chizui/Il2CppInspectorRedux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix x86 analysis based on ELF PLT

Browse Source
This commit is contained in:
Katy Coe
2019-10-26 15:18:55 +02:00
parent 3a66e59447
commit 9ee2e7567c
2 changed files with 59 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
Il2CppInspector/FileFormatReaders/ElfReader.cs
View File

@@ -79,7 +79,12 @@ namespace Il2CppInspector
public uint[] UIntArray(ulong[] a) => Array.ConvertAll(a, x => (uint) x); public uint[] UIntArray(ulong[] a) => Array.ConvertAll(a, x => (uint) x);
} }
internal abstract class ElfReader<TWord, TPHdr, TSym, TReader, TMath> : FileFormatReader<TReader> interface IElfReader
{
uint GetPLTAddress();
}
internal abstract class ElfReader<TWord, TPHdr, TSym, TReader, TMath> : FileFormatReader<TReader>, IElfReader
where TWord : struct where TWord : struct
where TPHdr : Ielf_phdr<TWord>, new() where TPHdr : Ielf_phdr<TWord>, new()
where TSym : Ielf_sym<TWord>, new() where TSym : Ielf_sym<TWord>, new()
@@ -335,5 +340,8 @@ namespace Il2CppInspector
var program_header_table = this.program_header_table.First(x => uiAddr >= math.ULong(x.p_vaddr) && uiAddr <= math.ULong(math.Add(x.p_vaddr, x.p_filesz))); var program_header_table = this.program_header_table.First(x => uiAddr >= math.ULong(x.p_vaddr) && uiAddr <= math.ULong(math.Add(x.p_vaddr, x.p_filesz)));
return (uint) (uiAddr - math.ULong(math.Sub(program_header_table.p_vaddr, program_header_table.p_offset))); return (uint) (uiAddr - math.ULong(math.Sub(program_header_table.p_vaddr, program_header_table.p_offset)));
} }
// Get the address of the procedure linkage table (.got.plt) which is needed for some disassemblies
public uint GetPLTAddress() => (uint) math.ULong(getDynamic(Elf.DT_PLTGOT).d_un);
} }
} }

94
Il2CppInspector/Il2CppBinaryX86.cs
View File

@@ -15,73 +15,79 @@ namespace Il2CppInspector
protected override (ulong, ulong) ConsiderCode(IFileFormatReader image, uint loc) { protected override (ulong, ulong) ConsiderCode(IFileFormatReader image, uint loc) {
ulong metadata, code; ulong metadata, code;
long funcPtr; long pCgr;
ushort opcode;
// Variant 1
// x86
// Assembly bytes to search for at start of each function // Assembly bytes to search for at start of each function
var bytes = new byte[] {0x6A, 0x00, 0x6A, 0x00, 0x68}; var bytes = new byte[] {0x6A, 0x00, 0x6A, 0x00, 0x68};
image.Position = loc; image.Position = loc;
var buff = image.ReadBytes(5); var buff = image.ReadBytes(5);
if (bytes.SequenceEqual(buff)) { if (bytes.SequenceEqual(buff)) {
// Next 4 bytes are the function pointer being pushed onto the stack // Next 4 bytes are the function pointer being pushed onto the stack
funcPtr = image.ReadUInt32(); pCgr = image.ReadUInt32();
// Start of next instruction // Start of next instruction
if (image.ReadByte() != 0xB9) if (image.ReadByte() != 0xB9)
return (0, 0); return (0, 0);
// Jump to Il2CppCodegenRegistration // Jump to Il2CppCodegenRegistration
image.Position = image.MapVATR((ulong) funcPtr + 6); image.Position = image.MapVATR((ulong) pCgr + 6);
metadata = image.ReadUInt32(); metadata = image.ReadUInt32();
image.Position = image.MapVATR((ulong) funcPtr + 11); image.Position = image.MapVATR((ulong) pCgr + 11);
code = image.ReadUInt32(); code = image.ReadUInt32();
return (code, metadata); return (code, metadata);
} }
// Variant 2 // x86 based on ELF PLT
bytes = new byte[] if (image is IElfReader elf) {
{0x55, 0x89, 0xE5, 0x53, 0x83, 0xE4, 0xF0, 0x83, 0xEC, 0x20, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B}; var plt = elf.GetPLTAddress();
image.Position = loc;
buff = image.ReadBytes(16);
if (!bytes.SequenceEqual(buff))
return (0, 0);
image.Position += 8; // push ebp; mov ebp, esp; push ebx; and esp, 0FFFFFFF0h; sub esp, 20h; call $+5; pop ebx
funcPtr = image.MapVATR(image.ReadUInt32() + image.GlobalOffset); bytes = new byte[]
if (funcPtr > image.Length) {0x55, 0x89, 0xE5, 0x53, 0x83, 0xE4, 0xF0, 0x83, 0xEC, 0x20, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B};
return (0, 0); image.Position = loc;
buff = image.ReadBytes(16);
if (!bytes.SequenceEqual(buff))
return (0, 0);
// Extract Metadata pointer // lea eax, (pCgr - offset)[ebx] (Position + 6 is the opcode lea eax; Position + 8 is the operand)
// An 0x838D opcode indicates LEA (no indirection) image.Position += 8;
image.Position = funcPtr + 0x20; pCgr = image.MapVATR(image.ReadUInt32() + plt);
opcode = image.ReadUInt16(); if (pCgr > image.Length)
metadata = image.ReadUInt32() + image.GlobalOffset; return (0, 0);
// An 8x838B opcode indicates MOV (pointer indirection) // Extract Metadata pointer
if (opcode == 0x838B) { // An 0x838D opcode indicates LEA (no indirection)
image.Position = image.MapVATR(metadata); image.Position = pCgr + 0x20;
metadata = image.ReadUInt32(); var opcode = image.ReadUInt16();
metadata = image.ReadUInt32() + plt;
// An 8x838B opcode indicates MOV (pointer indirection)
if (opcode == 0x838B) {
image.Position = image.MapVATR(metadata);
metadata = image.ReadUInt32();
}
if (opcode != 0x838B && opcode != 0x838D)
return (0, 0);
// Repeat the same logic for extracting the Code pointer
image.Position = pCgr + 0x2A;
opcode = image.ReadUInt16();
code = image.ReadUInt32() + plt;
if (opcode == 0x838B) {
image.Position = image.MapVATR(code);
code = image.ReadUInt32();
}
if (opcode != 0x838B && opcode != 0x838D)
return (0, 0);
return (code, metadata);
} }
if (opcode != 0x838B && opcode != 0x838D) return (0, 0);
return (0, 0);
// Repeat the same logic for extracting the Code pointer
image.Position = funcPtr + 0x2A;
opcode = image.ReadUInt16();
code = image.ReadUInt32() + image.GlobalOffset;
if (opcode == 0x838B) {
image.Position = image.MapVATR(code);
code = image.ReadUInt32();
}
if (opcode != 0x838B && opcode != 0x838D)
return (0, 0);
return (code, metadata);
} }
} }
} }