https://github.com/axhlzy/il2cpphookscripts
frida-based libil2cpp.so runtime parsing script
https://github.com/axhlzy/il2cpphookscripts
frida hook il2cpp unity
Last synced: 4 days ago
JSON representation
frida-based libil2cpp.so runtime parsing script
- Host: GitHub
- URL: https://github.com/axhlzy/il2cpphookscripts
- Owner: axhlzy
- License: mit
- Created: 2020-08-11T07:24:28.000Z (almost 5 years ago)
- Default Branch: ts
- Last Pushed: 2024-10-29T09:23:38.000Z (7 months ago)
- Last Synced: 2024-10-29T11:40:37.530Z (7 months ago)
- Topics: frida, hook, il2cpp, unity
- Language: TypeScript
- Homepage:
- Size: 29.9 MB
- Stars: 526
- Watchers: 19
- Forks: 167
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
## Il2cppHook
### frida-based libil2cpp.so runtime parsing script
[**įŽäŊä¸æ**](README.zh-CN.md)
[](https://www.npmjs.com/package/il2cpp-hooker)
[](https://vscode.dev/redirect?url=vscode://ms-vscode-remote.remote-containers/cloneInVolume?url=https://github.com/axhlzy/Il2CppHookScripts)
[](https://www.npmjs.com/package/il2cpp-hooker)
[](https://www.npmjs.com/package/il2cpp-hooker)
#### Features
- Parse Unity's method `m` / class `c` / field `f` / instance `lfs` / `lfp`
- parse runtime method argument `b` / `bt` / nop function `n` / detachAll and clean cache `D`
- (Batch) Hook `B/BF/BN` for commonly used functions, modify function return value `setFunctionXXX`, `setActive` to set gameobject active
- Wrapped "Interceptor.attach" to make it easier to use from the command line `A(ptr,(args)=>{},(ret)=>{})`
- More convenient to find function `findMethods` / `findClasses` and call function `callFunction` / `findExport` to find exports function
- `showMethodInfo` help us to Simply get the details of an Il2cppMethod*, and getting the details of a game object use`showGameObject`
- Object hierarchy `PrintHierarchy` / type hierarchy `showTypeParent`
- Disassemble `showAsm` with frida and method information, `seeHexA` means hexdump
- `breakWithStack` More symbol parsing for il2cpp, `breakWithArgs` just show args
- Commonly used Hook package `HookOnPointerClick` / `HookSetActive` / `B_Button` / `HookPlayerPrefs` soon ...
- Parse mount script `showComponents` alias `PrintHierarchyWithComponents` is also introduced !not alway work!
- JNI RegisterNatives Hook (impl in JNIHelper, default off [not stable]), using JNIHelper.cacheRegisterNativeItem to get info !testing!
- Using QBDI to simulate the execution of the function, using t(methoinfo) or traceFunction(mPtr) to enable replacement hook !testing!
- :confused: :confused: :confused:
-------
#### Install
```sh
$ npm install il2cpp-hooker -g
```
then you can use like this :point_down:
1. frida attch current app
```sh
$ fat
```
2. frida spawn app of ${PackageName}
```sh
$ fat ${PackageName}
```
3. Command line options
```sh
$ fat -h
_ _ ______ _ _
| | |(_____ \ | | | |
| | | ____) )____ ____ ____ _____| |__ ___ ___ | | _ _____ ____
| | | / ____// ___) _ \| _ (_____) _ \ / _ \ / _ \| |_/ ) ___ |/ ___)
| | || (____( (___| |_| | |_| | | | | | |_| | |_| | _ (| ____| |
|_|_|\______)____) __/| __/ |_| |_|\___/ \___/|_| \_)_____)_|
|_| |_|
Usage: fat [options]
Options:
-h, --help Print usage information.
-r, --runtime [engine] Specify the JS engine (qjs, v8). Default: v8
-t, --timeout [ms] Specify the time in milliseconds before calling the function.
-f, --functions [name] Specify the functions to call on startup. example: -f getApkInfo();
-l, --log [path] Specify the path to save the log.
-c, --vscode Open project with vscode.
-v, --version Print version information.
Report bugs to:
axhlzy (https://github.com/axhlzy/Il2CppHookScripts/)
```
-------
[
](https://codespaces.new/axhlzy/Il2CppHookScripts)
#### Compile
```sh
$ git clone https://github.com/axhlzy/Il2CppHookScripts.git
$ cd Il2cppHook/
$ npm install
$ npm run build & npm run compress
OR
$ npm run watch
$ frida -U -f com.xxx.xxx -l ../_Ufunc.js
OR
$ frida -FU -l ../_Ufunc.js
```
-------
#### đ Here's a simpler way to use it (Recommended)
`frida --codeshare axhlzy/il2cpphookscripts -U -f ${PackageName}`
> Requires Scientific Internet Access
-------
> [!NOTE]
> The npm package may not be updated in time, so you may consider using `fat -c` to open the project and use the `github action` [Artifacts](https://github.com/axhlzy/Il2CppHookScripts/actions) to replace _Ufunc.js file. :hushed:
-------
#### API
[More details](https://github.com/axhlzy/Il2CppHookScripts/wiki)
OR
open with vscode and search `globalthis.` to find more useage
-------
Buy the author a cup of coffee (^_^)
