This is the AMP version of this page.
If you want to load the real page instead, click this text.

Tutorial How to hook arrays in Unity's Il2cpp

Numark

Awesome Active Platinian
Okay, so apparently I've been asked many times on how to modify arrays, not gonna get deep into this, but here we go.


First of all, you need a monoArray struct, which I will provide.
C++: 
template <typename T>
struct monoArray
{
    void* klass;
    void* monitor;
    void* bounds;
    int   max_length;
    void* vector [1];
    int getLength()
    {
        return max_length;
    }
    T getPointer()
    {
        return (T)vector;
    }
};


Let's say you wanted to modify a Player List in a photon game, like getting other players?


When you use this Array, you need to make a hook for this.
C++: 
monoArray<void *> *(*PhotonNetwork_get_OtherPlayers)() = (monoArray<void *> *(*)())il2cppAddress + 0x84EB8C;

To access players as an example, you can use this code to get a vector to the players.

C++: 
auto photonplayers = PhotonNetwork_getOtherPlayers();

for (int i = 0; i < photonplayers->getLength(); ++i)
{
    auto photonplayer = photonplayers->getPointer()[i];
}

If whatever type the method is, change it if it's a void, int, bool, float, whatever it is.

Credits: Toshiro and Slice Cast
 
Can you help me with List<>. I dont know how to hook that
Code: 
// RVA: 0x140D26C Offset: 0x140D26C VA: 0x140D26C
    public static List<RemotePlayer> GetRemotePlayers(Predicate<RemotePlayer> predicate) { }
 
asdf101 said:
Can you help me with List<>. I dont know how to hook that
Code: 
// RVA: 0x140D26C Offset: 0x140D26C VA: 0x140D26C
    public static List<RemotePlayer> GetRemotePlayers(Predicate<RemotePlayer> predicate) { }
Click to expand...

Use this link

UnityStuff/Unity.h at master · kp7742/UnityStuff

A collection of structs and other useful things for hacking 64 bit iOS Unity games - kp7742/UnityStuff
github.com

You can find the struct monoList in that page.

Regards,
 
Another question: I want to read c# list of strings
Code: 
// RVA: 0x140C528 Offset: 0x140C528 VA: 0x140C528
    public static List<string> GetAllPlayersIdShuffled() { }

Is this how I should do it?
Code: 
monoList<monoString> *(*GetPlayerIds)() = (monoList<monoString> *(*)()) getAbsoluteAddress(targetLibName, 0x140C528);
auto getplayerids = GetPlayerIds();
I dont know how to read it. Help please
 

Please read document I posted above

 
public void InitiatePurchase(Product product, string developerPayload) { }

In lgl menu how to hack this free store using monostring??
 
How to hook this :

C#: 
public Boards[] boards; // 0x54

i try to hook it like this: How to Hook Field List Offset

C++: 
void (*_casMenuUpdate)(void *ins);
void casMenuUpdate(void *ins) {
    if (ins != NULL) {
        monoArray<void> *boards = *(monoArray<void>**)((uint64_t) ins + 0x54);
        if (boards != NULL) {
            for (int i = 0; i < boards->getLength(); i++) {
                auto board = (*void) boards->getPointer();
                board[i] = 0;
            }
        }
    }
}

But error arises: Expected "(" for function style cast or type construction
 
How I can get access to this class
public class RoomController // TypeDefIndex: 1420
{
// Fields
public Dictionary<int, PlayerInRoom> players; // 0x8
public ObscuredBool roomAccess; // 0xC
public ObscuredBool roomCarClassLock; // 0x18
public ObscuredBool roomCollisionCar; // 0x24
public ObscuredBool premiumAccess; // 0x30
public Maps roomMap; // 0x3C
public GameType roomGameType; // 0x40
public ObscuredString roomCarClass; // 0x44
public ObscuredString roomUpperClassLock; // 0x48
public ObscuredString roomLowerClassLock; // 0x4C
public ObscuredInt roomID; // 0x50
public ObscuredInt roomMaxPlayersCount; // 0x60
public ObscuredInt roomPlayersCount; // 0x70
public ObscuredInt roomConfigId; // 0x80
public ObscuredInt roomCID; // 0x90
public ObscuredString roomName; // 0xA0
public ObscuredString roomPass; // 0xA4

// Methods

// RVA: 0x1DCD19C Offset: 0x1DCD19C VA: 0x1DCD19C
public void .ctor() { }
}

Via another class RoomListController with Update Offset,and it's have field
public List<RoomController> rooms; // 0x114

I need to get ObscuredString roomPass and copy them to clipboard
 
You must log in or register to reply here.
Menu
Log in
Register