chizui/Il2CppInspectorRedux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

PE: Fail gracefully for Themida-packed binaries (#56, #95, #101)

Browse Source
This commit is contained in:
Katy Coe
2020-11-24 20:00:38 +01:00
parent 65cf69741d
commit dc85a54c5f
1 changed files with 11 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
Il2CppInspector.Common/FileFormatReaders/PEReader.cs
View File

@@ -81,6 +81,17 @@ namespace Il2CppInspector
// Get sections table // Get sections table
sections = ReadArray<PESection>(coff.NumberOfSections); sections = ReadArray<PESection>(coff.NumberOfSections);
// Packed with Themida?
// TODO: Deal with Themida packing (issues #56, #95, #101)
if (sections.FirstOrDefault(x => x.Name == ".themida") is PESection _) {
throw new InvalidOperationException("This IL2CPP binary is packed with Themida and cannot be loaded directly. Unpack the binary first and try again. NOTE: Automatic unpacking of PE files will be included in a future update coming soon!");
}
// Packed with something else?
if (sections.FirstOrDefault(x => x.Name == ".rdata") is null) {
throw new InvalidOperationException("This IL2CPP binary is packed in a way not currently supported by Il2CppInspector and cannot be loaded. NOTE: Automatic unpacking of PE files will be included in a future update coming soon!");
}
// Confirm that .rdata section begins at same place as IAT // Confirm that .rdata section begins at same place as IAT
var rData = sections.First(x => x.Name == ".rdata"); var rData = sections.First(x => x.Name == ".rdata");
if (rData.VirtualAddress != IATStart) if (rData.VirtualAddress != IATStart)