4 Commits

4 changed files with 35 additions and 20 deletions

View File

@@ -197,7 +197,27 @@ namespace Il2CppInspector
return exports.Values; return exports.Values;
} }
public override bool TryMapVATR(ulong uiAddr, out uint fileOffset)
{
if (uiAddr == 0)
{
fileOffset = 0;
return true;
}
var section = sections.FirstOrDefault(x => uiAddr - pe.ImageBase >= x.VirtualAddress &&
uiAddr - pe.ImageBase < x.VirtualAddress + x.SizeOfRawData);
if (section == null)
{
fileOffset = 0;
return false;
}
fileOffset = (uint)(uiAddr - section.VirtualAddress - pe.ImageBase + section.PointerToRawData);
return true;
}
public override uint MapVATR(ulong uiAddr) { public override uint MapVATR(ulong uiAddr) {
if (uiAddr == 0) if (uiAddr == 0)
return 0; return 0;

View File

@@ -296,8 +296,11 @@ namespace Il2CppInspector
*/ */
if ((Metadata != null && Metadata.Types.Length != MetadataRegistration.TypeDefinitionsSizesCount) if ((Metadata != null && Metadata.Types.Length != MetadataRegistration.TypeDefinitionsSizesCount)
|| CodeRegistration.ReversePInvokeWrapperCount > 0x10000 || CodeRegistration.ReversePInvokeWrapperCount > 0x10000
|| CodeRegistration.UnresolvedVirtualCallCount > 0x4000 // >= 22 // L-NOTE: These below boundaries have been updated already as some games
|| CodeRegistration.InteropDataCount > 0x1000 // >= 23 // have reached these limits during normal use. Maybe we should just remove them
// at this point?
|| CodeRegistration.UnresolvedVirtualCallCount > 0x8000 // >= 22
|| CodeRegistration.InteropDataCount > 0x2000 // >= 23
|| (Image.Version <= MetadataVersions.V241 && CodeRegistration.InvokerPointersCount > CodeRegistration.MethodPointersCount)) || (Image.Version <= MetadataVersions.V241 && CodeRegistration.InvokerPointersCount > CodeRegistration.MethodPointersCount))
throw new NotSupportedException("The detected Il2CppCodeRegistration / Il2CppMetadataRegistration structs do not pass validation. This may mean that their fields have been re-ordered as a form of obfuscation and Il2CppInspector has not been able to restore the original order automatically. Consider re-ordering the fields in Il2CppBinaryClasses.cs and try again."); throw new NotSupportedException("The detected Il2CppCodeRegistration / Il2CppMetadataRegistration structs do not pass validation. This may mean that their fields have been re-ordered as a form of obfuscation and Il2CppInspector has not been able to restore the original order automatically. Consider re-ordering the fields in Il2CppBinaryClasses.cs and try again.");

View File

@@ -277,21 +277,12 @@ namespace Il2CppInspector
vas = FindAllMappedWords(imageBytes, typesLength).Select(a => a - mrSize + ptrSize * 4); vas = FindAllMappedWords(imageBytes, typesLength).Select(a => a - mrSize + ptrSize * 4);
// >= 19 && < 27 // >= 19
if (Image.Version < MetadataVersions.V270) // Luke: Previously, a check comparing MetadataUsagesCount was used here,
foreach (var va in vas) // but I know of at least one binary where this will break detection.
{ // Testing showed that we can just use the same heuristic used for v27+
var mr = Image.ReadMappedVersionedObject<Il2CppMetadataRegistration>(va); // on older versions as well, so we'll just use it for all cases.
if (mr.MetadataUsagesCount == (ulong) metadata.MetadataUsageLists.Length) if (Image.Version >= MetadataVersions.V190)
metadataRegistration = va;
}
// plagiarism. noun - https://www.lexico.com/en/definition/plagiarism
// the practice of taking someone else's work or ideas and passing them off as one's own.
// Synonyms: copying, piracy, theft, strealing, infringement of copyright
// >= 27
else
{ {
foreach (var va in vas) foreach (var va in vas)
{ {
@@ -304,6 +295,7 @@ namespace Il2CppInspector
} }
} }
} }
if (metadataRegistration == 0) if (metadataRegistration == 0)
return (0, 0); return (0, 0);

View File

@@ -83,8 +83,8 @@ class IDADisassemblerInterface(BaseDisassemblerInterface):
ida_ida.inf_set_genflags(self._cached_genflags & ~ida_ida.INFFL_AUTO) ida_ida.inf_set_genflags(self._cached_genflags & ~ida_ida.INFFL_AUTO)
# Unload type libraries we know to cause issues - like the c++ linux one # Unload type libraries we know to cause issues - like the c++ linux one
PLATFORMS = ["x86", "x64", "arm", "arm64"] PLATFORMS = ["x86", "x64", "arm", "arm64", "win7"]
PROBLEMATIC_TYPELIBS = ["gnulnx"] PROBLEMATIC_TYPELIBS = ["gnulnx", "mssdk64"]
for lib in PROBLEMATIC_TYPELIBS: for lib in PROBLEMATIC_TYPELIBS:
for platform in PLATFORMS: for platform in PLATFORMS: