2025 Unity Il2Cpp 外部逆向深度工程：从元数据解析到无痕Hook的完整实现

#pragma pack(push, 1)
struct MetadataHeader {
    uint32_t sanity;          // 0xFAB11BAF
    uint32_t version;         // 24, 25, 26, 27, 28, 29
    int32_t  stringLiteralOffset;
    int32_t  stringLiteralSize;
    int32_t  stringLiteralDataOffset;
    int32_t  stringLiteralDataSize;
    int32_t  typeDefinitionsOffset;   // 类型定义表
    int32_t  typeDefinitionsSize;
    int32_t  methodDefinitionsOffset; // 方法定义表（关键）
    int32_t  methodDefinitionsSize;
    // ... 后续字段不在此列出，但通过计算偏移访问
};
#pragma pack(pop)

class MetadataParser {
    std::vector<uint8_t> data; // 从进程读取的dat内容
    const MetadataHeader* header;
    uintptr_t baseRVA;        // libil2cpp.so/GameAssembly.dll基址

public:
    MetadataParser(const std::vector<uint8_t>& rawData, uintptr_t moduleBase)
        : data(rawData), header(reinterpret_cast<const MetadataHeader*>(data.data())), baseRVA(moduleBase) {
        if (header->sanity != 0xFAB11BAF) throw std::runtime_error("Invalid metadata");
    }

    // 获取方法定义表起始指针
    const void* GetMethodDefinitions() const {
        return data.data() + header->typeDefinitionsOffset + header->typeDefinitionsSize * 4; // 具体偏移需按版本计算
    }

    // 通过方法名+类名查找方法指针RVA（返回相对模块基址的RVA）
    uint32_t FindMethodRVA(const std::string& className, const std::string& methodName) {
        // 遍历类型定义 -> 获取方法索引范围 -> 匹配名称索引（字符串表）
        // 此处仅给出核心逻辑片段，完整实现约200行
        auto methodDefs = reinterpret_cast<const Il2CppMethodDefinition*>(GetMethodDefinitions());
        uint32_t methodCount = header->methodDefinitionsSize / sizeof(Il2CppMethodDefinition);
        for (uint32_t i = 0; i < methodCount; ++i) {
            const auto& m = methodDefs[i];
            const char* mName = GetStringFromIndex(m.nameIndex);
            const char* cName = GetTypeName(m.declaringTypeIndex);
            if (className == cName && methodName == mName) {
                // methodIndex 对应 Codegen 表中的索引，Codegen表存储每个方法的RVA
                uint32_t codegenIndex = m.methodIndex;
                uint32_t rva = ReadCodegenRVA(codegenIndex);
                return rva;
            }
        }
        return 0;
    }

    uint32_t ReadCodegenRVA(uint32_t idx) const {
        // Codegen表通常位于模块的 .rdata 段，通过读取模块的导出表或硬编码偏移获取
        // 此处为示例，实际需根据PE/ELF解析节表
        uintptr_t codegenTableAddr = baseRVA + 0x1A0000; // 需动态获取
        return *reinterpret_cast<uint32_t*>(codegenTableAddr + idx * 4);
    }
};

class IMemoryAccess {
public:
    virtual bool Read(uintptr_t addr, void* buffer, size_t size) = 0;
    virtual bool Write(uintptr_t addr, const void* buffer, size_t size) = 0;
    virtual uintptr_t GetModuleBase(const std::string& name) = 0;
    virtual ~IMemoryAccess() = default;
};

// Windows实现（利用ReadProcessMemory）
class WinMemory : public IMemoryAccess {
    HANDLE hProcess;
public:
    WinMemory(DWORD pid) { hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid); }
    bool Read(uintptr_t addr, void* buf, size_t sz) override {
        SIZE_T read = 0;
        return ReadProcessMemory(hProcess, (LPCVOID)addr, buf, sz, &read) && read == sz;
    }
    // Write类似...
};

// Android实现（利用 /proc/pid/mem + pread/pwrite）
class AndroidMemory : public IMemoryAccess {
    int memFd;
public:
    AndroidMemory(pid_t pid) {
        std::string path = "/proc/" + std::to_string(pid) + "/mem";
        memFd = open(path.c_str(), O_RDWR);
    }
    bool Read(uintptr_t addr, void* buf, size_t sz) override {
        return pread64(memFd, buf, sz, (off64_t)addr) == (ssize_t)sz;
    }
    // Write使用pwrite64
};

template<typename T>
T ReadChain(IMemoryAccess* mem, uintptr_t base, const std::vector<uint32_t>& offsets) {
    uintptr_t addr = base;
    for (size_t i = 0; i < offsets.size(); ++i) {
        if (!mem->Read(addr + offsets[i], &addr, sizeof(uintptr_t))) {
            throw std::runtime_error("Chain break");
        }
    }
    T result;
    mem->Read(addr, &result, sizeof(T));
    return result;
}

#include <windows.h>
#include <winternl.h>

class HardwareBreakpoint {
    HANDLE hThread;
    CONTEXT ctx;
    int slot; // 0~3
public:
    HardwareBreakpoint(HANDLE thread, int slot) : hThread(thread), slot(slot) {
        ctx.ContextFlags = CONTEXT_DEBUG_REGISTERS;
        GetThreadContext(hThread, &ctx);
    }
    void Set(uintptr_t address, bool enable = true) {
        // 设置 DR0~DR3
        ctx.Dr0 = (slot == 0) ? address : ctx.Dr0;
        ctx.Dr1 = (slot == 1) ? address : ctx.Dr1;
        ctx.Dr2 = (slot == 2) ? address : ctx.Dr2;
        ctx.Dr3 = (slot == 3) ? address : ctx.Dr3;
        // 设置DR7控制位：启用该槽，长度为1字节（0b00），读写执行（0b11）
        ctx.Dr7 |= (1 << (2 * slot)) | (3 << (16 + 4 * slot));
        if (!enable) {
            ctx.Dr7 &= ~(1 << (2 * slot));
        }
        SetThreadContext(hThread, &ctx);
    }
    // 在异常处理中（VEH）捕获断点事件，执行Hook逻辑
};

LONG WINAPI VEHHandler(PEXCEPTION_POINTERS ex) {
    if (ex->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP) {
        // 检查触发地址是否与DR寄存器匹配
        auto context = ex->ContextRecord;
        for (int i = 0; i < 4; ++i) {
            uintptr_t dr = (&context->Dr0)[i];
            if (context->Rip == dr) {
                // 执行Hook逻辑（例如修改返回值）
                // 注意：需在VEH中修改Context，且要模拟原指令或跳过
                context->Rax = 9999; // 修改返回值示例
                context->Rip += 0x01; // 跳过被断点指令（需根据原指令长度调整）
                return EXCEPTION_CONTINUE_EXECUTION;
            }
        }
    }
    return EXCEPTION_CONTINUE_SEARCH;
}

// 安装VEH
AddVectoredExceptionHandler(1, VEHHandler);

typedef NTSTATUS (NTAPI *pNtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);
pNtQueryInformationProcess OriginalNtQuery = nullptr;

NTSTATUS NTAPI HookedNtQuery(HANDLE h, PROCESSINFOCLASS pic, PVOID info, ULONG len, PULONG retLen) {
    if (pic == ProcessDebugPort) {
        *(HANDLE*)info = 0;
        return 0;
    }
    return OriginalNtQuery(h, pic, info, len, retLen);
}

// 假设已获取 EnemyList 地址和 SetVisible 函数地址
void AutoVisible(IMemoryAccess* mem, uintptr_t enemyListAddr, uintptr_t setVisibleAddr) {
    uint32_t count = mem->Read<uint32_t>(enemyListAddr + 0x10); // 列表大小
    uintptr_t items = mem->Read<uintptr_t>(enemyListAddr + 0x08); // 指针数组
    for (uint32_t i = 0; i < count; ++i) {
        uintptr_t enemyPtr = mem->Read<uintptr_t>(items + i * 8);
        if (enemyPtr) {
            // 调用 SetVisible(enemyPtr, true)
            // 因无法直接调用，使用远程代码注入执行call，或使用WriteProcessMemory修改内存标志位
            // 此处采用直接修改对象中的可见标志位（偏移0x1A0，具体由逆向得出）
            mem->Write<bool>(enemyPtr + 0x1A0, true);
        }
    }
}

#define SAFE_READ(mem, addr, buf, sz) \
    __try { mem->Read(addr, buf, sz); } \
    __except(EXCEPTION_EXECUTE_HANDLER) { memset(buf, 0, sz); /* 返回默认值 */ }