- 1
DUMP !!! Solve: Hot-update/hot-fix Unity 3D game can't be dumped fully
-
Similar Content
-
- 9 answers
- 3,105 views
-
- 9 replies
- 3,360 views
-
- 1 reply
- 1,193 views
-
- 1 reply
- 6,180 views
-
- 1 answer
- 5,879 views
-
Question
ryanhn717
My Purpose :
Dumping the game to get the dump.cs, which including all class name, field, methods and the most important "offset" etc. So certain memory hack can be made (or script).
My Question:
When a game using hot-update, e.g. via HybridCLR , so normal-dump-method when we use the Il2CppDumper ( neither based on andriod or Windows, or using Zygisk etc) can not dump the FULL file out. Here normal-dump-method means below three methods:
1、extract game apk file and get " global-metadata.dat file" and "IL2cpp.so file", then dump.
2、Using GG in game memory to directly export the "global-metadata.dat memory" to ***** .bin file(then rename to global-metadata.dat) and "IL2cpp.so memory" to ***** . bin file, then dump.
3、Using GG in game memory via magic letter (464C457Fh - il2cpp / FAB11BAFh - metadata) to export the " global-metadata.dat file" and "IL2cpp.so file", then dump.
We can not dump full, Because when game using hot-update, normally the "hotfix.dll" (e.g.) injected is separate from the original files, and new information which contained in the "hotfix.dll" is not in the original il2cpp.so file. It leads the result we can not get any useful info when we using normal-dump-method.
One solution:
Using GG in game memory via puting the DOS-PE header Letter " MZ "(magic head in decimal : 9460301 ) , and export all the C# DLL file to *****.bin file. Then using "get_dll_from_dumped_bin.exe" tool to convert all the *****.bin file you exported from the running game to *****.bin file. We can find the "hotfix.bin" (maybe different name) file. You can use Dnspy or other similar tool to check. All information we need is inside.
MY FINALL QUESTION:
After we get the "hotfix.bin" file, how can we dump it to get the dump.cs ? I mean how can we get the ingame memory class, filed, method and the most important offset ?
Link to comment
Share on other sites
2 answers to this question
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now