpp: dumping UnityEngine.UIModule...
il2cpp: dumping D4L...
il2cpp: dumping StylizedGrass.Runtime...
il2cpp: dumping NativeGallery.Runtime...
il2cpp: dumping UnityEngine.TextRenderingModule...
il2cpp: dumping UnityEngine.InputLegacyModule...
il2cpp: dumping UnityEngine.AssetBundleModule...
il2cpp: dumping UnityEngine.XRModule...
il2cpp: dumping NavMeshComponentsExamples...
il2cpp: dumping PBT.Inner...
il2cpp: dumping UnityEngine.TerrainModule...
il2cpp: dumping Google.Play.Common...
il2cpp: dumping UnityEngine.SharedInternalsModule...
il2cpp: dumping UnityEngine.TilemapModule...
il2cpp: dumping NavMeshComponents...
il2cpp: dumping UnityEngine.VFXModule...
il2cpp: dumping Takasho.ProtobufKernel...
il2cpp: dumping UnityEngine.DirectorModule...
il2cpp: dumping UnityEngine.SubsystemsModule...
il2cpp: dumping UnityEngine.ImageConversionModule...
il2cpp: dumping UnityEngine.VideoModule...
il2cpp: dumping UnityEngine.UnityAnalyticsModule...
il2cpp: dumping UnityEngine.UnityWebRequestWWWModule...
il2cpp: dumping UnityEngine.UnityWebRequestTextureModule...
il2cpp: dumping UnityEngine.InputModule...
il2cpp: dumping UnityEngine.JSONSerializeModule...
il2cpp: dumping Google.Play.Core...
il2cpp: dumping UnityEngine.UnityWebRequestAssetBundleModule...
il2cpp: dumping spine-timeline...
il2cpp: dumping UnityEngine.ScreenCaptureModule...
il2cpp: dumping UnityEngine.SpriteShapeModule...
il2cpp: dumping UnityEngine.GridModule...
il2cpp: dumping UnityEngine.VRModule...
il2cpp: dumping UniTask.DOTween...
il2cpp: dumping UnityEngine.WindModule...
il2cpp: dumping MiniJson...
il2cpp: dumping D4L.Tasks.UniTask...
il2cpp: dumping Google.Play.Review...
il2cpp: dumping Unity.RenderPipeline.Universal.ShaderLibrary...
il2cpp: dumping System.Configuration...
il2cpp: dumping Unity.Burst.Unsafe...
il2cpp: dumping HybridCLR.Runtime...
il2cpp: dumping Unity.InternalAPIEngineBridge.001...
il2cpp: dumping Unity.Collections.LowLevel.ILSupport...
il2cpp: dumping Poco...
il2cpp: dumping __Generated...
il2cpp: dump saved to /storage/emulated/0/Android/data/com.dgames.g65002002.google/files/com.dgames.g65002002.google_1.2.50.cs
vfsfitvnm commented 1 year ago

Would you run the following?

Il2Cpp.perform(() => {
    console.log(`1) ${Il2Cpp.domain.tryAssembly("Assembly-CSharp")?.handle}`);

    const assemblyObjects = Il2Cpp.domain.object.method<Il2Cpp.Array<Il2Cpp.Object>>("GetAssemblies").overload().invoke();
    const assemblies = Array.from(assemblyObjects)
        .map(_ => _.field<NativePointer>("_mono_assembly").value)
        .map(_ => new Il2Cpp.Assembly(_));

    console.log(`2) ${assemblies.find(_ => _.name == "Assembly-CSharp")?.handle}`);
});
ghost commented 1 year ago

Here is the output

Spawned `com.dgames.g65002002.google`. Resuming main thread!
[G8341::com.dgames.g65002002.google ]-> 1) 0x701228b600
2) undefined

I guess the 0x701228b600 is the memory location so here is the maps file com.dgames.g65002002.google-maps.txt

vfsfitvnm commented 1 year ago

So the assembly exists. Unfortunately I don't think there's something I can do. But you can:

Il2Cpp.perform(() => {
    Reflect.defineProperty(Il2Cpp.domain, "assemblies", {
        value: Il2Cpp.domain.assemblies.concat(Il2Cpp.domain.assembly("Assembly-CSharp"))
    });

    Il2Cpp.dump();
});
ghost commented 1 year ago

Thank you, it works

ghost commented 1 year ago

Sadly, the offsets are incorrect. There are lots of same offsets

image

I tried trace, there was no output.

Il2Cpp.perform(() => {
    Reflect.defineProperty(Il2Cpp.domain, "assemblies", {
        value: Il2Cpp.domain.assemblies.concat(Il2Cpp.domain.assembly("Assembly-CSharp"))
    });

    Il2Cpp.trace()
        .assemblies(Il2Cpp.domain.assembly("Assembly-CSharp"))
        .and()
        .attach();
});
vfsfitvnm commented 1 year ago

Interesting - this might be similar to https://github.com/vfsfitvnm/frida-il2cpp-bridge/issues/389#issuecomment-1732342083

We need to inspect the native library I guess