vfsfitvnm / frida-il2cpp-bridge

A Frida module to dump, trace or hijack any Il2Cpp application at runtime, without needing the global-metadata.dat file.
https://github.com/vfsfitvnm/frida-il2cpp-bridge/wiki
MIT License
1.05k stars 203 forks source link

Trying to iterate over a static field of type System.Collections.Generic.List<System.String> #556

Closed UnknownAPI closed 1 month ago

UnknownAPI commented 1 month ago

Is there support for iterating over a field of this type? When I access the field it only has a "handle" value.

import "frida-il2cpp-bridge";

Il2Cpp.perform(() => {
    const assembly_csharp = Il2Cpp.domain.assembly("Assembly-CSharp").image;
    const example_class = assembly_csharp.class("ExampleClass");
    var list_field = example_class.field("ListField")
});

I'm trying to iterate over list_field which is a List of String in Csharp

vfsfitvnm commented 1 month ago

There's no direct support for it, you have to call the appropriate methods in order to iterate through it (there many, just take a look at the class to find what inspires you the most).

Remember to get the field value, first:


    var list_field = example_class.field("ListField").value```
UnknownAPI commented 1 month ago

Thank you for your fast answer! After a while of testings on my end I found a pretty generic solution that may be re used by people out there.

import "frida-il2cpp-bridge";

Il2Cpp.perform(() => {
    const AsemblyCSharp = Il2Cpp.domain.assembly("Assembly-CSharp").image;
    const example_class = AsemblyCSharp.class("ExampleClass");
    var example_field = TLSClient.field("ExampleField").value
    var example_field_obj = example_field as Il2Cpp.Object

    var size = example_field_obj.method("get_Count").invoke()
    var size_int = size as number
    for (let i = 0; i < size_int; i++){
        console.log(example_field_obj.method("get_Item").invoke(i))
    }
});

There are probably cleaner implementations for this but it does the job for me.