mIsmanXP
Awesome Active Platinian
The application crashes upon invoking an IL2CPP function.
When utilizing the frida-il2cpp-bridge library, the provided code run smoothly:
On the C++ side, I store the instance of uiWord and later invoke the GetWord method. Attempting to call the GetWord method within the OnKeySelect function yields the same outcome – a crash:
i have confirmed the addresses, there's nothing wrong with it.
However, if, the game is launched through frida (with script provided by il2cpp-bridge), the game doesn't crash.
When utilizing the frida-il2cpp-bridge library, the provided code run smoothly:
JavaScript:
const uiWord = csImage.class("Game.UI.Word");
const onKeySelect = uiWord.method("OnKeySelected");
onKeySelect.implementation = function (key: any, after_input: boolean) {
const getWord = this.method("GetWord");
const result = getWord.invoke();
console.log(result);
return this.method(onKeySelect.name).invoke(key, after_input);
};
C++:
//System.Void OnKeySelected(Game.UI.UIKey key, System.Boolean after_input); // 0x00d25414
void (*o_OnKeySelect)(void *uiWord, void *uiKey, bool afterInput);
void OnKeySelect(void *uiWord, void *uiKey, bool afterInput) {
LOGD("OnKeySelect => %llx : %llx : %d", uiWord, uiKey, afterInput);
uiwInstance = uiWord;
return o_OnKeySelect(uiWord, uiKey, afterInput);
}
...
...
HOOK_LIB("libil2cpp.so", "0x1148F24", Initialize, o_Initialize);
HOOK_LIB("libil2cpp.so", "0xD25414", OnKeySelect, o_OnKeySelect);
setHints = (decltype(setHints)) getAbsoluteAddress(targetLibName, 0x01149a1c);
getWord = (decltype(getWord)) getAbsoluteAddress(targetLibName, 0x00d2661c);//System.String GetWord(); // 0x00d2661c
LOGD("getWord %llx", getWord);
...
...
switch (featNum) {
case 0: {
LOGD("Trying to set hints to : %d", value);
if (hsInstance) {
setHints(hsInstance, value); //works fine
}
break;
}
case 1: {
if (uiwInstance) {
LOGD("GETWORD");
getWord(uiwInstance); //pauses briefly and then crashes
}
break;
}
}
...i have confirmed the addresses, there's nothing wrong with it.
However, if, the game is launched through frida (with script provided by il2cpp-bridge), the game doesn't crash.