0227睡到0751睡到1121，不小心睡了个大的，好爽好爽。
昨天回坑クルスタ感觉游戏中还是有很多便秘的点，想看看unity游戏怎么hook，先处理c盘了。
1
2
3
4
5
| PS C:\Users\MR> dotnet nuget locals all --list
http-cache: C:\Users\MR\AppData\Local\NuGet\v3-cache
global-packages: C:\Users\MR\.nuget\packages\
temp: C:\Users\MR\AppData\Local\Temp\NuGetScratch
plugins-cache: C:\Users\MR\AppData\Local\NuGet\plugins-cache
|
直接dotnet nuget locals all --clear删。
通过GameAssembly.dll知道IL2CPP项目。
使用AssetRipper，找出Import : During Il2Cpp initialization, found Unity version: 2021.3.25f1。
使用Cpp2IL，Another year goes by and the version number is still 2022. ，2026年的版本号还在使用2022还是太新潮了。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
| PS F:\Games\CPP2IL> .\Cpp2IL-2022.1.0-pre-release.21-Windows.exe --list-output-formats
===Cpp2IL by Samboy063===
A Tool to Reverse Unity's "il2cpp" Build Process.
Version 2022.1.0-pre-release.21+58fc404ac503f4e512055cafc48c03088fc6e224
[Info] [Program] Running on Win32NT
[Info] [Plugins] Loading plugins from F:\Games\CPP2IL\Plugins...
[Info] [Plugins] Using Plugin: Cpp2IL Built-In
[Info] [Program] Available output formats:
ID: dummydll Name: DLL output format for backwards compatibility.
ID: dll_default Name: DLL files with default method bodies
ID: dll_empty Name: DLL files with empty method bodies
ID: dll_throw_null Name: DLL files with method bodies containing throw null
ID: dll_il_recovery Name: DLL files with IL Recovery
ID: diffable-cs Name: Diffable C#
ID: isil Name: ISIL Dump
ID: wasmmappings Name: WebAssembly Method Mappings
ID: wasm_name_section Name: Webassembly name section
PS F:\Games\CPP2IL> .\Cpp2IL-2022.1.0-pre-release.21-Windows.exe --list-processors
===Cpp2IL by Samboy063===
A Tool to Reverse Unity's "il2cpp" Build Process.
Version 2022.1.0-pre-release.21+58fc404ac503f4e512055cafc48c03088fc6e224
[Info] [Program] Running on Win32NT
[Info] [Plugins] Loading plugins from F:\Games\CPP2IL\Plugins...
[Info] [Plugins] Using Plugin: Cpp2IL Built-In
[Info] [Program] Available processors:
ID: attributeanalyzer Name: CustomAttribute Analyzer
ID: attributeinjector Name: Attribute Injector
ID: callanalyzer Name: Call Analyzer
ID: nativemethoddetector Name: Native Method Detection
ID: stablenamer Name: Stable (Unhollower-Style) Renaming
ID: deobfmap Name: Deobfuscation Map
|
.\Cpp2IL-2022.1.0-pre-release.21-Windows.exe --game-path "F:\Games\DMM\Twinkle_StarKnightsX" --output-as dll_il_recovery --use-processor callanalyzer --output-to "F:\Games\CPP2IL\cpp2il_out"出来了好多dll。
.\Cpp2IL-2022.1.0-pre-release.21-Windows.exe --game-path "F:\Games\DMM\Twinkle_StarKnightsX" --output-as diffable-cs --use-processor callanalyzer --output-to "F:\Games\CPP2IL\diffable_cs"出来了好多cs。
1
2
3
4
5
6
7
| [CallerCount(Count = 0)]
[CallsUnknownMethods(Count = 33)]
[ContainsUnimplementedInstructions]
private static TSKBattleManager() { }
[CallerCount(Count = 0)]
public TSKBattleManager() { }
|
出来的cs会有很奇妙的东西，应该是没能恢复完全。
使用Ghidra，安装 Eclipse Temurin JDK 21（LTS），导入GameAssembly.dll进行分析。
用dnSpyEx打开Assembly-CSharp.dll。
得到的还是用不了的。有很多
1
2
3
4
| get
{
throw null;
}
|
下载Il2CppDumper，使用PS F:\Others\Il2CppDumper-win-v6.7.46> .\Il2CppDumper.exe得到F:\Others\Il2CppDumper-win-v6.7.46\DummyDll中好多dll，以及有用的script.json。它其中内容类似
1
2
3
4
5
6
| {
"Address": 4060144,
"Name": "TSKBattleAI.\u003C\u003Ec$$\u003CLottery\u003Eb__6_0",
"Signature": "bool TSKBattleAI___c___Lottery_b__6_0 (TSKBattleAI___c_o* __this, TSKBattleNote_o* __, const MethodInfo* method);",
"TypeSignature": "iiii"
},
|
想用于Ghidra结果遇到了问题：
Unable to load script: ghidra.py
detail: Ghidra was not started with PyGhidra. Python is not available
我将退回使用Ghidra 10.4, which was released on Sep 29, 2023.
成功了。
虽然 ghidra.py 已经恢复了函数名和类型名，但没有恢复字段名和局部变量类型，所以仍然很难读。
对于 IL2CPP 游戏，没有任何工具能恢复出完整、接近原作者写的 C# 源码。这是由 IL2CPP 的编译过程决定的，不是工具不够先进。
那好像有点难受，
1
2
3
4
5
6
7
| if ((param_3 & 4) != 0) {
if (param_2 == 0) goto LAB_180ae8c59;
cVar2 = TSKBattleNote$$CheckRace(param_2,3,0);
if (cVar2 != '\0') {
return 1;
}
}
|
这种代码还是太难看了。哎呀IL2CPP怎么这么坏。