Unity IL2CPP 移动端运行时改造技术报告

static const uint32_t META_LIMIT = 40000000u;   // metadata ~31M，留余量
static const uint32_t MIN_SPAN   = 2000000u;    // 收紧版：排除短误报

static inline bool is_meta_header(const uint32_t* v) {
    if (v[0] != IL2CPP_MAGIC) return false;     // 0xFAB11BAF
    uint32_t ver = v[1];
    if (ver < 20 || ver > 40) return false;     // 已知版本区间
    if (v[2] != 0x100) return false;
    uint32_t max_off = 0;
    for (int i = 2; i <= 10; i += 2) {
        if (v[i]   >= META_LIMIT) return false; // 各表 offset
        if (v[i+1] >= META_LIMIT) return false; // 各表 size
        if (v[i] > max_off) max_off = v[i];
    }
    return max_off >= MIN_SPAN;                 // 真表 offset 跨度占文件 40%+
}

// mincore 逐页确认驻留，再读。否则 /proc/maps 与实际读之间有竞态，
// 映射被释放时直接 SIGBUS。
unsigned char* vec = malloc(npages);
if (mincore((void*)lo, (size_t)(hi - lo), vec) != 0) return;
for (size_t pg = 0; pg < npages; pg++) {
    if (!(vec[pg] & 1)) continue;               // 该页未驻留，跳过
    /* 逐 4 字节对齐位置试判据 */
}

if (perm[0] != 'r' || perm[1] != 'w') continue;   // 解密副本可写
size_t sz = (size_t)(hi - lo);
if (sz >= META_SIZE && sz < META_SIZE + (2u << 20)) {
    const uint8_t* b = (const uint8_t*)lo;
    /* 打印前 16 字节：明文/密文一眼可辨 */
}

// init 在 0x5438CFC 把 Il2CppImage* 填进 base+0xCCE7448
void** slots = (void**)(g_base + 0xCCE7448);
for (int i = 0; i < 96; i++) {
    void* im = untagp(slots[i]);
    if (!im || !ok(im, 0x48)) break;
    /* im + 0x00 = image, + 0x38 = codeGenModule */
}

struct TdOut { uint8_t b[0x54]; };
struct MdOut { uint8_t b[0x24]; };
// 正确：返回结构体，编译器自动把返回槽放进 X8
typedef TdOut (*fn_td)(const void* src, void* ctx);
typedef MdOut (*fn_dec)(const void* src, void* ctx);

// 无条件跳转 B：imm26 是"相对当前指令"的指令数
static uint32_t b_enc(uintptr_t from, uintptr_t to) {
    int64_t d = (int64_t)to - (int64_t)from;
    return 0x14000000u | (uint32_t)((d >> 2) & 0x03FFFFFFu);
}
// 带链接跳转 BL：同一编码，opcode 换 0x94
static uint32_t bl_enc(uintptr_t from, uintptr_t to) {
    int64_t d = ((int64_t)to - (int64_t)from) >> 2;
    return 0x94000000u | (uint32_t)(d & 0x03FFFFFF);
}
// 改一条指令：临时给整页加写权限，写完立刻收回
static bool patch_word_rwx(uintptr_t rva, uint32_t w) {
    uint32_t* p = (uint32_t*)(g_base + rva);
    long psz = sysconf(_SC_PAGESIZE);
    uintptr_t page = (uintptr_t)p & ~((uintptr_t)psz - 1);
    if (mprotect((void*)page, psz, PROT_READ | PROT_WRITE | PROT_EXEC) != 0) return false;
    memcpy(p, &w, 4);
    __builtin___clear_cache((char*)p, (char*)p + 4);
    mprotect((void*)page, psz, PROT_READ | PROT_EXEC);
    return true;
}

static void hook_mi_upd(void* self, void* m) {
    if (m && !g_mc_upd_mi) g_mc_upd_mi = m;   // 首次命中即缓存
    g_orig_mi_upd(self, m);                    // 必须透传，不能只记日志
}

static void recalc_try_hooks(void) {
    struct { uintptr_t rva; void* repl; void** orig; bool* done; } H[4] = {
        { 0x5face00, (void*)hook_mi_upd,  (void**)&g_orig_mi_upd,  &g_mi_done[0] },  // UpdateLevel
        { 0x5fb05bc, (void*)hook_mi_chg,  (void**)&g_orig_mi_chg,  &g_mi_done[1] },  // OnChange
        { 0x605c720, (void*)hook_mi_schg, (void**)&g_orig_mi_schg, nullptr },        // SupportCard.OnChange
        { 0x6059570, (void*)hook_mi_supd, (void**)&g_orig_mi_supd, nullptr },        // SupportCard.UpdateLevel
    };
    for (int i = 0; i < 4; i++) {
        if (H[i].done && *H[i].done) continue;
        void* fn = (void*)(g_base + H[i].rva);
        if (!ok(fn, 4)) continue;                       // 页还没解密，等下一轮 tick
        if (DobbyHook(fn, H[i].repl, H[i].orig) != 0 || !*H[i].orig) continue;
        if (H[i].done) *H[i].done = true;
    }
}

static const uintptr_t SN_SITES[1]      = { 0x6059624 };
static const uint32_t  SN_ORIG[1]       = { 0x97e4817f };   // bl GetByGroupAndExp
static const uintptr_t SN_ACHIEVABLE[1] = { 0x605a664 };    // bl get_AchievableSupportCardLevel

// 校验原始字节（页可能还没解密）
for (int i = 0; i < 1; i++) {
    uint32_t w = 0;
    if (!ok((const void*)(g_base + SN_SITES[i]), 4)) { LOGE("site%d 未映射", i); return; }
    memcpy(&w, (const void*)(g_base + SN_SITES[i]), 4);
    if (w != SN_ORIG[i]) { LOGE("site%d word %08x != %08x（页未解密）", i, w, SN_ORIG[i]); return; }
    g_sn_backup[i] = w;                       // 备份，用于还原
}

// 在站点附近申请一张可执行页
uintptr_t C = stub_alloc(g_base + SN_SITES[0], 0x40, &g_sn_slot);

// 写桩
uintptr_t c = C;
uint32_t code[3];
code[0] = 0xaa1303e0u;                             // mov x0, x19   ← this
code[1] = bl_enc(c + 4, g_base + SN_ACHIEVABLE[0]); // bl 可达行
code[2] = b_enc(c + 8, g_base + SN_SITES[0] + 4);   // b 回原位置
memcpy((void*)c, code, sizeof(code));
__builtin___clear_cache((char*)c, (char*)c + 12);

// 把原调用点改成跳到桩
patch_word_rwx(SN_SITES[0], b_enc(g_base + SN_SITES[0], c));

static void cache_clear_snaps() {
    for (int i = 0; i < g_sn_probe_n && i < CARD_CAP; i++) {
        void* e = g_sn_probe[i];
        if (!e || !ok(e, 0x60)) continue;
        void* zero = nullptr;
        memcpy((char*)e + 0x48, &zero, sizeof(zero));   // 等级行缓存清零
    }
}

// 非 Custom 类：先确认这个位置确实是目标字段（用 getter 透传值配对）
uint32_t mc = g_orig_aw_mc ? g_orig_aw_mc(e, nullptr) : 0xFFFFFFFFu;
uint32_t a = 0;
memcpy(&a, (char*)e + 0x1c, 4);
if (g_tx_on && mc <= 15 && a == mc && a < tgt) {   // 只升不降
    memcpy((char*)e + 0x1c, &tgt, 4);
}

// 错误示范
uint32_t skv = 0;
memcpy(&skv, (char*)e + 0x24, 4);
if (g_orig_sk_get) {
    uint32_t passthru = g_orig_sk_get(e, nullptr);
    if (passthru != skv) continue;   // ← 恒真，等于没有检查
}

static const int SKR[2] = { 0x24, 0x28 };   // 演出技能 / 激奏技能
for (int j = 0; j < 2; j++) {
    uint32_t skv = 0;
    memcpy(&skv, (char*)e + SKR[j], 4);
    if (skv <= 15 && skv < g_sk_level) {    // 值域 + 单调
        memcpy((char*)e + SKR[j], &g_sk_level, 4);
    }
}

uint32_t rk = g_orig_sc_rank(e, nullptr);
uint32_t mx = g_orig_sc_maxrank(e, nullptr);
uint32_t want = g_sn_rank;
if (mx && mx < want) want = mx;      // 绝不越过表里的最大档
if (rk >= want) continue;            // 只升不降
g_orig_sc_setrank(e, want, nullptr); // 走游戏自己的 setter（含 OnChange）

// 关键一步：清成长行缓存并重算
void* zero = nullptr;
memcpy((char*)e + 0x48, &zero, sizeof(zero));
g_orig_sc_updlevel(e, nullptr);

// 把经验钳到该行的 exp，否则进度条显示 0
void* row = nullptr;
memcpy(&row, (char*)e + 0x48, sizeof(row));
if (row && ok(row, 0x2c)) {
    uint32_t row_exp = 0, cur_exp = 0;
    memcpy(&row_exp, (char*)row + 0x28, 4);
    memcpy(&cur_exp, (char*)e + 0x18, 4);
    if (row_exp > cur_exp) memcpy((char*)e + 0x18, &row_exp, 4);
}

if (g_custom_klass && k == g_custom_klass) {
    static const int SKC[2] = { 0x54, 0x58 };       // 派生卡
    for (int j = 0; j < 2; j++) {
        uint32_t skv = 0;
        memcpy(&skv, (char*)e + SKC[j], 4);
        if (skv <= 15 && skv < g_sk_level) memcpy((char*)e + SKC[j], &g_sk_level, 4);
    }
    continue;
}
// 标准卡
static const int SKR[2] = { 0x24, 0x28 };
for (int j = 0; j < 2; j++) { /* 同上 */ }

static void mf_post(void* self, int which) {
    if (!g_sk_on || g_sk_level == 0) return;
    int off0 = (which < 2) ? 0x38 : 0x2c;   // 主 DTO / 卡组 DTO
    int off1 = (which < 2) ? 0x4c : 0x30;
    int offs[2] = { off0, off1 };
    for (int j = 0; j < 2; j++) {
        if (!ok((char*)self + offs[j], 4)) continue;
        uint32_t cur = 0;
        memcpy(&cur, (char*)self + offs[j], 4);
        if (cur <= 15 && cur < g_sk_level) memcpy((char*)self + offs[j], &g_sk_level, 4);
    }
}

// 崩溃写法
g_orig_sc_updlevel(e, nullptr);   // ← 第二个参数是 MethodInfo*

static void command_loop(uintptr_t base) {
    for (;;) {
        char prop[92] = {0};
        __system_property_get("debug.<pkg>.cmd", prop);     // 通道 1：系统属性
        FILE* f = fopen(CMD_FILE, "r");                       // 通道 2：命令文件
        if (f) {
            char cmd[300] = {0};
            if (fgets(cmd, sizeof(cmd), f)) {
                size_t n = strlen(cmd);
                while (n && (cmd[n-1]=='\n' || cmd[n-1]=='\r' || cmd[n-1]==' ')) cmd[--n] = 0;
                fclose(f);
                unlink(CMD_FILE);      // 先删再执行，避免重复触发
                /* ... 分发 ... */
            } else fclose(f);
        }
        usleep(400 * 1000);
    }
}

static void render_loop() {
    if (eglMakeCurrent(g_disp, g_surf, g_surf, g_ctx) == EGL_FALSE) return;
    /* 每次进入渲染循环 = 一个新的 GL 上下文。
     * 旧上下文的纹理/缓冲全部作废，必须重置"已上传"标志重新上传。 */
    g_icon_tried = false;
    g_icon_tex = 0;
    ImGui::CreateContext();
    /* ... */
}

// 角色卡：借 get_AwakeCount 这个高频入口
static uint32_t hook_aw_mc(void* self, void* method) {
    uint32_t v = g_orig_aw_mc(self, method);
    if (g_want_cp_recalc) { g_want_cp_recalc = false; card_recalc_now(); }
    /* ... */
    return v;
}