From 89b3c2b3aa127a2883264224a3ed46ede27bff27 Mon Sep 17 00:00:00 2001 From: Katy Coe Date: Tue, 16 Jun 2020 23:07:01 +0200 Subject: [PATCH] ELF: Detect a specific type of packing that isn't handled --- Il2CppInspector.Common/FileFormatReaders/ElfReader.cs | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/Il2CppInspector.Common/FileFormatReaders/ElfReader.cs b/Il2CppInspector.Common/FileFormatReaders/ElfReader.cs index 5c61a1f..aa9f737 100644 --- a/Il2CppInspector.Common/FileFormatReaders/ElfReader.cs +++ b/Il2CppInspector.Common/FileFormatReaders/ElfReader.cs @@ -275,6 +275,15 @@ namespace Il2CppInspector } } + // Detect more sophisticated packing + // We have seen several examples (eg. #14 and #26) where most of the file is zeroed + // and packed data is found in the latter third. So far these files always have zeroed .rodata sections + if (sectionByName.ContainsKey(".rodata")) { + var rodataBytes = ReadArray(conv.Long(sectionByName[".rodata"].sh_offset), conv.Int(sectionByName[".rodata"].sh_size)); + if (rodataBytes.All(b => b == 0x00)) + throw new InvalidOperationException("This IL2CPP binary is packed in a way not currently supported by Il2CppInspector and cannot be loaded."); + } + return true; }