Esempio n. 1
0
        protected override (ulong, ulong) ConsiderCode(IFileFormatReader image, uint loc)
        {
            ulong metadata, code;
            long  pCgr;

            // x86
            // Assembly bytes to search for at start of each function
            var bytes = new byte[] { 0x6A, 0x00, 0x6A, 0x00, 0x68 };

            image.Position = loc;
            var buff = image.ReadBytes(5);

            if (bytes.SequenceEqual(buff))
            {
                // Next 4 bytes are the function pointer being pushed onto the stack
                pCgr = image.ReadUInt32();

                // Start of next instruction
                if (image.ReadByte() != 0xB9)
                {
                    return(0, 0);
                }

                // Jump to Il2CppCodegenRegistration
                image.Position = image.MapVATR((ulong)pCgr + 6);
                metadata       = image.ReadUInt32();
                image.Position = image.MapVATR((ulong)pCgr + 11);
                code           = image.ReadUInt32();
                return(code, metadata);
            }

            // x86 based on ELF PLT
            if (image is IElfReader elf)
            {
                var plt = elf.GetPLTAddress();

                // push ebp; mov ebp, esp; push ebx; and esp, 0FFFFFFF0h; sub esp, 20h; call $+5; pop ebx
                bytes = new byte[]
                { 0x55, 0x89, 0xE5, 0x53, 0x83, 0xE4, 0xF0, 0x83, 0xEC, 0x20, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B };
                image.Position = loc;
                buff           = image.ReadBytes(16);
                if (!bytes.SequenceEqual(buff))
                {
                    return(0, 0);
                }

                // lea eax, (pCgr - offset)[ebx] (Position + 6 is the opcode lea eax; Position + 8 is the operand)
                image.Position += 6;

                // Ensure it's lea eax, #address
                if (image.ReadUInt16() != 0x838D)
                {
                    return(0, 0);
                }

                try {
                    pCgr = image.MapVATR(image.ReadUInt32() + plt);
                }
                // Could not find a mapping in the section table
                catch (InvalidOperationException) {
                    return(0, 0);
                }

                // Extract Metadata pointer
                // An 0x838D opcode indicates LEA (no indirection)
                image.Position = pCgr + 0x20;
                var opcode = image.ReadUInt16();
                metadata = image.ReadUInt32() + plt;

                // An 8x838B opcode indicates MOV (pointer indirection)
                if (opcode == 0x838B)
                {
                    image.Position = image.MapVATR(metadata);
                    metadata       = image.ReadUInt32();
                }

                if (opcode != 0x838B && opcode != 0x838D)
                {
                    return(0, 0);
                }

                // Repeat the same logic for extracting the Code pointer
                image.Position = pCgr + 0x2A;
                opcode         = image.ReadUInt16();
                code           = image.ReadUInt32() + plt;

                if (opcode == 0x838B)
                {
                    image.Position = image.MapVATR(code);
                    code           = image.ReadUInt32();
                }

                if (opcode != 0x838B && opcode != 0x838D)
                {
                    return(0, 0);
                }

                return(code, metadata);
            }

            return(0, 0);
        }
Esempio n. 2
0
        private void Configure(IFileFormatReader image, ulong codeRegistration, ulong metadataRegistration)
        {
            // Output locations
            Console.WriteLine("CodeRegistration struct found at 0x{0:X16} (file offset 0x{1:X8})", image.Bits == 32 ? codeRegistration & 0xffff_ffff : codeRegistration, image.MapVATR(codeRegistration));
            Console.WriteLine("MetadataRegistration struct found at 0x{0:X16} (file offset 0x{1:X8})", image.Bits == 32 ? metadataRegistration & 0xffff_ffff : metadataRegistration, image.MapVATR(metadataRegistration));

            // Set width of long (convert to sizeof(int) for 32-bit files)
            if (image.Bits == 32)
            {
                image.Stream.PrimitiveMappings.Add(typeof(long), typeof(int));
                image.Stream.PrimitiveMappings.Add(typeof(ulong), typeof(uint));
            }

            // Root structures from which we find everything else
            CodeRegistration     = image.ReadMappedObject <Il2CppCodeRegistration>(codeRegistration);
            MetadataRegistration = image.ReadMappedObject <Il2CppMetadataRegistration>(metadataRegistration);

            // The global method pointer list was deprecated in v24.2 in favour of Il2CppCodeGenModule
            if (Image.Version <= 24.1)
            {
                GlobalMethodPointers = image.ReadMappedArray <ulong>(CodeRegistration.pmethodPointers, (int)CodeRegistration.methodPointersCount);
            }

            // After v24 method pointers and RGCTX data were stored in Il2CppCodeGenModules
            if (Image.Version >= 24.2)
            {
                Modules = new Dictionary <string, Il2CppCodeGenModule>();

                // Array of pointers to Il2CppCodeGenModule
                var modules = image.ReadMappedObjectPointerArray <Il2CppCodeGenModule>(CodeRegistration.pcodeGenModules, (int)CodeRegistration.codeGenModulesCount);

                foreach (var module in modules)
                {
                    var name = image.ReadMappedNullTerminatedString(module.moduleName);
                    Modules.Add(name, module);

                    // Read method pointers
                    ModuleMethodPointers.Add(module, image.ReadMappedArray <ulong>(module.methodPointers, (int)module.methodPointerCount));
                }
            }

            // Field offset data. Metadata <=21.x uses a value-type array; >=21.x uses a pointer array

            // Versions from 22 onwards use an array of pointers in Binary.FieldOffsetData
            bool fieldOffsetsArePointers = (image.Version >= 22);

            // Some variants of 21 also use an array of pointers
            if (image.Version == 21)
            {
                // Always 4-byte values even for 64-bit builds when array is NOT pointers
                var fieldTest = image.ReadMappedArray <uint>(MetadataRegistration.pfieldOffsets, 6);

                // We detect this by relying on the fact Module, Object, ValueType, Attribute, _Attribute and Int32
                // are always the first six defined types, and that all but Int32 have no fields
                fieldOffsetsArePointers = (fieldTest[0] == 0 && fieldTest[1] == 0 && fieldTest[2] == 0 && fieldTest[3] == 0 && fieldTest[4] == 0 && fieldTest[5] > 0);
            }

            // All older versions use values directly in the array
            if (!fieldOffsetsArePointers)
            {
                FieldOffsets = image.ReadMappedArray <uint>(MetadataRegistration.pfieldOffsets, (int)MetadataRegistration.fieldOffsetsCount);
            }
            else
            {
                FieldOffsetPointers = image.ReadMappedWordArray(MetadataRegistration.pfieldOffsets, (int)MetadataRegistration.fieldOffsetsCount);
            }

            // Type definitions (pointer array)
            Types = image.ReadMappedObjectPointerArray <Il2CppType>(MetadataRegistration.ptypes, (int)MetadataRegistration.typesCount);

            // Custom attribute constructors
            CustomAttributeGenerators = image.ReadMappedArray <ulong>(CodeRegistration.customAttributeGenerators, (int)CodeRegistration.customAttributeCount);

            // Generic method specs
            MethodSpecs = image.ReadMappedArray <Il2CppMethodSpec>(MetadataRegistration.methodSpecs, (int)MetadataRegistration.methodSpecsCount);
        }
Esempio n. 3
0
        private void Configure(IFileFormatReader image, ulong codeRegistration, ulong metadataRegistration)
        {
            // Store locations
            CodeRegistrationPointer     = codeRegistration;
            MetadataRegistrationPointer = metadataRegistration;

            Console.WriteLine("CodeRegistration struct found at 0x{0:X16} (file offset 0x{1:X8})", image.Bits == 32 ? codeRegistration & 0xffff_ffff : codeRegistration, image.MapVATR(codeRegistration));
            Console.WriteLine("MetadataRegistration struct found at 0x{0:X16} (file offset 0x{1:X8})", image.Bits == 32 ? metadataRegistration & 0xffff_ffff : metadataRegistration, image.MapVATR(metadataRegistration));

            // Set width of long (convert to sizeof(int) for 32-bit files)
            if (image.Bits == 32)
            {
                image.Stream.PrimitiveMappings.Add(typeof(long), typeof(int));
                image.Stream.PrimitiveMappings.Add(typeof(ulong), typeof(uint));
            }

            // Root structures from which we find everything else
            CodeRegistration     = image.ReadMappedObject <Il2CppCodeRegistration>(codeRegistration);
            MetadataRegistration = image.ReadMappedObject <Il2CppMetadataRegistration>(metadataRegistration);

            // The global method pointer list was deprecated in v24.2 in favour of Il2CppCodeGenModule
            if (Image.Version <= 24.1)
            {
                GlobalMethodPointers = image.ReadMappedArray <ulong>(CodeRegistration.pmethodPointers, (int)CodeRegistration.methodPointersCount);
            }

            // After v24 method pointers and RGCTX data were stored in Il2CppCodeGenModules
            if (Image.Version >= 24.2)
            {
                Modules = new Dictionary <string, Il2CppCodeGenModule>();

                // Array of pointers to Il2CppCodeGenModule
                var codeGenModulePointers = image.ReadMappedArray <ulong>(CodeRegistration.pcodeGenModules, (int)CodeRegistration.codeGenModulesCount);
                var modules = image.ReadMappedObjectPointerArray <Il2CppCodeGenModule>(CodeRegistration.pcodeGenModules, (int)CodeRegistration.codeGenModulesCount);

                foreach (var mp in modules.Zip(codeGenModulePointers, (m, p) => new { Module = m, Pointer = p }))
                {
                    var module = mp.Module;

                    var name = image.ReadMappedNullTerminatedString(module.moduleName);
                    Modules.Add(name, module);
                    CodeGenModulePointers.Add(name, mp.Pointer);

                    // Read method pointers
                    ModuleMethodPointers.Add(module, image.ReadMappedArray <ulong>(module.methodPointers, (int)module.methodPointerCount));

                    // Read method invoker pointer indices - one per method
                    MethodInvokerIndices.Add(module, image.ReadMappedArray <int>(module.invokerIndices, (int)module.methodPointerCount));
                }
            }

            // Field offset data. Metadata <=21.x uses a value-type array; >=21.x uses a pointer array

            // Versions from 22 onwards use an array of pointers in Binary.FieldOffsetData
            bool fieldOffsetsArePointers = (image.Version >= 22);

            // Some variants of 21 also use an array of pointers
            if (image.Version == 21)
            {
                // Always 4-byte values even for 64-bit builds when array is NOT pointers
                var fieldTest = image.ReadMappedArray <uint>(MetadataRegistration.pfieldOffsets, 6);

                // We detect this by relying on the fact Module, Object, ValueType, Attribute, _Attribute and Int32
                // are always the first six defined types, and that all but Int32 have no fields
                fieldOffsetsArePointers = (fieldTest[0] == 0 && fieldTest[1] == 0 && fieldTest[2] == 0 && fieldTest[3] == 0 && fieldTest[4] == 0 && fieldTest[5] > 0);
            }

            // All older versions use values directly in the array
            if (!fieldOffsetsArePointers)
            {
                FieldOffsets = image.ReadMappedArray <uint>(MetadataRegistration.pfieldOffsets, (int)MetadataRegistration.fieldOffsetsCount);
            }
            else
            {
                FieldOffsetPointers = image.ReadMappedWordArray(MetadataRegistration.pfieldOffsets, (int)MetadataRegistration.fieldOffsetsCount);
            }

            // Type references (pointer array)
            var typeRefPointers = image.ReadMappedArray <ulong>(MetadataRegistration.ptypes, (int)MetadataRegistration.typesCount);

            TypeReferenceIndicesByAddress = typeRefPointers.Zip(Enumerable.Range(0, typeRefPointers.Length), (a, i) => new { a, i }).ToDictionary(x => x.a, x => x.i);
            TypeReferences = image.ReadMappedObjectPointerArray <Il2CppType>(MetadataRegistration.ptypes, (int)MetadataRegistration.typesCount);

            // Custom attribute constructors (function pointers)
            CustomAttributeGenerators = image.ReadMappedArray <ulong>(CodeRegistration.customAttributeGenerators, (int)CodeRegistration.customAttributeCount);

            // Method.Invoke function pointers
            MethodInvokePointers = image.ReadMappedArray <ulong>(CodeRegistration.invokerPointers, (int)CodeRegistration.invokerPointersCount);

            // TODO: Function pointers as shown below
            // reversePInvokeWrappers
            // <=22: delegateWrappersFromManagedToNative, marshalingFunctions;
            // >=21 <=22: ccwMarhsalingFunctions
            // >=22: unresolvedVirtualCallPointers
            // >=23: interopData

            // Generic type and method specs (open and closed constructed types)
            MethodSpecs = image.ReadMappedArray <Il2CppMethodSpec>(MetadataRegistration.methodSpecs, (int)MetadataRegistration.methodSpecsCount);

            // Concrete generic class and method signatures
            GenericInstances = image.ReadMappedObjectPointerArray <Il2CppGenericInst>(MetadataRegistration.genericInsts, (int)MetadataRegistration.genericInstsCount);

            // Concrete generic method pointers
            var genericMethodPointers = image.ReadMappedArray <ulong>(CodeRegistration.genericMethodPointers, (int)CodeRegistration.genericMethodPointersCount);
            var genericMethodTable    = image.ReadMappedArray <Il2CppGenericMethodFunctionsDefinitions>(MetadataRegistration.genericMethodTable, (int)MetadataRegistration.genericMethodTableCount);

            foreach (var tableEntry in genericMethodTable)
            {
                GenericMethodPointers.Add(MethodSpecs[tableEntry.genericMethodIndex], genericMethodPointers[tableEntry.indices.methodIndex]);
                GenericMethodInvokerIndices.Add(MethodSpecs[tableEntry.genericMethodIndex], tableEntry.indices.invokerIndex);
            }
        }
        protected override (ulong, ulong) ConsiderCode(IFileFormatReader image, uint loc)
        {
            // Setup
            var buffSize  = 0x76; // minimum number of bytes to process the longest expected function
            var leaSize   = 7;    // the length of an LEA instruction with a 64-bit register operand and a 32-bit memory operand
            var xor64Size = 3;    // the length of a XOR instruction of two 64-bit registers
            var xor32Size = 2;    // the length of a XOR instruction of two 32-bit registers
            var pushSize  = 2;    // the length of a PUSH instruction with a 64-bit register
            var offset    = 0;

            int RAX = 0, RBX = 3, RCX = 1, RDX = 2, RSI = 6, RDI = 7; // R8 = 8

            ulong pCgr = 0;                                           // the point to the code registration function

            image.Position = loc;
            var buff = image.ReadBytes(buffSize);

            // We have seen two versions of the initializer:
            // 1. Regular version
            // 2. Inlined version with il2cpp::utils::RegisterRuntimeInitializeAndCleanup(CallbackFunction, CallbackFunction, order)

            // Version 1 passes "this" in rcx and the arguments in rdx (our wanted pointer), r8d (always zero) and r9d (always zero)
            //           or "this" in rdi, and the arguments in rsi (our wanted pointer), edx (always zero) and ecx (always zero)
            // Version 2 has a standard prologue and loads the wanted pointer into rax or rbp (lea rax/rbp)

            (int reg, uint operand)? lea;

            // Check for regular version
            // Generalize it as follows:
            // - each instruction must be lea r64, imm32 or xor r32, r32
            // - xors must always have the same register for both operands
            // - lea that can't be mapped into the file is the pointer to 'this', otherwise it's the pointer to the init function
            // - the last instruction should always be jmp (not currently enforced)
            // - function length should not be longer than 5 instructions (two leas, two xors and one jmp)

            offset = 0;
            for (var instructions = 0; instructions < 4; instructions++)
            {
                // All allowed instruction types
                var xor32 = getXorR32R32(buff, offset);
                var xor64 = getXorR64R64(buff, offset);
                lea = getLea(buff, offset);

                if (xor32 != null && xor32.Value.reg_op1 == xor32.Value.reg_op2)
                {
                    offset += xor32Size;
                }
                else if (xor64 != null && xor64.Value.reg_op1 == xor64.Value.reg_op2)
                {
                    offset += xor64Size;
                }
                else if (lea != null)
                {
                    offset += leaSize;

                    if (pCgr == 0)
                    {
                        try {
                            // We may have found Il2CppCodegenRegistration(void)
                            pCgr = image.GlobalOffset + loc + (ulong)offset + lea.Value.operand;
                            var newLoc = image.MapVATR(pCgr);
                        }
                        catch (InvalidOperationException) {
                            // this pointer
                            pCgr = 0;
                        }
                    }
                }
                else
                {
                    // not lea or xor
                    pCgr = 0;
                    break;
                }
            }

            // Check for inlined version
            if (pCgr == 0)
            {
                // Check for prologue
                // - A sequence of 0 or more mov [rsp+argX], rXX followed by 1 or more push rXX
                offset = 0;
                while (isMovRM64R64(buff, offset))
                {
                    offset += 5;
                }

                if (isPushR64(buff, offset))
                {
                    // Linear sweep for LEA
                    var leaInlined = findLea(buff, pushSize, buffSize - pushSize);
                    if (leaInlined != null)
                    {
                        pCgr = image.GlobalOffset + loc + (uint)leaInlined.Value.foundOffset + (uint)leaSize + leaInlined.Value.operand;
                    }
                }
            }

            // Assume we've found the pointer to Il2CppCodegenRegistration(void) and jump there
            if (pCgr != 0)
            {
                try {
                    Image.Position = Image.MapVATR(pCgr);
                }

                // Couldn't map virtual address to data in file, so it's not this function
                catch (InvalidOperationException) {
                    pCgr = 0;
                }
            }

            // Find the first 2 LEAs which we'll hope contain pointers to CodeRegistration and MetadataRegistration

            // There are two options here:
            // 1. il2cpp::vm::MetadataCache::Register is called directly with arguments in rcx, rdx, r8 or rdi, rsi, rdx (lea, lea, lea, jmp)
            // 2. The two functions being inlined. The arguments are loaded sequentially into rax after the prologue

            if (pCgr != 0)
            {
                var buff2Size = 0x50;
                var buff2     = image.ReadBytes(buffSize);
                offset = 0;

                var leas = new Dictionary <(int index, ulong address), int>();

                // Find the first three LEAs in the function
                while (offset + leaSize < buff2Size && leas.Count < 3)
                {
                    var nextLea = findLea(buff2, offset, buff2Size - (offset + leaSize));

                    // Use the original pointer found, not the file location + GlobalOffset because the data may be in a different section
                    if (nextLea != null)
                    {
                        leas.Add((leas.Count, pCgr + (uint)nextLea.Value.foundOffset + (uint)leaSize + nextLea.Value.operand), nextLea.Value.reg);
                    }

                    offset = nextLea?.foundOffset + leaSize ?? buff2Size;
                }

                if ((image.Version < 21 && leas.Count == 2) || (image.Version >= 21 && leas.Count == 3))
                {
                    // Register-based argument passing?
                    var leaRSI = leas.FirstOrDefault(l => l.Value == RSI).Key.address;
                    var leaRDI = leas.FirstOrDefault(l => l.Value == RDI).Key.address;

                    if (leaRSI != 0 && leaRDI != 0)
                    {
                        return(leaRDI, leaRSI);
                    }

                    var leaRCX = leas.FirstOrDefault(l => l.Value == RCX).Key.address;
                    var leaRDX = leas.FirstOrDefault(l => l.Value == RDX).Key.address;

                    if (leaRCX != 0 && leaRDX != 0)
                    {
                        return(leaRCX, leaRDX);
                    }

                    // RAX sequential loading? If so, take the first two arguments
                    var leasRAX = leas.Where(l => l.Value == RAX).OrderBy(l => l.Key.index).Select(l => l.Key.address).ToArray();
                    if (leasRAX.Length > 1)
                    {
                        return(leasRAX[0], leasRAX[1]);
                    }
                }
            }

            // If no initializer is found, we may be looking at a DT_INIT function which calls its own function table manually
            // In the sample we have seen (PlayStation 4), this function runs through two function tables:
            // 1. Start address of table loaded into rbx, pointer past end of table in r12 (lea rbx; lea r12)
            // 2. Pointer to final address of 2nd table loaded into rbx (lea rbx), runs backwards (8 bytes per entry) until finding 0xFFFFFFFF_FFFFFFFF
            // The strategy: find these LEAs, acquire and merge the two function tables, then call ourselves in a loop to check each function address

            // Expect function prologue and at least 3 64-bit register pushes (there are probably more)
            if (!isPrologue(buff) || !isPushR64(buff, 4) || !isPushR64(buff, 6) || !isPushR64(buff, 8))
            {
                return(0, 0);
            }

            // Find the start and end addresses of the first function table
            var leaOfStart = findLea(buff, 10, buffSize - 10);

            if (leaOfStart == null || leaOfStart.Value.reg != RBX) // Most be lea rbx
            {
                return(0, 0);
            }

            var leaOfEnd = findLea(buff, leaOfStart.Value.foundOffset + leaSize, buffSize - (leaOfStart.Value.foundOffset + leaSize));

            if (leaOfEnd == null || leaOfEnd.Value.reg == RBX) // Must be lea with any register besides rbx
            {
                return(0, 0);
            }

            var ptrStart1 = leaOfStart.Value.foundOffset + leaSize + leaOfStart.Value.operand;
            var ptrEnd1   = leaOfEnd.Value.foundOffset + leaSize + leaOfEnd.Value.operand;

            // Find the address of the last item in the second function table
            var leaOfLastItem = findLea(buff, leaOfEnd.Value.foundOffset + leaSize, buffSize - (leaOfEnd.Value.foundOffset + leaSize));

            if (leaOfLastItem == null || leaOfLastItem.Value.reg != 0b11) // Must be lea rbx
            {
                return(0, 0);
            }

            var entrySize = 8; // 64-bit array entries
            var ptrEnd2   = leaOfLastItem.Value.foundOffset + leaSize + leaOfLastItem.Value.operand + entrySize;

            // Work backwards to find the address of the first item in the second function table
            var ptrStart2 = ptrEnd2;

            while (image.ReadUInt64(image.MapVATR((ulong)ptrStart2)) != 0xFFFF_FFFF_FFFF_FFFF)
            {
                ptrStart2 -= entrySize;
            }
            ptrStart2 += entrySize;

            // Acquire both function tables
            var funcs1 = image.ReadMappedWordArray((ulong)ptrStart1, (int)(ptrEnd1 - ptrStart1) / entrySize);
            var funcs2 = image.ReadMappedWordArray((ulong)ptrStart2, (int)(ptrEnd2 - ptrStart2) / entrySize);

            // Check every function
            var funcs = funcs1.Concat(funcs2);

            foreach (var pFunc in funcs)
            {
                var result = ConsiderCode(image, image.MapVATR((ulong)pFunc));
                if (result != (0, 0))
                {
                    return(result);
                }
            }
            return(0, 0);
        }
        private Dictionary <uint, ulong> sweepForAddressLoads(List <uint> func, ulong baseAddress, IFileFormatReader image)
        {
            // List of registers and addresses loaded into them
            var regs = new Dictionary <uint, ulong>();

            // Iterate each instruction
            var pc = baseAddress;

            foreach (var inst in func)
            {
                // Is it an ADRP Xn, #page?
                if (getAdrp(inst, pc) is (uint reg, ulong page))
                {
                    // If we've had an earlier ADRP for the same register, we'll discard the previous load
                    if (regs.ContainsKey(reg))
                    {
                        regs[reg] = page;
                    }
                    else
                    {
                        regs.Add(reg, page);
                    }
                }

                if (getAdr(inst, pc) is (uint reg_adr, ulong addr))
                {
                    if (regs.ContainsKey(reg_adr))
                    {
                        regs[reg_adr] = addr;
                    }
                    else
                    {
                        regs.Add(reg_adr, addr);
                    }
                }

                // Is it an ADD Xm, Xn, #offset?
                if (getAdd64(inst) is (uint reg_n, uint reg_d, uint imm))
                {
                    // We are only interested in registers that have already had an ADRP, and the ADD must be to itself
                    if (reg_n == reg_d && regs.ContainsKey(reg_d))
                    {
                        regs[reg_d] += imm;
                    }
                }

                // Is it an LDR Xm, [Xn, #offset]?
                if (getLdr64ImmOffset(inst) is (uint reg_t, uint reg_ldr_n, uint simm))
                {
                    // We are only interested in registers that have already had an ADRP, and the LDR must be to itself
                    if (reg_t == reg_ldr_n && regs.ContainsKey(reg_ldr_n))
                    {
                        regs[reg_ldr_n] += simm * 8; // simm is a byte offset in a multiple of 8

                        // Now we have a pointer address, dereference it
                        regs[reg_ldr_n] = image.ReadUInt64(image.MapVATR(regs[reg_ldr_n]));
                    }
                }

                // Advance program counter which we need to calculate ADRP pages correctly
                pc += 4;
            }
            return(regs);
        }