Code Monkey home page Code Monkey logo

frida-il2cppdumper's Introduction

[Android U3D手游安全中级篇]

--------------------------------------------------------------------

frida-il2cppDumper

Riru Il2cppDumper 加强版 内存里直接dump出源码信息

Riru 无法输出泛型的问题也修正了、 但由于引擎版本特性、部分class还是无法输出propertyInfo的信息、 无伤大雅;

针对大部分global-metadata.dat 文件加密 il2cpp.so加密 可无视加密 基于主动调用、 所以就算是边运行边解密的壳也能成功解出

对魔改了结构体的游戏也同时有效,除非丧心病狂全改了(目前没发现,大部分的魔改处理还是在GlobalMetadataHeader)

支持平台:

Android IOS

支持Unity版本:

2017-最新

尽量不要在模拟器环境使用,由于模拟器使用X86架构, 如果游戏没有编译X86的SO frida是无法找到对应SO的,另外frida对于模拟器的兼容性也并非特别的完美。

如何使用

1.

> Android 修改_agent.js 下exports.pkg_name = "You game package";

> IOS 下修改SO 为UnityFramework 如果为其他命名请自行修改

2.

运行游戏 -->运行脚本-->文件生成在/data/data/游戏包名/dump.cs下

3.默认开启 Cpp2IL功能(仅支持安卓,IOS懒得写= =) 在/data/data/游戏包名/files/Script/下将生成各个对应的单cs类,打开任一版本Unity直接导入即可查看层级关系

u3d.ong

4.CPP2IL 新增压缩生成的Script文件夹,以供快速导出 默认路径/data/data/游戏包名/files/Script.zip。不开启压缩关闭export let ZipOutCSFile=false; 默认true

感谢

RiruIl2CppDumper

frida-il2cppdumper's People

Contributors

iiiimmmyyy avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar

frida-il2cppdumper's Issues

Have problems when execute the script

Good day, IIIImmmyyy!
I have cloned a source from the repo and configured the package name and version, but when I push the code was built to the android emulator has some error. Please help me. Thank you in advance.

Specs:
Both Frida desktop and server 15.1.14.

My configuration:

export var UnityVer = {
    V_2017_4_31f1: "2017.4.31f1",
    V_2018_4_36f1: "2018.4.36f1",
    V_5_6_4p4: "5.6.4p4"
};
export const soName = "libil2cpp.so";

export  const pkg_name="com.vng.codmvn";

export const UNITY_VER = UnityVer.V_5_6_4p4;

alt text

TypeError: not a function

TypeError: not a function
at il2cpp_domain_get_assemblies (agent/il2cpp/il2cppApi.js:22)
at start (agent/dumper.js:14)
at main (agent/index.ts:8)
at call (native)
at onNextTick (node_modules/timers-browserify/main.js:64)
at apply (native)
at (node_modules/process/browser.js:153)
at drainQueue (node_modules/process/browser.js:123)
at apply (native)
at (frida/runtime/core.js:45)
大佬这种报错怎么解决 游戏引擎版本是2018_4_12f1 设备是32位的夜神模拟器

ios如何dump

把提取的so(dylib)放在js同一个目录吗

issues

I found that when the game has x86 library, it will succeed on Android simulator, but when it doesn't, it will report an error. Why?

Failed to run the script

Please, help me understand, what's going wrong?

I run
frida -f com.bytetyper.iwantpizza -l _agent.js -D 9c2648e95b631f0715e504b14e5127077cad60df --no-pause

And get

    ____
    / _  |   Frida 15.1.17 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to iPhone (id=9c2648e95b631f0715e504b14e5127077cad60df)
Spawned `com.bytetyper.iwantpizza`. Resuming main thread!               
Error: failed to open file (No such file or directory)
    at <anonymous> (agent/dumper.js:9)
    at call (native)
    at o (node_modules/browser-pack/_prelude.js:1)
    at <anonymous> (node_modules/browser-pack/_prelude.js:1)
    at <anonymous> (agent/index.ts:2)
    at call (native)
    at <anonymous> (/_agent.js:1119)
    at call (native)
    at <anonymous> (/_agent.js:1119)
    at call (native)
    at o (node_modules/browser-pack/_prelude.js:1)
    at r (node_modules/browser-pack/_prelude.js:1)
    at <eval> (/_agent.js:1395)
[iPhone::com.bytetyper.iwantpizza ]->

dump 报错TypeError: not a function

getOffsetTypeCount() {
// if (config_1.UNITY_VER === config_1.UnityVer.V_2020) {
// return this.add(24).readPointer().toInt32();
// }
// else {
// return this.get("typeCount").readPointer().toInt32();
// }
return this.get("typeCount").readPointer().toInt32();
}
config_1.UnityVer.V_2020 识别报错后,直接改为 this.get("typeCount").readPointer().toInt32(); 或者return this.get("typeCount").readPointer().toInt32();后然后执行会报下面的错误,大佬帮忙看下

TypeError: not a function
at il2cpp_image_get_class (agent/il2cpp/il2cppApi.js:77)
at getClass (agent/il2cpp/struct/Il2CppImage.js:52)
at findAllClass (agent/dumper.js:145)
at (agent/dumper.js:106)
at apply (native)
at (frida/runtime/core.js:51)

报错 跑不动

(py38env) MacBookPro:agent Ken$ frida -U -f com.manling.xmqy.aligames --no-pause -l index.ts
____
/ _ | Frida 14.2.2 - A world-class dynamic instrumentation toolkit
| (| |
> _ | Commands:
/
/ |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at https://www.frida.re/docs/home/
Failed to load script: script(line 2): SyntaxError: expecting '('

Thank you for using Frida!
(py38env) MacBookPro:agent Ken$

TypeError: il2cpp_image_get_class is not a function

使用的frida 12.10.0版本
并且也用frida-compile编译了,--runtime=v8 也加了,但提示TypeError: il2cpp_image_get_class is not a function
1L}H0 8GH69TZ5E AYTL H

不知道是什么问题,佬能给个解决办法吗

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.