public InstructionTranslater(OffsetsCollector offsets, MethodDefinition currentMethod, long currentMethodOffset)
{
this.offsets = offsets;
this.currentMethod = currentMethod;
this.currentMethodOffset = currentMethodOffset;
Init();
}
public IList <TranslatedInstruction> DisassembleMethod(MethodDefinition method)
{
long offset = OffsetsCollector.GetMethodOffset(method);
if (offset == -1)
{
return(null);
}
return(Disassembler.DisassembleMethod(method, OffsetsCollector.GetMethodOffset(method)));
}
public NativeDetective(string il2cppDumpPath, string nativeAssemblyPath)
{
Offsets = new OffsetsCollector(il2cppDumpPath);
Offsets.ReadStrings();
Offsets.ReadMethods();
Disassembler = new MethodDisassembler(File.ReadAllBytes(nativeAssemblyPath), Offsets);
UsageFinder = new MethodUsageFinder(Offsets, Disassembler);
}
public List <Usage> FindUsages(string textToFind)
{
var usages = new List <Usage>();
foreach (MethodDefinition method in offsets.Methods)
{
long offset = OffsetsCollector.GetMethodOffset(method);
if (offset > -1)
{
int count = GetStringUsagesInMethod(textToFind, method);
if (count > 0)
{
usages.Add(new Usage {
Method = method, Count = count
});
}
}
}
return(usages);
}
private int GetFieldUsagesInMethod(FieldDefinition fieldToFind, MethodDefinition methodToSearch)
{
var instructions = disassembler.DisassembleMethod(OffsetsCollector.GetMethodOffset(methodToSearch));
return(instructions.Where(x => x.UsedField == fieldToFind).Count());
}
public MethodUsageFinder(OffsetsCollector offsets, MethodDisassembler disassembler)
{
this.offsets = offsets;
this.disassembler = disassembler;
}
private int GetStringUsagesInMethod(string textToFind, MethodDefinition methodToSearch)
{
var instructions = disassembler.DisassembleMethod(OffsetsCollector.GetMethodOffset(methodToSearch));
return(instructions.Where(x => x.StringContent != null && x.StringContent.Contains(textToFind)).Count());
}
public MethodDisassembler(byte[] nativeDllCode, OffsetsCollector offsets)
{
NativeDllCode = nativeDllCode;
Offsets = offsets;
}
