原神1.x时期的unity分析

背景

建议先看上一篇针对崩坏3保护思路的文章集合，本篇大量学习自上一个系列的文章，没有katyscode的分析基础想要看清楚思路会有点难度

另外可以从

GI-Download-Library

MAnggiarMustofa • Updated Aug 30, 2023

获取到历史版本的游戏下载链接

先看下元数据的16进制

1. 通过il2cpp_init反汇编正向找到解密函数地址

2. 字符串搜索global-metadata字符串反向定位到关键函数

继续分析看下里面还有有无解密代码

char __fastcall InitializeIl2CppFromMain(__int64 a1, __int64 a2, unsigned int a3, __int64 a4)
{
  __int128 v7; // [rsp+20h] [rbp-48h]
  __int128 v8; // [rsp+40h] [rbp-28h] BYREF
  __int64 v9; // [rsp+50h] [rbp-18h]

  *&v7 = qword_18193E688;
  *(&v7 + 1) = qword_18193E698;
  v8 = v7;
  v9 = qword_18193E6A8;
  il2cpp_init_security_(&v8);
  sub_18090EF00();
  sub_1808DBBB0();
  qword_181936570(0i64);
  qword_1819366E0(a3, a4, 0i64);
  qword_1819366C8();
  qword_1819366D0();
  il2cpp_init("IL2CPP Root Domain");
  il2cpp_set_config("unused_application_configuration");
  sub_180920D90();
  return 1;
}

试着直接调用吧

#include <iostream>
#include <fstream>
#include <vector>
#include <stdexcept>
#include <cstdio>
#include <Windows.h>

using DecFunction = byte * (*)(const byte*, int);

std::vector<byte> read_file(const std::string& file_path) {
    std::ifstream file(file_path, std::ios::binary | std::ios::ate);
    if (!file) throw std::runtime_error("Failed to open file: " + file_path);
    std::vector<byte> buffer(file.tellg());
    file.seekg(0);
    if (!file.read(reinterpret_cast<char*>(buffer.data()), buffer.size())) {
        throw std::runtime_error("Failed to read file: " + file_path);
    }
    return buffer;
}

int main(int argc, char* argv[]) {
    if (argc != 4) {
        std::cerr << "arg must be: metadata_path unityplayer_path func_rva" << std::endl;
        return std::getchar();
    }

    const auto metadata_buffer = read_file(argv[1]);
    const auto unity_module = LoadLibraryA(argv[2]);
    if (!unity_module) {
        std::cerr << "Failed to load Unity player library." << std::endl;
        return std::getchar();
    }

    const auto dec_func = reinterpret_cast<DecFunction>((byte*)unity_module + std::strtoul(argv[3], nullptr, 16));
    const auto result = dec_func(metadata_buffer.data(), metadata_buffer.size());

    std::ofstream outfile("dec.bin", std::ios::binary);
    if (!outfile) {
        std::cerr << "Failed to open output file." << std::endl;
        FreeLibrary(unity_module);
        return std::getchar();
    }
    outfile.write(reinterpret_cast<const char*>(result), metadata_buffer.size());

    FreeLibrary(unity_module);
    return std::getchar();
}

看下输出成果

但依然存在加密数据

对照源码标注InitializeRuntimemetadata函数

i = 0;
token_ = token;
metadataUsageLists = (const Il2CppMetadataUsageList *)(*(int *)(metadataheader + 0x150) + DecMetadataBuffer);
count = metadataUsageLists[token_].count;
start = metadataUsageLists[token_].start;
do
{
  offset = i + start;
  metadataUsagePairsStart = (const Il2CppMetadataUsagePair *)(DecMetadataBuffer + *(int *)(metadataheader + 0xF8));
  destinationIndex = metadataUsagePairsStart[offset].destinationIndex;
  LODWORD(offset) = metadataUsagePairsStart[offset].encodedSourceIndex;
  usage = (unsigned int)offset >> 29;
  decodedIndex = offset & 0x1FFFFFFF;
  ++i;
}

关键的字符串字面量在哪里呢？

元数据空隙分析

9C 13 0F 00 24 B8 00 00
C0 CB 0F 00 AC 37 10 00
6C 03 20 00 88 65 03 00
F4 68 23 00 90 E8 24 00
84 51 48 00 90 FC 00 00
14 4E 49 00 80 07 00 00
94 55 49 00 F0 0F 00 00
84 65 49 00 20 70 24 00
A4 D5 6D 00 F0 A9 00 00
94 7F 6E 00 B0 1B 05 00
44 9B 73 00 6C 89 01 00
B0 24 75 00 14 05 00 00
C4 29 75 00 D0 38 10 00
94 62 85 00 58 7A 09 00
EC DC 8E 00 3C BD 00 00
28 9A 8F 00 20 8B 00 00
48 25 90 00 00 00 00 00
48 25 90 00 68 0C 00 00
BC 72 C2 00 20 0B 33 00
DC 7D F5 00 B0 0C 00 00
8C 8A F5 00 B0 09 3D 00
3C 94 32 01 38 11 00 00
74 A5 32 01 24 21 00 00
98 C6 32 01 00 EA 0F 00
98 B0 42 01 C0 04 CE 00
58 B5 10 02 7C A0 01 00
D4 55 12 02 B4 82 05 00
88 D8 17 02 F8 F6 13 00

字符数据动态调用/分析

1. 找字符串解密就是找GetStringLiteralFromIndex函数，其本身特征不明显但函数中有调用到il2cpp::vm::String::NewLen

2. userassembly的导出函数il2cpp_string_new_len就是il2cpp::vm::String::NewLen的包装器

3. 根据2找到il2cpp::vm::String::NewLen，再根据il2cpp::vm::String::NewLen找到GetStringLiteralFromIndex继而分析或者想让回溯InitializeRuntimeMetadata

字符串解密算法

byte cl = (byte)(buffer[i] ^ stringDecryptionBlob[(0x1400 + i) % 0x5000]);
byte al = (byte)(stringDecryptionBlob[i % 0x2800 + index % 0x2800] + i);
buffer[i] = (byte)(cl ^ al);