Android安全-frida怎么在il2cpp里替换返回值byte类型

YYY的c#定义:

1	`public static byte[] YYY(ref string contentFile)`

下面这样执行会报错 Error: expected a pointer

import "frida-il2cpp-bridge";
 
Il2Cpp.perform(() => {
 
    console.log("Unity version: " + Il2Cpp.unityVersion);
    const XXX = Il2Cpp.domain.assembly('Assembly-CSharp').image.class('XXX');
    const YYY = XXX.method("YYY");
 
    YYY.implementation = function (item): Uint8Array {
        var result = this.method<Uint8Array>("YYY").invoke(item);
        var file = new File("text.txt", "r");
        return file.readBytes(); // <------ Error: expected a pointer
    };
});

换下面则会卡住，应该是被hook的无法读取到这个内存地址

var byteArray = file.readBytes()
console.log(hexdump(byteArray, {
    offset: 0,
    length: byteArray.length,
    header: true,
    ansi: true,
}));
 
console.log(byteArray.byteLength);
var memAllocate = Memory.alloc(byteArray.byteLength);
Memory.writeByteArray(memAllocate, byteArray);
return memAllocate;

使用 Il2Cpp.array 下面代码

import "frida-il2cpp-bridge";
 
Il2Cpp.perform(() => {
 
    console.log("Unity version: " + Il2Cpp.unityVersion);
    const XXX = Il2Cpp.domain.assembly('Assembly-CSharp').image.class('XXX');
    const YYY = XXX.method("YYY");
 
   const SystemByte = Il2Cpp.corlib.class("System.Byte");
 
   var byteArray;
 
    YYY.implementation = function (item): Uint8Array {
        var result = this.method<Uint8Array>("YYY").invoke(item);
        var file = new File("text.txt", "r");
         byteArray = file.readBytes()
         var bytePointer = Il2Cpp.array(SystemByte, byteArray);
            return bytePointer;
    };
});

报错：

Error: expected an unsigned integer
    at array (il2cpp/structs/array.ts:92)
    at <anonymous> (index.ts:xx) <---- return bytePointer line
    at call (native)
    at <anonymous> (il2cpp/structs/method.ts:354)

最后于 2小时前被张馆长编辑，原因：

更多【Android安全-frida怎么在il2cpp里替换返回值byte类型】相关视频教程：www.yxfzedu.com

Android安全-frida怎么在il2cpp里替换返回值byte类型

相关文章推荐

友情链接

课程目录

技术交流QQ群