Il2cpp patching doesn't affect the code execution

[Acessor]

I've created a POC (Proof of concept) project in unity to test out Il2cpp android patching using Game Guardian. When you click the button it gets the values returned from each method and formats them so we can see the results.

I use IlDumper to get the offsets.

And I made a script for il2cpp method patching in GG (it supports offset patching)

demo.lua

The script seems to work and the values do change in memory. But still the POC application login doesn't change (it still returns true and not false, for example)

I need help figuring out what the problem is

[THETWINSOFFICIAL]

It should work with this

Mov r0, #0

Bx lr

for false

[CmP]

It's unclear where the dumper got 0x2FCD50 from, but in the comment on the screenshot values are different. There RVA is 0x2080 and this is much more likely (than 0x2FCD50) to be the offset to start of the method in process memory. If you can provide your "libil2cpp.so" file, it should become clear which offset is correct.

[Acessor]

11 hours ago, CmP said:

It's unclear where the dumper got 0x2FCD50 from, but in the comment on the screenshot values are different. There RVA is 0x2080 and this is much more likely (than 0x2FCD50) to be the offset to start of the method in process memory. If you can provide your "libil2cpp.so" file, it should become clear which offset is correct.

Nope RVA is 0x2080 is the offset of the dumped .NET assembly that is displayed by DnSpy and not of the .so file itself. Here's the apk file itself (you can unzip .so file and metadata to get offsets). (Also this POC is an updated version, I've impoved the design so the offsets will be different from the ones from my post above.

POC.apk

[CmP]

The offset was indeed correct, the issue is with your code. "GetValues" method doesn't use "getBool" method for determining what to print, it gets value of "v_bool" field directly. The instruction that gets the value is at offset 0x2FD33C, it is disassembled as "LDRB R1, [R7, #16]". By modifying it to "MOV R1, #0" one can achieve what was intended: 

[Acessor]

17 hours ago, CmP said:

The offset was indeed correct, the issue is with your code. "GetValues" method doesn't use "getBool" method for determining what to print, it gets value of "v_bool" field directly. The instruction that gets the value is at offset 0x2FD33C, it is disassembled as "LDRB R1, [R7, #16]". By modifying it to "MOV R1, #0" one can achieve what was intended: 

Thank you a lot. There was no direct method calls because of the compiler optimizations. If you select a "release" build mode that all the fields are acessed directly without the method calls. But if "master" or "debug" is selected then all the methods are executed directly, as expected. Now, when the project is done, you can check it out - https://github.com/acessors/Il2Cpp-Exploitation-POC