axhlzy / il2cpphookscripts

frida-based libil2cpp.so runtime parsing script

Il2cppHook

frida-based libil2cpp.so runtime parsing script

Features

• Parse Unity's method m / class c / field f / instance lfs
• parse runtime method argument b
• (Batch) Hook B/BF for commonly used functions, modify function return value setFunctionXXX
• More convenient to find function findMethods and call function callFunction
• Object hierarchy PrintHierarchy / type hierarchy showTypeParent
• Disassemble showAsm with frida and method information
• Commonly used Hook package HookOnPointerClick/HookSetActive/B_Button...
• Parse mount script showComponents alias s HookOnPointerClick/PrintHierarchyWithComponents is also introduced <--- testing
• JNI RegisterNatives Hook (impl in JNIHelper, default off [not stable]), using JNIHelper.cacheRegisterNativeItem to get info
• Using QBDI to simulate the execution of the function, using t(methoinfo) or traceFunction(mPtr) to enable replacement hook
• 😕 😕 😕

---

Install

$ npm install il2cpp-hooker -g

then you can use like this 👇

1. frida attch current app

$ fat

2. frida spawn app of ${PackageName}

$ fat ${PackageName}

3. Command line options

$ fat -h

        _ _  ______                        _                 _
        | | |(_____ \                      | |               | |
        | | |  ____) )____ ____  ____ _____| |__   ___   ___ | |  _ _____  ____
        | | | / ____// ___)  _ \|  _ (_____)  _ \ / _ \ / _ \| |_/ ) ___ |/ ___)
        | | || (____( (___| |_| | |_| |    | | | | |_| | |_| |  _ (| ____| |
        |_|_|\______)____)  __/|  __/     |_| |_|\___/ \___/|_| \_)_____)_|
                        |_|   |_|


Usage: fat [options] <package-name?>

Options:
  -h, --help                  Print usage information.
  -r, --runtime [engine]      Specify the JS engine (qjs, v8). Default: v8
  -t, --timeout [ms]          Specify the time in milliseconds before calling the function.
  -f, --functions [name]      Specify the functions to call on startup. example: -f getApkInfo();
  -l, --log [path]            Specify the path to save the log.
  -c, --vscode                Open project with vscode.
  -v, --version               Print version information.

Report bugs to:
   axhlzy <[email protected]> (https://github.com/axhlzy/Il2CppHookScripts/)

---

Compile

$ git clone https://github.com/axhlzy/Il2CppHookScripts.git
$ cd Il2cppHook/

$ npm install

$ npm run build & npm run compress
OR
$ npm run watch

$ frida -U -f com.xxx.xxx -l ../_Ufunc.js
OR
$ frida -FU -l ../_Ufunc.js

---

👇 Here's a simpler way to use it (Recommended)

frida --codeshare axhlzy/il2cpphookscripts -U -f ${PackageName}

Requires Scientific Internet Access

---

Note

The npm package may not be updated in time, so you may consider using fat -c to open the project and use the github action Artifacts to replace _Ufunc.js file. 😯

---

API

More details

OR

open with vscode and search globalthis. to find more useage

---

Support the author

il2cpphookscripts's Issues

请问一下，listFieldsFromCls(klass, instance)这里的instance是啥意思呢

listFieldsFromCls(klass, instance)这里的instance是啥意思呢

每次调用函数都会出现 "KeyError: 'message'" 报错信息

系统环境

电脑

脚本就是按照README.md 编译生成的脚本

涉及到报错的 一些包的版本

平板

报错信息:

fat com.hypergryph.arknights
     ____
    / _  |   Frida 16.0.8 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to M2105K81AC (id=192.168.1.3:5555)
Spawned `com.hypergryph.arknights`. Resuming main thread!               
[M2105K81AC::com.hypergryph.arknights ]-> i("UnityEngine.Networking")
 --------------------------------------------------------------                                               
| List Images { assembly -> image -> classCount -> imageName } |                                              
 --------------------------------------------------------------                                               
Traceback (most recent call last):                                                                            
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,                                                                
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\runpy.py", line 86, in _run_code           
    exec(code, run_globals)
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\Scripts\frida.exe\__main__.py", line 7, in <module>
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 1362, in main
    app.run()
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\application.py", line 398, in run
    self._reactor.run()
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\reactor.py", line 44, in run
    self._run_until_return(self)
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 435, in _process_input
    if not self._exec_and_print(self._evaluate_expression, expression):
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 463, in _exec_and_print
    (t, value) = self._perform_on_reactor_thread(lambda: exec(arg))
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\application.py", line 768, in _perform_on_reactor_thread
    raise error
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\application.py", line 752, in work
    result[0] = f()
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 463, in <lambda>
    (t, value) = self._perform_on_reactor_thread(lambda: exec(arg))
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 648, in _evaluate_expression
    return self._parse_evaluate_result(result)
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 661, in _parse_evaluate_result
    raise JavaScriptError(result[1])
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 1195, in __init__
    super().__init__(error["message"])
KeyError: 'message'

尝试使用frida

┌──(UPON💀DESKTOP-HVRI740)-[F:/Arknight/arkModify/scripts/Il2CppHookScripts]-[ts]                                                                                                                                      1s  ⨯  
└─# frida -Uf com.hypergryph.arknights -l .\Il2cppHook\_Ufunc.js
     ____
    / _  |   Frida 16.0.8 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to M2105K81AC (id=192.168.1.3:5555)
Spawned `com.hypergryph.arknights`. Resuming main thread!               
[M2105K81AC::com.hypergryph.arknights ]-> c()
Error: imageOrName can not be null
[M2105K81AC::com.hypergryph.arknights ]-> c("UnityEngine.Networking")

 Current -> UnityEngine.Networking.dll @ 0x7dd4ac68c0                                     
                                                                                          
 ---------------------------------------------------------------------------------------- 
| List Classes { namespace {classPtr->filedsCount->methodsCount->enumClass->className} } |
 ---------------------------------------------------------------------------------------- 

[*] UnityEngine.Networking
        [-] 0x7dd4d8e400 (F:30/M:17/E:0)        ChannelBuffer
        [-] 0x7dd4d8e280 (F:3/M:6/E:0)  ChannelPacket
        [-] 0x7dd1ee2c00 (F:34/M:42/E:0)        ClientScene
        [-] 0x7dd4d8e580 (F:0/M:1/E:0)  ClientAttribute
        [-] 0x7dd4d8e700 (F:0/M:1/E:0)  ClientCallbackAttribute
        [-] 0x7dd4d8e880 (F:0/M:2/E:0)  DotNetCompatibility
        [-] 0x7dd1ee2f00 (F:6/M:10/E:0) LocalClient
        [-] 0x7dd4cefa00 (F:1/M:6/E:0)  ULocalConnectionToClient
        [-] 0x7dd4cefc00 (F:1/M:5/E:0)  ULocalConnectionToServer
        [-] 0x7dd1ee3200 (F:2/M:7/E:0)  LogFilter
        [-] 0x7dd4d8ea00 (F:0/M:3/E:0)  MessageBase
        [-] 0x7d99807c00 (F:15/M:29/E:0)        NetworkAnimator
        [-] 0x7dd4299b00 (F:6/M:65/E:0) NetworkBehaviour
        [-] 0x7dd4e01100 (F:5/M:16/E:0) NetBuffer
        [-] 0x7dd4e01280 (F:4/M:0/E:0)  UIntFloat
        [-] 0x7dd4e01400 (F:0/M:1/E:0)  FloatConversion
        [-] 0x7dd1ee3080 (F:24/M:39/E:0)        NetworkClient
        [-] 0x7dd1eea600 (F:19/M:41/E:0)        NetworkConnection
        [-] 0x7dd4e01580 (F:3/M:8/E:0)  NetworkCRC
        [-] 0x7dd4e01700 (F:2/M:0/E:0)  NetworkBroadcastResult
        [-] 0x7dd1ee3e00 (F:19/M:40/E:0)        NetworkDiscovery
        [-] 0x7dd4e01880 (F:16/M:2/E:0) NetworkHash128
        [-] 0x7dd1ee3680 (F:20/M:59/E:0)        NetworkIdentity
        [-] 0x7dd4e01a00 (F:3/M:9/E:0)  NetworkInstanceId
        [-] 0x7dd1eca800 (F:13/M:67/E:0)        NetworkLobbyManager
        [-] 0x7d98d97a00 (F:3/M:20/E:0) NetworkLobbyPlayer
        [-] 0x7dd4ddef00 (F:3/M:0/E:1)  PlayerSpawnMethod
        [-] 0x7dbf0eb680 (F:48/M:132/E:0)       NetworkManager
        [-] 0x7d9986ca00 (F:5/M:4/E:0)  NetworkManagerHUD
        [-] 0x7dd4e01b80 (F:1/M:5/E:0)  NetworkMessageHandlers
        [-] 0x7dd1eeaa00 (F:16/M:50/E:0)        NetworkMigrationManager
        [-] 0x7dd1ee7800 (F:5/M:6/E:0)  NetworkProximityChecker
        [-] 0x7dd4e01d00 (F:5/M:25/E:0) NetworkReader
        [-] 0x7dd4e01e80 (F:4/M:13/E:0) NetworkScene
        [-] 0x7dd4e02000 (F:1/M:7/E:0)  NetworkSceneId
        [-] 0x7dd1ee3c80 (F:24/M:82/E:0)        NetworkServer
        [-] 0x7dd1eec000 (F:12/M:31/E:0)        NetworkServerSimple
        [-] 0x7dd1ee3f80 (F:0/M:3/E:0)  NetworkStartPosition
        [-] 0x7dd1ee8c00 (F:19/M:36/E:0)        NetworkTransformChild
        [-] 0x7dd1ee7d00 (F:34/M:77/E:0)        NetworkTransform
        [-] 0x7dd1efb000 (F:4/M:10/E:0) NetworkTransformVisualizer
        [-] 0x7dd4e02180 (F:5/M:26/E:0) NetworkWriter
        [-] 0x7dd4e02300 (F:5/M:4/E:0)  PlayerController
        [-] 0x7dd4cefe00 (F:0/M:4/E:0)  NetworkMessageDelegate
        [-] 0x7dd4cfc000 (F:0/M:4/E:0)  SpawnDelegate
        [-] 0x7dd4cfc200 (F:0/M:4/E:0)  UnSpawnDelegate
        [-] 0x7dd4e02480 (F:1/M:2/E:0)  MsgType
        [-] 0x7dd1d58a80 (F:5/M:3/E:0)  NetworkMessage
        [-] 0x7dd4ddf180 (F:2/M:0/E:1)  Version
        [-] 0x7dd4ddf400 (F:4/M:0/E:1)  ChannelOption

[*]
        [-] 0x7dd1ee2a80 (F:2/M:0/E:0)  PendingOwner
        [-] 0x7dd1ee2d80 (F:2/M:0/E:0)  InternalMsg
        [-] 0x7dd1ee6b80 (F:8/M:0/E:1)  FilterLevel
        [-] 0x7dd1eea400 (F:0/M:4/E:0)  CmdDelegate
        [-] 0x7dd1ee6e00 (F:5/M:0/E:1)  UNetInvokeType
        [-] 0x7dd1ee3380 (F:3/M:2/E:0)  Invoker
        [-] 0x7dd1ee7080 (F:8/M:0/E:1)  ConnectState
        [-] 0x7dd1ee3500 (F:3/M:1/E:0)  PacketStat
        [-] 0x7dd1eea800 (F:0/M:4/E:0)  ClientAuthorityCallback
        [-] 0x7dd1ee3800 (F:2/M:0/E:0)  PendingPlayer
        [-] 0x7dd1ee7300 (F:3/M:0/E:1)  SceneChangeOption
        [-] 0x7dd1ee3980 (F:3/M:0/E:0)  PendingPlayerInfo
        [-] 0x7dd1ee3b00 (F:1/M:0/E:0)  ConnectionPendingPlayers
        [-] 0x7dd1ee7580 (F:3/M:0/E:1)  CheckMethod
        [-] 0x7dbc4c6e40 (F:1/M:7/E:0)  ServerSimpleWrapper
        [-] 0x7dd1ee7a80 (F:6/M:0/E:1)  TransformSyncMode
        [-] 0x7dd1ee7f80 (F:9/M:0/E:1)  AxisSyncMode
        [-] 0x7dd1ee8200 (F:4/M:0/E:1)  CompressionSyncMode
        [-] 0x7dd1eeac00 (F:0/M:4/E:0)  ClientMoveCallback3D
        [-] 0x7dd1eeae00 (F:0/M:4/E:0)  ClientMoveCallback2D

[*] UnityEngine.Networking.NetworkSystem
        [-] 0x7dd4d8eb80 (F:1/M:3/E:0)  StringMessage
        [-] 0x7dd4d8ed00 (F:1/M:4/E:0)  IntegerMessage
        [-] 0x7dd4d8ee80 (F:0/M:3/E:0)  EmptyMessage
        [-] 0x7dd4dff000 (F:1/M:3/E:0)  ErrorMessage
        [-] 0x7dd4dff180 (F:0/M:1/E:0)  ReadyMessage
        [-] 0x7dd4dff300 (F:0/M:1/E:0)  NotReadyMessage
        [-] 0x7dd4dff480 (F:3/M:3/E:0)  AddPlayerMessage
        [-] 0x7dd4dff600 (F:1/M:3/E:0)  RemovePlayerMessage
        [-] 0x7dd4dff780 (F:3/M:3/E:0)  PeerAuthorityMessage
        [-] 0x7dd4dff900 (F:2/M:0/E:0)  PeerInfoPlayer
        [-] 0x7dd4dffa80 (F:6/M:4/E:0)  PeerInfoMessage
        [-] 0x7dd4dffc00 (F:2/M:3/E:0)  PeerListMessage
        [-] 0x7dd4dffd80 (F:5/M:3/E:0)  ReconnectMessage
        [-] 0x7dd4dfff00 (F:5/M:3/E:0)  ObjectSpawnMessage
        [-] 0x7dd4e00080 (F:4/M:3/E:0)  ObjectSpawnSceneMessage
        [-] 0x7dd4e00200 (F:1/M:3/E:0)  ObjectSpawnFinishedMessage
        [-] 0x7dd4e00380 (F:1/M:3/E:0)  ObjectDestroyMessage
        [-] 0x7dd4e00500 (F:2/M:3/E:0)  OwnerMessage
        [-] 0x7dd4e00680 (F:2/M:3/E:0)  ClientAuthorityMessage
        [-] 0x7dd4e00800 (F:4/M:3/E:0)  AnimationMessage
        [-] 0x7dd4e00980 (F:2/M:3/E:0)  AnimationParametersMessage
        [-] 0x7dd4e00b00 (F:2/M:3/E:0)  AnimationTriggerMessage
        [-] 0x7dd4e00c80 (F:2/M:3/E:0)  LobbyReadyToBeginMessage
        [-] 0x7dd4e00e00 (F:2/M:0/E:0)  CRCMessageEntry
        [-] 0x7dd4e00f80 (F:1/M:3/E:0)  CRCMessage

----------------------------
Traceback (most recent call last):
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\runpy.py", line 196, in _run_module_as_main
    return _run_code(code, main_globals, None,
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\runpy.py", line 86, in _run_code
    exec(code, run_globals)
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\Scripts\frida.exe\__main__.py", line 7, in <module>
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 1362, in main
    app.run()
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\application.py", line 398, in run
    self._reactor.run()
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\reactor.py", line 44, in run
    self._run_until_return(self)
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 435, in _process_input
    if not self._exec_and_print(self._evaluate_expression, expression):
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 463, in _exec_and_print
    (t, value) = self._perform_on_reactor_thread(lambda: exec(arg))
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\application.py", line 768, in _perform_on_reactor_thread
    raise error
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\application.py", line 752, in work
    result[0] = f()
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 463, in <lambda>
    (t, value) = self._perform_on_reactor_thread(lambda: exec(arg))
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 648, in _evaluate_expression
    return self._parse_evaluate_result(result)
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 661, in _parse_evaluate_result
    raise JavaScriptError(result[1])
  File "C:\Users\15592\AppData\Local\Programs\Python\Python310\lib\site-packages\frida_tools\repl.py", line 1195, in __init__
    super().__init__(error["message"])
KeyError: 'message'

unity2017的无法hook

Ufun.js 对于unity2017的无法hook

部分失效

attach的时候，i()方法显示not a function

λ frida -U -l C:\Users\Administrator\Desktop\工具\Il2CppDumperTool-master\U3DHook\Ufun.js -F
____
/ _ | Frida 14.2.2 - A world-class dynamic instrumentation toolkit
| (| |
> _ | Commands:
// |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at https://www.frida.re/docs/home/
[MI 8::地球末日：生存]-> i()
TypeError: not a function
at list_Images (/Ufun.js:362)
at i (/Ufun.js:212)
[MI 8::地球末日：生存]->

spwan启动的时候，i()方法正常，a()方法失效

λ frida -U -l C:\Users\Administrator\Desktop\工具\Il2CppDumperTool-master\U3DHook\Ufun.js -f zombie.survival.craft.z --no-pause
____
/ _ | Frida 14.2.2 - A world-class dynamic instrumentation toolkit
| (| |
> _ | Commands:
// |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at https://www.frida.re/docs/home/
Spawned zombie.survival.craft.z. Resuming main thread!
[MI 8::zombie.survival.craft.z]-> i()

[] 0xd69c5400 1527 mscorlib
[] 0xd69c5438 10 System.Configuration
[] 0xd69c5470 75 Mono.Security
[] 0xd69c54a8 8 System.Xml
[] 0xd69c54e0 594 System
[] 0xd69c5518 56 System.Core
[] 0xd69c5550 29 UnityEngine.SharedInternalsModule
[] 0xd69c5588 587 UnityEngine.CoreModule
[] 0xd69c55c0 2 System.Data
[] 0xd69c55f8 1 System.Diagnostics.StackTrace
[] 0xd69c5630 1 System.Globalization.Extensions
[] 0xd69c5668 1 System.IO.Compression
[] 0xd69c56a0 5 UnityEngine.AssetBundleModule
[] 0xd69c56d8 38 UnityEngine.PhysicsModule
[] 0xd69c5710 12 UnityEngine.SubsystemsModule
[] 0xd69c5748 16 UnityEngine.TextRenderingModule
[] 0xd69c5780 13 UnityEngine.UnityWebRequestModule
[] 0xd69c57b8 25 UnityEngine.AudioModule
[] 0xd69c57f0 2 UnityEngine.GridModule
[] 0xd69c6a18 2 UiTest
[] 0xd69c6a18 2 UiTest
[] 0xd69c6a50 79 Unity.Addressables
[] 0xd69c6a88 48 Unity.Mediation
[] 0xd69c6ac0 262 devtodev_cross
[] 0xd69c6af8 2 Facebook.Unity.Android
[] 0xd69c6b30 29 Google.Play.AppUpdate
[] 0xd69c6b68 46 Google.Play.AssetDelivery
[] 0xd69c6ba0 8 Google.Play.Instant
[] 0xd69c6bd8 8 Google.Play.Review
[] 0xd69c6c10 7 SA.Foundation.Network
[] 0xd69c6c48 6 Unity.Analytics.DataPrivacy
[] 0xd69c6c80 33 Unity.ProBuilder
[] 0xd69c6cb8 326 Assembly-CSharp-firstpass
[] 0xd69c6cf0 11094 Assembly-CSharp

List 115 Images

[MI 8::zombie.survival.craft.z]-> a()

---

Added 0 Methods | All 0

[MI 8::zombie.survival.craft.z]->

附加上手游，碰到错误信息

[Pixel XL::com.xxx.global]-> %resume
[Pixel XL::com.xxx.global]-> TypeError: Cannot read property 'endsWith' of undefined
at InvocationContext.onLeave (node_modules/frida-il2cpp-bridge/dist/utils/native-wait.js:69:1)

[Pixel XL::com.xxx.global]-> i()

| List Images { assembly -> image -> classCount -> imageName } |

Traceback (most recent call last):
File "D:\Anaconda3\envs\f1518\lib\runpy.py", line 194, in _run_module_as_main
return _run_code(code, main_globals, None,
File "D:\Anaconda3\envs\f1518\lib\runpy.py", line 87, in run_code
exec(code, run_globals)
File "D:\Anaconda3\envs\f1518\Scripts\frida.exe_main.py", line 7, in
File "D:\Anaconda3\envs\f1518\lib\site-packages\frida_tools\repl.py", line 905, in main
app.run()
File "D:\Anaconda3\envs\f1518\lib\site-packages\frida_tools\application.py", line 255, in run
self._reactor.run()
File "D:\Anaconda3\envs\f1518\lib\site-packages\frida_tools\application.py", line 739, in run
self._run_until_return(self)
File "D:\Anaconda3\envs\f1518\lib\site-packages\frida_tools\repl.py", line 349, in _process_input
if not self._eval_and_print(expression):
File "D:\Anaconda3\envs\f1518\lib\site-packages\frida_tools\repl.py", line 357, in _eval_and_print
(t, value) = self._perform_on_reactor_thread(lambda: self._evaluate(expression))
File "D:\Anaconda3\envs\f1518\lib\site-packages\frida_tools\application.py", line 572, in _perform_on_reactor_thread
raise error
File "D:\Anaconda3\envs\f1518\lib\site-packages\frida_tools\application.py", line 556, in work
result[0] = f()
File "D:\Anaconda3\envs\f1518\lib\site-packages\frida_tools\repl.py", line 357, in
(t, value) = self._perform_on_reactor_thread(lambda: self._evaluate(expression))
File "D:\Anaconda3\envs\f1518\lib\site-packages\frida_tools\repl.py", line 512, in _evaluate
raise JavaScriptError(result[1])
File "D:\Anaconda3\envs\f1518\lib\site-packages\frida_tools\repl.py", line 910, in init
super(JavaScriptError, self).init(error['message'])
KeyError: 'message'

然后就在这卡住不动了，寻求帮助

MonoHook\Mfun.js提个bug

t_arrayAddr
    .forEach(function(value,index){
        LOG("-------------------------",LogColor.C90)
        LOG('currentAddr:' + value + "\t"+t_arrayName[index],LogColor.C32)
		if(value==0x0)//=========这里有时候value会是0x0，这是我多加的
		{
			return;
		}

=======================================================================
//判断是image还是class
LOG(getLine(85),LogColor.C33)
if (String(arr_imgs_addr).indexOf(String(imgOrCls))!=-1){
var img = imgOrCls
var ret_arr = list_classes(img,"")

    ret_arr.forEach(function(value,index){
        var ret = m(value,"")
		if(ret==undefined)//=========这里的ret有时候会是undefined，这是我多加的
		{
			return ;
		}

IOS可以支持吗

IOS可以支持吗

list_Methods之后就卡死了

使用list_Methods之后就卡死了

有指定 Unity 版本的方法吗？

尝试HookPlayerPrefs()，但是报了6行的il2cpp: couldn't determine the Unity version, please specify it manually。

发现是frida-il2cpp-bridge的报错，其开发者给的解决办法是couldn't determine the Unity version。

但是因为对本项目各处代码的运行时机不太了解，不知道应该写在哪。

是否有提供或者能够提供指定 Unity 版本的方法？

can I use this on memuPlay

大佬有群吗

最近在尝试逆向 unity游戏 正好看见大佬,有交流群么。
大佬这么厉害应该去52破解 ，这样太默默无闻了。
能多发点unity 游戏逆向的吗, 我想用这插件照着学下。

返回类型为Vector3的时候类和对象地址是同一个，且不能正确获取到值

如下面这个打印的日志

ret | ---> 0x6fb8ed3400 Vector3 (0x6fb8ed3400) (0.0, 0.0, 0.0)

你好，我用模拟器找不到libil2cpp.so，用非root真机修改smali的方式，加载frida so成功，也监听端口了，就是一附加就崩溃

你好，我用模拟器找不到libil2cpp.so，用非root真机修改smali的方式，加载frida so成功，也监听端口了，就是一附加就崩溃

Frida-Gadget with error Java API not available

I want to Dump this libil2cpp.so but it has error

C:\Users\Admin>frida -l F:\Download\Il2CppHookScripts-ts\Il2CppHookScripts-ts\Il2cppHook\_Ufunc.js -U Gadget
     ____
    / _  |   Frida 16.0.10 - A world-class dynamic instrumentation toolkit
   | (_| |
    > _  |   Commands:
   /_/ |_|       help      -> Displays the help system
   . . . .       object?   -> Display information about 'object'
   . . . .       exit/quit -> Exit
   . . . .
   . . . .   More info at https://frida.re/docs/home/
   . . . .
   . . . .   Connected to Android Emulator 5556 (id=emulator-5556)

[Android Emulator 5556::Gadget ]-> dumpSo()
------------------------------
[name]:libil2cpp.so
[base]:0x73c0000
[size]:25190400
[path]:/data/app/vn.pg1.vltk1m-iPPlLFi7_LzKT9aWhEB56Q==/lib/arm/libil2cpp.so
------------------------------
Error: Java API not available
    at _checkAvailable (frida/node_modules/frida-java-bridge/index.js:298)
    at perform (frida/node_modules/frida-java-bridge/index.js:203)
    at dump_mem (agent/utils/dumper.ts:22)
    at dump_so (agent/utils/dumper.ts:10)
    at <eval> (<input>:1)
    at eval (native)

Please help me if you know

Inquiry about file save function and dump function

hello. Thank you for creating a really great program.
The game I'm checking has many classes and functions, so if I use functions like "c() == list_classes", wouldn't it be possible to save the list locally as a file?

Also, if you look at the wiki, you don't see the dump function. Has it disappeared now?
The game I'm checking generates an error when using il2cppdumper, so I'm asking if I can use the dump function.

1

1

Ufun.js spawn启动无法立即Hook住所有的函数

Ufun.js spawn启动无法立即Hook住所有的函数，提示 Added 0 BreakPoints | All 0
加载时机错了吗

byte[]参数如何获取和修改

U3D函数参数是byte[] 应该如何hook查看和修改

Error :)

Spawned com.lockwoodpublishing.avakinlife. Resuming main thread!
Error: access violation accessing 0x0
at value (frida/runtime/core.js:384)
at HookRegisterNatives (agent/java/registerNative.ts:151)
at JNIHelper (agent/java/registerNative.ts:120)
at get instance (agent/java/registerNative.ts:111)
at (agent/java/registerNative.ts:142)
at call (native)
at o (node_modules/browser-pack/_prelude.js:1)
at (node_modules/browser-pack/_prelude.js:1)
at (agent/java/include.ts:9)
at call (native)
at o (node_modules/browser-pack/_prelude.js:1)
at (node_modules/browser-pack/_prelude.js:1)
at (agent/include.ts:7)
at call (native)
at o (node_modules/browser-pack/_prelude.js:1)
at (node_modules/browser-pack/_prelude.js:1)
at (agent/index.ts:1)
at call (native)
at (C:\Users\Sam\Music\bridge3\Il2CppHookScripts\Il2cppHook_Ufunc.js:39105)
at call (native)
at (C:\Users\Sam\Music\bridge3\Il2CppHookScripts\Il2cppHook_Ufunc.js:39105)
at call (native)
at o (node_modules/browser-pack/_prelude.js:1)
at r (node_modules/browser-pack/_prelude.js:1)
at (C:\Users\Sam\Music\bridge3\Il2CppHookScripts\Il2cppHook_Ufunc.js:47864)
at evaluate (native)
at (/frida/repl-2.js:1)

breakPoints(filter)能不能增加不区分大小写

breakPoints(filter)能不能增加不区分大小写，比如B("Click") 和 B("click")

使用showComponents的时候，参数是对象地址，怎么查看当前场景中所有对象呢

如题，麻烦大佬回复一下，非常感谢

大哥求助!找不到libil2cpp.so

大佬,我用的你的第一个方法,用的fat 包名 启动的游戏,但是后面发现找不到libil2cpp.so .请教这是怎么回事呀?

如何查找 struct 类型的 接口

如public struct structName{
public static int Encrypt(int value, int key)
}
find_class只能查找类.不能查找结构体

listFieldsFromCls 是否可以增加静态变量

是否可以显示静态变量的值

运行之后使用快捷指令提示not a function

[Android Emulator 5554::FishIdle]-> i()
TypeError: not a function
at list_Images (/Ufun.js:652)
at i (/Ufun.js:326)

建议把namespace搜索且断点也加上

范围搜索这个还是用的比较多啊，image搜索下的方法比较多的时候，缩小范围可以namespace[抱拳]

Add for termux or jshook

Please support for termux or jshook
(Android)

请问下 find_method要查找 Dictionary 实例化的函数地址 该如何写

请问下 find_method要查找 Dictionary 实例化的函数地址 该如何写