[{"data":1,"prerenderedAt":2978},["ShallowReactive",2],{"/articles/il2cpp-runtime-patching-report":3},{"id":4,"title":5,"body":6,"date":2963,"description":2964,"extension":2965,"featured":2966,"meta":2967,"navigation":385,"path":2968,"report":2966,"seo":2969,"stem":2970,"tags":2971,"tip":2976,"__hash__":2977},"articles/articles/il2cpp-runtime-patching-report.md","Unity IL2CPP 移动端运行时改造技术报告",{"type":7,"value":8,"toc":2915},"minimark",[9,13,18,114,117,121,124,250,253,320,323,333,337,348,353,364,452,455,458,502,512,516,523,557,561,564,612,623,662,666,673,715,725,755,773,781,792,798,817,831,835,842,846,850,857,909,913,916,1025,1031,1035,1046,1147,1157,1161,1165,1264,1277,1281,1295,1436,1439,1488,1492,1502,1545,1557,1563,1573,1579,1583,1587,1590,1596,1599,1603,1621,1660,1681,1685,1688,1727,1741,1784,1789,1793,1800,1806,1810,1816,1820,1827,1831,1917,1929,2036,2040,2046,2052,2061,2066,2070,2074,2080,2139,2145,2165,2168,2172,2178,2241,2247,2309,2323,2327,2330,2345,2348,2354,2361,2365,2372,2387,2405,2409,2430,2434,2440,2444,2448,2455,2458,2551,2554,2558,2564,2570,2576,2591,2597,2646,2651,2655,2668,2706,2710,2713,2776,2779,2793,2796,2800,2806,2812,2818,2824,2830,2834,2837,2874,2877,2897,2900,2905,2908,2911],[10,11,12],"p",{},"测试环境：自有设备、自有账号、离线验证。全文隐去应用与厂商标识。所有偏移量来自单一构建，仅作方法示例。",[14,15,17],"h2",{"id":16},"_0-结论先行","0. 结论先行",[19,20,21,40],"table",{},[22,23,24],"thead",{},[25,26,27,31,34,37],"tr",{},[28,29,30],"th",{},"目标",[28,32,33],{},"实际改的层",[28,35,36],{},"手法",[28,38,39],{},"UI 即时生效",[41,42,43,61,75,88,101],"tbody",{},[25,44,45,49,52,55],{},[46,47,48],"td",{},"等级 → 推到上限",[46,50,51],{},"查表调用点",[46,53,54],{},"指令替换（跳转桩）",[46,56,57],{},[58,59,60],"strong",{},"是",[25,62,63,66,69,72],{},[46,64,65],{},"特训档位",[46,67,68],{},"运行时实体字段",[46,70,71],{},"直接写 + 值域保护",[46,73,74],{},"否",[25,76,77,80,83,86],{},[46,78,79],{},"留影等级 + 上限",[46,81,82],{},"运行时字段 + 缓存行",[46,84,85],{},"走游戏 setter + 清缓存",[46,87,74],{},[25,89,90,93,96,99],{},[46,91,92],{},"技能等级（演出/激奏）",[46,94,95],{},"运行时字段 + 协议 DTO",[46,97,98],{},"双写",[46,100,74],{},[25,102,103,106,109,112],{},[46,104,105],{},"记忆满级",[46,107,108],{},"LINQ 谓词",[46,110,111],{},"谓词常量替换",[46,113,74],{},[10,115,116],{},"唯一能即时生效的是第一种，原因见第 9 节。",[14,118,120],{"id":119},"_1-执行层热修闸门决定一切","1. 执行层：热修闸门决定一切",[10,122,123],{},"目标集成了 IFix 热更新框架。每个托管方法编译后的原生代码都长这样：",[125,126,131],"pre",{"className":127,"code":128,"language":129,"meta":130,"style":130},"language-asm shiki shiki-themes github-light github-dark","; MemberCard.get_Level @0x605a54c\nstp  x30, x19, [sp, #-0x10]!\nmov  x19, x0\nmov  w0, #0x1df4          ; 该方法的补丁编号\nbl   IsPatched            ; 0x5f9cf50\ntbz  w0, #0, original     ; 未热修 -> 执行原生体\nmov  w0, #0x1df4\nbl   GetPatch             ; 0x5f9ced4\ncbz  x0, original\nmov  x1, x19\nmov  x2, xzr\nldp  x30, x19, [sp], #0x10\nb    #0x5e86784           ; 已热修 -> 交给解释器\noriginal:\nmov  x0, x19\nbl   get_CurrentSupportCardLevel\ncbz  x0, ...\nldr  w0, [x0, #0x24]\nret\n","asm","",[132,133,134,142,148,154,160,166,172,178,184,190,196,202,208,214,220,226,232,238,244],"code",{"__ignoreMap":130},[135,136,139],"span",{"class":137,"line":138},"line",1,[135,140,141],{},"; MemberCard.get_Level @0x605a54c\n",[135,143,145],{"class":137,"line":144},2,[135,146,147],{},"stp  x30, x19, [sp, #-0x10]!\n",[135,149,151],{"class":137,"line":150},3,[135,152,153],{},"mov  x19, x0\n",[135,155,157],{"class":137,"line":156},4,[135,158,159],{},"mov  w0, #0x1df4          ; 该方法的补丁编号\n",[135,161,163],{"class":137,"line":162},5,[135,164,165],{},"bl   IsPatched            ; 0x5f9cf50\n",[135,167,169],{"class":137,"line":168},6,[135,170,171],{},"tbz  w0, #0, original     ; 未热修 -> 执行原生体\n",[135,173,175],{"class":137,"line":174},7,[135,176,177],{},"mov  w0, #0x1df4\n",[135,179,181],{"class":137,"line":180},8,[135,182,183],{},"bl   GetPatch             ; 0x5f9ced4\n",[135,185,187],{"class":137,"line":186},9,[135,188,189],{},"cbz  x0, original\n",[135,191,193],{"class":137,"line":192},10,[135,194,195],{},"mov  x1, x19\n",[135,197,199],{"class":137,"line":198},11,[135,200,201],{},"mov  x2, xzr\n",[135,203,205],{"class":137,"line":204},12,[135,206,207],{},"ldp  x30, x19, [sp], #0x10\n",[135,209,211],{"class":137,"line":210},13,[135,212,213],{},"b    #0x5e86784           ; 已热修 -> 交给解释器\n",[135,215,217],{"class":137,"line":216},14,[135,218,219],{},"original:\n",[135,221,223],{"class":137,"line":222},15,[135,224,225],{},"mov  x0, x19\n",[135,227,229],{"class":137,"line":228},16,[135,230,231],{},"bl   get_CurrentSupportCardLevel\n",[135,233,235],{"class":137,"line":234},17,[135,236,237],{},"cbz  x0, ...\n",[135,239,241],{"class":137,"line":240},18,[135,242,243],{},"ldr  w0, [x0, #0x24]\n",[135,245,247],{"class":137,"line":246},19,[135,248,249],{},"ret\n",[10,251,252],{},"两个直接后果：",[19,254,255,267],{},[22,256,257],{},[25,258,259,261,264],{},[28,260,36],{},[28,262,263],{},"是否有效",[28,265,266],{},"原因",[41,268,269,286,303],{},[25,270,271,278,283],{},[46,272,273,274,277],{},"方法体中部打补丁（换一条 ",[132,275,276],{},"bl","）",[46,279,280],{},[58,281,282],{},"仅当该方法未被热修",[46,284,285],{},"热修方法入口即跳解释器，原生体是死代码",[25,287,288,291,296],{},[46,289,290],{},"入口内联钩（DobbyHook 替换函数地址）",[46,292,293],{},[58,294,295],{},"始终有效",[46,297,298,299,302],{},"在 ",[132,300,301],{},"IsPatched"," 判定之前执行",[25,304,305,308,313],{},[46,306,307],{},"钩属性 getter 改返回值",[46,309,310],{},[58,311,312],{},"对热修过的显示逻辑无效",[46,314,315,316,319],{},"解释器执行 IL 时用 ",[132,317,318],{},"ldfld"," 直读字段，不经访问器",[10,321,322],{},"第三条是最大的认知转折：日志能证明 getter 返回了目标值，但界面纹丝不动，因为界面根本不调 getter。",[10,324,325,326,329,330,332],{},"判定一个方法是否被热修，读它入口第一个 ",[132,327,328],{},"mov w0, #imm"," 之后的 ",[132,331,301],{}," 返回值即可。",[14,334,336],{"id":335},"_2-元数据获取从加密文件到完整方法表","2. 元数据获取：从加密文件到完整方法表",[10,338,339,340,343,344,347],{},"后续所有工作都依赖一张「类名 / 方法名 → RVA」的表。而应用随包的 ",[132,341,342],{},"global-metadata.dat"," 是",[58,345,346],{},"加密","的，标准工具直接解析失败。两条路：静态解出文件，或运行时从进程内存里捞解密后的副本。我们走后者，因为解密逻辑在 native 里且随版本变化。",[349,350,352],"h3",{"id":351},"_21-结构判据扫描进程内存","2.1 结构判据扫描进程内存",[10,354,355,356,359,360,363],{},"IL2CPP metadata 头部布局是已知的：魔数 ",[132,357,358],{},"0xFAB11BAF","、版本号，之后是成组的 ",[132,361,362],{},"(offset, size)","。据此写判据：",[125,365,369],{"className":366,"code":367,"language":368,"meta":130,"style":130},"language-c shiki shiki-themes github-light github-dark","static const uint32_t META_LIMIT = 40000000u;   // metadata ~31M，留余量\nstatic const uint32_t MIN_SPAN   = 2000000u;    // 收紧版：排除短误报\n\nstatic inline bool is_meta_header(const uint32_t* v) {\n    if (v[0] != IL2CPP_MAGIC) return false;     // 0xFAB11BAF\n    uint32_t ver = v[1];\n    if (ver \u003C 20 || ver > 40) return false;     // 已知版本区间\n    if (v[2] != 0x100) return false;\n    uint32_t max_off = 0;\n    for (int i = 2; i \u003C= 10; i += 2) {\n        if (v[i]   >= META_LIMIT) return false; // 各表 offset\n        if (v[i+1] >= META_LIMIT) return false; // 各表 size\n        if (v[i] > max_off) max_off = v[i];\n    }\n    return max_off >= MIN_SPAN;                 // 真表 offset 跨度占文件 40%+\n}\n","c",[132,370,371,376,381,387,392,397,402,407,412,417,422,427,432,437,442,447],{"__ignoreMap":130},[135,372,373],{"class":137,"line":138},[135,374,375],{},"static const uint32_t META_LIMIT = 40000000u;   // metadata ~31M，留余量\n",[135,377,378],{"class":137,"line":144},[135,379,380],{},"static const uint32_t MIN_SPAN   = 2000000u;    // 收紧版：排除短误报\n",[135,382,383],{"class":137,"line":150},[135,384,386],{"emptyLinePlaceholder":385},true,"\n",[135,388,389],{"class":137,"line":156},[135,390,391],{},"static inline bool is_meta_header(const uint32_t* v) {\n",[135,393,394],{"class":137,"line":162},[135,395,396],{},"    if (v[0] != IL2CPP_MAGIC) return false;     // 0xFAB11BAF\n",[135,398,399],{"class":137,"line":168},[135,400,401],{},"    uint32_t ver = v[1];\n",[135,403,404],{"class":137,"line":174},[135,405,406],{},"    if (ver \u003C 20 || ver > 40) return false;     // 已知版本区间\n",[135,408,409],{"class":137,"line":180},[135,410,411],{},"    if (v[2] != 0x100) return false;\n",[135,413,414],{"class":137,"line":186},[135,415,416],{},"    uint32_t max_off = 0;\n",[135,418,419],{"class":137,"line":192},[135,420,421],{},"    for (int i = 2; i \u003C= 10; i += 2) {\n",[135,423,424],{"class":137,"line":198},[135,425,426],{},"        if (v[i]   >= META_LIMIT) return false; // 各表 offset\n",[135,428,429],{"class":137,"line":204},[135,430,431],{},"        if (v[i+1] >= META_LIMIT) return false; // 各表 size\n",[135,433,434],{"class":137,"line":210},[135,435,436],{},"        if (v[i] > max_off) max_off = v[i];\n",[135,438,439],{"class":137,"line":216},[135,440,441],{},"    }\n",[135,443,444],{"class":137,"line":222},[135,445,446],{},"    return max_off >= MIN_SPAN;                 // 真表 offset 跨度占文件 40%+\n",[135,448,449],{"class":137,"line":228},[135,450,451],{},"}\n",[10,453,454],{},"实测：4 个真实 metadata（ver 27/29/31）全部命中，而加密版本正确不命中。",[10,456,457],{},"扫描时的两个细节：",[125,459,461],{"className":366,"code":460,"language":368,"meta":130,"style":130},"// mincore 逐页确认驻留，再读。否则 /proc/maps 与实际读之间有竞态，\n// 映射被释放时直接 SIGBUS。\nunsigned char* vec = malloc(npages);\nif (mincore((void*)lo, (size_t)(hi - lo), vec) != 0) return;\nfor (size_t pg = 0; pg \u003C npages; pg++) {\n    if (!(vec[pg] & 1)) continue;               // 该页未驻留，跳过\n    /* 逐 4 字节对齐位置试判据 */\n}\n",[132,462,463,468,473,478,483,488,493,498],{"__ignoreMap":130},[135,464,465],{"class":137,"line":138},[135,466,467],{},"// mincore 逐页确认驻留，再读。否则 /proc/maps 与实际读之间有竞态，\n",[135,469,470],{"class":137,"line":144},[135,471,472],{},"// 映射被释放时直接 SIGBUS。\n",[135,474,475],{"class":137,"line":150},[135,476,477],{},"unsigned char* vec = malloc(npages);\n",[135,479,480],{"class":137,"line":156},[135,481,482],{},"if (mincore((void*)lo, (size_t)(hi - lo), vec) != 0) return;\n",[135,484,485],{"class":137,"line":162},[135,486,487],{},"for (size_t pg = 0; pg \u003C npages; pg++) {\n",[135,489,490],{"class":137,"line":168},[135,491,492],{},"    if (!(vec[pg] & 1)) continue;               // 该页未驻留，跳过\n",[135,494,495],{"class":137,"line":174},[135,496,497],{},"    /* 逐 4 字节对齐位置试判据 */\n",[135,499,500],{"class":137,"line":180},[135,501,451],{},[10,503,504,505,511],{},"另外",[58,506,507,508],{},"不要跳过 ",[132,509,510],{},"[heap]","：解密后的副本很可能就在堆上。",[349,513,515],{"id":514},"_22-用体积定位解密副本","2.2 用体积定位解密副本",[10,517,518,519,522],{},"第二个判据更直接：解密副本是 ",[132,520,521],{},"malloc"," 出来的，长度与磁盘文件几乎一致。",[125,524,526],{"className":366,"code":525,"language":368,"meta":130,"style":130},"if (perm[0] != 'r' || perm[1] != 'w') continue;   // 解密副本可写\nsize_t sz = (size_t)(hi - lo);\nif (sz >= META_SIZE && sz \u003C META_SIZE + (2u \u003C\u003C 20)) {\n    const uint8_t* b = (const uint8_t*)lo;\n    /* 打印前 16 字节：明文/密文一眼可辨 */\n}\n",[132,527,528,533,538,543,548,553],{"__ignoreMap":130},[135,529,530],{"class":137,"line":138},[135,531,532],{},"if (perm[0] != 'r' || perm[1] != 'w') continue;   // 解密副本可写\n",[135,534,535],{"class":137,"line":144},[135,536,537],{},"size_t sz = (size_t)(hi - lo);\n",[135,539,540],{"class":137,"line":150},[135,541,542],{},"if (sz >= META_SIZE && sz \u003C META_SIZE + (2u \u003C\u003C 20)) {\n",[135,544,545],{"class":137,"line":156},[135,546,547],{},"    const uint8_t* b = (const uint8_t*)lo;\n",[135,549,550],{"class":137,"line":162},[135,551,552],{},"    /* 打印前 16 字节：明文/密文一眼可辨 */\n",[135,554,555],{"class":137,"line":168},[135,556,451],{},[349,558,560],{"id":559},"_23-运行时全局与镜像表","2.3 运行时全局与镜像表",[10,562,563],{},"拿到头部之后，三个关键全局（同一构建，来自探针 dump）：",[19,565,566,576],{},[22,567,568],{},[25,569,570,573],{},[28,571,572],{},"用途",[28,574,575],{},"地址",[41,577,578,590,602],{},[25,579,580,585],{},[46,581,582],{},[132,583,584],{},"s_Image",[46,586,587],{},[132,588,589],{},"base + 0xCCE7288",[25,591,592,597],{},[46,593,594],{},[132,595,596],{},"Il2CppGlobalMetadataHeader*",[46,598,599],{},[132,600,601],{},"base + 0xCCE7290",[25,603,604,607],{},[46,605,606],{},"类型注册表",[46,608,609],{},[132,610,611],{},"base + 0xCCE7278",[10,613,614,615,618,619,622],{},"镜像表用的是 init 阶段填好的静态槽位表 ",[132,616,617],{},"base + 0xCCE7448","（最多 96 槽，实测 25 个非空），",[58,620,621],{},"不是"," domain 里的 vector（那个在运行时是空的）：",[125,624,626],{"className":366,"code":625,"language":368,"meta":130,"style":130},"// init 在 0x5438CFC 把 Il2CppImage* 填进 base+0xCCE7448\nvoid** slots = (void**)(g_base + 0xCCE7448);\nfor (int i = 0; i \u003C 96; i++) {\n    void* im = untagp(slots[i]);\n    if (!im || !ok(im, 0x48)) break;\n    /* im + 0x00 = image, + 0x38 = codeGenModule */\n}\n",[132,627,628,633,638,643,648,653,658],{"__ignoreMap":130},[135,629,630],{"class":137,"line":138},[135,631,632],{},"// init 在 0x5438CFC 把 Il2CppImage* 填进 base+0xCCE7448\n",[135,634,635],{"class":137,"line":144},[135,636,637],{},"void** slots = (void**)(g_base + 0xCCE7448);\n",[135,639,640],{"class":137,"line":150},[135,641,642],{},"for (int i = 0; i \u003C 96; i++) {\n",[135,644,645],{"class":137,"line":156},[135,646,647],{},"    void* im = untagp(slots[i]);\n",[135,649,650],{"class":137,"line":162},[135,651,652],{},"    if (!im || !ok(im, 0x48)) break;\n",[135,654,655],{"class":137,"line":168},[135,656,657],{},"    /* im + 0x00 = image, + 0x38 = codeGenModule */\n",[135,659,660],{"class":137,"line":174},[135,661,451],{},[349,663,665],{"id":664},"_24-直调引擎自己的元数据访问器","2.4 直调引擎自己的元数据访问器",[10,667,668,669,672],{},"不自己解析元数据二进制格式（版本一改就废），而是",[58,670,671],{},"直接调用引擎的两个解包函数","：",[19,674,675,687],{},[22,676,677],{},[25,678,679,682,684],{},[28,680,681],{},"函数",[28,683,575],{},[28,685,686],{},"作用",[41,688,689,702],{},[25,690,691,696,699],{},[46,692,693],{},[132,694,695],{},"fp_td",[46,697,698],{},"0x5415BD0",[46,700,701],{},"解包 type definition 记录（0x54 字节）",[25,703,704,709,712],{},[46,705,706],{},[132,707,708],{},"fp_dec",[46,710,711],{},"0x541592C",[46,713,714],{},"解包 method definition 记录（0x24 字节）",[10,716,717,720,721,724],{},[58,718,719],{},"ABI 坑（这次踩得最贵）","：这两个函数是「返回大结构体」的签名。按 AAPCS64，超过 16 字节的返回值走 ",[58,722,723],{},"X8","（sret 约定）：",[125,726,728],{"className":366,"code":727,"language":368,"meta":130,"style":130},"struct TdOut { uint8_t b[0x54]; };\nstruct MdOut { uint8_t b[0x24]; };\n// 正确：返回结构体，编译器自动把返回槽放进 X8\ntypedef TdOut (*fn_td)(const void* src, void* ctx);\ntypedef MdOut (*fn_dec)(const void* src, void* ctx);\n",[132,729,730,735,740,745,750],{"__ignoreMap":130},[135,731,732],{"class":137,"line":138},[135,733,734],{},"struct TdOut { uint8_t b[0x54]; };\n",[135,736,737],{"class":137,"line":144},[135,738,739],{},"struct MdOut { uint8_t b[0x24]; };\n",[135,741,742],{"class":137,"line":150},[135,743,744],{},"// 正确：返回结构体，编译器自动把返回槽放进 X8\n",[135,746,747],{"class":137,"line":156},[135,748,749],{},"typedef TdOut (*fn_td)(const void* src, void* ctx);\n",[135,751,752],{"class":137,"line":162},[135,753,754],{},"typedef MdOut (*fn_dec)(const void* src, void* ctx);\n",[10,756,757,758,761,762,765,766,769,770,772],{},"我们一度声明成三参 ",[132,759,760],{},"(out, src, ctx)","，于是 ",[132,763,764],{},"out"," 进了 ",[58,767,768],{},"X0","，而函数把数据写进 ",[58,771,723],{}," 里的垃圾指针：",[125,774,779],{"className":775,"code":777,"language":778},[776],"language-text","SIGSEGV_ACCERR @0x5415bdc   (str d0,[x8])\n","text",[132,780,777],{"__ignoreMap":130},[10,782,783,784,787,788,791],{},"方法地址的计算公式（来自对 ",[132,785,786],{},"0x54294F0"," / ",[132,789,790],{},"0x543D1D8"," 的反汇编）：",[125,793,796],{"className":794,"code":795,"language":778},[776],"mdAddr  = meta + hdr[0x44] + (hdr[0x48] / hdr[0x4C]) * (td.methodStart + j)\nnameOff = meta + md.nameIndex + hdr[0x20]\ncodePtr = methodPointers[(md.token & 0xFFFFFF) - 1]\n",[132,797,795],{"__ignoreMap":130},[10,799,800,801,804,805,808,809,812,813,816],{},"其中 ",[132,802,803],{},"methodPointers"," 的取法：",[132,806,807],{},"klass+0x00"," → image，",[132,810,811],{},"image+0x38"," → codeGenModule，",[132,814,815],{},"module+0x10"," → 方法指针数组。",[10,818,819,820,826,827,830],{},"还有一个魔改点：",[58,821,822,823],{},"方法数不能读 ",[132,824,825],{},"klass+0x120","，这个字段在该运行时里恒为 0，必须从 td 记录的 ",[132,828,829],{},"method_count"," 取。",[349,832,834],{"id":833},"_25-产物","2.5 产物",[10,836,837,838,841],{},"导出成 TSV：",[132,839,840],{},"命名空间 / 类 / 方法名 / mdidx / token / RVA","。本文后续出现的每一个地址，都是拿这张表反查出来的；反过来，任何一个名字也都能查到地址。",[14,843,845],{"id":844},"_3-定位基建","3. 定位基建",[349,847,849],{"id":848},"_31-页面解密识别","3.1 页面解密识别",[10,851,852,853,856],{},"目标对部分代码页做了单字节 XOR（密钥 ",[132,854,855],{},"0x98","）。不识别的话反汇编出来一片乱码，容易误判成花指令。判据用 capstone 的解码率：",[125,858,862],{"className":859,"code":860,"language":861,"meta":130,"style":130},"language-python shiki shiki-themes github-light github-dark","def get_code(rva, size):\n    \"\"\"返回 (code, mode)：明文或 xor98 解密；用可解码率判定\"\"\"\n    raw = so[rva - DELTA : rva - DELTA + size]\n    def rate(b):\n        return sum(1 for _ in md.disasm(b, rva))\n    if rate(raw) >= size // 8:      return raw, \"plain\"\n    dec = bytes(b ^ 0x98 for b in raw)\n    if rate(dec) >= size // 8:      return dec, \"xor98\"\n    return raw, \"UNKNOWN\"\n","python",[132,863,864,869,874,879,884,889,894,899,904],{"__ignoreMap":130},[135,865,866],{"class":137,"line":138},[135,867,868],{},"def get_code(rva, size):\n",[135,870,871],{"class":137,"line":144},[135,872,873],{},"    \"\"\"返回 (code, mode)：明文或 xor98 解密；用可解码率判定\"\"\"\n",[135,875,876],{"class":137,"line":150},[135,877,878],{},"    raw = so[rva - DELTA : rva - DELTA + size]\n",[135,880,881],{"class":137,"line":156},[135,882,883],{},"    def rate(b):\n",[135,885,886],{"class":137,"line":162},[135,887,888],{},"        return sum(1 for _ in md.disasm(b, rva))\n",[135,890,891],{"class":137,"line":168},[135,892,893],{},"    if rate(raw) >= size // 8:      return raw, \"plain\"\n",[135,895,896],{"class":137,"line":174},[135,897,898],{},"    dec = bytes(b ^ 0x98 for b in raw)\n",[135,900,901],{"class":137,"line":180},[135,902,903],{},"    if rate(dec) >= size // 8:      return dec, \"xor98\"\n",[135,905,906],{"class":137,"line":186},[135,907,908],{},"    return raw, \"UNKNOWN\"\n",[349,910,912],{"id":911},"_32-桩编码助手","3.2 桩编码助手",[10,914,915],{},"所有指令替换都靠手写 ARM64 编码。三个基础函数：",[125,917,919],{"className":366,"code":918,"language":368,"meta":130,"style":130},"// 无条件跳转 B：imm26 是\"相对当前指令\"的指令数\nstatic uint32_t b_enc(uintptr_t from, uintptr_t to) {\n    int64_t d = (int64_t)to - (int64_t)from;\n    return 0x14000000u | (uint32_t)((d >> 2) & 0x03FFFFFFu);\n}\n// 带链接跳转 BL：同一编码，opcode 换 0x94\nstatic uint32_t bl_enc(uintptr_t from, uintptr_t to) {\n    int64_t d = ((int64_t)to - (int64_t)from) >> 2;\n    return 0x94000000u | (uint32_t)(d & 0x03FFFFFF);\n}\n// 改一条指令：临时给整页加写权限，写完立刻收回\nstatic bool patch_word_rwx(uintptr_t rva, uint32_t w) {\n    uint32_t* p = (uint32_t*)(g_base + rva);\n    long psz = sysconf(_SC_PAGESIZE);\n    uintptr_t page = (uintptr_t)p & ~((uintptr_t)psz - 1);\n    if (mprotect((void*)page, psz, PROT_READ | PROT_WRITE | PROT_EXEC) != 0) return false;\n    memcpy(p, &w, 4);\n    __builtin___clear_cache((char*)p, (char*)p + 4);\n    mprotect((void*)page, psz, PROT_READ | PROT_EXEC);\n    return true;\n}\n",[132,920,921,926,931,936,941,945,950,955,960,965,969,974,979,984,989,994,999,1004,1009,1014,1020],{"__ignoreMap":130},[135,922,923],{"class":137,"line":138},[135,924,925],{},"// 无条件跳转 B：imm26 是\"相对当前指令\"的指令数\n",[135,927,928],{"class":137,"line":144},[135,929,930],{},"static uint32_t b_enc(uintptr_t from, uintptr_t to) {\n",[135,932,933],{"class":137,"line":150},[135,934,935],{},"    int64_t d = (int64_t)to - (int64_t)from;\n",[135,937,938],{"class":137,"line":156},[135,939,940],{},"    return 0x14000000u | (uint32_t)((d >> 2) & 0x03FFFFFFu);\n",[135,942,943],{"class":137,"line":162},[135,944,451],{},[135,946,947],{"class":137,"line":168},[135,948,949],{},"// 带链接跳转 BL：同一编码，opcode 换 0x94\n",[135,951,952],{"class":137,"line":174},[135,953,954],{},"static uint32_t bl_enc(uintptr_t from, uintptr_t to) {\n",[135,956,957],{"class":137,"line":180},[135,958,959],{},"    int64_t d = ((int64_t)to - (int64_t)from) >> 2;\n",[135,961,962],{"class":137,"line":186},[135,963,964],{},"    return 0x94000000u | (uint32_t)(d & 0x03FFFFFF);\n",[135,966,967],{"class":137,"line":192},[135,968,451],{},[135,970,971],{"class":137,"line":198},[135,972,973],{},"// 改一条指令：临时给整页加写权限，写完立刻收回\n",[135,975,976],{"class":137,"line":204},[135,977,978],{},"static bool patch_word_rwx(uintptr_t rva, uint32_t w) {\n",[135,980,981],{"class":137,"line":210},[135,982,983],{},"    uint32_t* p = (uint32_t*)(g_base + rva);\n",[135,985,986],{"class":137,"line":216},[135,987,988],{},"    long psz = sysconf(_SC_PAGESIZE);\n",[135,990,991],{"class":137,"line":222},[135,992,993],{},"    uintptr_t page = (uintptr_t)p & ~((uintptr_t)psz - 1);\n",[135,995,996],{"class":137,"line":228},[135,997,998],{},"    if (mprotect((void*)page, psz, PROT_READ | PROT_WRITE | PROT_EXEC) != 0) return false;\n",[135,1000,1001],{"class":137,"line":234},[135,1002,1003],{},"    memcpy(p, &w, 4);\n",[135,1005,1006],{"class":137,"line":240},[135,1007,1008],{},"    __builtin___clear_cache((char*)p, (char*)p + 4);\n",[135,1010,1011],{"class":137,"line":246},[135,1012,1013],{},"    mprotect((void*)page, psz, PROT_READ | PROT_EXEC);\n",[135,1015,1017],{"class":137,"line":1016},20,[135,1018,1019],{},"    return true;\n",[135,1021,1023],{"class":137,"line":1022},21,[135,1024,451],{},[10,1026,1027,1030],{},[132,1028,1029],{},"__builtin___clear_cache"," 不能省。ARM64 的 I-cache 和 D-cache 不保证一致，漏掉会「补丁写进去了但 CPU 跑的还是旧指令」。",[349,1032,1034],{"id":1033},"_33-方法信息捕获","3.3 方法信息捕获",[10,1036,1037,1038,1041,1042,1045],{},"手动调用托管方法时第二个参数必须是真实的 ",[132,1039,1040],{},"MethodInfo*","，传 ",[132,1043,1044],{},"nullptr"," 会让游戏内部解引用崩掉（详见 7.3）。由于没有静态地址，用透传钩在真实调用时把它记下来：",[125,1047,1049],{"className":366,"code":1048,"language":368,"meta":130,"style":130},"static void hook_mi_upd(void* self, void* m) {\n    if (m && !g_mc_upd_mi) g_mc_upd_mi = m;   // 首次命中即缓存\n    g_orig_mi_upd(self, m);                    // 必须透传，不能只记日志\n}\n\nstatic void recalc_try_hooks(void) {\n    struct { uintptr_t rva; void* repl; void** orig; bool* done; } H[4] = {\n        { 0x5face00, (void*)hook_mi_upd,  (void**)&g_orig_mi_upd,  &g_mi_done[0] },  // UpdateLevel\n        { 0x5fb05bc, (void*)hook_mi_chg,  (void**)&g_orig_mi_chg,  &g_mi_done[1] },  // OnChange\n        { 0x605c720, (void*)hook_mi_schg, (void**)&g_orig_mi_schg, nullptr },        // SupportCard.OnChange\n        { 0x6059570, (void*)hook_mi_supd, (void**)&g_orig_mi_supd, nullptr },        // SupportCard.UpdateLevel\n    };\n    for (int i = 0; i \u003C 4; i++) {\n        if (H[i].done && *H[i].done) continue;\n        void* fn = (void*)(g_base + H[i].rva);\n        if (!ok(fn, 4)) continue;                       // 页还没解密，等下一轮 tick\n        if (DobbyHook(fn, H[i].repl, H[i].orig) != 0 || !*H[i].orig) continue;\n        if (H[i].done) *H[i].done = true;\n    }\n}\n",[132,1050,1051,1056,1061,1066,1070,1074,1079,1084,1089,1094,1099,1104,1109,1114,1119,1124,1129,1134,1139,1143],{"__ignoreMap":130},[135,1052,1053],{"class":137,"line":138},[135,1054,1055],{},"static void hook_mi_upd(void* self, void* m) {\n",[135,1057,1058],{"class":137,"line":144},[135,1059,1060],{},"    if (m && !g_mc_upd_mi) g_mc_upd_mi = m;   // 首次命中即缓存\n",[135,1062,1063],{"class":137,"line":150},[135,1064,1065],{},"    g_orig_mi_upd(self, m);                    // 必须透传，不能只记日志\n",[135,1067,1068],{"class":137,"line":156},[135,1069,451],{},[135,1071,1072],{"class":137,"line":162},[135,1073,386],{"emptyLinePlaceholder":385},[135,1075,1076],{"class":137,"line":168},[135,1077,1078],{},"static void recalc_try_hooks(void) {\n",[135,1080,1081],{"class":137,"line":174},[135,1082,1083],{},"    struct { uintptr_t rva; void* repl; void** orig; bool* done; } H[4] = {\n",[135,1085,1086],{"class":137,"line":180},[135,1087,1088],{},"        { 0x5face00, (void*)hook_mi_upd,  (void**)&g_orig_mi_upd,  &g_mi_done[0] },  // UpdateLevel\n",[135,1090,1091],{"class":137,"line":186},[135,1092,1093],{},"        { 0x5fb05bc, (void*)hook_mi_chg,  (void**)&g_orig_mi_chg,  &g_mi_done[1] },  // OnChange\n",[135,1095,1096],{"class":137,"line":192},[135,1097,1098],{},"        { 0x605c720, (void*)hook_mi_schg, (void**)&g_orig_mi_schg, nullptr },        // SupportCard.OnChange\n",[135,1100,1101],{"class":137,"line":198},[135,1102,1103],{},"        { 0x6059570, (void*)hook_mi_supd, (void**)&g_orig_mi_supd, nullptr },        // SupportCard.UpdateLevel\n",[135,1105,1106],{"class":137,"line":204},[135,1107,1108],{},"    };\n",[135,1110,1111],{"class":137,"line":210},[135,1112,1113],{},"    for (int i = 0; i \u003C 4; i++) {\n",[135,1115,1116],{"class":137,"line":216},[135,1117,1118],{},"        if (H[i].done && *H[i].done) continue;\n",[135,1120,1121],{"class":137,"line":222},[135,1122,1123],{},"        void* fn = (void*)(g_base + H[i].rva);\n",[135,1125,1126],{"class":137,"line":228},[135,1127,1128],{},"        if (!ok(fn, 4)) continue;                       // 页还没解密，等下一轮 tick\n",[135,1130,1131],{"class":137,"line":234},[135,1132,1133],{},"        if (DobbyHook(fn, H[i].repl, H[i].orig) != 0 || !*H[i].orig) continue;\n",[135,1135,1136],{"class":137,"line":240},[135,1137,1138],{},"        if (H[i].done) *H[i].done = true;\n",[135,1140,1141],{"class":137,"line":246},[135,1142,441],{},[135,1144,1145],{"class":137,"line":1016},[135,1146,451],{},[10,1148,1149,1152,1153,1156],{},[132,1150,1151],{},"ok()"," 是自写的地址校验：查 ",[132,1154,1155],{},"/proc/self/maps"," 确认该地址在已映射且可执行的区间内。所有解引用前都过一遍，避免在页未解密时踩内存。",[14,1158,1160],{"id":1159},"_4-案例一等级推到上限唯一能热更新的那个","4. 案例一：等级推到上限（唯一能热更新的那个）",[349,1162,1164],{"id":1163},"_41-链路","4.1 链路",[19,1166,1167,1179],{},[22,1168,1169],{},[25,1170,1171,1174,1176],{},[28,1172,1173],{},"环节",[28,1175,575],{},[28,1177,1178],{},"语义",[41,1180,1181,1202,1218,1235,1248],{},[25,1182,1183,1188,1191],{},[46,1184,1185],{},[132,1186,1187],{},"get_Level",[46,1189,1190],{},"0x605a54c",[46,1192,1193,1194,1197,1198,1201],{},"读 ",[132,1195,1196],{},"[卡+0x48]"," 缓存的等级行，行 ",[132,1199,1200],{},"+0x24"," = 等级",[25,1203,1204,1209,1212],{},[46,1205,1206],{},[132,1207,1208],{},"get_CurrentSupportCardLevel",[46,1210,1211],{},"0x605a408",[46,1213,1214,1215],{},"缓存空时调 ",[132,1216,1217],{},"UpdateLevel",[25,1219,1220,1224,1227],{},[46,1221,1222],{},[132,1223,1217],{},[46,1225,1226],{},"0x6059570",[46,1228,1229,1234],{},[58,1230,1231],{},[132,1232,1233],{},"bl GetByGroupAndExp(等级组, 经验)"," ← 要替换的就是这条",[25,1236,1237,1242,1245],{},[46,1238,1239],{},[132,1240,1241],{},"get_AchievableSupportCardLevel",[46,1243,1244],{},"0x605a664",[46,1246,1247],{},"游戏自带：\"不超过上限的最大成长行\"",[25,1249,1250,1255,1258],{},[46,1251,1252],{},[132,1253,1254],{},"get_LimitLevel",[46,1256,1257],{},"0x605a940",[46,1259,1260,1261],{},"当前档位行 ",[132,1262,1263],{},"+0x28",[10,1265,1266,1268,1269,1272,1273,1276],{},[132,1267,1241],{}," 内部就是一个 LINQ 谓词 ",[132,1270,1271],{},"行.Level \u003C= get_LimitLevel","，取最后一个满足的行。也就是说，",[58,1274,1275],{},"它返回的就是上限行","。",[349,1278,1280],{"id":1279},"_42-实现","4.2 实现",[10,1282,1283,1284,1286,1287,1290,1291,1294],{},"被替换的那条 ",[132,1285,276],{}," 位于 ",[132,1288,1289],{},"0x6059624","，原始机器码 ",[132,1292,1293],{},"0x97e4817f","。替换成一个三指令桩：",[125,1296,1298],{"className":366,"code":1297,"language":368,"meta":130,"style":130},"static const uintptr_t SN_SITES[1]      = { 0x6059624 };\nstatic const uint32_t  SN_ORIG[1]       = { 0x97e4817f };   // bl GetByGroupAndExp\nstatic const uintptr_t SN_ACHIEVABLE[1] = { 0x605a664 };    // bl get_AchievableSupportCardLevel\n\n// 校验原始字节（页可能还没解密）\nfor (int i = 0; i \u003C 1; i++) {\n    uint32_t w = 0;\n    if (!ok((const void*)(g_base + SN_SITES[i]), 4)) { LOGE(\"site%d 未映射\", i); return; }\n    memcpy(&w, (const void*)(g_base + SN_SITES[i]), 4);\n    if (w != SN_ORIG[i]) { LOGE(\"site%d word %08x != %08x（页未解密）\", i, w, SN_ORIG[i]); return; }\n    g_sn_backup[i] = w;                       // 备份，用于还原\n}\n\n// 在站点附近申请一张可执行页\nuintptr_t C = stub_alloc(g_base + SN_SITES[0], 0x40, &g_sn_slot);\n\n// 写桩\nuintptr_t c = C;\nuint32_t code[3];\ncode[0] = 0xaa1303e0u;                             // mov x0, x19   ← this\ncode[1] = bl_enc(c + 4, g_base + SN_ACHIEVABLE[0]); // bl 可达行\ncode[2] = b_enc(c + 8, g_base + SN_SITES[0] + 4);   // b 回原位置\nmemcpy((void*)c, code, sizeof(code));\n__builtin___clear_cache((char*)c, (char*)c + 12);\n\n// 把原调用点改成跳到桩\npatch_word_rwx(SN_SITES[0], b_enc(g_base + SN_SITES[0], c));\n",[132,1299,1300,1305,1310,1315,1319,1324,1329,1334,1339,1344,1349,1354,1358,1362,1367,1372,1376,1381,1386,1391,1396,1401,1407,1413,1419,1424,1430],{"__ignoreMap":130},[135,1301,1302],{"class":137,"line":138},[135,1303,1304],{},"static const uintptr_t SN_SITES[1]      = { 0x6059624 };\n",[135,1306,1307],{"class":137,"line":144},[135,1308,1309],{},"static const uint32_t  SN_ORIG[1]       = { 0x97e4817f };   // bl GetByGroupAndExp\n",[135,1311,1312],{"class":137,"line":150},[135,1313,1314],{},"static const uintptr_t SN_ACHIEVABLE[1] = { 0x605a664 };    // bl get_AchievableSupportCardLevel\n",[135,1316,1317],{"class":137,"line":156},[135,1318,386],{"emptyLinePlaceholder":385},[135,1320,1321],{"class":137,"line":162},[135,1322,1323],{},"// 校验原始字节（页可能还没解密）\n",[135,1325,1326],{"class":137,"line":168},[135,1327,1328],{},"for (int i = 0; i \u003C 1; i++) {\n",[135,1330,1331],{"class":137,"line":174},[135,1332,1333],{},"    uint32_t w = 0;\n",[135,1335,1336],{"class":137,"line":180},[135,1337,1338],{},"    if (!ok((const void*)(g_base + SN_SITES[i]), 4)) { LOGE(\"site%d 未映射\", i); return; }\n",[135,1340,1341],{"class":137,"line":186},[135,1342,1343],{},"    memcpy(&w, (const void*)(g_base + SN_SITES[i]), 4);\n",[135,1345,1346],{"class":137,"line":192},[135,1347,1348],{},"    if (w != SN_ORIG[i]) { LOGE(\"site%d word %08x != %08x（页未解密）\", i, w, SN_ORIG[i]); return; }\n",[135,1350,1351],{"class":137,"line":198},[135,1352,1353],{},"    g_sn_backup[i] = w;                       // 备份，用于还原\n",[135,1355,1356],{"class":137,"line":204},[135,1357,451],{},[135,1359,1360],{"class":137,"line":210},[135,1361,386],{"emptyLinePlaceholder":385},[135,1363,1364],{"class":137,"line":216},[135,1365,1366],{},"// 在站点附近申请一张可执行页\n",[135,1368,1369],{"class":137,"line":222},[135,1370,1371],{},"uintptr_t C = stub_alloc(g_base + SN_SITES[0], 0x40, &g_sn_slot);\n",[135,1373,1374],{"class":137,"line":228},[135,1375,386],{"emptyLinePlaceholder":385},[135,1377,1378],{"class":137,"line":234},[135,1379,1380],{},"// 写桩\n",[135,1382,1383],{"class":137,"line":240},[135,1384,1385],{},"uintptr_t c = C;\n",[135,1387,1388],{"class":137,"line":246},[135,1389,1390],{},"uint32_t code[3];\n",[135,1392,1393],{"class":137,"line":1016},[135,1394,1395],{},"code[0] = 0xaa1303e0u;                             // mov x0, x19   ← this\n",[135,1397,1398],{"class":137,"line":1022},[135,1399,1400],{},"code[1] = bl_enc(c + 4, g_base + SN_ACHIEVABLE[0]); // bl 可达行\n",[135,1402,1404],{"class":137,"line":1403},22,[135,1405,1406],{},"code[2] = b_enc(c + 8, g_base + SN_SITES[0] + 4);   // b 回原位置\n",[135,1408,1410],{"class":137,"line":1409},23,[135,1411,1412],{},"memcpy((void*)c, code, sizeof(code));\n",[135,1414,1416],{"class":137,"line":1415},24,[135,1417,1418],{},"__builtin___clear_cache((char*)c, (char*)c + 12);\n",[135,1420,1422],{"class":137,"line":1421},25,[135,1423,386],{"emptyLinePlaceholder":385},[135,1425,1427],{"class":137,"line":1426},26,[135,1428,1429],{},"// 把原调用点改成跳到桩\n",[135,1431,1433],{"class":137,"line":1432},27,[135,1434,1435],{},"patch_word_rwx(SN_SITES[0], b_enc(g_base + SN_SITES[0], c));\n",[10,1437,1438],{},"三件事必须同时成立，否则崩：",[1440,1441,1442,1459,1471],"ol",{},[1443,1444,1445,1454,1455,1458],"li",{},[58,1446,1447,1450,1451],{},[132,1448,1449],{},"x19"," 在当前点确实是 ",[132,1452,1453],{},"this","。要回看被替换点的前几条指令确认（本例中 ",[132,1456,1457],{},"mov x19, x0"," 在函数序言，中间没被覆盖）。",[1443,1460,1461,1467,1468,1470],{},[58,1462,1463,1464],{},"跳回点是 ",[132,1465,1466],{},"site + 4","，即原 ",[132,1469,276],{}," 的下一条指令。",[1443,1472,1473,1479,1480,1483,1484,1487],{},[58,1474,1475,1478],{},[132,1476,1477],{},"x0/x30"," 在此处没有活跃值","。两个调用点之后都不再读 ",[132,1481,1482],{},"x0","（结果来自返回值），",[132,1485,1486],{},"x30"," 退出时从栈恢复。",[349,1489,1491],{"id":1490},"_43-顺带撞到的坑","4.3 顺带撞到的坑",[10,1493,1494,1497,1498,1501],{},[58,1495,1496],{},"坑：改完不生效，因为缓存。"," 等级行被缓存在卡对象的 ",[132,1499,1500],{},"+0x48","。桩只影响「重新查表」这条路径，缓存非空时根本不会查表。所以开启功能时还要清缓存：",[125,1503,1505],{"className":366,"code":1504,"language":368,"meta":130,"style":130},"static void cache_clear_snaps() {\n    for (int i = 0; i \u003C g_sn_probe_n && i \u003C CARD_CAP; i++) {\n        void* e = g_sn_probe[i];\n        if (!e || !ok(e, 0x60)) continue;\n        void* zero = nullptr;\n        memcpy((char*)e + 0x48, &zero, sizeof(zero));   // 等级行缓存清零\n    }\n}\n",[132,1506,1507,1512,1517,1522,1527,1532,1537,1541],{"__ignoreMap":130},[135,1508,1509],{"class":137,"line":138},[135,1510,1511],{},"static void cache_clear_snaps() {\n",[135,1513,1514],{"class":137,"line":144},[135,1515,1516],{},"    for (int i = 0; i \u003C g_sn_probe_n && i \u003C CARD_CAP; i++) {\n",[135,1518,1519],{"class":137,"line":150},[135,1520,1521],{},"        void* e = g_sn_probe[i];\n",[135,1523,1524],{"class":137,"line":156},[135,1525,1526],{},"        if (!e || !ok(e, 0x60)) continue;\n",[135,1528,1529],{"class":137,"line":162},[135,1530,1531],{},"        void* zero = nullptr;\n",[135,1533,1534],{"class":137,"line":168},[135,1535,1536],{},"        memcpy((char*)e + 0x48, &zero, sizeof(zero));   // 等级行缓存清零\n",[135,1538,1539],{"class":137,"line":174},[135,1540,441],{},[135,1542,1543],{"class":137,"line":180},[135,1544,451],{},[10,1546,1547,1548,1550,1551,1553,1554],{},"清零之后，下一次读 ",[132,1549,1187],{}," 时缓存为空 → 走 ",[132,1552,1217],{}," → 桩生效 → 拿到上限行。",[58,1555,1556],{},"全程由游戏自己在游戏线程上完成，我们只清了一个指针。",[10,1558,1559,1562],{},[58,1560,1561],{},"坑：桩页面必须离站点够近。"," B 指令的 imm26 只有 ±128MB 范围。早期用固定阈值找空闲页，结果页面刚好超出范围，跳转变成乱飞。改成在站点附近按距离筛选，并把上限放宽到 ±119MB 再加余量。",[10,1564,1565,1568,1569,1572],{},[58,1566,1567],{},"实测","（",[132,1570,1571],{},"snread"," 直读游戏自身 getter）：",[125,1574,1577],{"className":1575,"code":1576,"language":778},[776],"snread[0] rank=3 max=5 lv=50 limit=50 exp=194250\n",[132,1578,1576],{"__ignoreMap":130},[14,1580,1582],{"id":1581},"_5-案例二档位字段值域保护","5. 案例二：档位字段（值域保护）",[349,1584,1586],{"id":1585},"_51-字段布局","5.1 字段布局",[10,1588,1589],{},"运行时对象的字段排布很紧凑，要找的字段前后都是同宽度的整数：",[125,1591,1594],{"className":1592,"code":1593,"language":778},[776],"+0x18  经验\n+0x1c  档位 A        ← 目标\n+0x20  档位 B\n+0x24  数值 C\n+0x28  数值 D\n+0x48  成长行缓存（指针）\n+0x4c  另一个档位\n+0x60  成长行缓存（指针）\n",[132,1595,1593],{"__ignoreMap":130},[10,1597,1598],{},"四个整数都可能是「看起来合理的小整数」，写错一个就是另一个功能的静默损坏。",[349,1600,1602],{"id":1601},"_52-实现","5.2 实现",[10,1604,1605,1606,1609,1610,1613,1614,1609,1617,1620],{},"权威偏移来源是叶子访问器的反汇编：",[132,1607,1608],{},"get_X"," 就是 ",[132,1611,1612],{},"ldr w0,[x19,#0x1c]","，",[132,1615,1616],{},"SetX",[132,1618,1619],{},"str w19,[x20,#0x1c]","。确认后扫写：",[125,1622,1624],{"className":366,"code":1623,"language":368,"meta":130,"style":130},"// 非 Custom 类：先确认这个位置确实是目标字段（用 getter 透传值配对）\nuint32_t mc = g_orig_aw_mc ? g_orig_aw_mc(e, nullptr) : 0xFFFFFFFFu;\nuint32_t a = 0;\nmemcpy(&a, (char*)e + 0x1c, 4);\nif (g_tx_on && mc \u003C= 15 && a == mc && a \u003C tgt) {   // 只升不降\n    memcpy((char*)e + 0x1c, &tgt, 4);\n}\n",[132,1625,1626,1631,1636,1641,1646,1651,1656],{"__ignoreMap":130},[135,1627,1628],{"class":137,"line":138},[135,1629,1630],{},"// 非 Custom 类：先确认这个位置确实是目标字段（用 getter 透传值配对）\n",[135,1632,1633],{"class":137,"line":144},[135,1634,1635],{},"uint32_t mc = g_orig_aw_mc ? g_orig_aw_mc(e, nullptr) : 0xFFFFFFFFu;\n",[135,1637,1638],{"class":137,"line":150},[135,1639,1640],{},"uint32_t a = 0;\n",[135,1642,1643],{"class":137,"line":156},[135,1644,1645],{},"memcpy(&a, (char*)e + 0x1c, 4);\n",[135,1647,1648],{"class":137,"line":162},[135,1649,1650],{},"if (g_tx_on && mc \u003C= 15 && a == mc && a \u003C tgt) {   // 只升不降\n",[135,1652,1653],{"class":137,"line":168},[135,1654,1655],{},"    memcpy((char*)e + 0x1c, &tgt, 4);\n",[135,1657,1658],{"class":137,"line":174},[135,1659,451],{},[10,1661,1662,1665,1666,672,1669,1672,1673,1676,1677,1680],{},[132,1663,1664],{},"a == mc"," 这一句是",[58,1667,1668],{},"必要的类判别",[132,1670,1671],{},"get_AwakeCount"," 的透传返回值必须等于 ",[132,1674,1675],{},"[+0x1c]","，才能确认这个元素是标准类而不是派生类（派生类同名字段在 ",[132,1678,1679],{},"+0x4c","）。",[349,1682,1684],{"id":1683},"_53-坑自证式校验恒真","5.3 坑：自证式校验恒真",[10,1686,1687],{},"我们一度写了这样一个「更严谨」的检查：",[125,1689,1691],{"className":366,"code":1690,"language":368,"meta":130,"style":130},"// 错误示范\nuint32_t skv = 0;\nmemcpy(&skv, (char*)e + 0x24, 4);\nif (g_orig_sk_get) {\n    uint32_t passthru = g_orig_sk_get(e, nullptr);\n    if (passthru != skv) continue;   // ← 恒真，等于没有检查\n}\n",[132,1692,1693,1698,1703,1708,1713,1718,1723],{"__ignoreMap":130},[135,1694,1695],{"class":137,"line":138},[135,1696,1697],{},"// 错误示范\n",[135,1699,1700],{"class":137,"line":144},[135,1701,1702],{},"uint32_t skv = 0;\n",[135,1704,1705],{"class":137,"line":150},[135,1706,1707],{},"memcpy(&skv, (char*)e + 0x24, 4);\n",[135,1709,1710],{"class":137,"line":156},[135,1711,1712],{},"if (g_orig_sk_get) {\n",[135,1714,1715],{"class":137,"line":162},[135,1716,1717],{},"    uint32_t passthru = g_orig_sk_get(e, nullptr);\n",[135,1719,1720],{"class":137,"line":168},[135,1721,1722],{},"    if (passthru != skv) continue;   // ← 恒真，等于没有检查\n",[135,1724,1725],{"class":137,"line":174},[135,1726,451],{},[10,1728,1729,1732,1733,1736,1737,1740],{},[132,1730,1731],{},"g_orig_sk_get"," 的实现体就是 ",[132,1734,1735],{},"ldr w0,[x19,#0x24]","，读的是同一块内存，两者",[58,1738,1739],{},"必然相等","。这个检查骗了我们几轮日志。改用值域合理性：",[125,1742,1744],{"className":366,"code":1743,"language":368,"meta":130,"style":130},"static const int SKR[2] = { 0x24, 0x28 };   // 演出技能 / 激奏技能\nfor (int j = 0; j \u003C 2; j++) {\n    uint32_t skv = 0;\n    memcpy(&skv, (char*)e + SKR[j], 4);\n    if (skv \u003C= 15 && skv \u003C g_sk_level) {    // 值域 + 单调\n        memcpy((char*)e + SKR[j], &g_sk_level, 4);\n    }\n}\n",[132,1745,1746,1751,1756,1761,1766,1771,1776,1780],{"__ignoreMap":130},[135,1747,1748],{"class":137,"line":138},[135,1749,1750],{},"static const int SKR[2] = { 0x24, 0x28 };   // 演出技能 / 激奏技能\n",[135,1752,1753],{"class":137,"line":144},[135,1754,1755],{},"for (int j = 0; j \u003C 2; j++) {\n",[135,1757,1758],{"class":137,"line":150},[135,1759,1760],{},"    uint32_t skv = 0;\n",[135,1762,1763],{"class":137,"line":156},[135,1764,1765],{},"    memcpy(&skv, (char*)e + SKR[j], 4);\n",[135,1767,1768],{"class":137,"line":162},[135,1769,1770],{},"    if (skv \u003C= 15 && skv \u003C g_sk_level) {    // 值域 + 单调\n",[135,1772,1773],{"class":137,"line":168},[135,1774,1775],{},"        memcpy((char*)e + SKR[j], &g_sk_level, 4);\n",[135,1777,1778],{"class":137,"line":174},[135,1779,441],{},[135,1781,1782],{"class":137,"line":180},[135,1783,451],{},[10,1785,1786],{},[58,1787,1788],{},"判据：任何「用同一来源验证同一来源」的检查都要重新审视。",[349,1790,1792],{"id":1791},"_54-坑改错层导致美术资源异常","5.4 坑：改错层导致美术资源异常",[10,1794,1795,1796,1799],{},"我们曾把一个字段当成运行时属性写入，结果卡面立绘白屏。事后确认那是",[58,1797,1798],{},"主数据表行","里的字段，而它同时是资源键的一部分。修复只能靠重启让主数据重新加载。",[10,1801,1802,1805],{},[58,1803,1804],{},"判据：写入前必须确认这一层就是界面读取的那一层。"," 判别方法：在运行时读出该对象的指针，确认它出现在界面刷新路径的参数里，而不是只在初始化时出现。",[349,1807,1809],{"id":1808},"_55-实测","5.5 实测",[125,1811,1814],{"className":1812,"code":1813,"language":778},[776],"扫写 27/31 张 (klass=0x0 base=0 tgt=2) 其中技能 sk=31 张 -> 3\n",[132,1815,1813],{"__ignoreMap":130},[14,1817,1819],{"id":1818},"_6-案例三留影等级-上限走游戏自己的-setter","6. 案例三：留影等级 + 上限（走游戏自己的 setter）",[10,1821,1822,1823,1826],{},"这个案例和案例一的区别：上限由",[58,1824,1825],{},"另一个字段","决定，而等级由经验查表决定，两者是独立的两条链。",[349,1828,1830],{"id":1829},"_61-链路与实现","6.1 链路与实现",[19,1832,1833,1843],{},[22,1834,1835],{},[25,1836,1837,1839,1841],{},[28,1838,1173],{},[28,1840,575],{},[28,1842,1178],{},[41,1844,1845,1860,1873,1891,1906],{},[25,1846,1847,1852,1855],{},[46,1848,1849],{},[132,1850,1851],{},"get_Rank",[46,1853,1854],{},"0x605acb8",[46,1856,1857],{},[132,1858,1859],{},"[卡+0x1c]",[25,1861,1862,1867,1870],{},[46,1863,1864],{},[132,1865,1866],{},"get_MaxRank",[46,1868,1869],{},"0x605ad54",[46,1871,1872],{},"查表",[25,1874,1875,1880,1883],{},[46,1876,1877],{},[132,1878,1879],{},"SetRank",[46,1881,1882],{},"0x605c6c0",[46,1884,1885,1887,1888],{},[132,1886,1619],{},"，并触发 ",[132,1889,1890],{},"OnChange",[25,1892,1893,1898,1901],{},[46,1894,1895],{},[132,1896,1897],{},"get_Exp",[46,1899,1900],{},"0x605a8f8",[46,1902,1903],{},[132,1904,1905],{},"[卡+0x18]",[25,1907,1908,1912,1914],{},[46,1909,1910],{},[132,1911,1217],{},[46,1913,1226],{},[46,1915,1916],{},"重算成长行",[10,1918,1919,1920,1925,1926,1928],{},"攻略是",[58,1921,1922,1923],{},"走游戏自己的 ",[132,1924,1879],{},"（而不是直接写字段），这样 ",[132,1927,1890],{}," 会被触发，UI 监听者能收到通知：",[125,1930,1932],{"className":366,"code":1931,"language":368,"meta":130,"style":130},"uint32_t rk = g_orig_sc_rank(e, nullptr);\nuint32_t mx = g_orig_sc_maxrank(e, nullptr);\nuint32_t want = g_sn_rank;\nif (mx && mx \u003C want) want = mx;      // 绝不越过表里的最大档\nif (rk >= want) continue;            // 只升不降\ng_orig_sc_setrank(e, want, nullptr); // 走游戏自己的 setter（含 OnChange）\n\n// 关键一步：清成长行缓存并重算\nvoid* zero = nullptr;\nmemcpy((char*)e + 0x48, &zero, sizeof(zero));\ng_orig_sc_updlevel(e, nullptr);\n\n// 把经验钳到该行的 exp，否则进度条显示 0\nvoid* row = nullptr;\nmemcpy(&row, (char*)e + 0x48, sizeof(row));\nif (row && ok(row, 0x2c)) {\n    uint32_t row_exp = 0, cur_exp = 0;\n    memcpy(&row_exp, (char*)row + 0x28, 4);\n    memcpy(&cur_exp, (char*)e + 0x18, 4);\n    if (row_exp > cur_exp) memcpy((char*)e + 0x18, &row_exp, 4);\n}\n",[132,1933,1934,1939,1944,1949,1954,1959,1964,1968,1973,1978,1983,1988,1992,1997,2002,2007,2012,2017,2022,2027,2032],{"__ignoreMap":130},[135,1935,1936],{"class":137,"line":138},[135,1937,1938],{},"uint32_t rk = g_orig_sc_rank(e, nullptr);\n",[135,1940,1941],{"class":137,"line":144},[135,1942,1943],{},"uint32_t mx = g_orig_sc_maxrank(e, nullptr);\n",[135,1945,1946],{"class":137,"line":150},[135,1947,1948],{},"uint32_t want = g_sn_rank;\n",[135,1950,1951],{"class":137,"line":156},[135,1952,1953],{},"if (mx && mx \u003C want) want = mx;      // 绝不越过表里的最大档\n",[135,1955,1956],{"class":137,"line":162},[135,1957,1958],{},"if (rk >= want) continue;            // 只升不降\n",[135,1960,1961],{"class":137,"line":168},[135,1962,1963],{},"g_orig_sc_setrank(e, want, nullptr); // 走游戏自己的 setter（含 OnChange）\n",[135,1965,1966],{"class":137,"line":174},[135,1967,386],{"emptyLinePlaceholder":385},[135,1969,1970],{"class":137,"line":180},[135,1971,1972],{},"// 关键一步：清成长行缓存并重算\n",[135,1974,1975],{"class":137,"line":186},[135,1976,1977],{},"void* zero = nullptr;\n",[135,1979,1980],{"class":137,"line":192},[135,1981,1982],{},"memcpy((char*)e + 0x48, &zero, sizeof(zero));\n",[135,1984,1985],{"class":137,"line":198},[135,1986,1987],{},"g_orig_sc_updlevel(e, nullptr);\n",[135,1989,1990],{"class":137,"line":204},[135,1991,386],{"emptyLinePlaceholder":385},[135,1993,1994],{"class":137,"line":210},[135,1995,1996],{},"// 把经验钳到该行的 exp，否则进度条显示 0\n",[135,1998,1999],{"class":137,"line":216},[135,2000,2001],{},"void* row = nullptr;\n",[135,2003,2004],{"class":137,"line":222},[135,2005,2006],{},"memcpy(&row, (char*)e + 0x48, sizeof(row));\n",[135,2008,2009],{"class":137,"line":228},[135,2010,2011],{},"if (row && ok(row, 0x2c)) {\n",[135,2013,2014],{"class":137,"line":234},[135,2015,2016],{},"    uint32_t row_exp = 0, cur_exp = 0;\n",[135,2018,2019],{"class":137,"line":240},[135,2020,2021],{},"    memcpy(&row_exp, (char*)row + 0x28, 4);\n",[135,2023,2024],{"class":137,"line":246},[135,2025,2026],{},"    memcpy(&cur_exp, (char*)e + 0x18, 4);\n",[135,2028,2029],{"class":137,"line":1016},[135,2030,2031],{},"    if (row_exp > cur_exp) memcpy((char*)e + 0x18, &row_exp, 4);\n",[135,2033,2034],{"class":137,"line":1022},[135,2035,451],{},[349,2037,2039],{"id":2038},"_62-坑只改档不清缓存","6.2 坑：只改档不清缓存",[10,2041,2042,2043,2045],{},"第一次实现只做了 ",[132,2044,1879],{},"，日志显示：",[125,2047,2050],{"className":2048,"code":2049,"language":778},[776],"snread[0] rank=3 max=5 lv=30 limit=50    ← 上限到 50 了，等级还停在 30\n",[132,2051,2049],{"__ignoreMap":130},[10,2053,2054,2055,2057,2058,2060],{},"原因就是成长行缓存在 ",[132,2056,1500],{},"，非空时 ",[132,2059,1208],{}," 直接返回旧行。清掉之后：",[125,2062,2064],{"className":2063,"code":1576,"language":778},[776],[132,2065,1576],{"__ignoreMap":130},[14,2067,2069],{"id":2068},"_7-案例四技能等级协议层双写","7. 案例四：技能等级（协议层双写）",[349,2071,2073],{"id":2072},"_71-字段表","7.1 字段表",[10,2075,2076,2077,672],{},"同一概念在三个类里有三套偏移，且演出技能与激奏技能是",[58,2078,2079],{},"两个独立字段",[19,2081,2082,2095],{},[22,2083,2084],{},[25,2085,2086,2089,2092],{},[28,2087,2088],{},"类",[28,2090,2091],{},"演出技能",[28,2093,2094],{},"激奏技能",[41,2096,2097,2110,2125],{},[25,2098,2099,2102,2106],{},[46,2100,2101],{},"运行时标准卡",[46,2103,2104],{},[132,2105,1200],{},[46,2107,2108],{},[132,2109,1263],{},[25,2111,2112,2115,2120],{},[46,2113,2114],{},"运行时派生卡",[46,2116,2117],{},[132,2118,2119],{},"+0x54",[46,2121,2122],{},[132,2123,2124],{},"+0x58",[25,2126,2127,2130,2135],{},[46,2128,2129],{},"协议 DTO",[46,2131,2132],{},[132,2133,2134],{},"+0x38",[46,2136,2137],{},[132,2138,1679],{},[10,2140,2141,2142,1276],{},"对照组（很重要）：",[58,2143,2144],{},"队长技能没有存储字段",[125,2146,2148],{"className":127,"code":2147,"language":129,"meta":130,"style":130},"; MemberCard.get_LeaderSkillLevel @0x5fac720\nbl   get_CurrentMemberCardRank     ; 拿当前突破档位行\nldr  w0, [x0, #0x38]               ; 等级直接从这一行读出来\n",[132,2149,2150,2155,2160],{"__ignoreMap":130},[135,2151,2152],{"class":137,"line":138},[135,2153,2154],{},"; MemberCard.get_LeaderSkillLevel @0x5fac720\n",[135,2156,2157],{"class":137,"line":144},[135,2158,2159],{},"bl   get_CurrentMemberCardRank     ; 拿当前突破档位行\n",[135,2161,2162],{"class":137,"line":150},[135,2163,2164],{},"ldr  w0, [x0, #0x38]               ; 等级直接从这一行读出来\n",[10,2166,2167],{},"也就是说「突破档位抬升 → 队长技能自动跟着变」，不需要单独写。这一点纠正了我们早期的一个错误假设（曾以为某个档位字段是技能入口）。",[349,2169,2171],{"id":2170},"_72-双写实现","7.2 双写实现",[10,2173,2174,2177],{},[58,2175,2176],{},"运行时层","（扫写已有对象，按 klass 分流）：",[125,2179,2181],{"className":366,"code":2180,"language":368,"meta":130,"style":130},"if (g_custom_klass && k == g_custom_klass) {\n    static const int SKC[2] = { 0x54, 0x58 };       // 派生卡\n    for (int j = 0; j \u003C 2; j++) {\n        uint32_t skv = 0;\n        memcpy(&skv, (char*)e + SKC[j], 4);\n        if (skv \u003C= 15 && skv \u003C g_sk_level) memcpy((char*)e + SKC[j], &g_sk_level, 4);\n    }\n    continue;\n}\n// 标准卡\nstatic const int SKR[2] = { 0x24, 0x28 };\nfor (int j = 0; j \u003C 2; j++) { /* 同上 */ }\n",[132,2182,2183,2188,2193,2198,2203,2208,2213,2217,2222,2226,2231,2236],{"__ignoreMap":130},[135,2184,2185],{"class":137,"line":138},[135,2186,2187],{},"if (g_custom_klass && k == g_custom_klass) {\n",[135,2189,2190],{"class":137,"line":144},[135,2191,2192],{},"    static const int SKC[2] = { 0x54, 0x58 };       // 派生卡\n",[135,2194,2195],{"class":137,"line":150},[135,2196,2197],{},"    for (int j = 0; j \u003C 2; j++) {\n",[135,2199,2200],{"class":137,"line":156},[135,2201,2202],{},"        uint32_t skv = 0;\n",[135,2204,2205],{"class":137,"line":162},[135,2206,2207],{},"        memcpy(&skv, (char*)e + SKC[j], 4);\n",[135,2209,2210],{"class":137,"line":168},[135,2211,2212],{},"        if (skv \u003C= 15 && skv \u003C g_sk_level) memcpy((char*)e + SKC[j], &g_sk_level, 4);\n",[135,2214,2215],{"class":137,"line":174},[135,2216,441],{},[135,2218,2219],{"class":137,"line":180},[135,2220,2221],{},"    continue;\n",[135,2223,2224],{"class":137,"line":186},[135,2225,451],{},[135,2227,2228],{"class":137,"line":192},[135,2229,2230],{},"// 标准卡\n",[135,2232,2233],{"class":137,"line":198},[135,2234,2235],{},"static const int SKR[2] = { 0x24, 0x28 };\n",[135,2237,2238],{"class":137,"line":204},[135,2239,2240],{},"for (int j = 0; j \u003C 2; j++) { /* 同上 */ }\n",[10,2242,2243,2246],{},[58,2244,2245],{},"协议层","（在反序列化出口写，保证服务器重新下发时也是目标值）：",[125,2248,2250],{"className":366,"code":2249,"language":368,"meta":130,"style":130},"static void mf_post(void* self, int which) {\n    if (!g_sk_on || g_sk_level == 0) return;\n    int off0 = (which \u003C 2) ? 0x38 : 0x2c;   // 主 DTO / 卡组 DTO\n    int off1 = (which \u003C 2) ? 0x4c : 0x30;\n    int offs[2] = { off0, off1 };\n    for (int j = 0; j \u003C 2; j++) {\n        if (!ok((char*)self + offs[j], 4)) continue;\n        uint32_t cur = 0;\n        memcpy(&cur, (char*)self + offs[j], 4);\n        if (cur \u003C= 15 && cur \u003C g_sk_level) memcpy((char*)self + offs[j], &g_sk_level, 4);\n    }\n}\n",[132,2251,2252,2257,2262,2267,2272,2277,2281,2286,2291,2296,2301,2305],{"__ignoreMap":130},[135,2253,2254],{"class":137,"line":138},[135,2255,2256],{},"static void mf_post(void* self, int which) {\n",[135,2258,2259],{"class":137,"line":144},[135,2260,2261],{},"    if (!g_sk_on || g_sk_level == 0) return;\n",[135,2263,2264],{"class":137,"line":150},[135,2265,2266],{},"    int off0 = (which \u003C 2) ? 0x38 : 0x2c;   // 主 DTO / 卡组 DTO\n",[135,2268,2269],{"class":137,"line":156},[135,2270,2271],{},"    int off1 = (which \u003C 2) ? 0x4c : 0x30;\n",[135,2273,2274],{"class":137,"line":162},[135,2275,2276],{},"    int offs[2] = { off0, off1 };\n",[135,2278,2279],{"class":137,"line":168},[135,2280,2197],{},[135,2282,2283],{"class":137,"line":174},[135,2284,2285],{},"        if (!ok((char*)self + offs[j], 4)) continue;\n",[135,2287,2288],{"class":137,"line":180},[135,2289,2290],{},"        uint32_t cur = 0;\n",[135,2292,2293],{"class":137,"line":186},[135,2294,2295],{},"        memcpy(&cur, (char*)self + offs[j], 4);\n",[135,2297,2298],{"class":137,"line":192},[135,2299,2300],{},"        if (cur \u003C= 15 && cur \u003C g_sk_level) memcpy((char*)self + offs[j], &g_sk_level, 4);\n",[135,2302,2303],{"class":137,"line":198},[135,2304,441],{},[135,2306,2307],{"class":137,"line":204},[135,2308,451],{},[10,2310,2311,2312,2315,2316,2318,2319,2322],{},"挂载在反序列化出口（",[132,2313,2314],{},"InternalMergeFrom","），",[58,2317,621],{},"挂在 ",[132,2320,2321],{},"set_X"," 上：实测 setter 整场零命中，protobuf 解码是直接写字段的。",[349,2324,2326],{"id":2325},"_73-坑methodinfo-传空指针","7.3 坑：MethodInfo 传空指针",[10,2328,2329],{},"第一版在命令线程里直接调游戏方法做重算：",[125,2331,2333],{"className":366,"code":2332,"language":368,"meta":130,"style":130},"// 崩溃写法\ng_orig_sc_updlevel(e, nullptr);   // ← 第二个参数是 MethodInfo*\n",[132,2334,2335,2340],{"__ignoreMap":130},[135,2336,2337],{"class":137,"line":138},[135,2338,2339],{},"// 崩溃写法\n",[135,2341,2342],{"class":137,"line":144},[135,2343,2344],{},"g_orig_sc_updlevel(e, nullptr);   // ← 第二个参数是 MethodInfo*\n",[10,2346,2347],{},"结果点一下开关立刻崩溃：",[125,2349,2352],{"className":2350,"code":2351,"language":778},[776],"signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x0\nx0 0  x19 0  x20 0x30\n#00 pc 0x542a188  libil2cpp.so    ldr x8,[x0,w19,uxtw #3]\n",[132,2353,2351],{"__ignoreMap":130},[10,2355,2356,2357,2360],{},"游戏内部会 ",[132,2358,2359],{},"ldr x8,[x0,#0xb8]"," 解引用这个指针。修法是 3.3 的捕获机制：抓到之前拒绝执行。",[349,2362,2364],{"id":2363},"_74-坑诊断函数自己崩","7.4 坑：诊断函数自己崩",[10,2366,2367,2368,2371],{},"写诊断命令时想直接调 ",[132,2369,2370],{},"get_LeaderSkillLevel"," 读值，结果崩在自己的函数里（崩溃点在该诊断函数 +240 字节处）。原因是该函数内部：",[125,2373,2375],{"className":127,"code":2374,"language":129,"meta":130,"style":130},"bl   get_CurrentMemberCardRank\nldr  w0, [x0, #0x38]     ; ← 对返回值没有空检查\n",[132,2376,2377,2382],{"__ignoreMap":130},[135,2378,2379],{"class":137,"line":138},[135,2380,2381],{},"bl   get_CurrentMemberCardRank\n",[135,2383,2384],{"class":137,"line":144},[135,2385,2386],{},"ldr  w0, [x0, #0x38]     ; ← 对返回值没有空检查\n",[10,2388,2389,2390,2404],{},"档位行表未就绪时返回空，直接解引用。",[58,2391,2392,2393,2395,2396,2399,2400,2403],{},"判据：反汇编时看到 ",[132,2394,276],{}," 之后紧跟 ",[132,2397,2398],{},"ldr xN,[x0,...]"," 而没有 ",[132,2401,2402],{},"cbz","，说明该函数依赖调用方保证前置条件，不能随意直调。"," 修法是诊断函数只读原始内存，不调这类函数。",[349,2406,2408],{"id":2407},"_75-坑dto-里没有对应字段","7.5 坑：DTO 里没有对应字段",[10,2410,2411,2412,2415,2416,2419,2420,1613,2423,2426,2427,2429],{},"卡组 DTO 只有演出技能 ",[132,2413,2414],{},"+0x2c"," 和一个 ",[132,2417,2418],{},"PerformanceSkill"," ",[132,2421,2422],{},"+0x30",[58,2424,2425],{},"没有激奏字段","。我无法确认 ",[132,2428,2422],{}," 的语义，所以没写它。少写一处不会出错，写错一处会静默损坏。",[349,2431,2433],{"id":2432},"_76-实测","7.6 实测",[125,2435,2438],{"className":2436,"code":2437,"language":778},[776],"sk: proto[1] LiveSkill   1 -> 3\nsk: proto[1] GekisouSkill 1 -> 3\nskread[0] 演出=3(getter 3) 激奏=3\n",[132,2439,2437],{"__ignoreMap":130},[14,2441,2443],{"id":2442},"_8-运行时控制台","8. 运行时控制台",[349,2445,2447],{"id":2446},"_81-架构","8.1 架构",[10,2449,2450,2451,2454],{},"不 hook 游戏渲染。自己开一个 EGL 上下文画在独立 SurfaceView 上，命中判定在 native 完成，菜单外的触摸返回 ",[132,2452,2453],{},"false"," 还给游戏。",[10,2456,2457],{},"命令通道双路，都不需要 ptrace：",[125,2459,2461],{"className":366,"code":2460,"language":368,"meta":130,"style":130},"static void command_loop(uintptr_t base) {\n    for (;;) {\n        char prop[92] = {0};\n        __system_property_get(\"debug.\u003Cpkg>.cmd\", prop);     // 通道 1：系统属性\n        FILE* f = fopen(CMD_FILE, \"r\");                       // 通道 2：命令文件\n        if (f) {\n            char cmd[300] = {0};\n            if (fgets(cmd, sizeof(cmd), f)) {\n                size_t n = strlen(cmd);\n                while (n && (cmd[n-1]=='\\n' || cmd[n-1]=='\\r' || cmd[n-1]==' ')) cmd[--n] = 0;\n                fclose(f);\n                unlink(CMD_FILE);      // 先删再执行，避免重复触发\n                /* ... 分发 ... */\n            } else fclose(f);\n        }\n        usleep(400 * 1000);\n    }\n}\n",[132,2462,2463,2468,2473,2478,2483,2488,2493,2498,2503,2508,2513,2518,2523,2528,2533,2538,2543,2547],{"__ignoreMap":130},[135,2464,2465],{"class":137,"line":138},[135,2466,2467],{},"static void command_loop(uintptr_t base) {\n",[135,2469,2470],{"class":137,"line":144},[135,2471,2472],{},"    for (;;) {\n",[135,2474,2475],{"class":137,"line":150},[135,2476,2477],{},"        char prop[92] = {0};\n",[135,2479,2480],{"class":137,"line":156},[135,2481,2482],{},"        __system_property_get(\"debug.\u003Cpkg>.cmd\", prop);     // 通道 1：系统属性\n",[135,2484,2485],{"class":137,"line":162},[135,2486,2487],{},"        FILE* f = fopen(CMD_FILE, \"r\");                       // 通道 2：命令文件\n",[135,2489,2490],{"class":137,"line":168},[135,2491,2492],{},"        if (f) {\n",[135,2494,2495],{"class":137,"line":174},[135,2496,2497],{},"            char cmd[300] = {0};\n",[135,2499,2500],{"class":137,"line":180},[135,2501,2502],{},"            if (fgets(cmd, sizeof(cmd), f)) {\n",[135,2504,2505],{"class":137,"line":186},[135,2506,2507],{},"                size_t n = strlen(cmd);\n",[135,2509,2510],{"class":137,"line":192},[135,2511,2512],{},"                while (n && (cmd[n-1]=='\\n' || cmd[n-1]=='\\r' || cmd[n-1]==' ')) cmd[--n] = 0;\n",[135,2514,2515],{"class":137,"line":198},[135,2516,2517],{},"                fclose(f);\n",[135,2519,2520],{"class":137,"line":204},[135,2521,2522],{},"                unlink(CMD_FILE);      // 先删再执行，避免重复触发\n",[135,2524,2525],{"class":137,"line":210},[135,2526,2527],{},"                /* ... 分发 ... */\n",[135,2529,2530],{"class":137,"line":216},[135,2531,2532],{},"            } else fclose(f);\n",[135,2534,2535],{"class":137,"line":222},[135,2536,2537],{},"        }\n",[135,2539,2540],{"class":137,"line":228},[135,2541,2542],{},"        usleep(400 * 1000);\n",[135,2544,2545],{"class":137,"line":234},[135,2546,441],{},[135,2548,2549],{"class":137,"line":240},[135,2550,451],{},[10,2552,2553],{},"开关状态用 conf 文件持久化配置 + 自动武装轮询：进程启动时读 conf，之后每个 tick 检查是否该生效，页未解密时自动重试。",[349,2555,2557],{"id":2556},"_82-坑跨图形上下文的资源失效","8.2 坑：跨图形上下文的资源失效",[10,2559,2560,2563],{},[58,2561,2562],{},"现象","：应用切后台再回前台，悬浮球图标变成纯黑方块。",[10,2565,2566,2569],{},[58,2567,2568],{},"定位","：日志显示生命周期是「销毁 → 重建」：",[125,2571,2574],{"className":2572,"code":2573,"language":778},[776],"12:46:26  overlay render loop exited      ← 切后台，EGL 销毁\n12:46:26  overlay stopped\n12:46:34  overlay surface 2550x1024       ← 回前台，新建上下文\n",[132,2575,2573],{"__ignoreMap":130},[10,2577,2578,2579,2582,2583,2586,2587,2590],{},"但「纹理已上传」标志是静态的，仍是 ",[132,2580,2581],{},"true","，于是新上下文里从没上传过纹理，",[132,2584,2585],{},"AddImage"," 拿旧上下文的纹理 ID 采样。采样失败返回",[58,2588,2589],{},"不透明黑","，而图标是方形贴图，就呈现为黑方块。",[10,2592,2593,2596],{},[58,2594,2595],{},"修法","：把资源生命周期和上下文绑定。",[125,2598,2600],{"className":366,"code":2599,"language":368,"meta":130,"style":130},"static void render_loop() {\n    if (eglMakeCurrent(g_disp, g_surf, g_surf, g_ctx) == EGL_FALSE) return;\n    /* 每次进入渲染循环 = 一个新的 GL 上下文。\n     * 旧上下文的纹理/缓冲全部作废，必须重置\"已上传\"标志重新上传。 */\n    g_icon_tried = false;\n    g_icon_tex = 0;\n    ImGui::CreateContext();\n    /* ... */\n}\n",[132,2601,2602,2607,2612,2617,2622,2627,2632,2637,2642],{"__ignoreMap":130},[135,2603,2604],{"class":137,"line":138},[135,2605,2606],{},"static void render_loop() {\n",[135,2608,2609],{"class":137,"line":144},[135,2610,2611],{},"    if (eglMakeCurrent(g_disp, g_surf, g_surf, g_ctx) == EGL_FALSE) return;\n",[135,2613,2614],{"class":137,"line":150},[135,2615,2616],{},"    /* 每次进入渲染循环 = 一个新的 GL 上下文。\n",[135,2618,2619],{"class":137,"line":156},[135,2620,2621],{},"     * 旧上下文的纹理/缓冲全部作废，必须重置\"已上传\"标志重新上传。 */\n",[135,2623,2624],{"class":137,"line":162},[135,2625,2626],{},"    g_icon_tried = false;\n",[135,2628,2629],{"class":137,"line":168},[135,2630,2631],{},"    g_icon_tex = 0;\n",[135,2633,2634],{"class":137,"line":174},[135,2635,2636],{},"    ImGui::CreateContext();\n",[135,2638,2639],{"class":137,"line":180},[135,2640,2641],{},"    /* ... */\n",[135,2643,2644],{"class":137,"line":186},[135,2645,451],{},[10,2647,2648],{},[58,2649,2650],{},"判据：凡跟随 GL 上下文的资源（纹理、VBO、shader、ImGui 字体图集），其\"已创建\"标志都必须在渲染循环入口重置。",[349,2652,2654],{"id":2653},"_83-坑非游戏线程调用托管方法","8.3 坑：非游戏线程调用托管方法",[10,2656,2657,2658,2661,2662,2664,2665,2667],{},"在自己的命令线程里直接调游戏方法会崩（7.3）。最终改为",[58,2659,2660],{},"纯内存操作 + 交回游戏线程","：命令线程只置标志或写内存，需要引擎参与的部分（如 ",[132,2663,1217],{},"、",[132,2666,1890],{},"）挂在游戏自身的高频调用路径上执行。",[125,2669,2671],{"className":366,"code":2670,"language":368,"meta":130,"style":130},"// 角色卡：借 get_AwakeCount 这个高频入口\nstatic uint32_t hook_aw_mc(void* self, void* method) {\n    uint32_t v = g_orig_aw_mc(self, method);\n    if (g_want_cp_recalc) { g_want_cp_recalc = false; card_recalc_now(); }\n    /* ... */\n    return v;\n}\n",[132,2672,2673,2678,2683,2688,2693,2697,2702],{"__ignoreMap":130},[135,2674,2675],{"class":137,"line":138},[135,2676,2677],{},"// 角色卡：借 get_AwakeCount 这个高频入口\n",[135,2679,2680],{"class":137,"line":144},[135,2681,2682],{},"static uint32_t hook_aw_mc(void* self, void* method) {\n",[135,2684,2685],{"class":137,"line":150},[135,2686,2687],{},"    uint32_t v = g_orig_aw_mc(self, method);\n",[135,2689,2690],{"class":137,"line":156},[135,2691,2692],{},"    if (g_want_cp_recalc) { g_want_cp_recalc = false; card_recalc_now(); }\n",[135,2694,2695],{"class":137,"line":162},[135,2696,2641],{},[135,2698,2699],{"class":137,"line":168},[135,2700,2701],{},"    return v;\n",[135,2703,2704],{"class":137,"line":174},[135,2705,451],{},[14,2707,2709],{"id":2708},"_9-数据源原则与它带来的差异","9. 数据源原则与它带来的差异",[10,2711,2712],{},"回到开头那张表。为什么只有案例一能热更新？",[19,2714,2715,2730],{},[22,2716,2717],{},[25,2718,2719,2721,2724,2727],{},[28,2720,36],{},[28,2722,2723],{},"游戏持有的状态",[28,2725,2726],{},"重启后",[28,2728,2729],{},"UI 即时",[41,2731,2732,2747,2760],{},[25,2733,2734,2737,2740,2743],{},[46,2735,2736],{},"替换查表路径",[46,2738,2739],{},"无（每次重算）",[46,2741,2742],{},"保持（代码补丁）",[46,2744,2745],{},[58,2746,60],{},[25,2748,2749,2752,2755,2758],{},[46,2750,2751],{},"写运行时字段",[46,2753,2754],{},"旧缓存",[46,2756,2757],{},"失效（服务器重下发）",[46,2759,74],{},[25,2761,2762,2765,2768,2774],{},[46,2763,2764],{},"写协议 DTO",[46,2766,2767],{},"无",[46,2769,2770,2773],{},[58,2771,2772],{},"保持","（每次解码都改）",[46,2775,74],{},[10,2777,2778],{},"由此得到两条工程结论：",[1440,2780,2781,2787],{},[1443,2782,2783,2786],{},[58,2784,2785],{},"要即时生效，就必须改查表路径","，不能只改数据。凡是能在链路上找到「输入 → 查表 → 结果」结构的，都应该优先用案例一的手法。",[1443,2788,2789,2792],{},[58,2790,2791],{},"要跨重启保持，就必须写协议层","（案例四），因为服务器每次下发的数据都会在反序列化出口被改写。",[10,2794,2795],{},"而字段级写入（案例二）两头不占：既不即时、也不持久。它只适合本来就由服务端权威、且不需要 UI 立刻刷新的场景。",[14,2797,2799],{"id":2798},"_10-防御视角","10. 防御视角",[10,2801,2802,2805],{},[58,2803,2804],{},"服务端权威是唯一真边界。"," 上述所有改造都只影响本地显示与本地计算。任何服务端会重算的数值，客户端改完只是「看起来变了」。这直接解释了「为什么有些改造重启后失效、有些能持久」：取决于该字段是否会被服务端重新下发覆盖。",[10,2807,2808,2811],{},[58,2809,2810],{},"热更新框架会扩大攻击面。"," 它为了动态替换逻辑，在每个方法入口保留了统一的闸门与解释器通道。理解这一个机制，就能解释「为什么大段补丁是死代码」；反过来，防守方也应该意识到这等于给每个方法加了一个可被外部调整的判定点。",[10,2813,2814,2817],{},[58,2815,2816],{},"代码加密的成本远低于想象。"," 单字节 XOR 只让我们多花了半天写判据，解密之后分析路径与明文完全一致。真正的成本来自「分析工作量」。",[10,2819,2820,2823],{},[58,2821,2822],{},"完整性校验比加密有效。"," 我们的迭代是重打包→重签名→重安装，单轮一分钟以内。如果目标校验代码段哈希，单轮成本会显著上升。",[10,2825,2826,2829],{},[58,2827,2828],{},"日志是最被低估的泄露面。"," 本次分析中自己的注入库日志极大加速了定位。同理，应用若在生产环境输出详细方法名、字段名与调用信息，对分析者是极大助力。",[14,2831,2833],{"id":2832},"_11-可复用判据清单","11. 可复用判据清单",[10,2835,2836],{},"定位阶段：",[1440,2838,2839,2845,2850,2861,2864],{},[1443,2840,2841,2842,2844],{},"先看方法入口有没有 ",[132,2843,301],{}," 闸门 → 有则原生体可能是死代码",[1443,2846,2847,2848,277],{},"界面数字的读取者可能不是 getter，而是字段直读（热修解释器用 ",[132,2849,318],{},[1443,2851,2852,2853,2856,2857,2860],{},"叶子访问器的 ",[132,2854,2855],{},"ldr","/",[132,2858,2859],{},"str"," 偏移是权威答案，不要靠猜",[1443,2862,2863],{},"区分三层副本：主数据表 / 运行时实体 / 协议 DTO",[1443,2865,2866,2395,2868,2870,2871,2873],{},[132,2867,276],{},[132,2869,2398],{}," 且无 ",[132,2872,2402],{}," → 该函数不能随意直调",[10,2875,2876],{},"写入阶段：",[1440,2878,2879,2882,2885,2888,2891],{"start":168},[1443,2880,2881],{},"优先替换查表调用，而不是改数据（唯一能即时生效的手法）",[1443,2883,2884],{},"改完字段必须清缓存，否则界面读的是旧值",[1443,2886,2887],{},"只升不降，避免把玩家已获得的进度改小",[1443,2889,2890],{},"用值域合理性做保护；不要用同源自证式检查（恒真）",[1443,2892,2893,2894,2896],{},"手动调托管方法必须带真实 ",[132,2895,1040],{},"，且只能在游戏线程调用",[10,2898,2899],{},"图形阶段：",[1440,2901,2902],{"start":198},[1443,2903,2904],{},"跟随 GL 上下文的资源，其「已创建」标志必须在渲染循环入口重置",[2906,2907],"hr",{},[10,2909,2910],{},"未完成项：部分功能的界面重读时机（案例二、四的即时刷新）、开关状态持久化、客户端与服务端同步行为的系统性梳理。",[2912,2913,2914],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":130,"searchDepth":144,"depth":144,"links":2916},[2917,2918,2919,2926,2931,2936,2943,2947,2955,2960,2961,2962],{"id":16,"depth":144,"text":17},{"id":119,"depth":144,"text":120},{"id":335,"depth":144,"text":336,"children":2920},[2921,2922,2923,2924,2925],{"id":351,"depth":150,"text":352},{"id":514,"depth":150,"text":515},{"id":559,"depth":150,"text":560},{"id":664,"depth":150,"text":665},{"id":833,"depth":150,"text":834},{"id":844,"depth":144,"text":845,"children":2927},[2928,2929,2930],{"id":848,"depth":150,"text":849},{"id":911,"depth":150,"text":912},{"id":1033,"depth":150,"text":1034},{"id":1159,"depth":144,"text":1160,"children":2932},[2933,2934,2935],{"id":1163,"depth":150,"text":1164},{"id":1279,"depth":150,"text":1280},{"id":1490,"depth":150,"text":1491},{"id":1581,"depth":144,"text":1582,"children":2937},[2938,2939,2940,2941,2942],{"id":1585,"depth":150,"text":1586},{"id":1601,"depth":150,"text":1602},{"id":1683,"depth":150,"text":1684},{"id":1791,"depth":150,"text":1792},{"id":1808,"depth":150,"text":1809},{"id":1818,"depth":144,"text":1819,"children":2944},[2945,2946],{"id":1829,"depth":150,"text":1830},{"id":2038,"depth":150,"text":2039},{"id":2068,"depth":144,"text":2069,"children":2948},[2949,2950,2951,2952,2953,2954],{"id":2072,"depth":150,"text":2073},{"id":2170,"depth":150,"text":2171},{"id":2325,"depth":150,"text":2326},{"id":2363,"depth":150,"text":2364},{"id":2407,"depth":150,"text":2408},{"id":2432,"depth":150,"text":2433},{"id":2442,"depth":144,"text":2443,"children":2956},[2957,2958,2959],{"id":2446,"depth":150,"text":2447},{"id":2556,"depth":150,"text":2557},{"id":2653,"depth":150,"text":2654},{"id":2708,"depth":144,"text":2709},{"id":2798,"depth":144,"text":2799},{"id":2832,"depth":144,"text":2833},"2026-09-27","针对 Unity IL2CPP 手游运行时数据链的完整实现记录：热修闸门绕过、查表替换、字段写入保护、协议层写入与运行时控制台，含全部实现代码与踩坑。","md",false,{},"/articles/il2cpp-runtime-patching-report",{"title":5,"description":2964},"articles/il2cpp-runtime-patching-report",[2972,2973,2974,2975],"安全","逆向工程","IL2CPP","Android","由 LongCat-2.5-Preview with Deepseek-V4.1-Flash 生成。","kaYm0LCIh6gRmskf-DzI1P8kagTfWgbPlTvwydvFgpA",1790495474559]