| static private ReadUInt32 ( this stream ) : uint | ||
| stream | this | |
| return | uint | |
private (bool, long, long) SearchAltARM7(long loc, long globalOffset)
{
var locfix = loc - 1;
var bytes = new byte[] { 0x0, 0x22 }; // MOVS R2, #0
Image.Position = Image.MapVATR(locfix);
Image.Position += 4;
var buff = Image.ReadBytes(2);
if (bytes.SequenceEqual(buff))
{
bytes = new byte[] { 0x78, 0x44, 0x79, 0x44 }; // ADD R0, PC and ADD R1, PC
Image.Position += 12;
buff = Image.ReadBytes(4);
if (bytes.SequenceEqual(buff))
{
Image.Position = Image.MapVATR(locfix) + 10;
bytes = Image.ReadBytes(8);
var subaddr = (long)(decodeMovImm32(bytes) + (uint)locfix + 24u - 1u);
var rsubaddr = Image.MapVATR(subaddr);
Image.Position = rsubaddr;
var ptr = decodeMovImm32(Image.ReadBytes(8)) + subaddr + 16u;
Image.Position = Image.MapVATR(ptr);
var metadataRegistration = Image.ReadUInt32();
Image.Position = rsubaddr + 8;
buff = Image.ReadBytes(4);
Image.Position = rsubaddr + 14;
buff = buff.Concat(Image.ReadBytes(4)).ToArray();
var codeRegistration = decodeMovImm32(buff) + subaddr + 26u;
return(true, codeRegistration, metadataRegistration);
}
}
return(false, 0, 0);
}
protected override (long, long) Search(long loc, long globalOffset)
{
long funcPtr, metadata, code;
// Variant 1
// Assembly bytes to search for at start of each function
var bytes = new byte[] { 0x6A, 0x00, 0x6A, 0x00, 0x68 };
Image.Position = loc;
var buff = Image.ReadBytes(5);
if (bytes.SequenceEqual(buff))
{
// Next 4 bytes are the function pointer being pushed onto the stack
funcPtr = Image.ReadUInt32();
// Start of next instruction
if (Image.ReadByte() != 0xB9)
{
return(0, 0);
}
// Jump to Il2CppCodegenRegistration
Image.Position = Image.MapVATR(funcPtr) + 6;
metadata = Image.ReadUInt32();
Image.Position = Image.MapVATR(funcPtr) + 11;
code = Image.ReadUInt32();
return(code, metadata);
}
// Variant 2
bytes = new byte[] { 0x55, 0x89, 0xE5, 0x53, 0x83, 0xE4, 0xF0, 0x83, 0xEC, 0x20, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B };
Image.Position = loc;
buff = Image.ReadBytes(16);
if (!bytes.SequenceEqual(buff))
{
return(0, 0);
}
Image.Position += 8;
funcPtr = Image.MapVATR(Image.ReadUInt32() + globalOffset);
if (funcPtr > Image.Stream.BaseStream.Length)
{
return(0, 0);
}
Image.Position = funcPtr + 0x22;
metadata = Image.ReadUInt32() + globalOffset;
Image.Position = funcPtr + 0x2C;
code = Image.ReadUInt32() + globalOffset;
return(code, metadata);
}
protected override (uint, uint) Search(uint loc, uint globalOffset)
{
// Assembly bytes to search for at start of each function
uint metadataRegistration, codeRegistration;
// ARM
var bytes = new byte[] { 0x1c, 0x0, 0x9f, 0xe5, 0x1c, 0x10, 0x9f, 0xe5, 0x1c, 0x20, 0x9f, 0xe5 };
Image.Position = loc;
var buff = Image.ReadBytes(12);
if (bytes.SequenceEqual(buff))
{
Image.Position = loc + 0x2c;
var subaddr = Image.ReadUInt32() + globalOffset;
Image.Position = subaddr + 0x28;
codeRegistration = Image.ReadUInt32() + globalOffset;
Image.Position = subaddr + 0x2C;
var ptr = Image.ReadUInt32() + globalOffset;
Image.Position = Image.MapVATR(ptr);
metadataRegistration = Image.ReadUInt32();
return(codeRegistration, metadataRegistration);
}
// ARMv7 Thumb (T1)
// http://liris.cnrs.fr/~mmrissa/lib/exe/fetch.php?media=armv7-a-r-manual.pdf - A8.8.106
// http://armconverter.com/hextoarm/
bytes = new byte[] { 0x2d, 0xe9, 0x00, 0x48, 0xeb, 0x46 };
Image.Position = loc;
buff = Image.ReadBytes(6);
if (!bytes.SequenceEqual(buff))
{
return(0, 0);
}
bytes = new byte[] { 0x00, 0x23, 0x00, 0x22, 0xbd, 0xe8, 0x00, 0x48 };
Image.Position += 0x10;
buff = Image.ReadBytes(8);
if (!bytes.SequenceEqual(buff))
{
return(0, 0);
}
Image.Position = loc + 6;
Image.Position = (Image.MapVATR(decodeMovImm32(Image.ReadBytes(8))) & 0xfffffffc) + 0x0e;
metadataRegistration = decodeMovImm32(Image.ReadBytes(8));
codeRegistration = decodeMovImm32(Image.ReadBytes(8));
return(codeRegistration, metadataRegistration);
}
private (bool, long, long) SearchARM(long loc, long globalOffset)
{
var bytes = new byte[] { 0x1c, 0x0, 0x9f, 0xe5, 0x1c, 0x10, 0x9f, 0xe5, 0x1c, 0x20, 0x9f, 0xe5 };
Image.Position = loc;
var buff = Image.ReadBytes(12);
if (bytes.SequenceEqual(buff))
{
Image.Position = loc + 0x2c;
var subaddr = Image.ReadUInt32() + (uint)globalOffset;
Image.Position = subaddr + 0x28;
long codeRegistration = Image.ReadUInt32() + (uint)globalOffset;
Image.Position = subaddr + 0x2C;
var ptr = Image.ReadUInt32() + (uint)globalOffset;
Image.Position = Image.MapVATR(ptr);
long metadataRegistration = Image.ReadUInt32();
return(true, codeRegistration, metadataRegistration);
}
return(false, 0, 0);
}
protected override (ulong, ulong) ConsiderCode(ulong loc, ulong globalOffset)
{
ulong funcPtr, metadata, code;
ushort opcode;
// Variant 1
// Assembly bytes to search for at start of each function
var bytes = new byte[] { 0x6A, 0x00, 0x6A, 0x00, 0x68 };
Image.Position = (long)loc;
var buff = Image.ReadBytes(5);
if (bytes.SequenceEqual(buff))
{
// Next 4 bytes are the function pointer being pushed onto the stack
funcPtr = Image.ReadUInt32();
// Start of next instruction
if (Image.ReadByte() != 0xB9)
{
return(0, 0);
}
// Jump to Il2CppCodegenRegistration
Image.Position = (uint)Image.MapVATR(funcPtr) + 6;
metadata = Image.ReadUInt32();
Image.Position = (uint)Image.MapVATR(funcPtr) + 11;
code = Image.ReadUInt32();
return(code, metadata);
}
// Variant 2
bytes = new byte[] { 0x55, 0x89, 0xE5, 0x53, 0x83, 0xE4, 0xF0, 0x83, 0xEC, 0x20, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B };
Image.Position = (long)loc;
buff = Image.ReadBytes(16);
if (!bytes.SequenceEqual(buff))
{
return(0, 0);
}
Image.Position += 8;
funcPtr = Image.MapVATR(Image.ReadUInt32() + globalOffset);
if ((long)funcPtr > Image.Stream.BaseStream.Length)
{
return(0, 0);
}
// Extract Metadata pointer
// An 0x838D opcode indicates LEA (no indirection)
Image.Position = (long)(funcPtr + 0x20);
opcode = Image.ReadUInt16();
metadata = Image.ReadUInt32() + globalOffset;
// An 8x838B opcode indicates MOV (pointer indirection)
if (opcode == 0x838B)
{
Image.Position = (uint)Image.MapVATR(metadata);
metadata = Image.ReadUInt32();
}
// Repeat the same logic for extracting the Code pointer
Image.Position = (long)(funcPtr + 0x2A);
opcode = Image.ReadUInt16();
code = Image.ReadUInt32() + globalOffset;
if (opcode == 0x838B)
{
Image.Position = (uint)Image.MapVATR(code);
code = Image.ReadUInt32();
}
return(code, metadata);
}
protected override (uint, uint) Search(uint loc, uint globalOffset)
{
// Assembly bytes to search for at start of each function
uint metadataRegistration, codeRegistration;
// ARM
var bytes = new byte[] { 0x1c, 0x0, 0x9f, 0xe5, 0x1c, 0x10, 0x9f, 0xe5, 0x1c, 0x20, 0x9f, 0xe5 };
Image.Position = loc;
var buff = Image.ReadBytes(12);
if (bytes.SequenceEqual(buff))
{
Image.Position = loc + 0x2c;
var subaddr = Image.ReadUInt32() + globalOffset;
Image.Position = subaddr + 0x28;
codeRegistration = Image.ReadUInt32() + globalOffset;
Image.Position = subaddr + 0x2C;
var ptr = Image.ReadUInt32() + globalOffset;
Image.Position = Image.MapVATR(ptr);
metadataRegistration = Image.ReadUInt32();
return(codeRegistration, metadataRegistration);
}
// ARM metadata v23
Image.Position = loc;
// Check for ADD Rx, PC in relevant parts of function
var func = Image.ReadBytes(0x20);
if (func[0x0C] == 0x79 && func[0x0D] == 0x44 && // ADD R1, PC
func[0x16] == 0x78 && func[0x17] == 0x44 && // ADD R0, PC
func[0x1E] == 0x7A && func[0x1F] == 0x44) // ADD R2, PC
{
// Follow path to metadata pointer
var ppMetadata = decodeMovImm32(func) + loc + 0x10;
Image.Position = ppMetadata;
metadataRegistration = Image.ReadUInt32();
// Follow path to code pointer
var pCode = decodeMovImm32(func.Skip(8).Take(4).Concat(func.Skip(14).Take(4)).ToArray());
codeRegistration = pCode + loc + 0x1A - globalOffset;
return(codeRegistration, metadataRegistration);
}
// ARMv7 Thumb (T1)
// http://liris.cnrs.fr/~mmrissa/lib/exe/fetch.php?media=armv7-a-r-manual.pdf - A8.8.106
// http://armconverter.com/hextoarm/
bytes = new byte[] { 0x2d, 0xe9, 0x00, 0x48, 0xeb, 0x46 };
Image.Position = loc;
buff = Image.ReadBytes(6);
if (!bytes.SequenceEqual(buff))
{
return(0, 0);
}
bytes = new byte[] { 0x00, 0x23, 0x00, 0x22, 0xbd, 0xe8, 0x00, 0x48 };
Image.Position += 0x10;
buff = Image.ReadBytes(8);
if (!bytes.SequenceEqual(buff))
{
return(0, 0);
}
Image.Position = loc + 6;
Image.Position = (Image.MapVATR(decodeMovImm32(Image.ReadBytes(8))) & 0xfffffffc) + 0x0e;
metadataRegistration = decodeMovImm32(Image.ReadBytes(8));
codeRegistration = decodeMovImm32(Image.ReadBytes(8));
return(codeRegistration, metadataRegistration);
}
