Advertisement
Sc2ad

Heap Copy Transpiler

Dec 10th, 2020
637
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.51 KB | None | 0 0
  1. /*
  2. Heap copy approach. Copies the original instructions to a buffer on heap, marks it as executable, and calls it from there.
  3. Shouldn't be too complicated, I may have also messed up the iterator math.
  4. This assumes that the heap isn't explicitly -X (hopefully, it isn't)
  5. */
  6.  
  7. std::vector<uint32_t> insts;
  8.  
  9. MAKE_HOOK_OFFSETLESS(LateUpdate, void, void *self) {
  10.     reinterpret_cast<void (*)(void*)>(insts.data())(self);
  11. }
  12.  
  13. extern "C" void load() {
  14.     auto lateUpdateInfo = il2cpp_utils::FindMethodUnsafe("", "BeatmapObjectCallbackController", "LateUpdate", 0);
  15.     auto nextMethodInfo = il2cpp_utils::FindMethodUnsafe("", "BeatmapObjectCallbackController", "AddBeatmapObjectCallback", 2);
  16.     uint32_t *startAddr = (uint32_t *) lateUpdateInfo->methodPointer;
  17.     uint32_t *endAddr = (uint32_t *) nextMethodInfo->methodPointer;
  18.  
  19.     std::vector<uint32_t> instructions(startAddr, endAddr);
  20.     insts.assign(instructions.begin(), instructions.end());
  21.  
  22.     for (int i = 0; i < instructions.size(); i++) {
  23.         uint32_t ins = instructions[i];
  24.         if (ins == 0x1e293901) { // 0x0139291e fsub s1,s8,s9
  25.             // Insert instructions, can insert at index i, since insts is copied
  26.             insts.insert(insts.begin() + i, 0x0);
  27.         }
  28.     }
  29.  
  30.     if (mprotect(reinterpret_cast<void*>(insts.data()), insts.size() * sizeof(uint32_t), PROT_EXEC) == 0) {
  31.         // Success
  32.     }
  33.  
  34.     INSTALL_HOOK_OFFSETLESS(LateUpdate, il2cpp_utils::FindMethodUnsafe("", "BeatmapObjectCallbackController", "LateUpdate", 0));
  35. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement