How to hook when the setter method i want to hook shares offset with other numerous setters methods?

[IceBear1226]

The game i'm trying to analyze has a lot of setters, getters methods. The remarkable thing is , setters have same offset, and getters too.

Even if I set the hook by exact name of method and class of domain, a random different name object that has a setter method with same offset comes in, and it resulted in "Process crashed: Bad access due to invalid address" error.

i tried to use " this.class.name " to compare it if it is the class I want to hook , and then used "revert()" in the case the condition is not met. , but it still made the game crash with the error.

Would there be anyone who faced same issue with me?

I wanna know If you tried to hook a setter or getter method sharing same offset with others, and if you had same error with me , how did you handle it . Please share it if you had same experience!

[vfsfitvnm]

Hi, woudl you please share your snippet and the classes (just console.log them)?

[IceBear1226]

This is my whole code !

==code starts==

import "frida-il2cpp-bridge";

//Il2CPP start
Il2Cpp.perform(() => {
    console.log(Il2Cpp.unityVersion);
    let baseAddress = Module.findBaseAddress("libil2cpp.so")
    console.log(`baseAddress : ${baseAddress}`);


function everyField(obj : Il2Cpp.Object){
    const repeatFields = obj.class.fields;
    const objClass = obj.class;

    repeatFields.forEach( field =>{ 
        if(field.isStatic){
            console.log(`logging static field : ${field.name} ,has value : ${objClass.field(field.name)} `);
            console.log(``);
        }else{
            console.log(`loggin instance field : ${field.name} ,has value ${obj.tryField(field.name)?.value} `);
            console.log(`type of the field's class! ${field.class.type}`);
            console.log(`checking instance of Object! ${obj.tryField(field.name)?.value instanceof Object} `);
            console.log(`chekcing instance of CPP Object! ${obj.tryField(field.name)?.value instanceof Il2Cpp.Object} `);
            console.log(``);
        }
    });
}

    //리워드DTO 세터
    //start of Hook block
    //0x0267567c
    //
 {

    const assemblyImg = Il2Cpp.domain.assembly("HotFix").image
    const klass =  assemblyImg.class("Proto.Bingo.BingoNormalRewardDto");
    const method = klass.method("set_RewardDto" , 1);
    
    method.implementation = function (value){
        console.log(`Handle of my method :  ${method.handle}`);

        console.log(`Name of the my method :  ${method.name}`);

        console.log(`virtual Addr this! : ${method.virtualAddress}`);

        console.log(`relativeVirtualAddress is this! : ${method.relativeVirtualAddress}`);
        console.log(`meth.objec. What object has this method? :  ${method.object}`);
        console.log(`This object is : ${this}`);

        console.log(``);
        // console.log(`toString 확인 : ${this.toString()}`); tostring가능.

        let obj = this as Il2Cpp.Object;
        let objHandle = this.handle;
        console.log(`this Object handle is : ${objHandle}`);

        
        let methodAddr = baseAddress?.add("0x0267567c");
        console.log(`Manually added Addr :  ${methodAddr}`);
        
        console.log(``);

        obj.class.methods.forEach(function(every){
            if(every.isStatic){    
            console.log(`loggin static this method  :  ${every.name} , It's handle : ${every.handle}`);
            }else{
                console.log(`loggin instance this method : ${every.name} , It's handle : ${every.handle}`);

            }
            
        })
        
        console.log(``);
        console.log(`set_RewardDto arg value  = ${value}`);
        console.log(`---------------------onEnter EveryField Start----------`);
        console.log(`this.toString() result = ${this.toString()}`);
        
        everyField(this as Il2Cpp.Object);
        
        console.log(`---------------------onEnter EveryField End----------`);
        
        if(!this.toString().includes(klass.fullName)){
            console.log(`Not the object i wanted to hook!@ = ${this.toString()}`);
            method.revert();
        }

        const result = this.method("set_RewardDto").invoke(value)
        //return값이 없다면?

        console.log(`---------------------onLeave EveryField Start----------`);
        
        everyField(this as Il2Cpp.Object);
        
        console.log(`---------------------onLeave EveryField End----------`);
        
        
        if(this.toString().includes(klass.fullName)){
            console.log(`내가 찾던 객체야! ${this.toString()}`);
            return result;
            
        }else{
            console.log(`revert 확인 . 객체 = ${this.toString()}`);
            method.revert();
        }
        
        //revert failed

    }
 }
 //end of Hook block

});

==code end==

And this is the result of the code logging.

==Log start==

Handle of my method : 0x7fff04b70028
Name of the my method : set_RewardDto
virtual Addr is this! : 0x7fff444ed67c
relativeVirtualAddress is this! : 0x267567c
meth.objec. What object has this method? : Void set_RewardDto(Proto.Common.RewardDto)
This object is : HotFix.HabbyMailManager

this Object handle is : 0x7ffe428f6780
Manually added Addr : 0x7fff444ed67c

loggin instance this method : get_Control , It's handle : 0x7ffeb2f721c8
loggin instance this method : set_Control , It's handle : 0x7ffeb2f72240
loggin instance this method : get_Listen , It's handle : 0x7ffeb2f722b8
loggin instance this method : set_Listen , It's handle : 0x7ffeb2f72330
loggin instance this method : SetData , It's handle : 0x7ffeb2f723a8
loggin instance this method : OnInit , It's handle : 0x7ffeb2f72420
loggin instance this method : OnDeInit , It's handle : 0x7ffeb2f72498
loggin instance this method : Login , It's handle : 0x7ffeb2f72510
loggin instance this method : OnEventRefreshLanaguage , It's handle : 0x7ffeb2f72588
loggin instance this method : OnUpdateSettingDataEvent , It's handle : 0x7ffeb2f72600
loggin instance this method : OnHttpStartEvent , It's handle : 0x7ffeb2f72678
loggin instance this method : OnHttpFinishedEvent , It's handle : 0x7ffeb2f726f0
loggin instance this method : OnCodeListen , It's handle : 0x7ffeb2f72768
loggin instance this method : OnRewardsListen , It's handle : 0x7ffeb2f727e0
loggin instance this method : ShowMask , It's handle : 0x7ffeb2f72858
loggin instance this method : CloseMask , It's handle : 0x7ffeb2f728d0
loggin instance this method : OnRefreshMailListData , It's handle : 0x7ffeb2f72948
loggin instance this method : .ctor , It's handle : 0x7ffeb2f729c0

set_RewardDto arg value = Habby.Tool.Http.UnityWebRequestObject1[Habby.Mail.Data.MailResponse1[Habby.Mail.Data.GetMailListResponse]]
---------------------onEnter EveryField Start----------
this.toString() result = HotFix.HabbyMailManager
loggin instance field : m_version ,has value ""
type of the field's class! HotFix.HabbyMailManager
checking instance of Object! true
chekcing instance of CPP Object! false

loggin instance field : m_url ,has value "https://mail.advrpg.com"
type of the field's class! HotFix.HabbyMailManager
checking instance of Object! true
chekcing instance of CPP Object! false

loggin instance field : m_serverType ,has value Release
type of the field's class! HotFix.HabbyMailManager
checking instance of Object! true
chekcing instance of CPP Object! false

loggin instance field : m_maskShow ,has value false
type of the field's class! HotFix.HabbyMailManager
checking instance of Object! false
chekcing instance of CPP Object! false

loggin instance field : m_isLogin ,has value false
type of the field's class! HotFix.HabbyMailManager
checking instance of Object! false
chekcing instance of CPP Object! false

loggin instance field : m_setting ,has value Habby.Mail.MailSetting
type of the field's class! HotFix.HabbyMailManager
checking instance of Object! true
chekcing instance of CPP Object! true

loggin instance field : k__BackingField ,has value HotFix.HabbyMailManager+ControlModule
type of the field's class! HotFix.HabbyMailManager
checking instance of Object! true
chekcing instance of CPP Object! true

loggin instance field : k__BackingField ,has value HotFix.MailMessageListen
type of the field's class! HotFix.HabbyMailManager
checking instance of Object! true
chekcing instance of CPP Object! true

---------------------onEnter EveryField End----------
Not the object i wanted to hook!@ = HotFix.HabbyMailManager
il2cpp: couldn't find method set_RewardDto in class HotFix.HabbyMailManager
at method (/node_modules/frida-il2cpp-bridge/dist/index.js:1951)
at method (/node_modules/frida-il2cpp-bridge/dist/index.js:2828)
at (logError.ts:86)
at call (native)
at (/node_modules/frida-il2cpp-bridge/dist/index.js:2731)

- Log End -


P.S  The dump of the classes showed here below! 

- dumped classes -





(I wanted to hook this class's instance)
// HotFix

class Proto.Bingo.BingoNormalRewardDto : System.Object, Google.Protobuf.IMessage
{
static Google.Protobuf.MessageParser<Proto.Bingo.BingoNormalRewardDto> parser; // 0x0
static System.Int32 PositionFieldNumber = 1;
System.UInt32 position; // 0x10
static System.Int32 RewardDtoFieldNumber = 2;
Proto.Common.RewardDto rewardDto_; // 0x18
static Google.Protobuf.MessageParser<Proto.Bingo.BingoNormalRewardDto> get_Parser(); // 0x02650720
System.UInt32 get_Position(); // 0x02661708
System.Void set_Position(System.UInt32 value); // 0x02675aac
Proto.Common.RewardDto get_RewardDto(); // 0x02663b44
System.Void set_RewardDto(Proto.Common.RewardDto value); // 0x0267567c
System.Void WriteTo(Google.Protobuf.CodedOutputStream output); // 0x0267567c
System.Int32 CalculateSize(); // 0x02635f00
System.Void MergeFrom(Google.Protobuf.CodedInputStream input); // 0x0267567c
System.Void .ctor(); // 0x0266e758
static System.Void .cctor(); // 0x0266c694
}

(the object's class dump that came into my code.)

// HotFix
class HotFix.HabbyMailManager : System.Object, Framework.MailManager.IMailManager
{
System.String m_version; // 0x10
System.String m_url; // 0x18
Framework.MailManager.MailServerType m_serverType; // 0x20
System.Boolean m_maskShow; // 0x24
System.Boolean m_isLogin; // 0x25
Habby.Mail.MailSetting m_setting; // 0x28
HotFix.HabbyMailManager.ControlModule k__BackingField; // 0x30
HotFix.MailMessageListen k__BackingField; // 0x38
HotFix.HabbyMailManager.ControlModule get_Control(); // 0x02663b44
System.Void set_Control(HotFix.HabbyMailManager.ControlModule value); // 0x0267567c
HotFix.MailMessageListen get_Listen(); // 0x02663b44
System.Void set_Listen(HotFix.MailMessageListen value); // 0x0267567c
System.Void SetData(System.String version, System.String url, Framework.MailManager.MailServerType serverType); // 0x0267786c
System.Void OnInit(); // 0x0266e758
System.Void OnDeInit(); // 0x0266e758
System.Void Login(System.String userID); // 0x0267567c
System.Void OnEventRefreshLanaguage(System.Object sender, System.Int32 type, Framework.EventSystem.BaseEventArgs eventargs); // 0x02676078
Habby.Mail.MailSetting OnUpdateSettingDataEvent(); // 0x02663b44
System.Void OnHttpStartEvent(Habby.Tool.Http.HttpObject obj); // 0x0267567c
System.Void OnHttpFinishedEvent(Habby.Tool.Http.HttpObject obj); // 0x0267567c
System.Void OnCodeListen(System.String message, System.Int32 code); // 0x02675e8c
System.Void OnRewardsListen(Proto.Common.CommonData commonData); // 0x0267567c
System.Void ShowMask(); // 0x0266e758
System.Void CloseMask(); // 0x0266e758
System.Void OnRefreshMailListData(System.Action onComplete); // 0x0267567c
System.Void .ctor(); // 0x0266e758
}

As you can see, they share offset in the dump. Almost every classes in Hotfix domain has same offset getters and setters.

I always thank you for being the guiding light. Hahah

[vfsfitvnm]

Uhm, yeah I see many methods share the same relative virtual addresses (0x0267567c, 0x02663b44...) - this is weird. I honestly have no idea. It would be ideal to use Ghidra (or a comparable disassembler/decompiler) to see what's going on at those addresses...

[vfsfitvnm]

Oh, another user reported something similar: #571