Skip to content

Commit 731c402

Browse files
committed
Sync some updates from the main project
1 parent 01ec5a6 commit 731c402

11 files changed

+201
-35
lines changed

Il2CppDumper/Il2Cpp/Il2Cpp.cs

+9
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,15 @@ protected bool AutoPlusInit(ulong codeRegistration, ulong metadataRegistration)
5555
if (Version >= 24.2)
5656
{
5757
pCodeRegistration = MapVATR<Il2CppCodeRegistration>(codeRegistration);
58+
if (Version == 29)
59+
{
60+
if (pCodeRegistration.genericMethodPointersCount > 0x50000) //TODO
61+
{
62+
Version = 29.1;
63+
codeRegistration -= PointerSize * 2;
64+
Console.WriteLine($"Change il2cpp version to: {Version}");
65+
}
66+
}
5867
if (Version == 27)
5968
{
6069
if (pCodeRegistration.reversePInvokeWrapperCount > 0x50000) //TODO

Il2CppDumper/Il2Cpp/Il2CppClass.cs

+5-1
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,12 @@ public class Il2CppCodeRegistration
1717
public ulong invokerPointers;
1818
public long customAttributeCount;
1919
public ulong customAttributeGenerators;
20-
public long unresolvedVirtualCallCount;
20+
public long unresolvedVirtualCallCount; //29.1 unresolvedIndirectCallCount;
2121
public ulong unresolvedVirtualCallPointers;
22+
[Version(Min = 29.1)]
23+
public ulong unresolvedInstanceCallPointers;
24+
[Version(Min = 29.1)]
25+
public ulong unresolvedStaticCallPointers;
2226
public ulong interopDataCount;
2327
public ulong interopData;
2428
public ulong windowsRuntimeFactoryCount;
+96
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
from binaryninja import *
2+
from os.path import exists
3+
4+
def get_addr(bv: BinaryView, addr: int):
5+
imageBase = bv.start
6+
return imageBase + addr
7+
8+
class Il2CppProcessTask(BackgroundTaskThread):
9+
def __init__(self, bv: BinaryView, script_path: str,
10+
header_path: str):
11+
BackgroundTaskThread.__init__(self, "Il2Cpp start", True)
12+
self.bv = bv
13+
self.script_path = script_path
14+
self.header_path = header_path
15+
self.has_types = False
16+
17+
def process_header(self):
18+
self.progress = "Il2Cpp types (1/3)"
19+
with open(self.header_path) as f:
20+
result = self.bv.parse_types_from_string(f.read())
21+
length = len(result.types)
22+
i = 0
23+
for name in result.types:
24+
i += 1
25+
if i % 100 == 0:
26+
percent = i / length * 100
27+
self.progress = f"Il2Cpp types: {percent:.2f}%"
28+
if self.bv.get_type_by_name(name):
29+
continue
30+
self.bv.define_user_type(name, result.types[name])
31+
32+
def process_methods(self, data: dict):
33+
self.progress = f"Il2Cpp methods (2/3)"
34+
scriptMethods = data["ScriptMethod"]
35+
length = len(scriptMethods)
36+
i = 0
37+
for scriptMethod in scriptMethods:
38+
if self.cancelled:
39+
self.progress = "Il2Cpp cancelled, aborting"
40+
return
41+
i += 1
42+
if i % 100 == 0:
43+
percent = i / length * 100
44+
self.progress = f"Il2Cpp methods: {percent:.2f}%"
45+
addr = get_addr(self.bv, scriptMethod["Address"])
46+
name = scriptMethod["Name"].replace("$", "_").replace(".", "_")
47+
signature = scriptMethod["Signature"]
48+
func = self.bv.get_function_at(addr)
49+
if func != None:
50+
if func.name == name:
51+
continue
52+
if self.has_types:
53+
func.function_type = signature
54+
else:
55+
func.name = scriptMethod["Name"]
56+
57+
def process_strings(self, data: dict):
58+
self.progress = "Il2Cpp strings (3/3)"
59+
scriptStrings = data["ScriptString"]
60+
i = 0
61+
for scriptString in scriptStrings:
62+
i += 1
63+
if self.cancelled:
64+
self.progress = "Il2Cpp cancelled, aborting"
65+
return
66+
addr = get_addr(self.bv, scriptString["Address"])
67+
value = scriptString["Value"]
68+
var = self.bv.get_data_var_at(addr)
69+
if var != None:
70+
var.name = f"StringLiteral_{i}"
71+
self.bv.set_comment_at(addr, value)
72+
73+
def run(self):
74+
if exists(self.header_path):
75+
self.process_header()
76+
else:
77+
log_warn("Header file not found")
78+
if self.bv.get_type_by_name("Il2CppClass"):
79+
self.has_types = True
80+
data = json.loads(open(self.script_path, 'rb').read().decode('utf-8'))
81+
if "ScriptMethod" in data:
82+
self.process_methods(data)
83+
if "ScriptString" in data:
84+
self.process_strings(data)
85+
86+
def process(bv: BinaryView):
87+
scriptDialog = OpenFileNameField("Select script.json", "script.json", "script.json")
88+
headerDialog = OpenFileNameField("Select il2cpp_binja.h", "il2cpp_binja.h", "il2cpp_binja.h")
89+
if not get_form_input([scriptDialog, headerDialog], "script.json from Il2CppDumper"):
90+
return log_error("File not selected, try again!")
91+
if not exists(scriptDialog.result):
92+
return log_error("File not found, try again!")
93+
task = Il2CppProcessTask(bv, scriptDialog.result, headerDialog.result)
94+
task.start()
95+
96+
PluginCommand.register("Il2CppDumper", "Process file", process)
+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"pluginmetadataversion": 2,
3+
"name": "Il2CppDumper",
4+
"type": [
5+
"core",
6+
"ui",
7+
"binaryview"
8+
],
9+
"api": [
10+
"python3"
11+
],
12+
"description": "Add Il2Cpp structs and method signatures",
13+
"longdescription": "",
14+
"license": {
15+
"name": "MIT",
16+
"text": "Copyright (c) 2022 Il2CppDumper contributors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."
17+
},
18+
"platforms": [
19+
"Darwin",
20+
"Linux",
21+
"Windows"
22+
],
23+
"installinstructions": {
24+
"Darwin": "Install Il2CppDumper",
25+
"Linux": "Install Il2CppDumper",
26+
"Windows": "Install Il2CppDumper"
27+
},
28+
"dependencies": {
29+
},
30+
"version": "1.0.0",
31+
"author": "Il2CppDumper contributors",
32+
"minimumbinaryninjaversion": 3164
33+
}

Il2CppDumper/Outputs/StructGenerator.cs

+1
Original file line numberDiff line numberDiff line change
@@ -454,6 +454,7 @@ public void WriteScript(string outputDir)
454454
sb.Append(HeaderConstants.HeaderV27);
455455
break;
456456
case 29:
457+
case 29.1:
457458
sb.Append(HeaderConstants.HeaderV29);
458459
break;
459460
default:

Il2CppDumper/Utils/DummyAssemblyGenerator.cs

+8-1
Original file line numberDiff line numberDiff line change
@@ -668,7 +668,14 @@ private CustomAttributeArgument CreateCustomAttributeArgument(TypeReference type
668668
var val = blobValue.Value;
669669
if (typeReference.FullName == "System.Object")
670670
{
671-
val = new CustomAttributeArgument(GetBlobValueTypeReference(blobValue, memberReference), val);
671+
if (blobValue.il2CppTypeEnum == Il2CppTypeEnum.IL2CPP_TYPE_IL2CPP_TYPE_INDEX)
672+
{
673+
val = new CustomAttributeArgument(memberReference.Module.ImportReference(typeof(Type)), GetTypeReference(memberReference, (Il2CppType)val));
674+
}
675+
else
676+
{
677+
val = new CustomAttributeArgument(GetBlobValueTypeReference(blobValue, memberReference), val);
678+
}
672679
}
673680
else if (val == null)
674681
{

Il2CppDumper/Utils/SectionHelper.cs

+4-2
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,8 @@ private ulong FindMetadataRegistrationOld()
249249
foreach (var section in data)
250250
{
251251
il2Cpp.Position = section.offset;
252-
while (il2Cpp.Position < section.offsetEnd - il2Cpp.PointerSize)
252+
var end = Math.Min(section.offsetEnd, il2Cpp.Length) - il2Cpp.PointerSize;
253+
while (il2Cpp.Position < end)
253254
{
254255
var addr = il2Cpp.Position;
255256
if (il2Cpp.ReadIntPtr() == typeDefinitionsCount)
@@ -284,7 +285,8 @@ private ulong FindMetadataRegistrationV21()
284285
foreach (var section in data)
285286
{
286287
il2Cpp.Position = section.offset;
287-
while (il2Cpp.Position < section.offsetEnd - il2Cpp.PointerSize)
288+
var end = Math.Min(section.offsetEnd, il2Cpp.Length) - il2Cpp.PointerSize;
289+
while (il2Cpp.Position < end)
288290
{
289291
var addr = il2Cpp.Position;
290292
if (il2Cpp.ReadIntPtr() == typeDefinitionsCount)

Il2CppDumper/binaryninja3_py3.py

-27
This file was deleted.
+41
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
import re
2+
3+
data = open("./il2cpp.h").read()
4+
5+
builtin = ["void", "intptr_t", "uint32_t", "uint16_t", "int32_t", "uint8_t", "bool",
6+
"int64_t", "uint64_t", "double", "int16_t", "int8_t", "float", "uintptr_t",
7+
"const", "union", "{", "};", "il2cpp_array_size_t", "il2cpp_array_lower_bound_t",
8+
"struct", "Il2CppMethodPointer"]
9+
structs = []
10+
notfound = []
11+
header = ""
12+
13+
for line in data.splitlines():
14+
if line.startswith("struct") or line.startswith("union"):
15+
struct = line.split()[1]
16+
if struct.endswith(";"):
17+
struct = struct[:-1]
18+
structs.append(struct)
19+
if line.startswith("\t"):
20+
struct = line[1:].split()[0]
21+
if struct == "struct":
22+
struct = line[1:].split()[1]
23+
if struct.endswith("*"):
24+
struct = struct[:-1]
25+
if struct.endswith("*"):
26+
struct = struct[:-1]
27+
if struct in builtin:
28+
continue
29+
if struct not in structs and struct not in notfound:
30+
notfound.append(struct)
31+
for struct in notfound:
32+
header += f"struct {struct};" + "\n"
33+
to_replace = re.findall("struct (.*) {\n};", data)
34+
for item in to_replace:
35+
data = data.replace("struct "+item+" {\n};", "")
36+
data = data.replace("\t"+item.split()[0]+" ", "\tvoid *")
37+
data = data.replace("\t struct "+item.split()[0]+" ", "\t void *")
38+
data = re.sub(r": (\w+) {", r"{\n\t\1 super;", data)
39+
with open("./il2cpp_binja.h", "w") as f:
40+
f.write(header)
41+
f.write(data)

README.md

+3-3
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ Unity il2cpp reverse engineer
1515
* Complete DLL restore (except code), can be used to extract `MonoBehaviour` and `MonoScript`
1616
* Supports ELF, ELF64, Mach-O, PE, NSO and WASM format
1717
* Supports Unity 5.3 - 2021.3
18-
* Supports generate IDA and Ghidra scripts to help IDA and Ghidra better analyze il2cpp files
18+
* Supports generate IDA, Ghidra and Binary Ninja scripts to help them better analyze il2cpp files
1919
* Supports generate structures header file
2020
* Supports Android memory dumped `libil2cpp.so` file to bypass protection
2121
* Support bypassing simple PE protection
@@ -58,7 +58,7 @@ structure information header file
5858

5959
For Ghidra
6060

61-
#### binaryninja3_py3.py
61+
#### Il2CppBinaryNinja
6262

6363
For BinaryNinja
6464

@@ -68,7 +68,7 @@ For Ghidra, work with [ghidra-wasm-plugin](https://github.com/nneonneo/ghidra-wa
6868

6969
#### script.json
7070

71-
For ida.py and ghidra.py
71+
For ida.py, ghidra.py and Il2CppBinaryNinja
7272

7373
#### stringliteral.json
7474

README.zh-CN.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ Il2CppDumper.exe <executable-file> <global-metadata> <output-directory>
5656

5757
用于Ghidra
5858

59-
#### binaryninja3_py3.py
59+
#### Il2CppBinaryNinja
6060

6161
用于BinaryNinja
6262

0 commit comments

Comments
 (0)