安卓真机无root环境下的单机游戏修改-IL2CPP

1

$ pip3 install -U objection

1

2

3

4

5

6

# 创建虚拟环境

$ virtualenv myenv

# 激活虚拟环境

$ .\myenv\Scripts\activate

# 安装objection

$ pip3 install -U objection

1

$ objection patchapk --source '.\Mine Survival_v2.5.3.apk'

1

$ adb install '.\Mine Survival_v2.5.3.objection.apk'

1

2

3

4

$ frida-ps -U

  PID  Name

-----  ------

21709  Gadget

1

2

3

4

Java.perform(function() {

    var module = Process.getModuleByName("libil2cpp.so");

    console.log(module.base);

})

1

$ frida -U Gadget -l .\hook.js

1

$ npm install --save-dev frida-il2cpp-bridge

1

2

3

4

5

6

7

8

9

10

{

  "main": "index.ts",

  "scripts": {

    "prepare": "npm run build",

    "watch": "frida-compile index.ts -w -o hook.js"

  },

  "dependencies": {

    "frida-il2cpp-bridge": "^0.9.0"

  }

}

1

2

3

4

5

import "frida-il2cpp-bridge";

Il2Cpp.perform(() => {

    console.log("Unity version: " + Il2Cpp.unityVersion);

});

1

2

3

4

5

6

7

8

9

10

11

import "frida-il2cpp-bridge";

Il2Cpp.perform(() => {

    console.log("Unity version: " + Il2Cpp.unityVersion);

    const AssemblyCSharp = Il2Cpp.domain.assembly("Assembly-CSharp").image

    const Inventory = AssemblyCSharp.class("Inventory");

    Il2Cpp.trace(true).classes(Inventory).and().attach();

});

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

import "frida-il2cpp-bridge";

Il2Cpp.perform(() => {

    console.log("Unity version: " + Il2Cpp.unityVersion);

    const AssemblyCSharp = Il2Cpp.domain.assembly("Assembly-CSharp").image

    const Inventory = AssemblyCSharp.class("Inventory");

    const AddDropItem = Inventory.method("AddDropItem");

    // Il2Cpp.trace(true).classes(Inventory).and().attach();

    AddDropItem.implementation = function (item): boolean {

        // bool AddItems(int id, int amount)

        this.method("AddItems").invoke(115, 999);

        const result = this.method<boolean>("AddDropItem").invoke(item);

        return result;

    };

});