il2cpp api偏移查找

打开 libunity.so 搜索字符串：Could not load symbol %s : %s

查找引用，进入任意一处

F5显示伪代码：

frida hook代码：

/*
用法：
frida -U -l hook_dlopen.js -f packageName --no-pause

*/


var soName = "libunity.so"


function myfun()
{
    var moduleBaseAddress = Module.getBaseAddress(soName);
    console.log(soName + "_address:", moduleBaseAddress);
    var nativePointer = moduleBaseAddress.add(0x6139C0);//加上偏移地址
    Interceptor.attach(nativePointer,
    {
        onEnter: function (args)
        {
            console.log("\n"); 
            console.log("==参数0：" + this.context.x0); 
            console.log("==参数1：" + this.context.x1.readCString())    
            console.log("==参数2：" + this.context.x2)    
        },
        onLeave: function (retval)
        {
            console.log("retval",retval,retval.sub(Module.getBaseAddress("libil2cpp.so"))); 
        }
    }
    );
}


function hook_dlopen()
{
    var is_can_hook = false;
    Interceptor.attach(Module.findExportByName(null, "dlopen"),
    {
        onEnter: function (args)
        {
            var pathptr = args[0];
            if (pathptr !== undefined && pathptr != null)
            {
                var path = ptr(pathptr).readCString();
                if (path.indexOf(soName) >= 0)
                {
                    this.is_can_hook = true;
                    console.log("\n"+soName+"_path:", path);

                }
            }
        },
        onLeave: function (retval)
        {
            if (this.is_can_hook)
            {
                myfun();
                console.log("dlopen finish...");
            }
        }
    }
    );

    Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),
    {
        onEnter: function (args)
        {
            var pathptr = args[0];
            if (pathptr !== undefined && pathptr != null)
            {
                var path = ptr(pathptr).readCString();
                if (path.indexOf(soName) >= 0)
                {
                    this.is_can_hook = true;
                    console.log("\n"+soName+"_path:", path);
                }
            }
        },
        onLeave: function (retval)
        {
            if (this.is_can_hook)
            {
                myfun();
                console.log("android_dlopen_ext  finish...");
            }
        }
    }
    );
}

setImmediate(hook_dlopen);

输出：

总结：

多找找特征，找旧版本对比

欢迎加入QQ群：812701781，542863693，欢迎分享一些骚操作（备注看的什么文章）

微信公众号：MoneyHoneyCome