il2cpp dumper func address in process memory

[DimoNULL]

How do I find the address of the function in the process memory if I have the address of the function in the file libil2cpp.so received through the il2cpp dumper?

[MC874]

Hi @DimoNULL, you need to get the libil2cpp.so address first, then do calculate offset by simply adding the RVA address of the function. Here's what it looks like using the script:

so = gg.getRangesList('libanogs.so')[1].start
gg.alert(tostring(so + "0x129fc4"))

-- "0x129fc4" is your function address
-- The function will be located at libil2cpp.so + function address.

 

[MAARS]

The index is not always the same so to avoid some runtime error you can make it dynamic
 

local function getBaseAddr(lib)
    local rangeList = gg.getRangesList(lib)
    for _, v in ipairs(rangeList) do
        if v.state == "Xa" then
            return v.start
        end
    end
end

local libanogs = getBaseAddr("libanogs.so")

gg.alert(tostring(libanogs + 0x129fc4))

-- "0x129fc4" is your function address
-- The function will be located at libil2cpp.so + function address.