120 lines
5.3 KiB
C#
120 lines
5.3 KiB
C#
/*
|
|
Copyright 2017 Perfare - https://github.com/Perfare/Il2CppDumper
|
|
Copyright 2017-2019 Katy Coe - http://www.hearthcode.org - http://www.djkaty.com
|
|
|
|
All rights reserved.
|
|
*/
|
|
|
|
using System;
|
|
using System.Linq;
|
|
|
|
namespace Il2CppInspector
|
|
{
|
|
internal class Il2CppBinaryARM : Il2CppBinary
|
|
{
|
|
public Il2CppBinaryARM(IFileFormatReader stream) : base(stream) { }
|
|
|
|
public Il2CppBinaryARM(IFileFormatReader stream, uint codeRegistration, uint metadataRegistration) : base(stream, codeRegistration, metadataRegistration) { }
|
|
|
|
protected override (ulong, ulong) ConsiderCode(IFileFormatReader image, uint loc) {
|
|
// Assembly bytes to search for at start of each function
|
|
ulong metadataRegistration, codeRegistration;
|
|
|
|
// ARMv7 based on ELF GOT
|
|
// Il2CppCodeRegistration.cpp initializer
|
|
image.Position = loc;
|
|
|
|
var buff = image.ReadBytes(0xc);
|
|
// LDR R0, [PC, #0x1C]; LDR R1, [PC, #0x1C]; LDR R2, [PC, #0x1C]
|
|
if (new byte[] { 0x1c, 0x0, 0x9f, 0xe5, 0x1c, 0x10, 0x9f, 0xe5, 0x1c, 0x20, 0x9f, 0xe5 }.SequenceEqual(buff)) {
|
|
|
|
// Get offset to all addresses
|
|
var offset = image.ReadUInt32(loc + 0x24) + loc + 0xc + 8;
|
|
|
|
// Get pointer to Il2CppCodegenRegistration(void)
|
|
var pCgr = image.ReadUInt32(loc + 0x2C) + offset;
|
|
|
|
// Read pointer table at end of function
|
|
codeRegistration = image.ReadUInt32(pCgr + 0x28) + offset;
|
|
var pMetadataRegistration = image.ReadUInt32(pCgr + 0x2C) + offset;
|
|
metadataRegistration = image.ReadUInt32(pMetadataRegistration);
|
|
return (codeRegistration, metadataRegistration);
|
|
}
|
|
|
|
// ARMv7
|
|
// Il2CppCodeRegistration.cpp initializer
|
|
image.Position = loc;
|
|
|
|
buff = image.ReadBytes(0x18);
|
|
// Check for ADD R0, PC, R0; ADD R1, PC, R1 near the end of the function
|
|
if (new byte[] {0x00, 0x00, 0x8F, 0xE0, 0x01, 0x10, 0x8F, 0xE0}.SequenceEqual(buff.Skip(0x10))
|
|
|
|
// Check for LDR R1, [PC, #x] where x is an offset to *Il2CppCodegenRegistration
|
|
&& new byte[] {0x10, 0x9F, 0xE5}.SequenceEqual(buff.Skip(0x9).Take(3))) {
|
|
|
|
// Read offset in LDR operand plus pointer table at end of function to find pCgr
|
|
var pCgr = buff[8] + loc + 0x10;
|
|
image.Position = pCgr;
|
|
pCgr = image.ReadUInt32() + loc + 0x1c;
|
|
|
|
// void Il2CppCodegenRegistration()
|
|
// Read pointer table at end of function
|
|
image.Position = pCgr + 0x1C;
|
|
var pMetadata = image.ReadUInt32() + pCgr + 0x14;
|
|
codeRegistration = image.ReadUInt32() + pCgr + 0x18;
|
|
|
|
image.Position = image.MapVATR(pMetadata);
|
|
metadataRegistration = image.ReadUInt32();
|
|
return (codeRegistration, metadataRegistration);
|
|
}
|
|
|
|
// ARMv7 Thumb (T1) metadata v23
|
|
// void Il2CppCodeRegistration()
|
|
image.Position = loc;
|
|
|
|
// Check for ADD Rx, PC in relevant parts of function
|
|
buff = image.ReadBytes(0x20);
|
|
if (buff[0x0C] == 0x79 && buff[0x0D] == 0x44 && // ADD R1, PC
|
|
buff[0x16] == 0x78 && buff[0x17] == 0x44 && // ADD R0, PC
|
|
buff[0x1E] == 0x7A && buff[0x1F] == 0x44) // ADD R2, PC
|
|
{
|
|
// Follow path to metadata pointer
|
|
var ppMetadata = decodeMovImm32(buff) + loc + 0x10;
|
|
image.Position = ppMetadata;
|
|
metadataRegistration = image.ReadUInt32();
|
|
|
|
// Follow path to code pointer
|
|
var pCode = decodeMovImm32(buff.Skip(8).Take(4).Concat(buff.Skip(14).Take(4)).ToArray());
|
|
codeRegistration = pCode + loc + 0x1A + image.GlobalOffset;
|
|
|
|
return (codeRegistration, metadataRegistration);
|
|
}
|
|
|
|
// ARMv7 Thumb (T1)
|
|
// http://liris.cnrs.fr/~mmrissa/lib/exe/fetch.php?media=armv7-a-r-manual.pdf - A8.8.106
|
|
// http://armconverter.com/hextoarm/
|
|
var bytes = new byte[] { 0x2d, 0xe9, 0x00, 0x48, 0xeb, 0x46 };
|
|
image.Position = loc;
|
|
buff = image.ReadBytes(6);
|
|
if (!bytes.SequenceEqual(buff))
|
|
return (0, 0);
|
|
bytes = new byte[] { 0x00, 0x23, 0x00, 0x22, 0xbd, 0xe8, 0x00, 0x48 };
|
|
image.Position += 0x10;
|
|
buff = image.ReadBytes(8);
|
|
if (!bytes.SequenceEqual(buff))
|
|
return (0, 0);
|
|
image.Position = loc + 6;
|
|
image.Position = (image.MapVATR(decodeMovImm32(image.ReadBytes(8))) & 0xfffffffc) + 0x0e;
|
|
metadataRegistration = decodeMovImm32(image.ReadBytes(8));
|
|
codeRegistration = decodeMovImm32(image.ReadBytes(8));
|
|
return (codeRegistration, metadataRegistration);
|
|
}
|
|
|
|
private uint decodeMovImm32(byte[] asm) {
|
|
ushort low = (ushort) (asm[2] + ((asm[3] & 0x70) << 4) + ((asm[1] & 0x04) << 9) + ((asm[0] & 0x0f) << 12));
|
|
ushort high = (ushort) (asm[6] + ((asm[7] & 0x70) << 4) + ((asm[5] & 0x04) << 9) + ((asm[4] & 0x0f) << 12));
|
|
return (uint) ((high << 16) + low);
|
|
}
|
|
}
|
|
}
|