protected override (ulong, ulong) ConsiderCode(IFileFormatReader image, uint loc) { // We have seen two versions of the initializer: // 1. Regular version // 2. Inlined version with il2cpp::utils::RegisterRuntimeInitializeAndCleanup(CallbackFunction, CallbackFunction, order) // Version 1 passes "this" in rcx and the arguments in rdx (our wanted pointer), r8d (always zero) and r9d (always zero) // Version 2 has a standard prologue and loads the wanted pointer into rax (lea rax) (int reg, uint operand)? lea; ulong pCgr = 0; image.Position = loc; var buff = image.ReadBytes(0x20); // arbitrary number of bytes, but enough to process the function // Check for regular version var xor = getXorR64R64(buff, 0); // 3 bytes if (xor != null && xor.Value.reg_op1 == xor.Value.reg_op2) { lea = getLea(buff, 3); // 7 bytes if (lea != null) { xor = getXorR64R64(buff, 10); if (xor != null && xor.Value.reg_op1 == xor.Value.reg_op2) { // We found Il2CppCodegenRegistration(void) pCgr = image.GlobalOffset + loc + 10 + lea.Value.operand; } } } // Check for inlined version if (pCgr == 0) { // Check for prologue if (isPushR32(buff, 0)) { // Linear sweep for LEA var leaInlined = findLea(buff, 2, 0x1E); // 0x20 - 2 if (leaInlined == null) { return(0, 0); } // LEA is 7 bytes long pCgr = image.GlobalOffset + loc + (uint)leaInlined.Value.foundOffset + 7 + leaInlined.Value.operand; } } if (pCgr == 0) { return(0, 0); } // Assume we've found the pointer to Il2CppCodegenRegistration(void) and jump there try { Image.Position = Image.MapVATR(pCgr); } // Couldn't map virtual address to data in file, so it's not this function catch (InvalidOperationException) { return(0, 0); } // Find the first 2 LEAs which we'll hope contain pointers to CodeRegistration and MetadataRegistration // There are two options here: // 1. il2cpp::vm::MetadataCache::Register is called directly with arguments in rcx, rdx and r8 (lea, lea, lea, jmp) // 2. The two functions being inlined. The arguments are loaded sequentially into rax after the prologue // By ignoring the REX R flag (bit 2 of the instruction prefix) which specifies an extension bit to the register operand, // we skip over "lea r8". This will leave us with two LEAs containing our desired pointers. buff = image.ReadBytes(0x40); // LEA is 7 bytes long var lea1 = findLea(buff, 0, 0x40 - 7); if (lea1 == null) { return(0, 0); } var lea2 = findLea(buff, lea1.Value.foundOffset + 7, 0x40 - lea1.Value.foundOffset - 7); if (lea2 == null) { return(0, 0); } // Use the original pointer found, not the file location + GlobalOffset because the data may be in a different section var ptr1 = pCgr + (uint)lea1.Value.foundOffset + 7 + lea1.Value.operand; var ptr2 = pCgr + (uint)lea2.Value.foundOffset + 7 + lea2.Value.operand; // RCX and RDX argument passing? if (lea1.Value.reg == 2 /* RDX */ && lea2.Value.reg == 1 /* RCX */) { return(ptr2, ptr1); } // RAX sequential loading? if (lea1.Value.reg == 0 /* RAX */ && lea2.Value.reg == 0 /* RAX */) { return(ptr1, ptr2); } return(0, 0); }
protected override (ulong, ulong) ConsiderCode(IFileFormatReader image, uint loc) { ulong metadata, code; long pCgr; // x86 // Assembly bytes to search for at start of each function var bytes = new byte[] { 0x6A, 0x00, 0x6A, 0x00, 0x68 }; image.Position = loc; var buff = image.ReadBytes(5); if (bytes.SequenceEqual(buff)) { // Next 4 bytes are the function pointer being pushed onto the stack pCgr = image.ReadUInt32(); // Start of next instruction if (image.ReadByte() != 0xB9) { return(0, 0); } // Jump to Il2CppCodegenRegistration image.Position = image.MapVATR((ulong)pCgr + 6); metadata = image.ReadUInt32(); image.Position = image.MapVATR((ulong)pCgr + 11); code = image.ReadUInt32(); return(code, metadata); } // x86 based on ELF PLT if (image is IElfReader elf) { var plt = elf.GetPLTAddress(); // push ebp; mov ebp, esp; push ebx; and esp, 0FFFFFFF0h; sub esp, 20h; call $+5; pop ebx bytes = new byte[] { 0x55, 0x89, 0xE5, 0x53, 0x83, 0xE4, 0xF0, 0x83, 0xEC, 0x20, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B }; image.Position = loc; buff = image.ReadBytes(16); if (!bytes.SequenceEqual(buff)) { return(0, 0); } // lea eax, (pCgr - offset)[ebx] (Position + 6 is the opcode lea eax; Position + 8 is the operand) image.Position += 6; // Ensure it's lea eax, #address if (image.ReadUInt16() != 0x838D) { return(0, 0); } try { pCgr = image.MapVATR(image.ReadUInt32() + plt); } // Could not find a mapping in the section table catch (InvalidOperationException) { return(0, 0); } // Extract Metadata pointer // An 0x838D opcode indicates LEA (no indirection) image.Position = pCgr + 0x20; var opcode = image.ReadUInt16(); metadata = image.ReadUInt32() + plt; // An 8x838B opcode indicates MOV (pointer indirection) if (opcode == 0x838B) { image.Position = image.MapVATR(metadata); metadata = image.ReadUInt32(); } if (opcode != 0x838B && opcode != 0x838D) { return(0, 0); } // Repeat the same logic for extracting the Code pointer image.Position = pCgr + 0x2A; opcode = image.ReadUInt16(); code = image.ReadUInt32() + plt; if (opcode == 0x838B) { image.Position = image.MapVATR(code); code = image.ReadUInt32(); } if (opcode != 0x838B && opcode != 0x838D) { return(0, 0); } return(code, metadata); } return(0, 0); }
protected override (ulong, ulong) ConsiderCode(IFileFormatReader image, uint loc) { // Setup var buffSize = 0x76; // minimum number of bytes to process the longest expected function var leaSize = 7; // the length of an LEA instruction with a 64-bit register operand and a 32-bit memory operand var xor64Size = 3; // the length of a XOR instruction of two 64-bit registers var xor32Size = 2; // the length of a XOR instruction of two 32-bit registers var pushSize = 2; // the length of a PUSH instruction with a 64-bit register var offset = 0; int RAX = 0, RBX = 3, RCX = 1, RDX = 2, RSI = 6, RDI = 7; // R8 = 8 ulong pCgr = 0; // the point to the code registration function image.Position = loc; var buff = image.ReadBytes(buffSize); // We have seen two versions of the initializer: // 1. Regular version // 2. Inlined version with il2cpp::utils::RegisterRuntimeInitializeAndCleanup(CallbackFunction, CallbackFunction, order) // Version 1 passes "this" in rcx and the arguments in rdx (our wanted pointer), r8d (always zero) and r9d (always zero) // or "this" in rdi, and the arguments in rsi (our wanted pointer), edx (always zero) and ecx (always zero) // Version 2 has a standard prologue and loads the wanted pointer into rax or rbp (lea rax/rbp) (int reg, uint operand)? lea; // Check for regular version // Generalize it as follows: // - each instruction must be lea r64, imm32 or xor r32, r32 // - xors must always have the same register for both operands // - lea that can't be mapped into the file is the pointer to 'this', otherwise it's the pointer to the init function // - the last instruction should always be jmp (not currently enforced) // - function length should not be longer than 5 instructions (two leas, two xors and one jmp) offset = 0; for (var instructions = 0; instructions < 4; instructions++) { // All allowed instruction types var xor32 = getXorR32R32(buff, offset); var xor64 = getXorR64R64(buff, offset); lea = getLea(buff, offset); if (xor32 != null && xor32.Value.reg_op1 == xor32.Value.reg_op2) { offset += xor32Size; } else if (xor64 != null && xor64.Value.reg_op1 == xor64.Value.reg_op2) { offset += xor64Size; } else if (lea != null) { offset += leaSize; if (pCgr == 0) { try { // We may have found Il2CppCodegenRegistration(void) pCgr = image.GlobalOffset + loc + (ulong)offset + lea.Value.operand; var newLoc = image.MapVATR(pCgr); } catch (InvalidOperationException) { // this pointer pCgr = 0; } } } else { // not lea or xor pCgr = 0; break; } } // Check for inlined version if (pCgr == 0) { // Check for prologue // - A sequence of 0 or more mov [rsp+argX], rXX followed by 1 or more push rXX offset = 0; while (isMovRM64R64(buff, offset)) { offset += 5; } if (isPushR64(buff, offset)) { // Linear sweep for LEA var leaInlined = findLea(buff, pushSize, buffSize - pushSize); if (leaInlined != null) { pCgr = image.GlobalOffset + loc + (uint)leaInlined.Value.foundOffset + (uint)leaSize + leaInlined.Value.operand; } } } // Assume we've found the pointer to Il2CppCodegenRegistration(void) and jump there if (pCgr != 0) { try { Image.Position = Image.MapVATR(pCgr); } // Couldn't map virtual address to data in file, so it's not this function catch (InvalidOperationException) { pCgr = 0; } } // Find the first 2 LEAs which we'll hope contain pointers to CodeRegistration and MetadataRegistration // There are two options here: // 1. il2cpp::vm::MetadataCache::Register is called directly with arguments in rcx, rdx, r8 or rdi, rsi, rdx (lea, lea, lea, jmp) // 2. The two functions being inlined. The arguments are loaded sequentially into rax after the prologue if (pCgr != 0) { var buff2Size = 0x50; var buff2 = image.ReadBytes(buffSize); offset = 0; var leas = new Dictionary <(int index, ulong address), int>(); // Find the first three LEAs in the function while (offset + leaSize < buff2Size && leas.Count < 3) { var nextLea = findLea(buff2, offset, buff2Size - (offset + leaSize)); // Use the original pointer found, not the file location + GlobalOffset because the data may be in a different section if (nextLea != null) { leas.Add((leas.Count, pCgr + (uint)nextLea.Value.foundOffset + (uint)leaSize + nextLea.Value.operand), nextLea.Value.reg); } offset = nextLea?.foundOffset + leaSize ?? buff2Size; } if ((image.Version < 21 && leas.Count == 2) || (image.Version >= 21 && leas.Count == 3)) { // Register-based argument passing? var leaRSI = leas.FirstOrDefault(l => l.Value == RSI).Key.address; var leaRDI = leas.FirstOrDefault(l => l.Value == RDI).Key.address; if (leaRSI != 0 && leaRDI != 0) { return(leaRDI, leaRSI); } var leaRCX = leas.FirstOrDefault(l => l.Value == RCX).Key.address; var leaRDX = leas.FirstOrDefault(l => l.Value == RDX).Key.address; if (leaRCX != 0 && leaRDX != 0) { return(leaRCX, leaRDX); } // RAX sequential loading? If so, take the first two arguments var leasRAX = leas.Where(l => l.Value == RAX).OrderBy(l => l.Key.index).Select(l => l.Key.address).ToArray(); if (leasRAX.Length > 1) { return(leasRAX[0], leasRAX[1]); } } } // If no initializer is found, we may be looking at a DT_INIT function which calls its own function table manually // In the sample we have seen (PlayStation 4), this function runs through two function tables: // 1. Start address of table loaded into rbx, pointer past end of table in r12 (lea rbx; lea r12) // 2. Pointer to final address of 2nd table loaded into rbx (lea rbx), runs backwards (8 bytes per entry) until finding 0xFFFFFFFF_FFFFFFFF // The strategy: find these LEAs, acquire and merge the two function tables, then call ourselves in a loop to check each function address // Expect function prologue and at least 3 64-bit register pushes (there are probably more) if (!isPrologue(buff) || !isPushR64(buff, 4) || !isPushR64(buff, 6) || !isPushR64(buff, 8)) { return(0, 0); } // Find the start and end addresses of the first function table var leaOfStart = findLea(buff, 10, buffSize - 10); if (leaOfStart == null || leaOfStart.Value.reg != RBX) // Most be lea rbx { return(0, 0); } var leaOfEnd = findLea(buff, leaOfStart.Value.foundOffset + leaSize, buffSize - (leaOfStart.Value.foundOffset + leaSize)); if (leaOfEnd == null || leaOfEnd.Value.reg == RBX) // Must be lea with any register besides rbx { return(0, 0); } var ptrStart1 = leaOfStart.Value.foundOffset + leaSize + leaOfStart.Value.operand; var ptrEnd1 = leaOfEnd.Value.foundOffset + leaSize + leaOfEnd.Value.operand; // Find the address of the last item in the second function table var leaOfLastItem = findLea(buff, leaOfEnd.Value.foundOffset + leaSize, buffSize - (leaOfEnd.Value.foundOffset + leaSize)); if (leaOfLastItem == null || leaOfLastItem.Value.reg != 0b11) // Must be lea rbx { return(0, 0); } var entrySize = 8; // 64-bit array entries var ptrEnd2 = leaOfLastItem.Value.foundOffset + leaSize + leaOfLastItem.Value.operand + entrySize; // Work backwards to find the address of the first item in the second function table var ptrStart2 = ptrEnd2; while (image.ReadUInt64(image.MapVATR((ulong)ptrStart2)) != 0xFFFF_FFFF_FFFF_FFFF) { ptrStart2 -= entrySize; } ptrStart2 += entrySize; // Acquire both function tables var funcs1 = image.ReadMappedWordArray((ulong)ptrStart1, (int)(ptrEnd1 - ptrStart1) / entrySize); var funcs2 = image.ReadMappedWordArray((ulong)ptrStart2, (int)(ptrEnd2 - ptrStart2) / entrySize); // Check every function var funcs = funcs1.Concat(funcs2); foreach (var pFunc in funcs) { var result = ConsiderCode(image, image.MapVATR((ulong)pFunc)); if (result != (0, 0)) { return(result); } } return(0, 0); }