chizui/Il2CppInspectorRedux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add new ARMv7 Il2CppCodeRegistration detection code

Browse Source
This commit is contained in:
Katy Coe
2019-10-16 08:53:51 +02:00
parent 79baebdb93
commit 724c5b605f
1 changed files with 39 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

47
Il2CppInspector/Il2CppBinaryARM.cs
View File

@@ -5,6 +5,7 @@
All rights reserved. All rights reserved.
*/ */
using System;
using System.Linq; using System.Linq;
namespace Il2CppInspector namespace Il2CppInspector
@@ -18,11 +19,13 @@ namespace Il2CppInspector
protected override (uint, uint) ConsiderCode(uint loc, uint globalOffset) { protected override (uint, uint) ConsiderCode(uint loc, uint globalOffset) {
// Assembly bytes to search for at start of each function // Assembly bytes to search for at start of each function
uint metadataRegistration, codeRegistration; uint metadataRegistration, codeRegistration;
byte[] buff;
// ARMv7 // ARMv7
// void Il2CppCodegenRegistration() (not available in the symbol table of later versions)
var bytes = new byte[] { 0x1c, 0x0, 0x9f, 0xe5, 0x1c, 0x10, 0x9f, 0xe5, 0x1c, 0x20, 0x9f, 0xe5 }; var bytes = new byte[] { 0x1c, 0x0, 0x9f, 0xe5, 0x1c, 0x10, 0x9f, 0xe5, 0x1c, 0x20, 0x9f, 0xe5 };
Image.Position = loc; Image.Position = loc;
var buff = Image.ReadBytes(12); buff = Image.ReadBytes(12);
if (bytes.SequenceEqual(buff)) { if (bytes.SequenceEqual(buff)) {
Image.Position = loc + 0x2c; Image.Position = loc + 0x2c;
var subaddr = Image.ReadUInt32() + globalOffset; var subaddr = Image.ReadUInt32() + globalOffset;
@@ -35,22 +38,50 @@ namespace Il2CppInspector
return (codeRegistration, metadataRegistration); return (codeRegistration, metadataRegistration);
} }
// ARMv7 metadata v23 // ARMv7 metadata v24
// void Il2CppCodeRegistration()
Image.Position = loc;
buff = Image.ReadBytes(0x18);
// Check for ADD R0, PC, R0; ADD R1, PC, R1 near the end of the function
if (new byte[] {0x00, 0x00, 0x8F, 0xE0, 0x01, 0x10, 0x8F, 0xE0}.SequenceEqual(buff.Skip(0x10))
// Check for LDR R1, [PC, #x] where x is an offset to *Il2CppCodegenRegistration
&& new byte[] {0x10, 0x9F, 0xE5}.SequenceEqual(buff.Skip(0x9).Take(3))) {
// Read offset in LDR operand plus pointer table at end of function to find pCgr
var pCgr = buff[8] + loc + 0x10;
Image.Position = pCgr;
pCgr = Image.ReadUInt32() + loc + 0x1c;
// void Il2CppCodegenRegistration()
// Read pointer table at end of function
Image.Position = pCgr + 0x1C;
var pMetadata = Image.ReadUInt32() + pCgr + 0x14;
codeRegistration = Image.ReadUInt32() + pCgr + 0x18;
Image.Position = Image.MapVATR(pMetadata);
metadataRegistration = Image.ReadUInt32();
return (codeRegistration, metadataRegistration);
}
// ARMv7 Thumb (T1) metadata v23
// void Il2CppCodeRegistration()
Image.Position = loc; Image.Position = loc;
// Check for ADD Rx, PC in relevant parts of function // Check for ADD Rx, PC in relevant parts of function
var func = Image.ReadBytes(0x20); buff = Image.ReadBytes(0x20);
if (func[0x0C] == 0x79 && func[0x0D] == 0x44 && // ADD R1, PC if (buff[0x0C] == 0x79 && buff[0x0D] == 0x44 && // ADD R1, PC
func[0x16] == 0x78 && func[0x17] == 0x44 && // ADD R0, PC buff[0x16] == 0x78 && buff[0x17] == 0x44 && // ADD R0, PC
func[0x1E] == 0x7A && func[0x1F] == 0x44) // ADD R2, PC buff[0x1E] == 0x7A && buff[0x1F] == 0x44) // ADD R2, PC
{ {
// Follow path to metadata pointer // Follow path to metadata pointer
var ppMetadata = decodeMovImm32(func) + loc + 0x10; var ppMetadata = decodeMovImm32(buff) + loc + 0x10;
Image.Position = ppMetadata; Image.Position = ppMetadata;
metadataRegistration = Image.ReadUInt32(); metadataRegistration = Image.ReadUInt32();
// Follow path to code pointer // Follow path to code pointer
var pCode = decodeMovImm32(func.Skip(8).Take(4).Concat(func.Skip(14).Take(4)).ToArray()); var pCode = decodeMovImm32(buff.Skip(8).Take(4).Concat(buff.Skip(14).Take(4)).ToArray());
codeRegistration = pCode + loc + 0x1A + globalOffset; codeRegistration = pCode + loc + 0x1A + globalOffset;
return (codeRegistration, metadataRegistration); return (codeRegistration, metadataRegistration);