From dc85a54c5f4fdb57f619907b47cb07d388328296 Mon Sep 17 00:00:00 2001 From: Katy Coe Date: Tue, 24 Nov 2020 20:00:38 +0100 Subject: [PATCH] PE: Fail gracefully for Themida-packed binaries (#56, #95, #101) --- Il2CppInspector.Common/FileFormatReaders/PEReader.cs | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/Il2CppInspector.Common/FileFormatReaders/PEReader.cs b/Il2CppInspector.Common/FileFormatReaders/PEReader.cs index 10c7349..89fab10 100644 --- a/Il2CppInspector.Common/FileFormatReaders/PEReader.cs +++ b/Il2CppInspector.Common/FileFormatReaders/PEReader.cs @@ -81,6 +81,17 @@ namespace Il2CppInspector // Get sections table sections = ReadArray(coff.NumberOfSections); + // Packed with Themida? + // TODO: Deal with Themida packing (issues #56, #95, #101) + if (sections.FirstOrDefault(x => x.Name == ".themida") is PESection _) { + throw new InvalidOperationException("This IL2CPP binary is packed with Themida and cannot be loaded directly. Unpack the binary first and try again. NOTE: Automatic unpacking of PE files will be included in a future update coming soon!"); + } + + // Packed with something else? + if (sections.FirstOrDefault(x => x.Name == ".rdata") is null) { + throw new InvalidOperationException("This IL2CPP binary is packed in a way not currently supported by Il2CppInspector and cannot be loaded. NOTE: Automatic unpacking of PE files will be included in a future update coming soon!"); + } + // Confirm that .rdata section begins at same place as IAT var rData = sections.First(x => x.Name == ".rdata"); if (rData.VirtualAddress != IATStart)