unity3d链接oracle,逆向和调试Unity3D游戏手记之一

一、背景和意义

Unity3D是手游领域的主要游戏引擎，熟练掌握对其的逆向方法，对我们而言十分重要。目前主流的方法是对其dll进行反汇编，然而越来越多游戏对其dll进行加密。因此本文的目的在于从另外一个方向对Unity3D游戏进行逆向和调试，第一步是要找到自定义函数的代码。

二、准备工作

逆向对象，Unity3D官方例程 ——SpaceShooter，发布于Android平台

工具：ida 6.5

三、相关代码分析

调用自定义函数的总体过程

info->compiled_method

runtime_invoke()

mono_jit_runtime_invoke() at mini.c:4,789 0x8065cc1

mono_runtime_invoke() at object.c:2,613 0x8195d35

create_exception_two_strings() at exception.c:133 0x81e6a9f

mono_exception_from_name_two_strings() at exception.c:156 0x81e6adf

create_exceptions() at appdomain.c:185 0x818b9e4

mono_runtime_init() at appdomain.c:262 0x818bc0d

mini_init() at mini.c:5,520 0x806734a

mono_main() at driver.c:1,623 0x80ec127

main() at main.c:34 0x805b950

主要要关注的是从mono_runtime_invoke()到info->compile_method()的这样一个调用过程

分析mono_runtime_invoke()

相关汇编代码

.text:001FA9AC ; MonoObject *__cdecl mono_runtime_invoke(MonoMethod *method, void *obj, void **params, MonoObject **exc)

.text:001FA9AC EXPORT mono_runtime_invoke

.text:001FA9AC mono_runtime_invoke ; CODE XREF: mono_jit_compile_method_inner+7B0�p

.text:001FA9AC ; load_agent+240�p ...

.text:001FA9AC

.text:001FA9AC exc = -0x1C

.text:001FA9AC params = -0x18

.text:001FA9AC obj = -0x14

.text:001FA9AC method = -0x10

.text:001FA9AC result = -8

.text:001FA9AC

.text:001FA9AC STMFD SP!, {R11,LR}

.text:001FA9B0 ADD R11, SP, #4

.text:001FA9B4 SUB SP, SP, #0x18

.text:001FA9B8 STR R0, [R11,#method]

.text:001FA9BC STR R1, [R11,#obj]

.text:001FA9C0 STR R2, [R11,#params]

.text:001FA9C4 STR R3, [R11,#exc]

.text:001FA9C8 BL mono_runtime_get_no_exec

.text:001FA9CC MOV R3, R0

.text:001FA9D0 CMP R3, #0

.text:001FA9D4 BEQ loc_1FA9FC

.text:001FA9D8 LDR R0, [R11,#method] ; method

.text:001FA9DC MOV R1, #1 ; signature

.text:001FA9E0 BL mono_method_full_name

.text:001FA9E4 MOV R3, R0

.text:001FA9E8 MOV R0, #0 ; log_domain

.text:001FA9EC MOV R1, #0x10 ; log_level

.text:001FA9F0 LDR R2, =(aInvokingMethod - 0x1FA9FC)

.text:001FA9F4 ADD R2, PC, R2 ; "Invoking method '%s' when running in no"...

.text:001FA9F8 BL g_log

.text:001FA9FC

.text:001FA9FC loc_1FA9FC ; CODE XREF: mono_runtime_invoke+28�j

.text:001FA9FC BL mono_profiler_get_events

.text:001FAA00 MOV R3, R0

.text:001FAA04 AND R3, R3, #0x10000

.text:001FAA08 CMP R3, #0

.text:001FAA0C BEQ loc_1FAA18

.text:001FAA10 LDR R0, [R11,#method] ; method

.text:001FAA14 BL mono_profiler_method_start_invoke

.text:001FAA18

.text:001FAA18 loc_1FAA18 ; CODE XREF: mono_runtime_invoke+60�j

.text:001FAA18 LDR R3, =(default_mono_runtime_invoke - 0x1FAA24)

.text:001FAA1C ADD R3, PC, R3 ; default_mono_runtime_invoke

.text:001FAA20 LDR R12, [R3]

.text:001FAA24 LDR R0, [R11,#method]

.text:001FAA28 LDR R1, [R11,#obj]

.text:001FAA2C LDR R2, [R11,#params]

.text:001FAA30 LDR R3, [R11,#exc]

.text:001FAA34 BLX R12

.text:001FAA38 STR R0, [R11,#result]

.text:001FAA3C BL mono_profiler_get_events

.text:001FAA40 MOV R3, R0

.text:001FAA44 AND R3, R3, #0x10000

.text:001FAA48 CMP R3, #0

.text:001FAA4C BEQ loc_1FAA58

.text:001FAA50 LDR R0, [R11,#method] ; method

.text:001FAA54 BL mono_profiler_method_end_invoke

.text:001FAA58

.text:001FAA58 loc_1FAA58 ; CODE XREF: mono_runtime_invoke+A0�j

.text:001FAA58 LDR R3, [R11,#result]

.text:001FAA5C MOV R0, R3

.text:001FAA60 SUB SP, R11, #4

.text:001FAA64 LDMFD SP!, {R11,PC}

.text:001FAA64 ; End of function mono_runtime_invoke

核心代码就是

.text:001FAA20 LDR R12, [R3]

.text:001FAA24 LDR R0, [R11,#method]

.text:001FAA28 LDR R1, [R11,#obj]

.text:001FAA2C LDR R2, [R11,#params]

.text:001FAA30 LDR R3, [R11,#exc]

.text:001FAA34 BLX R12

在mono源码中对应的就是

result = default_mono_runtime_invoke (method, obj, params, exc);

3.分析mono_jit_runtime_invoke()

这一层代码太长，就不全贴了

核心代码是在函数尾部

.text:000238F4 loc_238F4 ; CODE XREF: mono_jit_runtime_invoke+908�j

.text:000238F4 LDR R2, [R11,#obj]

.text:000238F8 LDR R3, [R11,#info]

.text:000238FC LDR R3, [R3,#4]

.text:00023900 LDR R12, [R11,#runtime_invoke]

.text:00023904 MOV R0, R2

.text:00023908 LDR R1, [R11,#params]

.text:0002390C LDR R2, [R11,#exc]

.text:00023910 BLX R12

.text:00023914 MOV R3, R0

对应的mono源码是

return runtime_invoke (obj, params, exc, info->compiled_method);

分析runtime_invoke()

debug117:589E0300 MOV R12, SP

debug117:589E0304 STMFD SP!, {R8,R11,R12,LR}

debug117:589E0308 SUB SP, SP, #0x30

debug117:589E030C MOV R11, SP

debug117:589E0310 STR R0, [R11,#0x1C]

debug117:589E0314 STR R1, [R11,#0x20]

debug117:589E0318 STR R2, [R11,#0x24]

debug117:589E031C STR R3, [R11,#0x28]

debug117:589E0320 MOV R0, #0

debug117:589E0324 STR R0, [R11]

debug117:589E0328 MOV R0, #0

debug117:589E032C STR R0, [R11,#4]

debug117:589E0330 LDR R0, [R11,#0x24]

debug117:589E0334 CMP R0, #0

debug117:589E0338 BEQ loc_589E0348

debug117:589E033C LDR R0, [R11,#0x24]

debug117:589E0340 MOV R1, #0

debug117:589E0344 STR R1, [R0]

debug117:589E0348

debug117:589E0348 loc_589E0348 ; CODE XREF: debug117:589E0338�j

debug117:589E0348 MOV R0, #0x5CE151C8

debug117:589E0350 LDR R0, [R0]

debug117:589E0354 CMP R0, #0

debug117:589E0358 BEQ loc_589E0360

debug117:589E035C BL unk_589E0060

debug117:589E0360

debug117:589E0360 loc_589E0360 ; CODE XREF: debug117:589E0358�j

debug117:589E0360 LDR R0, [R11,#0x28]

debug117:589E0364 BLX R0

debug117:589E0368 MOV R0, #0

debug117:589E036C STR R0, [R11]

debug117:589E0370 B loc_589E03C0

核心代码是

debug117:589E0360 LDR R0, [R11,#0x28]

debug117:589E0364 BLX R0

也就是调用info->compiled_method

最后就是自定义函数的ARM汇编代码了

C#源码是

void Update ()

{

if (restart)

{

if (Input.GetKeyDown (KeyCode.R))

{

Application.LoadLevel (Application.loadedLevel);

}

}

}

相应的汇编代码

debug118:589E54A8 MOV R12, SP

debug118:589E54AC STMFD SP!, {R8,R11,R12,LR}

debug118:589E54B0 SUB SP, SP, #8

debug118:589E54B4 MOV R11, SP

debug118:589E54B8 STR R0, [R11]

debug118:589E54BC LDR R0, [R11]

debug118:589E54C0 LDRB R0, [R0,#0x35]//获取bool restart

debug118:589E54C4 CMP R0, #0

debug118:589E54C8 BEQ loc_589E54E4//为假跳转

debug118:589E54CC MOV R0, #0x72//KeyCode.R的常量值？

debug118:589E54D0 BL unk_589E7408//应该是input.getKeyDown(KeyCode.R)

debug118:589E54D4 CMP R0, #0

debug118:589E54D8 BEQ loc_589E54E4//结果为假跳转

debug118:589E54DC BL unk_589E54F8

debug118:589E54E0 BL unk_589E54EC

debug118:589E54E4

debug118:589E54E4 loc_589E54E4 ; CODE XREF: debug118:589E54C8�j

debug118:589E54E4 ; debug118:589E54D8�j

debug118:589E54E4 ADD SP, R11, #8

debug118:589E54E8 LDMFD SP, {R8,R11,SP,PC}