Commit Graph

46 Commits

Author SHA1 Message Date
Luke
b05c03964a Struct reading and disassembly script overhaul, various misc. loading fixes, bump to .NET 9 (#13)
* Bump projects to .net 9 and update nugets

* add VersionedSerialization + source generator

* migrate versioning to StructVersion class, add handling/detection for 29.2/31.2

* add new struct definitions

* rename serialization methods and add BinaryObjectStreamReader for interop

* Rework metadata struct loading to use new struct versioning

* move 29/31.1/.2 to use tags (-2022,-2023) instead of minor versions

* fix metadata usage validity checks

* rework code registration offsetting a bit and add second 29/31.1 condition

* tweak .1 condition (again)

* 29/31.2 was a psyop

* also remove 29.2 from the readme

* remove loading of packed dlls - this was a very unsafe feature

* support auto-recovering type indices from type handles
fixes loading of memory-dumped v29+ libraries since those replacee their class indices on load with a pointer to the corresponding type

* support loading PEs without an export table

* also read UnresolvedVirtualCallCount on regular v31

* Disable plugin loading for now

* Overhaul disassembler script + add Binary Ninja target (#12)

* Overhaul diassembler scripts:
- No longer defines top level functions
- Split into three classes: StatusHandler (like before), DisassemblerInterface (for interfacing with the used program API), ScriptContext (for definiting general functions that use the disassembler interface)
- Add type annotations to all class methods and remove 2.7 compatibility stuff (Ghidra now supports Python 3 so this is unnecessary anymore)
- Disassembler backends are now responsible for launching metadata/script processing, to better support disassembler differences
- String handling is back in the base ScriptContext class, disassembler interfaces opt into the fake string segment creation and fall back to the old method if it isn't supported

* Add Binary Ninja disassembler script backend
This uses the new backend-controlled execution to launch metadata processing on a background thread to keep the ui responsive

* make binary ninja script use own _BINARYNINJA_ define and add define helpers to header

* Update README to account for new script and binary ninja backend

* implement fake string segment functions for binary ninja but don't advertise support

* also cache API function types in binary ninja backend

* fix ida script and disable folders again

* Fix metadata usage issues caused by it being a value type now

* make TryMapVATR overrideable and implement it for ELFs

* Make field offset reading use TryMapVATR to reduce exceptions

* Fix NRE in Assembly ctor on < v24.2

* Update actions workflow to produce cross-platform CLI binaries, update readme to reflect .net 9 changes

* workflow: only restore packages for projects that are being built

* workflow: tweak caching and fix gui compilation

* workflow: remove double .zip in CLI artifact name

* 29/31.2 don't actually exist, this logic is not needed
2024-11-14 14:32:11 +01:00
LukeFZ
4ce4d0e799 backport 29/31 version fixes from new versioning branch 2024-08-18 23:20:49 +02:00
Luke
396c222ac5 Tweak 29.1 heuristic 2024-06-24 14:18:49 +02:00
LukeFZ
7120970ece Use actual size of static array initializers 2023-12-01 08:14:12 +01:00
LukeFZ
d7067225fe fix Il2CppType definition for 27.2+ (better) 2023-11-30 21:37:17 +01:00
LukeFZ
8ffc7e0021 Add stuff for v29 2023-11-29 21:32:43 +01:00
LukeFZ
e3e0382e8c forgot to commit the pointerSize decl 2023-11-29 21:20:26 +01:00
LukeFZ
96e466743d Fix 24.5 compatibility, check metadata from data first since thats more common now 2023-11-29 21:16:43 +01:00
Katy Coe
98157c99ed IL2CPP: Handle metadata v24.5 (Unity 2019.4.21-2019.4.24) (#148) 2021-04-12 17:53:31 +02:00
Katy Coe
55401a447f Formats: Don't crash on secondary load strategies with existing type mappings (#140) 2021-02-23 23:44:07 +01:00
Katy Coe
cc0a0718df IL2CPP: Add basic validation to found CodeGenModule pointer (#137) 2021-02-12 14:04:30 +01:00
Katy Coe
f555ce40ff IL2CPP: Fix binary validation bug (typeDefinitionsSizes) 2021-01-15 16:33:27 +01:00
Katy Coe
c56bd26e4b IL2CPP: Abstract binary field order reconstruction to plugin 2021-01-12 14:31:14 +01:00
Katy Coe
c4cf6bb39c IL2CPP: Fix regression in TryPrepareMetadata 2021-01-12 12:09:44 +01:00
Katy Coe
c94fec41d7 IL2CPP: Abstract API export name decryption to plugin 2021-01-12 04:48:44 +01:00
Katy Coe
930b00f588 IL2CPP: Add plugin warning when failing to analyze 2021-01-12 01:10:30 +01:00
Katy Coe
71be0f2af2 Update year in copyright messages 2021-01-04 05:26:43 +01:00
Katy Coe
0ce0bbe74d Plugins: Add PreProcessBinary, PostProcessBinary, PostProcessAppModel 2020-12-29 21:32:54 +01:00
Katy Coe
7f755d2282 IL2CPP: Allow more reversePInvokeWrappers (#117) 2020-12-24 05:08:19 +01:00
Katy Coe
b9409e7425 Plugins: Add hook TODOs 2020-12-21 23:02:32 +01:00
Katy Coe
c00b474f33 IL2CPP: Change metadata and binary to derive from BinaryObjectStream 2020-12-21 06:37:29 +01:00
Katy Coe
ed258a5067 IL2CPP: Fix regression that broke ReconstructMetadata 2020-12-15 16:13:45 +01:00
Katy Coe
7878193f74 Formats: Add option for multiple load strategies per sub-image 2020-12-14 02:52:57 +01:00
Katy Coe
4e4f794376 IL2CPP: Handle ROT encryption of API exports 2020-12-10 21:25:13 +01:00
Katy Coe
43d736cf03 IL2CPP: Write reconstructed registration structs back to binary 2020-12-10 19:43:04 +01:00
Katy Coe
f6eed36284 IL2CPP: Add APIs to save processed metadata and binary to disk 2020-12-09 19:43:29 +01:00
Katy Coe
90fa9cf193 IL2CPP: Add IsModified flags to Metadata and Binary 2020-12-09 17:34:21 +01:00
Katy Coe
ec5d6606f3 IL2CPP: Only reconstruct registration data when necessary 2020-12-08 16:56:46 +01:00
Katy Coe
515365e9e9 Add progress callbacks to Il2CppBinary and Il2CppInspector 2020-12-06 17:33:07 +01:00
Katy Coe
aaa90370d1 IL2CPP: Refactor loaders in Il2CppBinary 2020-12-05 17:21:20 +01:00
Katy Coe
21cb7f9f80 IL2CPP: Reconstruct scrambled Il2CppCodeRegistration 2020-12-05 02:10:41 +01:00
Katy Coe
72ddaef7b1 IL2CPP: Prepare Code/Metadata struct data for de-obfuscation 2020-12-04 14:38:06 +01:00
Katy Coe
479aeb7bcd IL2CPP: Implement Il2CppAssemblyNameDefinition change (metadata v24.4) 2020-11-26 21:42:03 +01:00
Katy Coe
c07c13be24 IL2CPP: Auto-detect re-arranged struct field obfuscation (#44, #98) 2020-11-25 12:17:20 +01:00
Katy Coe
54ac9d7c1a IL2CPP: Fix crash when loading Il2CppCodeGenModule with no concrete methods (#58) 2020-08-22 03:30:17 +02:00
Katy Coe
641f502ab8 IL2CPP: Reconstruct CustomAttributesGenerators for metadata v27 2020-08-16 00:09:14 +02:00
Katy Coe
1f738a60c6 IL2CPP: Load metadata v27; mark broken areas with TODO 2020-08-15 06:28:48 +02:00
Katy Coe
00c2e8ad44 Unify symbol table format and implement for Elf and Mach-O 2020-08-09 00:30:18 +02:00
Katy Coe
2459bcb4a6 IL2CPP: Add registration structs search via data heuristics 2020-07-27 21:16:44 +02:00
Katy Coe
3fd97649e6 IL2CPP: Ignore API exports starting "il2cpp_z_" 2020-07-21 16:19:47 +02:00
Katy Coe
ccb401bb12 IL2CPP: Add Binary.GetAPIExports() 2020-07-20 17:09:19 +02:00
Robert Xiao
d426dad820 Add support for parsing and interpreting VTables
This prepares for a future PR where we add types to the IDA script
output.
2020-06-17 08:18:15 +02:00
Robert Xiao
c9d65e5f2d Get 2019.3.7f1+ working by adding new '24.3' version
In 2019.3.7f1, the following fields were added to
Il2CppCodeRegistration:

     uint32_t interopDataCount;
     Il2CppInteropData* interopData;
+    uint32_t windowsRuntimeFactoryCount;
+    Il2CppWindowsRuntimeFactoryTableEntry* windowsRuntimeFactoryTable;
     uint32_t codeGenModulesCount;
     const Il2CppCodeGenModule** codeGenModules;

These two fields overlap the old codeGenModules fields, causing failures.
The current fix is simply to bump the version to 24.3 if these fields are
detected in order to get the correct codeGenModules pointer. Long term, a
better detection mechanism (probably based on examining the name string
pointer in codeGenModules[0]) will be necessary. However, this is pending
more samples of 2019.3.7+ for testing.
2020-06-16 23:30:53 +02:00
Robert Xiao
4f074837b7 Fix fieldOffsetsArePointers logic on 64-bit builds
The logic for fieldOffsetsArePointers was always reading 32-bit units
even on 64-bits. When fieldOffsetsArePointers is true, fieldOffsets is
declared as int32_t**, so each element *must* be a pointer and therefore
word-sized (64 bits on 64-bit machines). So it doesn't make sense to
only read 32-bit words for this test.

This fixes metadata extraction for 64-bit builds from Il2Cpp versions
5.3.7f1, 5.3.8f2, 5.4.1f1, 5.4.2f2, 5.4.3f1, 5.4.4f1, 5.4.5f1 and
5.4.6f3. Notably, 5.4.0f3 is an unusual outlier which uses int32_t * for
fieldOffsets.
2020-06-16 23:30:53 +02:00
Katy Coe
245a95b15b IL2CPP: Allow code at address zero to be evaluated (part of #21) 2020-02-13 18:22:38 +01:00
Katy Coe
e971cb8502 Refactor solution layout 2020-02-06 02:51:42 +01:00