protected override (ulong, ulong) ConsiderCode(IFileFormatReader image, uint loc)
{
// Setup
var buffSize = 0x76; // minimum number of bytes to process the longest expected function
var leaSize = 7; // the length of an LEA instruction with a 64-bit register operand and a 32-bit memory operand
var xor64Size = 3; // the length of a XOR instruction of two 64-bit registers
var xor32Size = 2; // the length of a XOR instruction of two 32-bit registers
var pushSize = 2; // the length of a PUSH instruction with a 64-bit register
var offset = 0;
int RAX = 0, RBX = 3, RCX = 1, RDX = 2, RSI = 6, RDI = 7; // R8 = 8
ulong pCgr = 0; // the point to the code registration function
image.Position = loc;
var buff = image.ReadBytes(buffSize);
// We have seen two versions of the initializer:
// 1. Regular version
// 2. Inlined version with il2cpp::utils::RegisterRuntimeInitializeAndCleanup(CallbackFunction, CallbackFunction, order)
// Version 1 passes "this" in rcx and the arguments in rdx (our wanted pointer), r8d (always zero) and r9d (always zero)
// or "this" in rdi, and the arguments in rsi (our wanted pointer), edx (always zero) and ecx (always zero)
// Version 2 has a standard prologue and loads the wanted pointer into rax or rbp (lea rax/rbp)
(int reg, uint operand)? lea;
// Check for regular version
// Generalize it as follows:
// - each instruction must be lea r64, imm32 or xor r32, r32
// - xors must always have the same register for both operands
// - lea that can't be mapped into the file is the pointer to 'this', otherwise it's the pointer to the init function
// - the last instruction should always be jmp (not currently enforced)
// - function length should not be longer than 5 instructions (two leas, two xors and one jmp)
offset = 0;
for (var instructions = 0; instructions < 4; instructions++)
{
// All allowed instruction types
var xor32 = getXorR32R32(buff, offset);
var xor64 = getXorR64R64(buff, offset);
lea = getLea(buff, offset);
if (xor32 != null && xor32.Value.reg_op1 == xor32.Value.reg_op2)
{
offset += xor32Size;
}
else if (xor64 != null && xor64.Value.reg_op1 == xor64.Value.reg_op2)
{
offset += xor64Size;
}
else if (lea != null)
{
offset += leaSize;
if (pCgr == 0)
{
try {
// We may have found Il2CppCodegenRegistration(void)
pCgr = image.GlobalOffset + loc + (ulong)offset + lea.Value.operand;
var newLoc = image.MapVATR(pCgr);
}
catch (InvalidOperationException) {
// this pointer
pCgr = 0;
}
}
}
else
{
// not lea or xor
pCgr = 0;
break;
}
}
// Check for inlined version
if (pCgr == 0)
{
// Check for prologue
// - A sequence of 0 or more mov [rsp+argX], rXX followed by 1 or more push rXX
offset = 0;
while (isMovRM64R64(buff, offset))
{
offset += 5;
}
if (isPushR64(buff, offset))
{
// Linear sweep for LEA
var leaInlined = findLea(buff, pushSize, buffSize - pushSize);
if (leaInlined != null)
{
pCgr = image.GlobalOffset + loc + (uint)leaInlined.Value.foundOffset + (uint)leaSize + leaInlined.Value.operand;
}
}
}
// Assume we've found the pointer to Il2CppCodegenRegistration(void) and jump there
if (pCgr != 0)
{
try {
Image.Position = Image.MapVATR(pCgr);
}
// Couldn't map virtual address to data in file, so it's not this function
catch (InvalidOperationException) {
pCgr = 0;
}
}
// Find the first 2 LEAs which we'll hope contain pointers to CodeRegistration and MetadataRegistration
// There are two options here:
// 1. il2cpp::vm::MetadataCache::Register is called directly with arguments in rcx, rdx, r8 or rdi, rsi, rdx (lea, lea, lea, jmp)
// 2. The two functions being inlined. The arguments are loaded sequentially into rax after the prologue
if (pCgr != 0)
{
var buff2Size = 0x50;
var buff2 = image.ReadBytes(buffSize);
offset = 0;
var leas = new Dictionary <(int index, ulong address), int>();
// Find the first three LEAs in the function
while (offset + leaSize < buff2Size && leas.Count < 3)
{
var nextLea = findLea(buff2, offset, buff2Size - (offset + leaSize));
// Use the original pointer found, not the file location + GlobalOffset because the data may be in a different section
if (nextLea != null)
{
leas.Add((leas.Count, pCgr + (uint)nextLea.Value.foundOffset + (uint)leaSize + nextLea.Value.operand), nextLea.Value.reg);
}
offset = nextLea?.foundOffset + leaSize ?? buff2Size;
}
if ((image.Version < 21 && leas.Count == 2) || (image.Version >= 21 && leas.Count == 3))
{
// Register-based argument passing?
var leaRSI = leas.FirstOrDefault(l => l.Value == RSI).Key.address;
var leaRDI = leas.FirstOrDefault(l => l.Value == RDI).Key.address;
if (leaRSI != 0 && leaRDI != 0)
{
return(leaRDI, leaRSI);
}
var leaRCX = leas.FirstOrDefault(l => l.Value == RCX).Key.address;
var leaRDX = leas.FirstOrDefault(l => l.Value == RDX).Key.address;
if (leaRCX != 0 && leaRDX != 0)
{
return(leaRCX, leaRDX);
}
// RAX sequential loading? If so, take the first two arguments
var leasRAX = leas.Where(l => l.Value == RAX).OrderBy(l => l.Key.index).Select(l => l.Key.address).ToArray();
if (leasRAX.Length > 1)
{
return(leasRAX[0], leasRAX[1]);
}
}
}
// If no initializer is found, we may be looking at a DT_INIT function which calls its own function table manually
// In the sample we have seen (PlayStation 4), this function runs through two function tables:
// 1. Start address of table loaded into rbx, pointer past end of table in r12 (lea rbx; lea r12)
// 2. Pointer to final address of 2nd table loaded into rbx (lea rbx), runs backwards (8 bytes per entry) until finding 0xFFFFFFFF_FFFFFFFF
// The strategy: find these LEAs, acquire and merge the two function tables, then call ourselves in a loop to check each function address
// Expect function prologue and at least 3 64-bit register pushes (there are probably more)
if (!isPrologue(buff) || !isPushR64(buff, 4) || !isPushR64(buff, 6) || !isPushR64(buff, 8))
{
return(0, 0);
}
// Find the start and end addresses of the first function table
var leaOfStart = findLea(buff, 10, buffSize - 10);
if (leaOfStart == null || leaOfStart.Value.reg != RBX) // Most be lea rbx
{
return(0, 0);
}
var leaOfEnd = findLea(buff, leaOfStart.Value.foundOffset + leaSize, buffSize - (leaOfStart.Value.foundOffset + leaSize));
if (leaOfEnd == null || leaOfEnd.Value.reg == RBX) // Must be lea with any register besides rbx
{
return(0, 0);
}
var ptrStart1 = leaOfStart.Value.foundOffset + leaSize + leaOfStart.Value.operand;
var ptrEnd1 = leaOfEnd.Value.foundOffset + leaSize + leaOfEnd.Value.operand;
// Find the address of the last item in the second function table
var leaOfLastItem = findLea(buff, leaOfEnd.Value.foundOffset + leaSize, buffSize - (leaOfEnd.Value.foundOffset + leaSize));
if (leaOfLastItem == null || leaOfLastItem.Value.reg != 0b11) // Must be lea rbx
{
return(0, 0);
}
var entrySize = 8; // 64-bit array entries
var ptrEnd2 = leaOfLastItem.Value.foundOffset + leaSize + leaOfLastItem.Value.operand + entrySize;
// Work backwards to find the address of the first item in the second function table
var ptrStart2 = ptrEnd2;
while (image.ReadUInt64(image.MapVATR((ulong)ptrStart2)) != 0xFFFF_FFFF_FFFF_FFFF)
{
ptrStart2 -= entrySize;
}
ptrStart2 += entrySize;
// Acquire both function tables
var funcs1 = image.ReadMappedWordArray((ulong)ptrStart1, (int)(ptrEnd1 - ptrStart1) / entrySize);
var funcs2 = image.ReadMappedWordArray((ulong)ptrStart2, (int)(ptrEnd2 - ptrStart2) / entrySize);
// Check every function
var funcs = funcs1.Concat(funcs2);
foreach (var pFunc in funcs)
{
var result = ConsiderCode(image, image.MapVATR((ulong)pFunc));
if (result != (0, 0))
{
return(result);
}
}
return(0, 0);
}
private void Configure(IFileFormatReader image, ulong codeRegistration, ulong metadataRegistration)
{
// Output locations
Console.WriteLine("CodeRegistration struct found at 0x{0:X16} (file offset 0x{1:X8})", image.Bits == 32 ? codeRegistration & 0xffff_ffff : codeRegistration, image.MapVATR(codeRegistration));
Console.WriteLine("MetadataRegistration struct found at 0x{0:X16} (file offset 0x{1:X8})", image.Bits == 32 ? metadataRegistration & 0xffff_ffff : metadataRegistration, image.MapVATR(metadataRegistration));
// Set width of long (convert to sizeof(int) for 32-bit files)
if (image.Bits == 32)
{
image.Stream.PrimitiveMappings.Add(typeof(long), typeof(int));
image.Stream.PrimitiveMappings.Add(typeof(ulong), typeof(uint));
}
// Root structures from which we find everything else
CodeRegistration = image.ReadMappedObject <Il2CppCodeRegistration>(codeRegistration);
MetadataRegistration = image.ReadMappedObject <Il2CppMetadataRegistration>(metadataRegistration);
// The global method pointer list was deprecated in v24.2 in favour of Il2CppCodeGenModule
if (Image.Version <= 24.1)
{
GlobalMethodPointers = image.ReadMappedArray <ulong>(CodeRegistration.pmethodPointers, (int)CodeRegistration.methodPointersCount);
}
// After v24 method pointers and RGCTX data were stored in Il2CppCodeGenModules
if (Image.Version >= 24.2)
{
Modules = new Dictionary <string, Il2CppCodeGenModule>();
// Array of pointers to Il2CppCodeGenModule
var modules = image.ReadMappedObjectPointerArray <Il2CppCodeGenModule>(CodeRegistration.pcodeGenModules, (int)CodeRegistration.codeGenModulesCount);
foreach (var module in modules)
{
var name = image.ReadMappedNullTerminatedString(module.moduleName);
Modules.Add(name, module);
// Read method pointers
ModuleMethodPointers.Add(module, image.ReadMappedArray <ulong>(module.methodPointers, (int)module.methodPointerCount));
}
}
// Field offset data. Metadata <=21.x uses a value-type array; >=21.x uses a pointer array
// Versions from 22 onwards use an array of pointers in Binary.FieldOffsetData
bool fieldOffsetsArePointers = (image.Version >= 22);
// Some variants of 21 also use an array of pointers
if (image.Version == 21)
{
// Always 4-byte values even for 64-bit builds when array is NOT pointers
var fieldTest = image.ReadMappedArray <uint>(MetadataRegistration.pfieldOffsets, 6);
// We detect this by relying on the fact Module, Object, ValueType, Attribute, _Attribute and Int32
// are always the first six defined types, and that all but Int32 have no fields
fieldOffsetsArePointers = (fieldTest[0] == 0 && fieldTest[1] == 0 && fieldTest[2] == 0 && fieldTest[3] == 0 && fieldTest[4] == 0 && fieldTest[5] > 0);
}
// All older versions use values directly in the array
if (!fieldOffsetsArePointers)
{
FieldOffsets = image.ReadMappedArray <uint>(MetadataRegistration.pfieldOffsets, (int)MetadataRegistration.fieldOffsetsCount);
}
else
{
FieldOffsetPointers = image.ReadMappedWordArray(MetadataRegistration.pfieldOffsets, (int)MetadataRegistration.fieldOffsetsCount);
}
// Type definitions (pointer array)
Types = image.ReadMappedObjectPointerArray <Il2CppType>(MetadataRegistration.ptypes, (int)MetadataRegistration.typesCount);
// Custom attribute constructors
CustomAttributeGenerators = image.ReadMappedArray <ulong>(CodeRegistration.customAttributeGenerators, (int)CodeRegistration.customAttributeCount);
// Generic method specs
MethodSpecs = image.ReadMappedArray <Il2CppMethodSpec>(MetadataRegistration.methodSpecs, (int)MetadataRegistration.methodSpecsCount);
}
private void Configure(IFileFormatReader image, ulong codeRegistration, ulong metadataRegistration)
{
// Store locations
CodeRegistrationPointer = codeRegistration;
MetadataRegistrationPointer = metadataRegistration;
Console.WriteLine("CodeRegistration struct found at 0x{0:X16} (file offset 0x{1:X8})", image.Bits == 32 ? codeRegistration & 0xffff_ffff : codeRegistration, image.MapVATR(codeRegistration));
Console.WriteLine("MetadataRegistration struct found at 0x{0:X16} (file offset 0x{1:X8})", image.Bits == 32 ? metadataRegistration & 0xffff_ffff : metadataRegistration, image.MapVATR(metadataRegistration));
// Set width of long (convert to sizeof(int) for 32-bit files)
if (image.Bits == 32)
{
image.Stream.PrimitiveMappings.Add(typeof(long), typeof(int));
image.Stream.PrimitiveMappings.Add(typeof(ulong), typeof(uint));
}
// Root structures from which we find everything else
CodeRegistration = image.ReadMappedObject <Il2CppCodeRegistration>(codeRegistration);
MetadataRegistration = image.ReadMappedObject <Il2CppMetadataRegistration>(metadataRegistration);
// The global method pointer list was deprecated in v24.2 in favour of Il2CppCodeGenModule
if (Image.Version <= 24.1)
{
GlobalMethodPointers = image.ReadMappedArray <ulong>(CodeRegistration.pmethodPointers, (int)CodeRegistration.methodPointersCount);
}
// After v24 method pointers and RGCTX data were stored in Il2CppCodeGenModules
if (Image.Version >= 24.2)
{
Modules = new Dictionary <string, Il2CppCodeGenModule>();
// Array of pointers to Il2CppCodeGenModule
var codeGenModulePointers = image.ReadMappedArray <ulong>(CodeRegistration.pcodeGenModules, (int)CodeRegistration.codeGenModulesCount);
var modules = image.ReadMappedObjectPointerArray <Il2CppCodeGenModule>(CodeRegistration.pcodeGenModules, (int)CodeRegistration.codeGenModulesCount);
foreach (var mp in modules.Zip(codeGenModulePointers, (m, p) => new { Module = m, Pointer = p }))
{
var module = mp.Module;
var name = image.ReadMappedNullTerminatedString(module.moduleName);
Modules.Add(name, module);
CodeGenModulePointers.Add(name, mp.Pointer);
// Read method pointers
ModuleMethodPointers.Add(module, image.ReadMappedArray <ulong>(module.methodPointers, (int)module.methodPointerCount));
// Read method invoker pointer indices - one per method
MethodInvokerIndices.Add(module, image.ReadMappedArray <int>(module.invokerIndices, (int)module.methodPointerCount));
}
}
// Field offset data. Metadata <=21.x uses a value-type array; >=21.x uses a pointer array
// Versions from 22 onwards use an array of pointers in Binary.FieldOffsetData
bool fieldOffsetsArePointers = (image.Version >= 22);
// Some variants of 21 also use an array of pointers
if (image.Version == 21)
{
// Always 4-byte values even for 64-bit builds when array is NOT pointers
var fieldTest = image.ReadMappedArray <uint>(MetadataRegistration.pfieldOffsets, 6);
// We detect this by relying on the fact Module, Object, ValueType, Attribute, _Attribute and Int32
// are always the first six defined types, and that all but Int32 have no fields
fieldOffsetsArePointers = (fieldTest[0] == 0 && fieldTest[1] == 0 && fieldTest[2] == 0 && fieldTest[3] == 0 && fieldTest[4] == 0 && fieldTest[5] > 0);
}
// All older versions use values directly in the array
if (!fieldOffsetsArePointers)
{
FieldOffsets = image.ReadMappedArray <uint>(MetadataRegistration.pfieldOffsets, (int)MetadataRegistration.fieldOffsetsCount);
}
else
{
FieldOffsetPointers = image.ReadMappedWordArray(MetadataRegistration.pfieldOffsets, (int)MetadataRegistration.fieldOffsetsCount);
}
// Type references (pointer array)
var typeRefPointers = image.ReadMappedArray <ulong>(MetadataRegistration.ptypes, (int)MetadataRegistration.typesCount);
TypeReferenceIndicesByAddress = typeRefPointers.Zip(Enumerable.Range(0, typeRefPointers.Length), (a, i) => new { a, i }).ToDictionary(x => x.a, x => x.i);
TypeReferences = image.ReadMappedObjectPointerArray <Il2CppType>(MetadataRegistration.ptypes, (int)MetadataRegistration.typesCount);
// Custom attribute constructors (function pointers)
CustomAttributeGenerators = image.ReadMappedArray <ulong>(CodeRegistration.customAttributeGenerators, (int)CodeRegistration.customAttributeCount);
// Method.Invoke function pointers
MethodInvokePointers = image.ReadMappedArray <ulong>(CodeRegistration.invokerPointers, (int)CodeRegistration.invokerPointersCount);
// TODO: Function pointers as shown below
// reversePInvokeWrappers
// <=22: delegateWrappersFromManagedToNative, marshalingFunctions;
// >=21 <=22: ccwMarhsalingFunctions
// >=22: unresolvedVirtualCallPointers
// >=23: interopData
// Generic type and method specs (open and closed constructed types)
MethodSpecs = image.ReadMappedArray <Il2CppMethodSpec>(MetadataRegistration.methodSpecs, (int)MetadataRegistration.methodSpecsCount);
// Concrete generic class and method signatures
GenericInstances = image.ReadMappedObjectPointerArray <Il2CppGenericInst>(MetadataRegistration.genericInsts, (int)MetadataRegistration.genericInstsCount);
// Concrete generic method pointers
var genericMethodPointers = image.ReadMappedArray <ulong>(CodeRegistration.genericMethodPointers, (int)CodeRegistration.genericMethodPointersCount);
var genericMethodTable = image.ReadMappedArray <Il2CppGenericMethodFunctionsDefinitions>(MetadataRegistration.genericMethodTable, (int)MetadataRegistration.genericMethodTableCount);
foreach (var tableEntry in genericMethodTable)
{
GenericMethodPointers.Add(MethodSpecs[tableEntry.genericMethodIndex], genericMethodPointers[tableEntry.indices.methodIndex]);
GenericMethodInvokerIndices.Add(MethodSpecs[tableEntry.genericMethodIndex], tableEntry.indices.invokerIndex);
}
}