vfsfitvnm / frida-il2cpp-bridge

A Frida module to dump, trace or hijack any Il2Cpp application at runtime, without needing the global-metadata.dat file.

Home Page:https://github.com/vfsfitvnm/frida-il2cpp-bridge/wiki

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

il2cpp: libil2cpp.so has been loaded, but such event hasn't been detected

dziunincode69 opened this issue · comments

hello im running a code from snippet but why i got this error

npm run spawn com.mobile.legends

playground@1.0.0 spawn
run() { frida -U -f "$1" -l _.js --runtime=v8; }; run com.mobile.legends

 ____
/ _  |   Frida 16.1.7 - A world-class dynamic instrumentation toolkit

| (| |
> _ | Commands:
/
/ |_| help -> Displays the help system
. . . . object? -> Display information about 'object'
. . . . exit/quit -> Exit
. . . .
. . . . More info at https://frida.re/docs/home/
. . . .
. . . . Connected to 22071212AG (id=C6HISK9LB67LFQKB)
Spawned com.mobile.legends. Resuming main thread!
[22071212AG::com.mobile.legends ]-> il2cpp: libil2cpp.so has been loaded, but such event hasn't been detected - please file a bug
Error: access violation accessing 0x0
at NativeFunction. ()
at Object.initialize (il2cpp/module.ts:19:24)
at Object.perform (il2cpp/perform.ts:5:36)

Hi, thanks for reporting. Are you using an emulator? If so, you need to run Frida with --realm=emulated. Please follow #437 and let me know!

im using android device not a emulator
my device: xiaomi 12T
and im using USB to connect with adb and frida

Thanks.
What happens if you eval:

Process.getModuleByName("libil2cpp.so")

throught the Frida REPL?

hello
i Got this response

[22071212AG::com.mobile.legends ]-> Process.getModuleByName("libil2cpp.so")

{ "base": "0x7695243000", "name": "libil2cpp.so", "path": "/data/app/~~2aUqt56EA83TXpBt_YIxpg==/com.mobile.legends-xXkqYG7V3IWVEDF9rdnVXA==/split_config.arm64_v8a.apk!/lib/arm64-v8a/libil2cpp.so", "size": 237568 }

Thanks, it looks like this game (or your device) is using a strategy I'm not aware of to load libil2cpp.so