5930 lines
249 KiB
JavaScript
5930 lines
249 KiB
JavaScript
// node_modules/frida-il2cpp-bridge/dist/index.js
|
||
var __decorate = function(decorators, target, key, desc) {
|
||
var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
|
||
if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
|
||
else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
|
||
return c > 3 && r && Object.defineProperty(target, key, r), r;
|
||
};
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
Il2Cpp3.application = {
|
||
/**
|
||
* Gets the data path name of the current application, e.g.
|
||
* `/data/emulated/0/Android/data/com.example.application/files`
|
||
* on Android.
|
||
*
|
||
* **This information is not guaranteed to exist.**
|
||
*
|
||
* ```ts
|
||
* Il2Cpp.perform(() => {
|
||
* // prints /data/emulated/0/Android/data/com.example.application/files
|
||
* console.log(Il2Cpp.application.dataPath);
|
||
* });
|
||
* ```
|
||
*/
|
||
get dataPath() {
|
||
return unityEngineCall("get_persistentDataPath");
|
||
},
|
||
/**
|
||
* Gets the identifier name of the current application, e.g.
|
||
* `com.example.application` on Android.
|
||
*
|
||
* In case the identifier cannot be retrieved, the main module name is
|
||
* returned instead, which typically is the process name.
|
||
*
|
||
* ```ts
|
||
* Il2Cpp.perform(() => {
|
||
* // prints com.example.application
|
||
* console.log(Il2Cpp.application.identifier);
|
||
* });
|
||
* ```
|
||
*/
|
||
get identifier() {
|
||
return unityEngineCall("get_identifier") ?? unityEngineCall("get_bundleIdentifier") ?? Process.mainModule.name;
|
||
},
|
||
/**
|
||
* Gets the version name of the current application, e.g. `4.12.8`.
|
||
*
|
||
* In case the version cannot be retrieved, an hash of the IL2CPP
|
||
* module is returned instead.
|
||
*
|
||
* ```ts
|
||
* Il2Cpp.perform(() => {
|
||
* // prints 4.12.8
|
||
* console.log(Il2Cpp.application.version);
|
||
* });
|
||
* ```
|
||
*/
|
||
get version() {
|
||
return unityEngineCall("get_version") ?? exportsHash(Il2Cpp3.module).toString(16);
|
||
}
|
||
};
|
||
getter(Il2Cpp3, "unityVersion", () => {
|
||
try {
|
||
const unityVersion = Il2Cpp3.$config.unityVersion ?? unityEngineCall("get_unityVersion");
|
||
if (unityVersion != null) {
|
||
return unityVersion;
|
||
}
|
||
} catch (_) {
|
||
}
|
||
const searchPattern = "69 6c 32 63 70 70";
|
||
for (const range of Il2Cpp3.module.enumerateRanges("r--").concat(Process.getRangeByAddress(Il2Cpp3.module.base))) {
|
||
for (let { address } of Memory.scanSync(range.base, range.size, searchPattern)) {
|
||
while (address.readU8() != 0) {
|
||
address = address.sub(1);
|
||
}
|
||
const match = UnityVersion.find(address.add(1).readCString());
|
||
if (match != void 0) {
|
||
return match;
|
||
}
|
||
}
|
||
}
|
||
raise("couldn't determine the Unity version, please specify it manually");
|
||
}, lazy);
|
||
getter(Il2Cpp3, "unityVersionIsBelow201830", () => {
|
||
return UnityVersion.lt(Il2Cpp3.unityVersion, "2018.3.0");
|
||
}, lazy);
|
||
getter(Il2Cpp3, "unityVersionIsBelow202120", () => {
|
||
return UnityVersion.lt(Il2Cpp3.unityVersion, "2021.2.0");
|
||
}, lazy);
|
||
function unityEngineCall(method) {
|
||
const handle = Il2Cpp3.exports.resolveInternalCall(Memory.allocUtf8String("UnityEngine.Application::" + method));
|
||
const nativeFunction = new NativeFunction(handle, "pointer", []);
|
||
return nativeFunction.isNull() ? null : new Il2Cpp3.String(nativeFunction()).asNullable()?.content ?? null;
|
||
}
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
function boxed(value, type) {
|
||
const mapping = {
|
||
int8: "System.SByte",
|
||
uint8: "System.Byte",
|
||
int16: "System.Int16",
|
||
uint16: "System.UInt16",
|
||
int32: "System.Int32",
|
||
uint32: "System.UInt32",
|
||
int64: "System.Int64",
|
||
uint64: "System.UInt64",
|
||
char: "System.Char",
|
||
intptr: "System.IntPtr",
|
||
uintptr: "System.UIntPtr"
|
||
};
|
||
const className = typeof value == "boolean" ? "System.Boolean" : typeof value == "number" ? mapping[type ?? "int32"] : value instanceof Int64 ? "System.Int64" : value instanceof UInt64 ? "System.UInt64" : value instanceof NativePointer ? mapping[type ?? "intptr"] : raise(`Cannot create boxed primitive using value of type '${typeof value}'`);
|
||
const object = Il2Cpp3.corlib.class(className ?? raise(`Unknown primitive type name '${type}'`)).alloc();
|
||
(object.tryField("m_value") ?? object.tryField("_pointer") ?? raise(`Could not find primitive field in class '${className}'`)).value = value;
|
||
return object;
|
||
}
|
||
Il2Cpp3.boxed = boxed;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
Il2Cpp3.$config = {
|
||
moduleName: void 0,
|
||
unityVersion: void 0,
|
||
exports: void 0
|
||
};
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
function dump(fileName, path) {
|
||
fileName = fileName ?? `${Il2Cpp3.application.identifier}_${Il2Cpp3.application.version}.cs`;
|
||
path = path ?? Il2Cpp3.application.dataPath ?? Process.getCurrentDir();
|
||
createDirectoryRecursively(path);
|
||
const destination = `${path}/${fileName}`;
|
||
const file = new File(destination, "w");
|
||
for (const assembly of Il2Cpp3.domain.assemblies) {
|
||
inform(`dumping ${assembly.name}...`);
|
||
for (const klass of assembly.image.classes) {
|
||
file.write(`${klass}
|
||
|
||
`);
|
||
}
|
||
}
|
||
file.flush();
|
||
file.close();
|
||
ok(`dump saved to ${destination}`);
|
||
showDeprecationNotice();
|
||
}
|
||
Il2Cpp3.dump = dump;
|
||
function dumpTree(path, ignoreAlreadyExistingDirectory = false) {
|
||
path = path ?? `${Il2Cpp3.application.dataPath ?? Process.getCurrentDir()}/${Il2Cpp3.application.identifier}_${Il2Cpp3.application.version}`;
|
||
if (!ignoreAlreadyExistingDirectory && directoryExists(path)) {
|
||
raise(`directory ${path} already exists - pass ignoreAlreadyExistingDirectory = true to skip this check`);
|
||
}
|
||
for (const assembly of Il2Cpp3.domain.assemblies) {
|
||
inform(`dumping ${assembly.name}...`);
|
||
const destination = `${path}/${assembly.name.replaceAll(".", "/")}.cs`;
|
||
createDirectoryRecursively(destination.substring(0, destination.lastIndexOf("/")));
|
||
const file = new File(destination, "w");
|
||
for (const klass of assembly.image.classes) {
|
||
file.write(`${klass}
|
||
|
||
`);
|
||
}
|
||
file.flush();
|
||
file.close();
|
||
}
|
||
ok(`dump saved to ${path}`);
|
||
showDeprecationNotice();
|
||
}
|
||
Il2Cpp3.dumpTree = dumpTree;
|
||
function directoryExists(path) {
|
||
return Il2Cpp3.corlib.class("System.IO.Directory").method("Exists").invoke(Il2Cpp3.string(path));
|
||
}
|
||
function createDirectoryRecursively(path) {
|
||
Il2Cpp3.corlib.class("System.IO.Directory").method("CreateDirectory").invoke(Il2Cpp3.string(path));
|
||
}
|
||
function showDeprecationNotice() {
|
||
warn("this api will be removed in a future release, please use `npx frida-il2cpp-bridge dump` instead");
|
||
}
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
function installExceptionListener(targetThread = "current") {
|
||
const currentThread = Il2Cpp3.exports.threadGetCurrent();
|
||
return Interceptor.attach(Il2Cpp3.module.getExportByName("__cxa_throw"), function(args) {
|
||
if (targetThread == "current" && !Il2Cpp3.exports.threadGetCurrent().equals(currentThread)) {
|
||
return;
|
||
}
|
||
inform(new Il2Cpp3.Object(args[0].readPointer()));
|
||
});
|
||
}
|
||
Il2Cpp3.installExceptionListener = installExceptionListener;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
Il2Cpp3.exports = {
|
||
get alloc() {
|
||
return r("il2cpp_alloc", "pointer", ["size_t"]);
|
||
},
|
||
get arrayGetLength() {
|
||
return r("il2cpp_array_length", "uint32", ["pointer"]);
|
||
},
|
||
get arrayNew() {
|
||
return r("il2cpp_array_new", "pointer", ["pointer", "uint32"]);
|
||
},
|
||
get assemblyGetImage() {
|
||
return r("il2cpp_assembly_get_image", "pointer", ["pointer"]);
|
||
},
|
||
get classForEach() {
|
||
return r("il2cpp_class_for_each", "void", ["pointer", "pointer"]);
|
||
},
|
||
get classFromName() {
|
||
return r("il2cpp_class_from_name", "pointer", ["pointer", "pointer", "pointer"]);
|
||
},
|
||
get classFromObject() {
|
||
return r("il2cpp_class_from_system_type", "pointer", ["pointer"]);
|
||
},
|
||
get classGetArrayClass() {
|
||
return r("il2cpp_array_class_get", "pointer", ["pointer", "uint32"]);
|
||
},
|
||
get classGetArrayElementSize() {
|
||
return r("il2cpp_class_array_element_size", "int", ["pointer"]);
|
||
},
|
||
get classGetAssemblyName() {
|
||
return r("il2cpp_class_get_assemblyname", "pointer", ["pointer"]);
|
||
},
|
||
get classGetBaseType() {
|
||
return r("il2cpp_class_enum_basetype", "pointer", ["pointer"]);
|
||
},
|
||
get classGetDeclaringType() {
|
||
return r("il2cpp_class_get_declaring_type", "pointer", ["pointer"]);
|
||
},
|
||
get classGetElementClass() {
|
||
return r("il2cpp_class_get_element_class", "pointer", ["pointer"]);
|
||
},
|
||
get classGetFieldFromName() {
|
||
return r("il2cpp_class_get_field_from_name", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get classGetFields() {
|
||
return r("il2cpp_class_get_fields", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get classGetFlags() {
|
||
return r("il2cpp_class_get_flags", "int", ["pointer"]);
|
||
},
|
||
get classGetImage() {
|
||
return r("il2cpp_class_get_image", "pointer", ["pointer"]);
|
||
},
|
||
get classGetInstanceSize() {
|
||
return r("il2cpp_class_instance_size", "int32", ["pointer"]);
|
||
},
|
||
get classGetInterfaces() {
|
||
return r("il2cpp_class_get_interfaces", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get classGetMethodFromName() {
|
||
return r("il2cpp_class_get_method_from_name", "pointer", ["pointer", "pointer", "int"]);
|
||
},
|
||
get classGetMethods() {
|
||
return r("il2cpp_class_get_methods", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get classGetName() {
|
||
return r("il2cpp_class_get_name", "pointer", ["pointer"]);
|
||
},
|
||
get classGetNamespace() {
|
||
return r("il2cpp_class_get_namespace", "pointer", ["pointer"]);
|
||
},
|
||
get classGetNestedClasses() {
|
||
return r("il2cpp_class_get_nested_types", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get classGetParent() {
|
||
return r("il2cpp_class_get_parent", "pointer", ["pointer"]);
|
||
},
|
||
get classGetStaticFieldData() {
|
||
return r("il2cpp_class_get_static_field_data", "pointer", ["pointer"]);
|
||
},
|
||
get classGetValueTypeSize() {
|
||
return r("il2cpp_class_value_size", "int32", ["pointer", "pointer"]);
|
||
},
|
||
get classGetType() {
|
||
return r("il2cpp_class_get_type", "pointer", ["pointer"]);
|
||
},
|
||
get classHasReferences() {
|
||
return r("il2cpp_class_has_references", "bool", ["pointer"]);
|
||
},
|
||
get classInitialize() {
|
||
return r("il2cpp_runtime_class_init", "void", ["pointer"]);
|
||
},
|
||
get classIsAbstract() {
|
||
return r("il2cpp_class_is_abstract", "bool", ["pointer"]);
|
||
},
|
||
get classIsAssignableFrom() {
|
||
return r("il2cpp_class_is_assignable_from", "bool", ["pointer", "pointer"]);
|
||
},
|
||
get classIsBlittable() {
|
||
return r("il2cpp_class_is_blittable", "bool", ["pointer"]);
|
||
},
|
||
get classIsEnum() {
|
||
return r("il2cpp_class_is_enum", "bool", ["pointer"]);
|
||
},
|
||
get classIsGeneric() {
|
||
return r("il2cpp_class_is_generic", "bool", ["pointer"]);
|
||
},
|
||
get classIsInflated() {
|
||
return r("il2cpp_class_is_inflated", "bool", ["pointer"]);
|
||
},
|
||
get classIsInterface() {
|
||
return r("il2cpp_class_is_interface", "bool", ["pointer"]);
|
||
},
|
||
get classIsSubclassOf() {
|
||
return r("il2cpp_class_is_subclass_of", "bool", ["pointer", "pointer", "bool"]);
|
||
},
|
||
get classIsValueType() {
|
||
return r("il2cpp_class_is_valuetype", "bool", ["pointer"]);
|
||
},
|
||
get domainGetAssemblyFromName() {
|
||
return r("il2cpp_domain_assembly_open", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get domainGet() {
|
||
return r("il2cpp_domain_get", "pointer", []);
|
||
},
|
||
get domainGetAssemblies() {
|
||
return r("il2cpp_domain_get_assemblies", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get fieldGetClass() {
|
||
return r("il2cpp_field_get_parent", "pointer", ["pointer"]);
|
||
},
|
||
get fieldGetFlags() {
|
||
return r("il2cpp_field_get_flags", "int", ["pointer"]);
|
||
},
|
||
get fieldGetName() {
|
||
return r("il2cpp_field_get_name", "pointer", ["pointer"]);
|
||
},
|
||
get fieldGetOffset() {
|
||
return r("il2cpp_field_get_offset", "int32", ["pointer"]);
|
||
},
|
||
get fieldGetStaticValue() {
|
||
return r("il2cpp_field_static_get_value", "void", ["pointer", "pointer"]);
|
||
},
|
||
get fieldGetType() {
|
||
return r("il2cpp_field_get_type", "pointer", ["pointer"]);
|
||
},
|
||
get fieldSetStaticValue() {
|
||
return r("il2cpp_field_static_set_value", "void", ["pointer", "pointer"]);
|
||
},
|
||
get free() {
|
||
return r("il2cpp_free", "void", ["pointer"]);
|
||
},
|
||
get gcCollect() {
|
||
return r("il2cpp_gc_collect", "void", ["int"]);
|
||
},
|
||
get gcCollectALittle() {
|
||
return r("il2cpp_gc_collect_a_little", "void", []);
|
||
},
|
||
get gcDisable() {
|
||
return r("il2cpp_gc_disable", "void", []);
|
||
},
|
||
get gcEnable() {
|
||
return r("il2cpp_gc_enable", "void", []);
|
||
},
|
||
get gcGetHeapSize() {
|
||
return r("il2cpp_gc_get_heap_size", "int64", []);
|
||
},
|
||
get gcGetMaxTimeSlice() {
|
||
return r("il2cpp_gc_get_max_time_slice_ns", "int64", []);
|
||
},
|
||
get gcGetUsedSize() {
|
||
return r("il2cpp_gc_get_used_size", "int64", []);
|
||
},
|
||
get gcHandleGetTarget() {
|
||
return r("il2cpp_gchandle_get_target", "pointer", ["uint32"]);
|
||
},
|
||
get gcHandleFree() {
|
||
return r("il2cpp_gchandle_free", "void", ["uint32"]);
|
||
},
|
||
get gcHandleNew() {
|
||
return r("il2cpp_gchandle_new", "uint32", ["pointer", "bool"]);
|
||
},
|
||
get gcHandleNewWeakRef() {
|
||
return r("il2cpp_gchandle_new_weakref", "uint32", ["pointer", "bool"]);
|
||
},
|
||
get gcIsDisabled() {
|
||
return r("il2cpp_gc_is_disabled", "bool", []);
|
||
},
|
||
get gcIsIncremental() {
|
||
return r("il2cpp_gc_is_incremental", "bool", []);
|
||
},
|
||
get gcSetMaxTimeSlice() {
|
||
return r("il2cpp_gc_set_max_time_slice_ns", "void", ["int64"]);
|
||
},
|
||
get gcStartIncrementalCollection() {
|
||
return r("il2cpp_gc_start_incremental_collection", "void", []);
|
||
},
|
||
get gcStartWorld() {
|
||
return r("il2cpp_start_gc_world", "void", []);
|
||
},
|
||
get gcStopWorld() {
|
||
return r("il2cpp_stop_gc_world", "void", []);
|
||
},
|
||
get getCorlib() {
|
||
return r("il2cpp_get_corlib", "pointer", []);
|
||
},
|
||
get imageGetAssembly() {
|
||
return r("il2cpp_image_get_assembly", "pointer", ["pointer"]);
|
||
},
|
||
get imageGetClass() {
|
||
return r("il2cpp_image_get_class", "pointer", ["pointer", "uint"]);
|
||
},
|
||
get imageGetClassCount() {
|
||
return r("il2cpp_image_get_class_count", "uint32", ["pointer"]);
|
||
},
|
||
get imageGetName() {
|
||
return r("il2cpp_image_get_name", "pointer", ["pointer"]);
|
||
},
|
||
get initialize() {
|
||
return r("il2cpp_init", "void", ["pointer"]);
|
||
},
|
||
get livenessAllocateStruct() {
|
||
return r("il2cpp_unity_liveness_allocate_struct", "pointer", ["pointer", "int", "pointer", "pointer", "pointer"]);
|
||
},
|
||
get livenessCalculationBegin() {
|
||
return r("il2cpp_unity_liveness_calculation_begin", "pointer", ["pointer", "int", "pointer", "pointer", "pointer", "pointer"]);
|
||
},
|
||
get livenessCalculationEnd() {
|
||
return r("il2cpp_unity_liveness_calculation_end", "void", ["pointer"]);
|
||
},
|
||
get livenessCalculationFromStatics() {
|
||
return r("il2cpp_unity_liveness_calculation_from_statics", "void", ["pointer"]);
|
||
},
|
||
get livenessFinalize() {
|
||
return r("il2cpp_unity_liveness_finalize", "void", ["pointer"]);
|
||
},
|
||
get livenessFreeStruct() {
|
||
return r("il2cpp_unity_liveness_free_struct", "void", ["pointer"]);
|
||
},
|
||
get memorySnapshotCapture() {
|
||
return r("il2cpp_capture_memory_snapshot", "pointer", []);
|
||
},
|
||
get memorySnapshotFree() {
|
||
return r("il2cpp_free_captured_memory_snapshot", "void", ["pointer"]);
|
||
},
|
||
get memorySnapshotGetClasses() {
|
||
return r("il2cpp_memory_snapshot_get_classes", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get memorySnapshotGetObjects() {
|
||
return r("il2cpp_memory_snapshot_get_objects", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get methodGetClass() {
|
||
return r("il2cpp_method_get_class", "pointer", ["pointer"]);
|
||
},
|
||
get methodGetFlags() {
|
||
return r("il2cpp_method_get_flags", "uint32", ["pointer", "pointer"]);
|
||
},
|
||
get methodGetName() {
|
||
return r("il2cpp_method_get_name", "pointer", ["pointer"]);
|
||
},
|
||
get methodGetObject() {
|
||
return r("il2cpp_method_get_object", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get methodGetParameterCount() {
|
||
return r("il2cpp_method_get_param_count", "uint8", ["pointer"]);
|
||
},
|
||
get methodGetParameterName() {
|
||
return r("il2cpp_method_get_param_name", "pointer", ["pointer", "uint32"]);
|
||
},
|
||
get methodGetParameters() {
|
||
return r("il2cpp_method_get_parameters", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get methodGetParameterType() {
|
||
return r("il2cpp_method_get_param", "pointer", ["pointer", "uint32"]);
|
||
},
|
||
get methodGetReturnType() {
|
||
return r("il2cpp_method_get_return_type", "pointer", ["pointer"]);
|
||
},
|
||
get methodIsGeneric() {
|
||
return r("il2cpp_method_is_generic", "bool", ["pointer"]);
|
||
},
|
||
get methodIsInflated() {
|
||
return r("il2cpp_method_is_inflated", "bool", ["pointer"]);
|
||
},
|
||
get methodIsInstance() {
|
||
return r("il2cpp_method_is_instance", "bool", ["pointer"]);
|
||
},
|
||
get monitorEnter() {
|
||
return r("il2cpp_monitor_enter", "void", ["pointer"]);
|
||
},
|
||
get monitorExit() {
|
||
return r("il2cpp_monitor_exit", "void", ["pointer"]);
|
||
},
|
||
get monitorPulse() {
|
||
return r("il2cpp_monitor_pulse", "void", ["pointer"]);
|
||
},
|
||
get monitorPulseAll() {
|
||
return r("il2cpp_monitor_pulse_all", "void", ["pointer"]);
|
||
},
|
||
get monitorTryEnter() {
|
||
return r("il2cpp_monitor_try_enter", "bool", ["pointer", "uint32"]);
|
||
},
|
||
get monitorTryWait() {
|
||
return r("il2cpp_monitor_try_wait", "bool", ["pointer", "uint32"]);
|
||
},
|
||
get monitorWait() {
|
||
return r("il2cpp_monitor_wait", "void", ["pointer"]);
|
||
},
|
||
get objectGetClass() {
|
||
return r("il2cpp_object_get_class", "pointer", ["pointer"]);
|
||
},
|
||
get objectGetVirtualMethod() {
|
||
return r("il2cpp_object_get_virtual_method", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get objectInitialize() {
|
||
return r("il2cpp_runtime_object_init_exception", "void", ["pointer", "pointer"]);
|
||
},
|
||
get objectNew() {
|
||
return r("il2cpp_object_new", "pointer", ["pointer"]);
|
||
},
|
||
get objectGetSize() {
|
||
return r("il2cpp_object_get_size", "uint32", ["pointer"]);
|
||
},
|
||
get objectUnbox() {
|
||
return r("il2cpp_object_unbox", "pointer", ["pointer"]);
|
||
},
|
||
get resolveInternalCall() {
|
||
return r("il2cpp_resolve_icall", "pointer", ["pointer"]);
|
||
},
|
||
get stringGetChars() {
|
||
return r("il2cpp_string_chars", "pointer", ["pointer"]);
|
||
},
|
||
get stringGetLength() {
|
||
return r("il2cpp_string_length", "int32", ["pointer"]);
|
||
},
|
||
get stringNew() {
|
||
return r("il2cpp_string_new", "pointer", ["pointer"]);
|
||
},
|
||
get valueTypeBox() {
|
||
return r("il2cpp_value_box", "pointer", ["pointer", "pointer"]);
|
||
},
|
||
get threadAttach() {
|
||
return r("il2cpp_thread_attach", "pointer", ["pointer"]);
|
||
},
|
||
get threadDetach() {
|
||
return r("il2cpp_thread_detach", "void", ["pointer"]);
|
||
},
|
||
get threadGetAttachedThreads() {
|
||
return r("il2cpp_thread_get_all_attached_threads", "pointer", ["pointer"]);
|
||
},
|
||
get threadGetCurrent() {
|
||
return r("il2cpp_thread_current", "pointer", []);
|
||
},
|
||
get threadIsVm() {
|
||
return r("il2cpp_is_vm_thread", "bool", ["pointer"]);
|
||
},
|
||
get typeEquals() {
|
||
return r("il2cpp_type_equals", "bool", ["pointer", "pointer"]);
|
||
},
|
||
get typeGetClass() {
|
||
return r("il2cpp_class_from_type", "pointer", ["pointer"]);
|
||
},
|
||
get typeGetName() {
|
||
return r("il2cpp_type_get_name", "pointer", ["pointer"]);
|
||
},
|
||
get typeGetObject() {
|
||
return r("il2cpp_type_get_object", "pointer", ["pointer"]);
|
||
},
|
||
get typeGetTypeEnum() {
|
||
return r("il2cpp_type_get_type", "int", ["pointer"]);
|
||
}
|
||
};
|
||
decorate(Il2Cpp3.exports, lazy);
|
||
getter(Il2Cpp3, "memorySnapshotExports", () => new CModule("#include <stdint.h>\n#include <string.h>\n\ntypedef struct Il2CppManagedMemorySnapshot Il2CppManagedMemorySnapshot;\ntypedef struct Il2CppMetadataType Il2CppMetadataType;\n\nstruct Il2CppManagedMemorySnapshot\n{\n struct Il2CppManagedHeap\n {\n uint32_t section_count;\n void * sections;\n } heap;\n struct Il2CppStacks\n {\n uint32_t stack_count;\n void * stacks;\n } stacks;\n struct Il2CppMetadataSnapshot\n {\n uint32_t type_count;\n Il2CppMetadataType * types;\n } metadata_snapshot;\n struct Il2CppGCHandles\n {\n uint32_t tracked_object_count;\n void ** pointers_to_objects;\n } gc_handles;\n struct Il2CppRuntimeInformation\n {\n uint32_t pointer_size;\n uint32_t object_header_size;\n uint32_t array_header_size;\n uint32_t array_bounds_offset_in_header;\n uint32_t array_size_offset_in_header;\n uint32_t allocation_granularity;\n } runtime_information;\n void * additional_user_information;\n};\n\nstruct Il2CppMetadataType\n{\n uint32_t flags;\n void * fields;\n uint32_t field_count;\n uint32_t statics_size;\n uint8_t * statics;\n uint32_t base_or_element_type_index;\n char * name;\n const char * assembly_name;\n uint64_t type_info_address;\n uint32_t size;\n};\n\nuintptr_t\nil2cpp_memory_snapshot_get_classes (\n const Il2CppManagedMemorySnapshot * snapshot, Il2CppMetadataType ** iter)\n{\n const int zero = 0;\n const void * null = 0;\n\n if (iter != NULL && snapshot->metadata_snapshot.type_count > zero)\n {\n if (*iter == null)\n {\n *iter = snapshot->metadata_snapshot.types;\n return (uintptr_t) (*iter)->type_info_address;\n }\n else\n {\n Il2CppMetadataType * metadata_type = *iter + 1;\n\n if (metadata_type < snapshot->metadata_snapshot.types +\n snapshot->metadata_snapshot.type_count)\n {\n *iter = metadata_type;\n return (uintptr_t) (*iter)->type_info_address;\n }\n }\n }\n return 0;\n}\n\nvoid **\nil2cpp_memory_snapshot_get_objects (\n const Il2CppManagedMemorySnapshot * snapshot, uint32_t * size)\n{\n *size = snapshot->gc_handles.tracked_object_count;\n return snapshot->gc_handles.pointers_to_objects;\n}\n"), lazy);
|
||
function r(exportName, retType, argTypes) {
|
||
const handle = Il2Cpp3.$config.exports?.[exportName]?.() ?? Il2Cpp3.module.findExportByName(exportName) ?? Il2Cpp3.memorySnapshotExports[exportName];
|
||
const target = new NativeFunction(handle ?? NULL, retType, argTypes);
|
||
return target.isNull() ? new Proxy(target, {
|
||
get(value, name) {
|
||
const property = value[name];
|
||
return typeof property === "function" ? property.bind(value) : property;
|
||
},
|
||
apply() {
|
||
if (handle == null) {
|
||
raise(`couldn't resolve export ${exportName}`);
|
||
} else if (handle.isNull()) {
|
||
raise(`export ${exportName} points to NULL IL2CPP library has likely been stripped, obfuscated, or customized`);
|
||
}
|
||
}
|
||
}) : target;
|
||
}
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
function is(klass) {
|
||
return (element) => {
|
||
if (element instanceof Il2Cpp3.Class) {
|
||
return klass.isAssignableFrom(element);
|
||
} else {
|
||
return klass.isAssignableFrom(element.class);
|
||
}
|
||
};
|
||
}
|
||
Il2Cpp3.is = is;
|
||
function isExactly(klass) {
|
||
return (element) => {
|
||
if (element instanceof Il2Cpp3.Class) {
|
||
return element.equals(klass);
|
||
} else {
|
||
return element.class.equals(klass);
|
||
}
|
||
};
|
||
}
|
||
Il2Cpp3.isExactly = isExactly;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
Il2Cpp3.gc = {
|
||
/**
|
||
* Gets the heap size in bytes.
|
||
*/
|
||
get heapSize() {
|
||
return Il2Cpp3.exports.gcGetHeapSize();
|
||
},
|
||
/**
|
||
* Determines whether the garbage collector is enabled.
|
||
*/
|
||
get isEnabled() {
|
||
return !Il2Cpp3.exports.gcIsDisabled();
|
||
},
|
||
/**
|
||
* Determines whether the garbage collector is incremental
|
||
* ([source](https://docs.unity3d.com/Manual/performance-incremental-garbage-collection.html)).
|
||
*/
|
||
get isIncremental() {
|
||
return !!Il2Cpp3.exports.gcIsIncremental();
|
||
},
|
||
/**
|
||
* Gets the number of nanoseconds the garbage collector can spend in a
|
||
* collection step.
|
||
*/
|
||
get maxTimeSlice() {
|
||
return Il2Cpp3.exports.gcGetMaxTimeSlice();
|
||
},
|
||
/**
|
||
* Gets the used heap size in bytes.
|
||
*/
|
||
get usedHeapSize() {
|
||
return Il2Cpp3.exports.gcGetUsedSize();
|
||
},
|
||
/**
|
||
* Enables or disables the garbage collector.
|
||
*/
|
||
set isEnabled(value) {
|
||
value ? Il2Cpp3.exports.gcEnable() : Il2Cpp3.exports.gcDisable();
|
||
},
|
||
/**
|
||
* Sets the number of nanoseconds the garbage collector can spend in
|
||
* a collection step.
|
||
*/
|
||
set maxTimeSlice(nanoseconds) {
|
||
Il2Cpp3.exports.gcSetMaxTimeSlice(nanoseconds);
|
||
},
|
||
/**
|
||
* Returns the heap allocated objects of the specified class. \
|
||
* This variant reads GC descriptors.
|
||
*/
|
||
choose(klass) {
|
||
const matches = [];
|
||
const callback = (objects, size) => {
|
||
for (let i = 0; i < size; i++) {
|
||
matches.push(new Il2Cpp3.Object(objects.add(i * Process.pointerSize).readPointer()));
|
||
}
|
||
};
|
||
const chooseCallback = new NativeCallback(callback, "void", ["pointer", "int", "pointer"]);
|
||
if (Il2Cpp3.unityVersionIsBelow202120) {
|
||
const onWorld = new NativeCallback(() => {
|
||
}, "void", []);
|
||
const state = Il2Cpp3.exports.livenessCalculationBegin(klass, 0, chooseCallback, NULL, onWorld, onWorld);
|
||
Il2Cpp3.exports.livenessCalculationFromStatics(state);
|
||
Il2Cpp3.exports.livenessCalculationEnd(state);
|
||
} else {
|
||
const realloc = (handle, size) => {
|
||
if (!handle.isNull() && size.compare(0) == 0) {
|
||
Il2Cpp3.free(handle);
|
||
return NULL;
|
||
} else {
|
||
return Il2Cpp3.alloc(size);
|
||
}
|
||
};
|
||
const reallocCallback = new NativeCallback(realloc, "pointer", ["pointer", "size_t", "pointer"]);
|
||
this.stopWorld();
|
||
const state = Il2Cpp3.exports.livenessAllocateStruct(klass, 0, chooseCallback, NULL, reallocCallback);
|
||
Il2Cpp3.exports.livenessCalculationFromStatics(state);
|
||
Il2Cpp3.exports.livenessFinalize(state);
|
||
this.startWorld();
|
||
Il2Cpp3.exports.livenessFreeStruct(state);
|
||
}
|
||
return matches;
|
||
},
|
||
/**
|
||
* Forces a garbage collection of the specified generation.
|
||
*/
|
||
collect(generation) {
|
||
Il2Cpp3.exports.gcCollect(generation < 0 ? 0 : generation > 2 ? 2 : generation);
|
||
},
|
||
/**
|
||
* Forces a garbage collection.
|
||
*/
|
||
collectALittle() {
|
||
Il2Cpp3.exports.gcCollectALittle();
|
||
},
|
||
/**
|
||
* Resumes all the previously stopped threads.
|
||
*/
|
||
startWorld() {
|
||
return Il2Cpp3.exports.gcStartWorld();
|
||
},
|
||
/**
|
||
* Performs an incremental garbage collection.
|
||
*/
|
||
startIncrementalCollection() {
|
||
return Il2Cpp3.exports.gcStartIncrementalCollection();
|
||
},
|
||
/**
|
||
* Stops all threads which may access the garbage collected heap, other
|
||
* than the caller.
|
||
*/
|
||
stopWorld() {
|
||
return Il2Cpp3.exports.gcStopWorld();
|
||
}
|
||
};
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Android;
|
||
(function(Android2) {
|
||
getter(Android2, "apiLevel", () => {
|
||
const value = getProperty("ro.build.version.sdk");
|
||
return value ? parseInt(value) : null;
|
||
}, lazy);
|
||
function getProperty(name) {
|
||
const handle = Process.findModuleByName("libc.so")?.findExportByName("__system_property_get");
|
||
if (handle) {
|
||
const __system_property_get = new NativeFunction(handle, "void", ["pointer", "pointer"]);
|
||
const value = Memory.alloc(92).writePointer(NULL);
|
||
__system_property_get(Memory.allocUtf8String(name), value);
|
||
return value.readCString() ?? void 0;
|
||
}
|
||
}
|
||
})(Android || (Android = {}));
|
||
function raise(message) {
|
||
const error = new Error(message);
|
||
error.name = "Il2CppError";
|
||
error.stack = error.stack?.replace(/^(Il2Cpp)?Error/, "\x1B[0m\x1B[38;5;9mil2cpp\x1B[0m")?.replace(/\n at (.+) \((.+):(.+)\)/, "\x1B[3m\x1B[2m")?.concat("\x1B[0m");
|
||
throw error;
|
||
}
|
||
function warn(message) {
|
||
globalThis.console.log(`\x1B[38;5;11mil2cpp\x1B[0m: ${message}`);
|
||
}
|
||
function ok(message) {
|
||
globalThis.console.log(`\x1B[38;5;10mil2cpp\x1B[0m: ${message}`);
|
||
}
|
||
function inform(message) {
|
||
globalThis.console.log(`\x1B[38;5;12mil2cpp\x1B[0m: ${message}`);
|
||
}
|
||
function decorate(target, decorator, descriptors = Object.getOwnPropertyDescriptors(target)) {
|
||
for (const key in descriptors) {
|
||
descriptors[key] = decorator(target, key, descriptors[key]);
|
||
}
|
||
Object.defineProperties(target, descriptors);
|
||
return target;
|
||
}
|
||
function getter(target, key, get, decorator) {
|
||
globalThis.Object.defineProperty(target, key, decorator?.(target, key, { get, configurable: true }) ?? { get, configurable: true });
|
||
}
|
||
function cyrb53(str) {
|
||
let h1 = 3735928559;
|
||
let h2 = 1103547991;
|
||
for (let i = 0, ch; i < str.length; i++) {
|
||
ch = str.charCodeAt(i);
|
||
h1 = Math.imul(h1 ^ ch, 2654435761);
|
||
h2 = Math.imul(h2 ^ ch, 1597334677);
|
||
}
|
||
h1 = Math.imul(h1 ^ h1 >>> 16, 2246822507);
|
||
h1 ^= Math.imul(h2 ^ h2 >>> 13, 3266489909);
|
||
h2 = Math.imul(h2 ^ h2 >>> 16, 2246822507);
|
||
h2 ^= Math.imul(h1 ^ h1 >>> 13, 3266489909);
|
||
return 4294967296 * (2097151 & h2) + (h1 >>> 0);
|
||
}
|
||
function exportsHash(module) {
|
||
return cyrb53(module.enumerateExports().sort((a, b) => a.name.localeCompare(b.name)).map((_) => _.name + _.address.sub(module.base)).join(""));
|
||
}
|
||
function lazy(_, propertyKey, descriptor) {
|
||
const getter2 = descriptor.get;
|
||
if (!getter2) {
|
||
throw new Error("@lazy can only be applied to getter accessors");
|
||
}
|
||
descriptor.get = function() {
|
||
const value = getter2.call(this);
|
||
Object.defineProperty(this, propertyKey, {
|
||
value,
|
||
configurable: descriptor.configurable,
|
||
enumerable: descriptor.enumerable,
|
||
writable: false
|
||
});
|
||
return value;
|
||
};
|
||
return descriptor;
|
||
}
|
||
var NativeStruct = class {
|
||
handle;
|
||
constructor(handleOrWrapper) {
|
||
if (handleOrWrapper instanceof NativePointer) {
|
||
this.handle = handleOrWrapper;
|
||
} else {
|
||
this.handle = handleOrWrapper.handle;
|
||
}
|
||
}
|
||
equals(other) {
|
||
return this.handle.equals(other.handle);
|
||
}
|
||
isNull() {
|
||
return this.handle.isNull();
|
||
}
|
||
asNullable() {
|
||
return this.isNull() ? null : this;
|
||
}
|
||
};
|
||
function addFlippedEntries(obj) {
|
||
return Object.keys(obj).reduce((obj2, key) => (obj2[obj2[key]] = key, obj2), obj);
|
||
}
|
||
NativePointer.prototype.offsetOf = function(condition, depth) {
|
||
depth ??= 512;
|
||
for (let i = 0; depth > 0 ? i < depth : i < -depth; i++) {
|
||
if (condition(depth > 0 ? this.add(i) : this.sub(i))) {
|
||
return i;
|
||
}
|
||
}
|
||
return null;
|
||
};
|
||
function readNativeIterator(block) {
|
||
const array = [];
|
||
const iterator = Memory.alloc(Process.pointerSize);
|
||
let handle = block(iterator);
|
||
while (!handle.isNull()) {
|
||
array.push(handle);
|
||
handle = block(iterator);
|
||
}
|
||
return array;
|
||
}
|
||
function readNativeList(block) {
|
||
const lengthPointer = Memory.alloc(Process.pointerSize);
|
||
const startPointer = block(lengthPointer);
|
||
if (startPointer.isNull()) {
|
||
return [];
|
||
}
|
||
const array = new Array(lengthPointer.readInt());
|
||
for (let i = 0; i < array.length; i++) {
|
||
array[i] = startPointer.add(i * Process.pointerSize).readPointer();
|
||
}
|
||
return array;
|
||
}
|
||
function recycle(Class) {
|
||
return new Proxy(Class, {
|
||
cache: /* @__PURE__ */ new Map(),
|
||
construct(Target, argArray) {
|
||
const handle = argArray[0].toUInt32();
|
||
if (!this.cache.has(handle)) {
|
||
this.cache.set(handle, new Target(argArray[0]));
|
||
}
|
||
return this.cache.get(handle);
|
||
}
|
||
});
|
||
}
|
||
var UnityVersion;
|
||
(function(UnityVersion2) {
|
||
const pattern = /(6\d{3}|20\d{2}|\d)\.(\d)\.(\d{1,2})(?:[abcfp]|rc){0,2}\d?/;
|
||
function find(string) {
|
||
return string?.match(pattern)?.[0];
|
||
}
|
||
UnityVersion2.find = find;
|
||
function gte(a, b) {
|
||
return compare(a, b) >= 0;
|
||
}
|
||
UnityVersion2.gte = gte;
|
||
function lt(a, b) {
|
||
return compare(a, b) < 0;
|
||
}
|
||
UnityVersion2.lt = lt;
|
||
function compare(a, b) {
|
||
const aMatches = a.match(pattern);
|
||
const bMatches = b.match(pattern);
|
||
for (let i = 1; i <= 3; i++) {
|
||
const a2 = Number(aMatches?.[i] ?? -1);
|
||
const b2 = Number(bMatches?.[i] ?? -1);
|
||
if (a2 > b2)
|
||
return 1;
|
||
else if (a2 < b2)
|
||
return -1;
|
||
}
|
||
return 0;
|
||
}
|
||
})(UnityVersion || (UnityVersion = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
function alloc(size = Process.pointerSize) {
|
||
return Il2Cpp3.exports.alloc(size);
|
||
}
|
||
Il2Cpp3.alloc = alloc;
|
||
function free(pointer) {
|
||
return Il2Cpp3.exports.free(pointer);
|
||
}
|
||
Il2Cpp3.free = free;
|
||
function read(pointer, type) {
|
||
switch (type.enumValue) {
|
||
case Il2Cpp3.Type.Enum.BOOLEAN:
|
||
return !!pointer.readS8();
|
||
case Il2Cpp3.Type.Enum.BYTE:
|
||
return pointer.readS8();
|
||
case Il2Cpp3.Type.Enum.UBYTE:
|
||
return pointer.readU8();
|
||
case Il2Cpp3.Type.Enum.SHORT:
|
||
return pointer.readS16();
|
||
case Il2Cpp3.Type.Enum.USHORT:
|
||
return pointer.readU16();
|
||
case Il2Cpp3.Type.Enum.INT:
|
||
return pointer.readS32();
|
||
case Il2Cpp3.Type.Enum.UINT:
|
||
return pointer.readU32();
|
||
case Il2Cpp3.Type.Enum.CHAR:
|
||
return pointer.readU16();
|
||
case Il2Cpp3.Type.Enum.LONG:
|
||
return pointer.readS64();
|
||
case Il2Cpp3.Type.Enum.ULONG:
|
||
return pointer.readU64();
|
||
case Il2Cpp3.Type.Enum.FLOAT:
|
||
return pointer.readFloat();
|
||
case Il2Cpp3.Type.Enum.DOUBLE:
|
||
return pointer.readDouble();
|
||
case Il2Cpp3.Type.Enum.NINT:
|
||
case Il2Cpp3.Type.Enum.NUINT:
|
||
return pointer.readPointer();
|
||
case Il2Cpp3.Type.Enum.POINTER:
|
||
return new Il2Cpp3.Pointer(pointer.readPointer(), type.class.baseType);
|
||
case Il2Cpp3.Type.Enum.VALUE_TYPE:
|
||
return new Il2Cpp3.ValueType(pointer, type);
|
||
case Il2Cpp3.Type.Enum.OBJECT:
|
||
case Il2Cpp3.Type.Enum.CLASS:
|
||
return new Il2Cpp3.Object(pointer.readPointer());
|
||
case Il2Cpp3.Type.Enum.GENERIC_INSTANCE:
|
||
return type.class.isValueType ? new Il2Cpp3.ValueType(pointer, type) : new Il2Cpp3.Object(pointer.readPointer());
|
||
case Il2Cpp3.Type.Enum.STRING:
|
||
return new Il2Cpp3.String(pointer.readPointer());
|
||
case Il2Cpp3.Type.Enum.ARRAY:
|
||
case Il2Cpp3.Type.Enum.NARRAY:
|
||
return new Il2Cpp3.Array(pointer.readPointer());
|
||
}
|
||
raise(`couldn't read the value from ${pointer} using an unhandled or unknown type ${type.name} (${type.enumValue}), please file an issue`);
|
||
}
|
||
Il2Cpp3.read = read;
|
||
function write(pointer, value, type) {
|
||
switch (type.enumValue) {
|
||
case Il2Cpp3.Type.Enum.BOOLEAN:
|
||
return pointer.writeS8(+value);
|
||
case Il2Cpp3.Type.Enum.BYTE:
|
||
return pointer.writeS8(value);
|
||
case Il2Cpp3.Type.Enum.UBYTE:
|
||
return pointer.writeU8(value);
|
||
case Il2Cpp3.Type.Enum.SHORT:
|
||
return pointer.writeS16(value);
|
||
case Il2Cpp3.Type.Enum.USHORT:
|
||
return pointer.writeU16(value);
|
||
case Il2Cpp3.Type.Enum.INT:
|
||
return pointer.writeS32(value);
|
||
case Il2Cpp3.Type.Enum.UINT:
|
||
return pointer.writeU32(value);
|
||
case Il2Cpp3.Type.Enum.CHAR:
|
||
return pointer.writeU16(value);
|
||
case Il2Cpp3.Type.Enum.LONG:
|
||
return pointer.writeS64(value);
|
||
case Il2Cpp3.Type.Enum.ULONG:
|
||
return pointer.writeU64(value);
|
||
case Il2Cpp3.Type.Enum.FLOAT:
|
||
return pointer.writeFloat(value);
|
||
case Il2Cpp3.Type.Enum.DOUBLE:
|
||
return pointer.writeDouble(value);
|
||
case Il2Cpp3.Type.Enum.NINT:
|
||
case Il2Cpp3.Type.Enum.NUINT:
|
||
case Il2Cpp3.Type.Enum.POINTER:
|
||
case Il2Cpp3.Type.Enum.STRING:
|
||
case Il2Cpp3.Type.Enum.ARRAY:
|
||
case Il2Cpp3.Type.Enum.NARRAY:
|
||
return pointer.writePointer(value);
|
||
case Il2Cpp3.Type.Enum.VALUE_TYPE:
|
||
return Memory.copy(pointer, value, type.class.valueTypeSize), pointer;
|
||
case Il2Cpp3.Type.Enum.OBJECT:
|
||
case Il2Cpp3.Type.Enum.CLASS:
|
||
case Il2Cpp3.Type.Enum.GENERIC_INSTANCE:
|
||
return value instanceof Il2Cpp3.ValueType ? (Memory.copy(pointer, value, type.class.valueTypeSize), pointer) : pointer.writePointer(value);
|
||
}
|
||
raise(`couldn't write value ${value} to ${pointer} using an unhandled or unknown type ${type.name} (${type.enumValue}), please file an issue`);
|
||
}
|
||
Il2Cpp3.write = write;
|
||
function fromFridaValue(value, type) {
|
||
if (globalThis.Array.isArray(value)) {
|
||
const handle = Memory.alloc(type.class.valueTypeSize);
|
||
const fields = type.class.fields.filter((_) => !_.isStatic);
|
||
for (let i = 0; i < fields.length; i++) {
|
||
const convertedValue = fromFridaValue(value[i], fields[i].type);
|
||
write(handle.add(fields[i].offset).sub(Il2Cpp3.Object.headerSize), convertedValue, fields[i].type);
|
||
}
|
||
return new Il2Cpp3.ValueType(handle, type);
|
||
} else if (value instanceof NativePointer) {
|
||
if (type.isByReference) {
|
||
return new Il2Cpp3.Reference(value, type);
|
||
}
|
||
switch (type.enumValue) {
|
||
case Il2Cpp3.Type.Enum.POINTER:
|
||
return new Il2Cpp3.Pointer(value, type.class.baseType);
|
||
case Il2Cpp3.Type.Enum.STRING:
|
||
return new Il2Cpp3.String(value);
|
||
case Il2Cpp3.Type.Enum.CLASS:
|
||
case Il2Cpp3.Type.Enum.GENERIC_INSTANCE:
|
||
case Il2Cpp3.Type.Enum.OBJECT:
|
||
return new Il2Cpp3.Object(value);
|
||
case Il2Cpp3.Type.Enum.ARRAY:
|
||
case Il2Cpp3.Type.Enum.NARRAY:
|
||
return new Il2Cpp3.Array(value);
|
||
default:
|
||
return value;
|
||
}
|
||
} else if (type.enumValue == Il2Cpp3.Type.Enum.BOOLEAN) {
|
||
return !!value;
|
||
} else if (type.enumValue == Il2Cpp3.Type.Enum.VALUE_TYPE && type.class.isEnum) {
|
||
return fromFridaValue([value], type);
|
||
} else {
|
||
return value;
|
||
}
|
||
}
|
||
Il2Cpp3.fromFridaValue = fromFridaValue;
|
||
function toFridaValue(value) {
|
||
if (typeof value == "boolean") {
|
||
return +value;
|
||
} else if (value instanceof Il2Cpp3.ValueType) {
|
||
if (value.type.class.isEnum) {
|
||
return value.field("value__").value;
|
||
} else {
|
||
const _ = value.type.class.fields.filter((_2) => !_2.isStatic).map((_2) => toFridaValue(_2.bind(value).value));
|
||
return _.length == 0 ? [0] : _;
|
||
}
|
||
} else {
|
||
return value;
|
||
}
|
||
}
|
||
Il2Cpp3.toFridaValue = toFridaValue;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
getter(Il2Cpp3, "module", () => {
|
||
return tryModule() ?? raise("Could not find IL2CPP module");
|
||
});
|
||
async function initialize(blocking = false) {
|
||
const module = tryModule() ?? await new Promise((resolve) => {
|
||
const [moduleName, fallbackModuleName] = getExpectedModuleNames();
|
||
const timeout = setTimeout(() => {
|
||
warn(`after 10 seconds, IL2CPP module '${moduleName}' has not been loaded yet, is the app running?`);
|
||
}, 1e4);
|
||
const moduleObserver = Process.attachModuleObserver({
|
||
onAdded(module2) {
|
||
if (module2.name == moduleName || fallbackModuleName && module2.name == fallbackModuleName) {
|
||
clearTimeout(timeout);
|
||
setImmediate(() => {
|
||
resolve(module2);
|
||
moduleObserver.detach();
|
||
});
|
||
}
|
||
}
|
||
});
|
||
});
|
||
Reflect.defineProperty(Il2Cpp3, "module", { value: module });
|
||
if (Il2Cpp3.exports.getCorlib().isNull()) {
|
||
return await new Promise((resolve) => {
|
||
const timeout = setTimeout(() => {
|
||
if (!Il2Cpp3.exports.getCorlib().isNull()) {
|
||
warn(`resuming execution despite IL2CPP initialization not being captured in time, please open an issue as this is suboptimal`);
|
||
interceptor.detach();
|
||
resolve(false);
|
||
}
|
||
}, 1e3);
|
||
const interceptor = Interceptor.attach(Il2Cpp3.exports.initialize, {
|
||
onEnter() {
|
||
clearTimeout(timeout);
|
||
},
|
||
onLeave() {
|
||
interceptor.detach();
|
||
blocking ? resolve(true) : setImmediate(() => resolve(false));
|
||
}
|
||
});
|
||
});
|
||
}
|
||
return false;
|
||
}
|
||
Il2Cpp3.initialize = initialize;
|
||
function tryModule() {
|
||
const [moduleName, fallback] = getExpectedModuleNames();
|
||
return Process.findModuleByName(moduleName) ?? Process.findModuleByName(fallback ?? moduleName) ?? (Process.platform == "darwin" ? Process.findModuleByAddress(DebugSymbol.fromName("il2cpp_init").address) : void 0) ?? void 0;
|
||
}
|
||
function getExpectedModuleNames() {
|
||
if (Il2Cpp3.$config.moduleName) {
|
||
return [Il2Cpp3.$config.moduleName];
|
||
}
|
||
switch (Process.platform) {
|
||
case "linux":
|
||
return [Android.apiLevel ? "libil2cpp.so" : "GameAssembly.so"];
|
||
case "windows":
|
||
return ["GameAssembly.dll"];
|
||
case "darwin":
|
||
return ["UnityFramework", "GameAssembly.dylib"];
|
||
}
|
||
raise(`${Process.platform} is not supported yet`);
|
||
}
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
function nullable(valueOrNull, klass) {
|
||
const actualClass = typeof valueOrNull == "boolean" ? Il2Cpp3.corlib.class("System.Boolean") : typeof valueOrNull == "number" ? klass ?? Il2Cpp3.corlib.class("System.Int32") : valueOrNull instanceof Int64 ? Il2Cpp3.corlib.class("System.Int64") : valueOrNull instanceof UInt64 ? Il2Cpp3.corlib.class("System.UInt64") : valueOrNull instanceof NativePointer ? klass ?? Il2Cpp3.corlib.class("System.IntPtr") : valueOrNull instanceof Il2Cpp3.ValueType ? valueOrNull.type.class : klass ?? raise(`A class must be specified when constructing a nullable for value '${valueOrNull}'`);
|
||
if (actualClass.isValueType == false) {
|
||
raise(`Cannot create nullable value type out of a reference type '${actualClass.type.name}'`);
|
||
}
|
||
const inflatedClass = Il2Cpp3.corlib.class("System.Nullable`1").inflate(actualClass);
|
||
const struct = new Il2Cpp3.ValueType(Memory.alloc(inflatedClass.valueTypeSize), inflatedClass.type);
|
||
(struct.tryField("hasValue") ?? struct.field("has_value")).value = valueOrNull != null;
|
||
if (valueOrNull != null) {
|
||
struct.field("value").value = valueOrNull;
|
||
}
|
||
return struct;
|
||
}
|
||
Il2Cpp3.nullable = nullable;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
async function perform(block, flag = "bind") {
|
||
let attachedThread = null;
|
||
try {
|
||
const isInMainThread = await Il2Cpp3.initialize(flag == "main");
|
||
if (flag == "main" && !isInMainThread) {
|
||
return perform(() => Il2Cpp3.mainThread.schedule(block), "free");
|
||
}
|
||
if (Il2Cpp3.currentThread == null) {
|
||
attachedThread = Il2Cpp3.domain.attach();
|
||
}
|
||
if (flag == "bind" && attachedThread != null) {
|
||
Script.bindWeak(globalThis, () => attachedThread?.detach());
|
||
}
|
||
const result = block();
|
||
return result instanceof Promise ? await result : result;
|
||
} catch (error) {
|
||
Script.nextTick((_) => {
|
||
throw _;
|
||
}, error);
|
||
return Promise.reject(error);
|
||
} finally {
|
||
if (flag == "free" && attachedThread != null) {
|
||
attachedThread.detach();
|
||
}
|
||
}
|
||
}
|
||
Il2Cpp3.perform = perform;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class Tracer {
|
||
/** @internal */
|
||
#state = {
|
||
depth: 0,
|
||
buffer: [],
|
||
history: /* @__PURE__ */ new Set(),
|
||
flush: () => {
|
||
if (this.#state.depth == 0) {
|
||
const message = `
|
||
${this.#state.buffer.join("\n")}
|
||
`;
|
||
if (this.#verbose) {
|
||
inform(message);
|
||
} else {
|
||
const hash = cyrb53(message);
|
||
if (!this.#state.history.has(hash)) {
|
||
this.#state.history.add(hash);
|
||
inform(message);
|
||
}
|
||
}
|
||
this.#state.buffer.length = 0;
|
||
}
|
||
}
|
||
};
|
||
/** @internal */
|
||
#threadId = Il2Cpp3.mainThread.id;
|
||
/** @internal */
|
||
#verbose = false;
|
||
/** @internal */
|
||
#applier;
|
||
/** @internal */
|
||
#targets = [];
|
||
/** @internal */
|
||
#domain;
|
||
/** @internal */
|
||
#assemblies;
|
||
/** @internal */
|
||
#classes;
|
||
/** @internal */
|
||
#methods;
|
||
/** @internal */
|
||
#assemblyFilter;
|
||
/** @internal */
|
||
#classFilter;
|
||
/** @internal */
|
||
#methodFilter;
|
||
/** @internal */
|
||
#parameterFilter;
|
||
constructor(applier) {
|
||
this.#applier = applier;
|
||
}
|
||
/** */
|
||
thread(thread) {
|
||
this.#threadId = thread.id;
|
||
return this;
|
||
}
|
||
/** Determines whether print duplicate logs. */
|
||
verbose(value) {
|
||
this.#verbose = value;
|
||
return this;
|
||
}
|
||
/** Sets the application domain as the place where to find the target methods. */
|
||
domain() {
|
||
this.#domain = Il2Cpp3.domain;
|
||
return this;
|
||
}
|
||
/** Sets the passed `assemblies` as the place where to find the target methods. */
|
||
assemblies(...assemblies) {
|
||
this.#assemblies = assemblies;
|
||
return this;
|
||
}
|
||
/** Sets the passed `classes` as the place where to find the target methods. */
|
||
classes(...classes) {
|
||
this.#classes = classes;
|
||
return this;
|
||
}
|
||
/** Sets the passed `methods` as the target methods. */
|
||
methods(...methods) {
|
||
this.#methods = methods;
|
||
return this;
|
||
}
|
||
/** Filters the assemblies where to find the target methods. */
|
||
filterAssemblies(filter) {
|
||
this.#assemblyFilter = filter;
|
||
return this;
|
||
}
|
||
/** Filters the classes where to find the target methods. */
|
||
filterClasses(filter) {
|
||
this.#classFilter = filter;
|
||
return this;
|
||
}
|
||
/** Filters the target methods. */
|
||
filterMethods(filter) {
|
||
this.#methodFilter = filter;
|
||
return this;
|
||
}
|
||
/** Filters the target methods. */
|
||
filterParameters(filter) {
|
||
this.#parameterFilter = filter;
|
||
return this;
|
||
}
|
||
/** Commits the current changes by finding the target methods. */
|
||
and() {
|
||
const filterMethod = (method) => {
|
||
if (this.#parameterFilter == void 0) {
|
||
this.#targets.push(method);
|
||
return;
|
||
}
|
||
for (const parameter of method.parameters) {
|
||
if (this.#parameterFilter(parameter)) {
|
||
this.#targets.push(method);
|
||
break;
|
||
}
|
||
}
|
||
};
|
||
const filterMethods = (values) => {
|
||
for (const method of values) {
|
||
filterMethod(method);
|
||
}
|
||
};
|
||
const filterClass = (klass) => {
|
||
if (this.#methodFilter == void 0) {
|
||
filterMethods(klass.methods);
|
||
return;
|
||
}
|
||
for (const method of klass.methods) {
|
||
if (this.#methodFilter(method)) {
|
||
filterMethod(method);
|
||
}
|
||
}
|
||
};
|
||
const filterClasses = (values) => {
|
||
for (const klass of values) {
|
||
filterClass(klass);
|
||
}
|
||
};
|
||
const filterAssembly = (assembly) => {
|
||
if (this.#classFilter == void 0) {
|
||
filterClasses(assembly.image.classes);
|
||
return;
|
||
}
|
||
for (const klass of assembly.image.classes) {
|
||
if (this.#classFilter(klass)) {
|
||
filterClass(klass);
|
||
}
|
||
}
|
||
};
|
||
const filterAssemblies = (assemblies) => {
|
||
for (const assembly of assemblies) {
|
||
filterAssembly(assembly);
|
||
}
|
||
};
|
||
const filterDomain = (domain) => {
|
||
if (this.#assemblyFilter == void 0) {
|
||
filterAssemblies(domain.assemblies);
|
||
return;
|
||
}
|
||
for (const assembly of domain.assemblies) {
|
||
if (this.#assemblyFilter(assembly)) {
|
||
filterAssembly(assembly);
|
||
}
|
||
}
|
||
};
|
||
this.#methods ? filterMethods(this.#methods) : this.#classes ? filterClasses(this.#classes) : this.#assemblies ? filterAssemblies(this.#assemblies) : this.#domain ? filterDomain(this.#domain) : void 0;
|
||
this.#assemblies = void 0;
|
||
this.#classes = void 0;
|
||
this.#methods = void 0;
|
||
this.#assemblyFilter = void 0;
|
||
this.#classFilter = void 0;
|
||
this.#methodFilter = void 0;
|
||
this.#parameterFilter = void 0;
|
||
return this;
|
||
}
|
||
/** Starts tracing. */
|
||
attach() {
|
||
for (const target of this.#targets) {
|
||
if (!target.virtualAddress.isNull()) {
|
||
try {
|
||
this.#applier(target, this.#state, this.#threadId);
|
||
} catch (e) {
|
||
switch (e.message) {
|
||
case /unable to intercept function at \w+; please file a bug/.exec(e.message)?.input:
|
||
case "already replaced this function":
|
||
break;
|
||
default:
|
||
throw e;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
Il2Cpp3.Tracer = Tracer;
|
||
function trace(parameters = false) {
|
||
const applier = () => (method, state, threadId) => {
|
||
const paddedVirtualAddress = method.relativeVirtualAddress.toString(16).padStart(8, "0");
|
||
Interceptor.attach(method.virtualAddress, {
|
||
onEnter() {
|
||
if (this.threadId == threadId) {
|
||
state.buffer.push(`\x1B[2m0x${paddedVirtualAddress}\x1B[0m ${`\u2502 `.repeat(state.depth++)}\u250C\u2500\x1B[35m${method.class.type.name}::\x1B[1m${method.name}\x1B[0m\x1B[0m`);
|
||
}
|
||
},
|
||
onLeave() {
|
||
if (this.threadId == threadId) {
|
||
state.buffer.push(`\x1B[2m0x${paddedVirtualAddress}\x1B[0m ${`\u2502 `.repeat(--state.depth)}\u2514\u2500\x1B[33m${method.class.type.name}::\x1B[1m${method.name}\x1B[0m\x1B[0m`);
|
||
state.flush();
|
||
}
|
||
}
|
||
});
|
||
};
|
||
const applierWithParameters = () => (method, state, threadId) => {
|
||
const paddedVirtualAddress = method.relativeVirtualAddress.toString(16).padStart(8, "0");
|
||
const startIndex = +!method.isStatic | +Il2Cpp3.unityVersionIsBelow201830;
|
||
const callback = function(...args) {
|
||
if (this.threadId == threadId) {
|
||
const thisParameter = method.isStatic ? void 0 : new Il2Cpp3.Parameter("this", -1, method.class.type);
|
||
const parameters2 = thisParameter ? [thisParameter].concat(method.parameters) : method.parameters;
|
||
state.buffer.push(`\x1B[2m0x${paddedVirtualAddress}\x1B[0m ${`\u2502 `.repeat(state.depth++)}\u250C\u2500\x1B[35m${method.class.type.name}::\x1B[1m${method.name}\x1B[0m\x1B[0m(${parameters2.map((e) => `\x1B[32m${e.name}\x1B[0m = \x1B[31m${Il2Cpp3.fromFridaValue(args[e.position + startIndex], e.type)}\x1B[0m`).join(", ")})`);
|
||
}
|
||
const returnValue = method.nativeFunction(...args);
|
||
if (this.threadId == threadId) {
|
||
state.buffer.push(`\x1B[2m0x${paddedVirtualAddress}\x1B[0m ${`\u2502 `.repeat(--state.depth)}\u2514\u2500\x1B[33m${method.class.type.name}::\x1B[1m${method.name}\x1B[0m\x1B[0m${returnValue == void 0 ? "" : ` = \x1B[36m${Il2Cpp3.fromFridaValue(returnValue, method.returnType)}`}\x1B[0m`);
|
||
state.flush();
|
||
}
|
||
return returnValue;
|
||
};
|
||
method.revert();
|
||
const nativeCallback = new NativeCallback(callback, method.returnType.fridaAlias, method.fridaSignature);
|
||
Interceptor.replace(method.virtualAddress, nativeCallback);
|
||
};
|
||
return new Il2Cpp3.Tracer(parameters ? applierWithParameters() : applier());
|
||
}
|
||
Il2Cpp3.trace = trace;
|
||
function backtrace(mode) {
|
||
const methods = Il2Cpp3.domain.assemblies.flatMap((_) => _.image.classes.flatMap((_2) => _2.methods.filter((_3) => !_3.virtualAddress.isNull()))).sort((_, __) => _.virtualAddress.compare(__.virtualAddress));
|
||
const searchInsert = (target) => {
|
||
let left = 0;
|
||
let right = methods.length - 1;
|
||
while (left <= right) {
|
||
const pivot = Math.floor((left + right) / 2);
|
||
const comparison = methods[pivot].virtualAddress.compare(target);
|
||
if (comparison == 0) {
|
||
return methods[pivot];
|
||
} else if (comparison > 0) {
|
||
right = pivot - 1;
|
||
} else {
|
||
left = pivot + 1;
|
||
}
|
||
}
|
||
return methods[right];
|
||
};
|
||
const applier = () => (method, state, threadId) => {
|
||
Interceptor.attach(method.virtualAddress, function() {
|
||
if (this.threadId == threadId) {
|
||
const handles = globalThis.Thread.backtrace(this.context, mode);
|
||
handles.unshift(method.virtualAddress);
|
||
for (const handle of handles) {
|
||
if (handle.compare(Il2Cpp3.module.base) > 0 && handle.compare(Il2Cpp3.module.base.add(Il2Cpp3.module.size)) < 0) {
|
||
const method2 = searchInsert(handle);
|
||
if (method2) {
|
||
const offset = handle.sub(method2.virtualAddress);
|
||
if (offset.compare(4095) < 0) {
|
||
state.buffer.push(`\x1B[2m0x${method2.relativeVirtualAddress.toString(16).padStart(8, "0")}\x1B[0m\x1B[2m+0x${offset.toString(16).padStart(3, `0`)}\x1B[0m ${method2.class.type.name}::\x1B[1m${method2.name}\x1B[0m`);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
state.flush();
|
||
}
|
||
});
|
||
};
|
||
return new Il2Cpp3.Tracer(applier());
|
||
}
|
||
Il2Cpp3.backtrace = backtrace;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class Array2 extends NativeStruct {
|
||
/** Gets the Il2CppArray struct size, possibly equal to `Process.pointerSize * 4`. */
|
||
static get headerSize() {
|
||
return Il2Cpp3.corlib.class("System.Array").instanceSize;
|
||
}
|
||
/** @internal Gets a pointer to the first element of the current array. */
|
||
get elements() {
|
||
const array2 = Il2Cpp3.string("vfsfitvnm").object.method("ToCharArray", 0).invoke();
|
||
const offset = Memory.scanSync(array2.handle, 255, "76 00 66 00 73 00 66 00 69 00 74 00 76 00 6e 00 6d 00")[0]?.address?.sub(array2.handle) ?? raise("couldn't find the elements offset in the native array struct");
|
||
getter(Il2Cpp3.Array.prototype, "elements", function() {
|
||
return new Il2Cpp3.Pointer(this.handle.add(offset), this.elementType);
|
||
}, lazy);
|
||
return this.elements;
|
||
}
|
||
/** Gets the size of the object encompassed by the current array. */
|
||
get elementSize() {
|
||
return this.elementType.class.arrayElementSize;
|
||
}
|
||
/** Gets the type of the object encompassed by the current array. */
|
||
get elementType() {
|
||
return this.object.class.type.class.baseType;
|
||
}
|
||
/** Gets the total number of elements in all the dimensions of the current array. */
|
||
get length() {
|
||
return Il2Cpp3.exports.arrayGetLength(this);
|
||
}
|
||
/** Gets the encompassing object of the current array. */
|
||
get object() {
|
||
return new Il2Cpp3.Object(this);
|
||
}
|
||
/** Gets the element at the specified index of the current array. */
|
||
get(index) {
|
||
if (index < 0 || index >= this.length) {
|
||
raise(`cannot get element at index ${index} as the array length is ${this.length}`);
|
||
}
|
||
return this.elements.get(index);
|
||
}
|
||
/** Sets the element at the specified index of the current array. */
|
||
set(index, value) {
|
||
if (index < 0 || index >= this.length) {
|
||
raise(`cannot set element at index ${index} as the array length is ${this.length}`);
|
||
}
|
||
this.elements.set(index, value);
|
||
}
|
||
/** */
|
||
toString() {
|
||
return this.isNull() ? "null" : `[${this.elements.read(this.length, 0)}]`;
|
||
}
|
||
/** Iterable. */
|
||
*[Symbol.iterator]() {
|
||
for (let i = 0; i < this.length; i++) {
|
||
yield this.elements.get(i);
|
||
}
|
||
}
|
||
}
|
||
__decorate([
|
||
lazy
|
||
], Array2.prototype, "elementSize", null);
|
||
__decorate([
|
||
lazy
|
||
], Array2.prototype, "elementType", null);
|
||
__decorate([
|
||
lazy
|
||
], Array2.prototype, "length", null);
|
||
__decorate([
|
||
lazy
|
||
], Array2.prototype, "object", null);
|
||
__decorate([
|
||
lazy
|
||
], Array2, "headerSize", null);
|
||
Il2Cpp3.Array = Array2;
|
||
function array(klass, lengthOrElements) {
|
||
const length = typeof lengthOrElements == "number" ? lengthOrElements : lengthOrElements.length;
|
||
const array2 = new Il2Cpp3.Array(Il2Cpp3.exports.arrayNew(klass, length));
|
||
if (globalThis.Array.isArray(lengthOrElements)) {
|
||
array2.elements.write(lengthOrElements);
|
||
}
|
||
return array2;
|
||
}
|
||
Il2Cpp3.array = array;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
let Assembly = class Assembly extends NativeStruct {
|
||
/** Gets the image of this assembly. */
|
||
get image() {
|
||
if (Il2Cpp3.exports.assemblyGetImage.isNull()) {
|
||
const runtimeModule = this.object.tryMethod("GetType", 1)?.invoke(Il2Cpp3.string("<Module>"))?.asNullable()?.tryMethod("get_Module")?.invoke() ?? this.object.tryMethod("GetModules", 1)?.invoke(false)?.get(0) ?? raise(`couldn't find the runtime module object of assembly ${this.name}`);
|
||
return new Il2Cpp3.Image(runtimeModule.field("_impl").value);
|
||
}
|
||
return new Il2Cpp3.Image(Il2Cpp3.exports.assemblyGetImage(this));
|
||
}
|
||
/** Gets the name of this assembly. */
|
||
get name() {
|
||
return this.image.name.replace(".dll", "");
|
||
}
|
||
/** Gets the encompassing object of the current assembly. */
|
||
get object() {
|
||
for (const _ of Il2Cpp3.domain.object.method("GetAssemblies", 1).invoke(false)) {
|
||
if (_.field("_mono_assembly").value.equals(this)) {
|
||
return _;
|
||
}
|
||
}
|
||
raise("couldn't find the object of the native assembly struct");
|
||
}
|
||
};
|
||
__decorate([
|
||
lazy
|
||
], Assembly.prototype, "name", null);
|
||
__decorate([
|
||
lazy
|
||
], Assembly.prototype, "object", null);
|
||
Assembly = __decorate([
|
||
recycle
|
||
], Assembly);
|
||
Il2Cpp3.Assembly = Assembly;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
let Class = class Class extends NativeStruct {
|
||
/** Gets the actual size of the instance of the current class. */
|
||
get actualInstanceSize() {
|
||
const SystemString = Il2Cpp3.corlib.class("System.String");
|
||
const offset = SystemString.handle.offsetOf((_) => _.readInt() == SystemString.instanceSize - 2) ?? raise("couldn't find the actual instance size offset in the native class struct");
|
||
getter(Il2Cpp3.Class.prototype, "actualInstanceSize", function() {
|
||
return this.handle.add(offset).readS32();
|
||
}, lazy);
|
||
return this.actualInstanceSize;
|
||
}
|
||
/** Gets the array class which encompass the current class. */
|
||
get arrayClass() {
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.classGetArrayClass(this, 1));
|
||
}
|
||
/** Gets the size of the object encompassed by the current array class. */
|
||
get arrayElementSize() {
|
||
return Il2Cpp3.exports.classGetArrayElementSize(this);
|
||
}
|
||
/** Gets the name of the assembly in which the current class is defined. */
|
||
get assemblyName() {
|
||
return Il2Cpp3.exports.classGetAssemblyName(this).readUtf8String().replace(".dll", "");
|
||
}
|
||
/** Gets the class that declares the current nested class. */
|
||
get declaringClass() {
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.classGetDeclaringType(this)).asNullable();
|
||
}
|
||
/** Gets the encompassed type of this array, reference, pointer or enum type. */
|
||
get baseType() {
|
||
return new Il2Cpp3.Type(Il2Cpp3.exports.classGetBaseType(this)).asNullable();
|
||
}
|
||
/** Gets the class of the object encompassed or referred to by the current array, pointer or reference class. */
|
||
get elementClass() {
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.classGetElementClass(this)).asNullable();
|
||
}
|
||
/** Gets the fields of the current class. */
|
||
get fields() {
|
||
return readNativeIterator((_) => Il2Cpp3.exports.classGetFields(this, _)).map((_) => new Il2Cpp3.Field(_));
|
||
}
|
||
/** Gets the flags of the current class. */
|
||
get flags() {
|
||
return Il2Cpp3.exports.classGetFlags(this);
|
||
}
|
||
/** Gets the full name (namespace + name) of the current class. */
|
||
get fullName() {
|
||
return this.namespace ? `${this.namespace}.${this.name}` : this.name;
|
||
}
|
||
/** Gets the generic class of the current class if the current class is inflated. */
|
||
get genericClass() {
|
||
const klass = this.image.tryClass(this.fullName)?.asNullable();
|
||
return klass?.equals(this) ? null : klass ?? null;
|
||
}
|
||
/** Gets the generics parameters of this generic class. */
|
||
get generics() {
|
||
if (!this.isGeneric && !this.isInflated) {
|
||
return [];
|
||
}
|
||
const types = this.type.object.method("GetGenericArguments").invoke();
|
||
return globalThis.Array.from(types).map((_) => new Il2Cpp3.Class(Il2Cpp3.exports.classFromObject(_)));
|
||
}
|
||
/** Determines whether the GC has tracking references to the current class instances. */
|
||
get hasReferences() {
|
||
return !!Il2Cpp3.exports.classHasReferences(this);
|
||
}
|
||
/** Determines whether ther current class has a valid static constructor. */
|
||
get hasStaticConstructor() {
|
||
const staticConstructor = this.tryMethod(".cctor");
|
||
return staticConstructor != null && !staticConstructor.virtualAddress.isNull();
|
||
}
|
||
/** Gets the image in which the current class is defined. */
|
||
get image() {
|
||
return new Il2Cpp3.Image(Il2Cpp3.exports.classGetImage(this));
|
||
}
|
||
/** Gets the size of the instance of the current class. */
|
||
get instanceSize() {
|
||
return Il2Cpp3.exports.classGetInstanceSize(this);
|
||
}
|
||
/** Determines whether the current class is abstract. */
|
||
get isAbstract() {
|
||
return !!Il2Cpp3.exports.classIsAbstract(this);
|
||
}
|
||
/** Determines whether the current class is blittable. */
|
||
get isBlittable() {
|
||
return !!Il2Cpp3.exports.classIsBlittable(this);
|
||
}
|
||
/** Determines whether the current class is an enumeration. */
|
||
get isEnum() {
|
||
return !!Il2Cpp3.exports.classIsEnum(this);
|
||
}
|
||
/** Determines whether the current class is a generic one. */
|
||
get isGeneric() {
|
||
return !!Il2Cpp3.exports.classIsGeneric(this);
|
||
}
|
||
/** Determines whether the current class is inflated. */
|
||
get isInflated() {
|
||
return !!Il2Cpp3.exports.classIsInflated(this);
|
||
}
|
||
/** Determines whether the current class is an interface. */
|
||
get isInterface() {
|
||
return !!Il2Cpp3.exports.classIsInterface(this);
|
||
}
|
||
/** Determines whether the current class is a struct. */
|
||
get isStruct() {
|
||
return this.isValueType && !this.isEnum;
|
||
}
|
||
/** Determines whether the current class is a value type. */
|
||
get isValueType() {
|
||
return !!Il2Cpp3.exports.classIsValueType(this);
|
||
}
|
||
/** Gets the interfaces implemented or inherited by the current class. */
|
||
get interfaces() {
|
||
return readNativeIterator((_) => Il2Cpp3.exports.classGetInterfaces(this, _)).map((_) => new Il2Cpp3.Class(_));
|
||
}
|
||
/** Gets the methods implemented by the current class. */
|
||
get methods() {
|
||
return readNativeIterator((_) => Il2Cpp3.exports.classGetMethods(this, _)).map((_) => new Il2Cpp3.Method(_));
|
||
}
|
||
/** Gets the name of the current class. */
|
||
get name() {
|
||
return Il2Cpp3.exports.classGetName(this).readUtf8String();
|
||
}
|
||
/** Gets the namespace of the current class. */
|
||
get namespace() {
|
||
return Il2Cpp3.exports.classGetNamespace(this).readUtf8String() || void 0;
|
||
}
|
||
/** Gets the classes nested inside the current class. */
|
||
get nestedClasses() {
|
||
return readNativeIterator((_) => Il2Cpp3.exports.classGetNestedClasses(this, _)).map((_) => new Il2Cpp3.Class(_));
|
||
}
|
||
/** Gets the class from which the current class directly inherits. */
|
||
get parent() {
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.classGetParent(this)).asNullable();
|
||
}
|
||
/** Gets the pointer class of the current class. */
|
||
get pointerClass() {
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.classFromObject(this.type.object.method("MakePointerType").invoke()));
|
||
}
|
||
/** Gets the rank (number of dimensions) of the current array class. */
|
||
get rank() {
|
||
let rank = 0;
|
||
const name = this.name;
|
||
for (let i = this.name.length - 1; i > 0; i--) {
|
||
const c = name[i];
|
||
if (c == "]")
|
||
rank++;
|
||
else if (c == "[" || rank == 0)
|
||
break;
|
||
else if (c == ",")
|
||
rank++;
|
||
else
|
||
break;
|
||
}
|
||
return rank;
|
||
}
|
||
/** Gets a pointer to the static fields of the current class. */
|
||
get staticFieldsData() {
|
||
return Il2Cpp3.exports.classGetStaticFieldData(this);
|
||
}
|
||
/** Gets the size of the instance - as a value type - of the current class. */
|
||
get valueTypeSize() {
|
||
return Il2Cpp3.exports.classGetValueTypeSize(this, NULL);
|
||
}
|
||
/** Gets the type of the current class. */
|
||
get type() {
|
||
return new Il2Cpp3.Type(Il2Cpp3.exports.classGetType(this));
|
||
}
|
||
/** Allocates a new object of the current class. */
|
||
alloc() {
|
||
return new Il2Cpp3.Object(Il2Cpp3.exports.objectNew(this));
|
||
}
|
||
/** Gets the field identified by the given name. */
|
||
field(name) {
|
||
return this.tryField(name) ?? raise(`couldn't find field ${name} in class ${this.type.name}`);
|
||
}
|
||
/** Gets the hierarchy of the current class. */
|
||
*hierarchy(options) {
|
||
let klass = options?.includeCurrent ?? true ? this : this.parent;
|
||
while (klass) {
|
||
yield klass;
|
||
klass = klass.parent;
|
||
}
|
||
}
|
||
/** Builds a generic instance of the current generic class. */
|
||
inflate(...classes) {
|
||
if (!this.isGeneric) {
|
||
raise(`cannot inflate class ${this.type.name} as it has no generic parameters`);
|
||
}
|
||
if (this.generics.length != classes.length) {
|
||
raise(`cannot inflate class ${this.type.name} as it needs ${this.generics.length} generic parameter(s), not ${classes.length}`);
|
||
}
|
||
const types = classes.map((_) => _.type.object);
|
||
const typeArray = Il2Cpp3.array(Il2Cpp3.corlib.class("System.Type"), types);
|
||
const inflatedType = this.type.object.method("MakeGenericType", 1).invoke(typeArray);
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.classFromObject(inflatedType));
|
||
}
|
||
/** Calls the static constructor of the current class. */
|
||
initialize() {
|
||
Il2Cpp3.exports.classInitialize(this);
|
||
return this;
|
||
}
|
||
/** Determines whether an instance of `other` class can be assigned to a variable of the current type. */
|
||
isAssignableFrom(other) {
|
||
return !!Il2Cpp3.exports.classIsAssignableFrom(this, other);
|
||
}
|
||
/** Determines whether the current class derives from `other` class. */
|
||
isSubclassOf(other, checkInterfaces) {
|
||
return !!Il2Cpp3.exports.classIsSubclassOf(this, other, +checkInterfaces);
|
||
}
|
||
/** Gets the method identified by the given name and parameter count. */
|
||
method(name, parameterCount = -1) {
|
||
return this.tryMethod(name, parameterCount) ?? raise(`couldn't find method ${name} in class ${this.type.name}`);
|
||
}
|
||
/** Gets the nested class with the given name. */
|
||
nested(name) {
|
||
return this.tryNested(name) ?? raise(`couldn't find nested class ${name} in class ${this.type.name}`);
|
||
}
|
||
/** Allocates a new object of the current class and calls its default constructor. */
|
||
new() {
|
||
const object = this.alloc();
|
||
const exceptionArray = Memory.alloc(Process.pointerSize);
|
||
Il2Cpp3.exports.objectInitialize(object, exceptionArray);
|
||
const exception = exceptionArray.readPointer();
|
||
if (!exception.isNull()) {
|
||
raise(new Il2Cpp3.Object(exception).toString());
|
||
}
|
||
return object;
|
||
}
|
||
/** Gets the field with the given name. */
|
||
tryField(name) {
|
||
return new Il2Cpp3.Field(Il2Cpp3.exports.classGetFieldFromName(this, Memory.allocUtf8String(name))).asNullable();
|
||
}
|
||
/** Gets the method with the given name and parameter count. */
|
||
tryMethod(name, parameterCount = -1) {
|
||
return new Il2Cpp3.Method(Il2Cpp3.exports.classGetMethodFromName(this, Memory.allocUtf8String(name), parameterCount)).asNullable();
|
||
}
|
||
/** Gets the nested class with the given name. */
|
||
tryNested(name) {
|
||
return this.nestedClasses.find((_) => _.name == name);
|
||
}
|
||
/** */
|
||
toString() {
|
||
const inherited = [this.parent].concat(this.interfaces);
|
||
return `// ${this.assemblyName}
|
||
${this.isEnum ? `enum` : this.isStruct ? `struct` : this.isInterface ? `interface` : `class`} ${this.type.name}${inherited ? ` : ${inherited.map((_) => _?.type.name).join(`, `)}` : ``}
|
||
{
|
||
${this.fields.join(`
|
||
`)}
|
||
${this.methods.join(`
|
||
`)}
|
||
}`;
|
||
}
|
||
/** Executes a callback for every defined class. */
|
||
static enumerate(block) {
|
||
const callback = new NativeCallback((_) => block(new Il2Cpp3.Class(_)), "void", ["pointer", "pointer"]);
|
||
return Il2Cpp3.exports.classForEach(callback, NULL);
|
||
}
|
||
};
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "arrayClass", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "arrayElementSize", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "assemblyName", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "declaringClass", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "baseType", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "elementClass", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "fields", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "flags", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "fullName", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "generics", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "hasReferences", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "hasStaticConstructor", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "image", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "instanceSize", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "isAbstract", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "isBlittable", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "isEnum", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "isGeneric", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "isInflated", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "isInterface", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "isValueType", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "interfaces", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "methods", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "name", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "namespace", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "nestedClasses", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "parent", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "pointerClass", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "rank", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "staticFieldsData", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "valueTypeSize", null);
|
||
__decorate([
|
||
lazy
|
||
], Class.prototype, "type", null);
|
||
Class = __decorate([
|
||
recycle
|
||
], Class);
|
||
Il2Cpp3.Class = Class;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
function delegate(klass, block) {
|
||
const SystemDelegate = Il2Cpp3.corlib.class("System.Delegate");
|
||
const SystemMulticastDelegate = Il2Cpp3.corlib.class("System.MulticastDelegate");
|
||
if (!SystemDelegate.isAssignableFrom(klass)) {
|
||
raise(`cannot create a delegate for ${klass.type.name} as it's a non-delegate class`);
|
||
}
|
||
if (klass.equals(SystemDelegate) || klass.equals(SystemMulticastDelegate)) {
|
||
raise(`cannot create a delegate for neither ${SystemDelegate.type.name} nor ${SystemMulticastDelegate.type.name}, use a subclass instead`);
|
||
}
|
||
const delegate2 = klass.alloc();
|
||
const key = delegate2.handle.toString();
|
||
const Invoke = delegate2.tryMethod("Invoke") ?? raise(`cannot create a delegate for ${klass.type.name}, there is no Invoke method`);
|
||
delegate2.method(".ctor").invoke(delegate2, Invoke.handle);
|
||
const callback = Invoke.wrap(block);
|
||
delegate2.field("method_ptr").value = callback;
|
||
delegate2.field("invoke_impl").value = callback;
|
||
Il2Cpp3._callbacksToKeepAlive[key] = callback;
|
||
return delegate2;
|
||
}
|
||
Il2Cpp3.delegate = delegate;
|
||
Il2Cpp3._callbacksToKeepAlive = {};
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
let Domain = class Domain extends NativeStruct {
|
||
/** Gets the assemblies that have been loaded into the execution context of the application domain. */
|
||
get assemblies() {
|
||
let handles = readNativeList((_) => Il2Cpp3.exports.domainGetAssemblies(this, _));
|
||
if (handles.length == 0) {
|
||
const assemblyObjects = this.object.method("GetAssemblies").overload().invoke();
|
||
handles = globalThis.Array.from(assemblyObjects).map((_) => _.field("_mono_assembly").value);
|
||
}
|
||
return handles.map((_) => new Il2Cpp3.Assembly(_));
|
||
}
|
||
/** Gets the encompassing object of the application domain. */
|
||
get object() {
|
||
return Il2Cpp3.corlib.class("System.AppDomain").method("get_CurrentDomain").invoke();
|
||
}
|
||
/** Opens and loads the assembly with the given name. */
|
||
assembly(name) {
|
||
return this.tryAssembly(name) ?? raise(`couldn't find assembly ${name}`);
|
||
}
|
||
/** Attached a new thread to the application domain. */
|
||
attach() {
|
||
return new Il2Cpp3.Thread(Il2Cpp3.exports.threadAttach(this));
|
||
}
|
||
/** Opens and loads the assembly with the given name. */
|
||
tryAssembly(name) {
|
||
return new Il2Cpp3.Assembly(Il2Cpp3.exports.domainGetAssemblyFromName(this, Memory.allocUtf8String(name))).asNullable();
|
||
}
|
||
};
|
||
__decorate([
|
||
lazy
|
||
], Domain.prototype, "assemblies", null);
|
||
__decorate([
|
||
lazy
|
||
], Domain.prototype, "object", null);
|
||
Domain = __decorate([
|
||
recycle
|
||
], Domain);
|
||
Il2Cpp3.Domain = Domain;
|
||
getter(Il2Cpp3, "domain", () => {
|
||
return new Il2Cpp3.Domain(Il2Cpp3.exports.domainGet());
|
||
}, lazy);
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class Field extends NativeStruct {
|
||
/** Gets the class in which this field is defined. */
|
||
get class() {
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.fieldGetClass(this));
|
||
}
|
||
/** Gets the flags of the current field. */
|
||
get flags() {
|
||
return Il2Cpp3.exports.fieldGetFlags(this);
|
||
}
|
||
/** Determines whether this field value is known at compile time. */
|
||
get isLiteral() {
|
||
return (this.flags & 64) != 0;
|
||
}
|
||
/** Determines whether this field is static. */
|
||
get isStatic() {
|
||
return (this.flags & 16) != 0;
|
||
}
|
||
/** Determines whether this field is thread static. */
|
||
get isThreadStatic() {
|
||
const offset = Il2Cpp3.corlib.class("System.AppDomain").field("type_resolve_in_progress").offset;
|
||
getter(Il2Cpp3.Field.prototype, "isThreadStatic", function() {
|
||
return this.offset == offset;
|
||
}, lazy);
|
||
return this.isThreadStatic;
|
||
}
|
||
/** Gets the access modifier of this field. */
|
||
get modifier() {
|
||
switch (this.flags & 7) {
|
||
case 1:
|
||
return "private";
|
||
case 2:
|
||
return "private protected";
|
||
case 3:
|
||
return "internal";
|
||
case 4:
|
||
return "protected";
|
||
case 5:
|
||
return "protected internal";
|
||
case 6:
|
||
return "public";
|
||
}
|
||
}
|
||
/** Gets the name of this field. */
|
||
get name() {
|
||
return Il2Cpp3.exports.fieldGetName(this).readUtf8String();
|
||
}
|
||
/** Gets the offset of this field, calculated as the difference with its owner virtual address. */
|
||
get offset() {
|
||
return Il2Cpp3.exports.fieldGetOffset(this);
|
||
}
|
||
/** Gets the type of this field. */
|
||
get type() {
|
||
return new Il2Cpp3.Type(Il2Cpp3.exports.fieldGetType(this));
|
||
}
|
||
/** Gets the value of this field. */
|
||
get value() {
|
||
if (!this.isStatic) {
|
||
raise(`cannot access instance field ${this.class.type.name}::${this.name} from a class, use an object instead`);
|
||
}
|
||
const handle = Memory.alloc(Process.pointerSize);
|
||
Il2Cpp3.exports.fieldGetStaticValue(this.handle, handle);
|
||
return Il2Cpp3.read(handle, this.type);
|
||
}
|
||
/** Sets the value of this field. Thread static or literal values cannot be altered yet. */
|
||
set value(value) {
|
||
if (!this.isStatic) {
|
||
raise(`cannot access instance field ${this.class.type.name}::${this.name} from a class, use an object instead`);
|
||
}
|
||
if (this.isThreadStatic || this.isLiteral) {
|
||
raise(`cannot write the value of field ${this.name} as it's thread static or literal`);
|
||
}
|
||
const handle = (
|
||
// pointer-like values should be passed as-is, but boxed
|
||
// value types (primitives included) must be unboxed first
|
||
value instanceof Il2Cpp3.Object && this.type.class.isValueType ? value.unbox() : value instanceof NativeStruct ? value.handle : value instanceof NativePointer ? value : Il2Cpp3.write(Memory.alloc(this.type.class.valueTypeSize), value, this.type)
|
||
);
|
||
Il2Cpp3.exports.fieldSetStaticValue(this.handle, handle);
|
||
}
|
||
/** */
|
||
toString() {
|
||
return `${this.isThreadStatic ? `[ThreadStatic] ` : ``}${this.isStatic ? `static ` : ``}${this.type.name} ${this.name}${this.isLiteral ? ` = ${this.type.class.isEnum ? Il2Cpp3.read(this.value.handle, this.type.class.baseType) : this.value}` : ``};${this.isThreadStatic || this.isLiteral ? `` : ` // 0x${this.offset.toString(16)}`}`;
|
||
}
|
||
/**
|
||
* @internal
|
||
* Binds the current field to a {@link Il2Cpp.Object} or a
|
||
* {@link Il2Cpp.ValueType} (also known as *instances*), so that it is
|
||
* possible to retrieve its value - see {@link Il2Cpp.Field.value} for
|
||
* details. \
|
||
* Binding a static field is forbidden.
|
||
*/
|
||
bind(instance) {
|
||
if (this.isStatic) {
|
||
raise(`cannot bind static field ${this.class.type.name}::${this.name} to an instance`);
|
||
}
|
||
const offset = this.offset - (instance instanceof Il2Cpp3.ValueType ? Il2Cpp3.Object.headerSize : 0);
|
||
return new Proxy(this, {
|
||
get(target, property) {
|
||
if (property == "value") {
|
||
return Il2Cpp3.read(instance.handle.add(offset), target.type);
|
||
}
|
||
return Reflect.get(target, property);
|
||
},
|
||
set(target, property, value) {
|
||
if (property == "value") {
|
||
Il2Cpp3.write(instance.handle.add(offset), value, target.type);
|
||
return true;
|
||
}
|
||
return Reflect.set(target, property, value);
|
||
}
|
||
});
|
||
}
|
||
}
|
||
__decorate([
|
||
lazy
|
||
], Field.prototype, "class", null);
|
||
__decorate([
|
||
lazy
|
||
], Field.prototype, "flags", null);
|
||
__decorate([
|
||
lazy
|
||
], Field.prototype, "isLiteral", null);
|
||
__decorate([
|
||
lazy
|
||
], Field.prototype, "isStatic", null);
|
||
__decorate([
|
||
lazy
|
||
], Field.prototype, "isThreadStatic", null);
|
||
__decorate([
|
||
lazy
|
||
], Field.prototype, "modifier", null);
|
||
__decorate([
|
||
lazy
|
||
], Field.prototype, "name", null);
|
||
__decorate([
|
||
lazy
|
||
], Field.prototype, "offset", null);
|
||
__decorate([
|
||
lazy
|
||
], Field.prototype, "type", null);
|
||
Il2Cpp3.Field = Field;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class GCHandle {
|
||
handle;
|
||
/** @internal */
|
||
constructor(handle) {
|
||
this.handle = handle;
|
||
}
|
||
/** Gets the object associated to this handle. */
|
||
get target() {
|
||
return new Il2Cpp3.Object(Il2Cpp3.exports.gcHandleGetTarget(this.handle)).asNullable();
|
||
}
|
||
/** Frees this handle. */
|
||
free() {
|
||
return Il2Cpp3.exports.gcHandleFree(this.handle);
|
||
}
|
||
}
|
||
Il2Cpp3.GCHandle = GCHandle;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
let Image = class Image extends NativeStruct {
|
||
/** Gets the assembly in which the current image is defined. */
|
||
get assembly() {
|
||
return new Il2Cpp3.Assembly(Il2Cpp3.exports.imageGetAssembly(this));
|
||
}
|
||
/** Gets the amount of classes defined in this image. */
|
||
get classCount() {
|
||
if (Il2Cpp3.unityVersionIsBelow201830) {
|
||
return this.classes.length;
|
||
} else {
|
||
return Il2Cpp3.exports.imageGetClassCount(this);
|
||
}
|
||
}
|
||
/** Gets the classes defined in this image. */
|
||
get classes() {
|
||
if (Il2Cpp3.unityVersionIsBelow201830) {
|
||
const types = this.assembly.object.method("GetTypes").invoke(false);
|
||
const classes = globalThis.Array.from(types, (_) => new Il2Cpp3.Class(Il2Cpp3.exports.classFromObject(_)));
|
||
const Module = this.tryClass("<Module>");
|
||
if (Module) {
|
||
classes.unshift(Module);
|
||
}
|
||
return classes;
|
||
} else {
|
||
return globalThis.Array.from(globalThis.Array(this.classCount), (_, i) => new Il2Cpp3.Class(Il2Cpp3.exports.imageGetClass(this, i)));
|
||
}
|
||
}
|
||
/** Gets the name of this image. */
|
||
get name() {
|
||
return Il2Cpp3.exports.imageGetName(this).readUtf8String();
|
||
}
|
||
/** Gets the class with the specified name defined in this image. */
|
||
class(name) {
|
||
return this.tryClass(name) ?? raise(`couldn't find class ${name} in assembly ${this.name}`);
|
||
}
|
||
/** Gets the class with the specified name defined in this image. */
|
||
tryClass(name) {
|
||
const dotIndex = name.lastIndexOf(".");
|
||
const classNamespace = Memory.allocUtf8String(dotIndex == -1 ? "" : name.slice(0, dotIndex));
|
||
const className = Memory.allocUtf8String(name.slice(dotIndex + 1));
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.classFromName(this, classNamespace, className)).asNullable();
|
||
}
|
||
};
|
||
__decorate([
|
||
lazy
|
||
], Image.prototype, "assembly", null);
|
||
__decorate([
|
||
lazy
|
||
], Image.prototype, "classCount", null);
|
||
__decorate([
|
||
lazy
|
||
], Image.prototype, "classes", null);
|
||
__decorate([
|
||
lazy
|
||
], Image.prototype, "name", null);
|
||
Image = __decorate([
|
||
recycle
|
||
], Image);
|
||
Il2Cpp3.Image = Image;
|
||
getter(Il2Cpp3, "corlib", () => {
|
||
return new Il2Cpp3.Image(Il2Cpp3.exports.getCorlib());
|
||
}, lazy);
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class MemorySnapshot extends NativeStruct {
|
||
/** Captures a memory snapshot. */
|
||
static capture() {
|
||
return new Il2Cpp3.MemorySnapshot();
|
||
}
|
||
/** Creates a memory snapshot with the given handle. */
|
||
constructor(handle = Il2Cpp3.exports.memorySnapshotCapture()) {
|
||
super(handle);
|
||
}
|
||
/** Gets any initialized class. */
|
||
get classes() {
|
||
return readNativeIterator((_) => Il2Cpp3.exports.memorySnapshotGetClasses(this, _)).map((_) => new Il2Cpp3.Class(_));
|
||
}
|
||
/** Gets the objects tracked by this memory snapshot. */
|
||
get objects() {
|
||
return readNativeList((_) => Il2Cpp3.exports.memorySnapshotGetObjects(this, _)).filter((_) => !_.isNull()).map((_) => new Il2Cpp3.Object(_));
|
||
}
|
||
/** Frees this memory snapshot. */
|
||
free() {
|
||
Il2Cpp3.exports.memorySnapshotFree(this);
|
||
}
|
||
}
|
||
__decorate([
|
||
lazy
|
||
], MemorySnapshot.prototype, "classes", null);
|
||
__decorate([
|
||
lazy
|
||
], MemorySnapshot.prototype, "objects", null);
|
||
Il2Cpp3.MemorySnapshot = MemorySnapshot;
|
||
function memorySnapshot(block) {
|
||
const memorySnapshot2 = Il2Cpp3.MemorySnapshot.capture();
|
||
const result = block(memorySnapshot2);
|
||
memorySnapshot2.free();
|
||
return result;
|
||
}
|
||
Il2Cpp3.memorySnapshot = memorySnapshot;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class Method extends NativeStruct {
|
||
/** Gets the class in which this method is defined. */
|
||
get class() {
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.methodGetClass(this));
|
||
}
|
||
/** Gets the flags of the current method. */
|
||
get flags() {
|
||
return Il2Cpp3.exports.methodGetFlags(this, NULL);
|
||
}
|
||
/** Gets the implementation flags of the current method. */
|
||
get implementationFlags() {
|
||
const implementationFlagsPointer = Memory.alloc(Process.pointerSize);
|
||
Il2Cpp3.exports.methodGetFlags(this, implementationFlagsPointer);
|
||
return implementationFlagsPointer.readU32();
|
||
}
|
||
/** */
|
||
get fridaSignature() {
|
||
const types = [];
|
||
for (const parameter of this.parameters) {
|
||
types.push(parameter.type.fridaAlias);
|
||
}
|
||
if (!this.isStatic || Il2Cpp3.unityVersionIsBelow201830) {
|
||
types.unshift("pointer");
|
||
}
|
||
if (this.isInflated) {
|
||
types.push("pointer");
|
||
}
|
||
return types;
|
||
}
|
||
/** Gets the generic parameters of this generic method. */
|
||
get generics() {
|
||
if (!this.isGeneric) {
|
||
return [];
|
||
}
|
||
const types = this.object.method("GetGenericArguments").invoke();
|
||
return globalThis.Array.from(types).map((_) => new Il2Cpp3.Class(Il2Cpp3.exports.classFromObject(_)));
|
||
}
|
||
/** Determines whether this method is external. */
|
||
get isExternal() {
|
||
return (this.implementationFlags & 4096) != 0;
|
||
}
|
||
/** Determines whether this method is generic. */
|
||
get isGeneric() {
|
||
return !!Il2Cpp3.exports.methodIsGeneric(this);
|
||
}
|
||
/** Determines whether this method is inflated (generic with a concrete type parameter). */
|
||
get isInflated() {
|
||
return !!Il2Cpp3.exports.methodIsInflated(this);
|
||
}
|
||
/** Determines whether this method is static. */
|
||
get isStatic() {
|
||
return !Il2Cpp3.exports.methodIsInstance(this);
|
||
}
|
||
/** Determines whether this method is synchronized. */
|
||
get isSynchronized() {
|
||
return (this.implementationFlags & 32) != 0;
|
||
}
|
||
/** Gets the access modifier of this method. */
|
||
get modifier() {
|
||
switch (this.flags & 7) {
|
||
case 1:
|
||
return "private";
|
||
case 2:
|
||
return "private protected";
|
||
case 3:
|
||
return "internal";
|
||
case 4:
|
||
return "protected";
|
||
case 5:
|
||
return "protected internal";
|
||
case 6:
|
||
return "public";
|
||
}
|
||
}
|
||
/** Gets the name of this method. */
|
||
get name() {
|
||
return Il2Cpp3.exports.methodGetName(this).readUtf8String();
|
||
}
|
||
/** @internal */
|
||
get nativeFunction() {
|
||
return new NativeFunction(this.virtualAddress, this.returnType.fridaAlias, this.fridaSignature);
|
||
}
|
||
/** Gets the encompassing object of the current method. */
|
||
get object() {
|
||
return new Il2Cpp3.Object(Il2Cpp3.exports.methodGetObject(this, NULL));
|
||
}
|
||
/** Gets the amount of parameters of this method. */
|
||
get parameterCount() {
|
||
return Il2Cpp3.exports.methodGetParameterCount(this);
|
||
}
|
||
/** Gets the parameters of this method. */
|
||
get parameters() {
|
||
return globalThis.Array.from(globalThis.Array(this.parameterCount), (_, i) => {
|
||
const parameterName = Il2Cpp3.exports.methodGetParameterName(this, i).readUtf8String();
|
||
const parameterType = Il2Cpp3.exports.methodGetParameterType(this, i);
|
||
return new Il2Cpp3.Parameter(parameterName, i, new Il2Cpp3.Type(parameterType));
|
||
});
|
||
}
|
||
/** Gets the relative virtual address (RVA) of this method. */
|
||
get relativeVirtualAddress() {
|
||
return this.virtualAddress.sub(Il2Cpp3.module.base);
|
||
}
|
||
/** Gets the return type of this method. */
|
||
get returnType() {
|
||
return new Il2Cpp3.Type(Il2Cpp3.exports.methodGetReturnType(this));
|
||
}
|
||
/** Gets the virtual address (VA) of this method. */
|
||
get virtualAddress() {
|
||
const FilterTypeName = Il2Cpp3.corlib.class("System.Reflection.Module").initialize().field("FilterTypeName").value;
|
||
const FilterTypeNameMethodPointer = FilterTypeName.field("method_ptr").value;
|
||
const FilterTypeNameMethod = FilterTypeName.field("method").value;
|
||
const offset = FilterTypeNameMethod.offsetOf((_) => _.readPointer().equals(FilterTypeNameMethodPointer)) ?? raise("couldn't find the virtual address offset in the native method struct");
|
||
getter(Il2Cpp3.Method.prototype, "virtualAddress", function() {
|
||
return this.handle.add(offset).readPointer();
|
||
}, lazy);
|
||
Il2Cpp3.corlib.class("System.Reflection.Module").method(".cctor").invoke();
|
||
return this.virtualAddress;
|
||
}
|
||
/** Replaces the body of this method. */
|
||
set implementation(block) {
|
||
try {
|
||
Interceptor.replace(this.virtualAddress, this.wrap(block));
|
||
} catch (e) {
|
||
switch (e.message) {
|
||
case "access violation accessing 0x0":
|
||
raise(`couldn't set implementation for method ${this.name} as it has a NULL virtual address`);
|
||
case /unable to intercept function at \w+; please file a bug/.exec(e.message)?.input:
|
||
warn(`couldn't set implementation for method ${this.name} as it may be a thunk`);
|
||
break;
|
||
case "already replaced this function":
|
||
warn(`couldn't set implementation for method ${this.name} as it has already been replaced by a thunk`);
|
||
break;
|
||
default:
|
||
throw e;
|
||
}
|
||
}
|
||
}
|
||
/** Creates a generic instance of the current generic method. */
|
||
inflate(...classes) {
|
||
if (!this.isGeneric || this.generics.length != classes.length) {
|
||
for (const method of this.overloads()) {
|
||
if (method.isGeneric && method.generics.length == classes.length) {
|
||
return method.inflate(...classes);
|
||
}
|
||
}
|
||
raise(`could not find inflatable signature of method ${this.name} with ${classes.length} generic parameter(s)`);
|
||
}
|
||
const types = classes.map((_) => _.type.object);
|
||
const typeArray = Il2Cpp3.array(Il2Cpp3.corlib.class("System.Type"), types);
|
||
const inflatedMethodObject = this.object.method("MakeGenericMethod", 1).invoke(typeArray);
|
||
return new Il2Cpp3.Method(inflatedMethodObject.field("mhandle").value);
|
||
}
|
||
/** Invokes this method. */
|
||
invoke(...parameters) {
|
||
if (!this.isStatic) {
|
||
raise(`cannot invoke non-static method ${this.name} as it must be invoked throught a Il2Cpp.Object, not a Il2Cpp.Class`);
|
||
}
|
||
return this.invokeRaw(NULL, ...parameters);
|
||
}
|
||
/** @internal */
|
||
invokeRaw(instance, ...parameters) {
|
||
const allocatedParameters = parameters.map(Il2Cpp3.toFridaValue);
|
||
if (!this.isStatic || Il2Cpp3.unityVersionIsBelow201830) {
|
||
allocatedParameters.unshift(instance);
|
||
}
|
||
if (this.isInflated) {
|
||
allocatedParameters.push(this.handle);
|
||
}
|
||
try {
|
||
const returnValue = this.nativeFunction(...allocatedParameters);
|
||
return Il2Cpp3.fromFridaValue(returnValue, this.returnType);
|
||
} catch (e) {
|
||
if (e == null) {
|
||
raise("an unexpected native invocation exception occurred, this is due to parameter types mismatch");
|
||
}
|
||
switch (e.message) {
|
||
case "bad argument count":
|
||
raise(`couldn't invoke method ${this.name} as it needs ${this.parameterCount} parameter(s), not ${parameters.length}`);
|
||
case "expected a pointer":
|
||
case "expected number":
|
||
case "expected array with fields":
|
||
raise(`couldn't invoke method ${this.name} using incorrect parameter types`);
|
||
}
|
||
throw e;
|
||
}
|
||
}
|
||
/** Gets the overloaded method with the given parameter types. */
|
||
overload(...typeNamesOrClasses) {
|
||
const method = this.tryOverload(...typeNamesOrClasses);
|
||
return method ?? raise(`couldn't find overloaded method ${this.name}(${typeNamesOrClasses.map((_) => _ instanceof Il2Cpp3.Class ? _.type.name : _)})`);
|
||
}
|
||
/** @internal */
|
||
*overloads() {
|
||
for (const klass of this.class.hierarchy()) {
|
||
for (const method of klass.methods) {
|
||
if (this.name == method.name) {
|
||
yield method;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
/** Gets the parameter with the given name. */
|
||
parameter(name) {
|
||
return this.tryParameter(name) ?? raise(`couldn't find parameter ${name} in method ${this.name}`);
|
||
}
|
||
/** Restore the original method implementation. */
|
||
revert() {
|
||
Interceptor.revert(this.virtualAddress);
|
||
Interceptor.flush();
|
||
}
|
||
/** Gets the overloaded method with the given parameter types. */
|
||
tryOverload(...typeNamesOrClasses) {
|
||
const minScore = typeNamesOrClasses.length * 1;
|
||
const maxScore = typeNamesOrClasses.length * 2;
|
||
let candidate = void 0;
|
||
loop: for (const method of this.overloads()) {
|
||
if (method.parameterCount != typeNamesOrClasses.length)
|
||
continue;
|
||
let score = 0;
|
||
let i = 0;
|
||
for (const parameter of method.parameters) {
|
||
const desiredTypeNameOrClass = typeNamesOrClasses[i];
|
||
if (desiredTypeNameOrClass instanceof Il2Cpp3.Class) {
|
||
if (parameter.type.is(desiredTypeNameOrClass.type)) {
|
||
score += 2;
|
||
} else if (parameter.type.class.isAssignableFrom(desiredTypeNameOrClass)) {
|
||
score += 1;
|
||
} else {
|
||
continue loop;
|
||
}
|
||
} else if (parameter.type.name == desiredTypeNameOrClass) {
|
||
score += 2;
|
||
} else {
|
||
continue loop;
|
||
}
|
||
i++;
|
||
}
|
||
if (score < minScore) {
|
||
continue;
|
||
} else if (score == maxScore) {
|
||
return method;
|
||
} else if (candidate == void 0 || score > candidate[0]) {
|
||
candidate = [score, method];
|
||
} else if (score == candidate[0]) {
|
||
let i2 = 0;
|
||
for (const parameter of candidate[1].parameters) {
|
||
if (parameter.type.class.isAssignableFrom(method.parameters[i2].type.class)) {
|
||
candidate = [score, method];
|
||
continue loop;
|
||
}
|
||
i2++;
|
||
}
|
||
}
|
||
}
|
||
return candidate?.[1];
|
||
}
|
||
/** Gets the parameter with the given name. */
|
||
tryParameter(name) {
|
||
return this.parameters.find((_) => _.name == name);
|
||
}
|
||
/** */
|
||
toString() {
|
||
return `${this.isStatic ? `static ` : ``}${this.returnType.name} ${this.name}${this.generics.length > 0 ? `<${this.generics.map((_) => _.type.name).join(",")}>` : ""}(${this.parameters.join(`, `)});${this.virtualAddress.isNull() ? `` : ` // 0x${this.relativeVirtualAddress.toString(16).padStart(8, `0`)}`}`;
|
||
}
|
||
/**
|
||
* @internal
|
||
* Binds the current method to a {@link Il2Cpp.Object} or a
|
||
* {@link Il2Cpp.ValueType} (also known as *instances*), so that it is
|
||
* possible to invoke it - see {@link Il2Cpp.Method.invoke} for
|
||
* details. \
|
||
* Binding a static method is forbidden.
|
||
*/
|
||
bind(instance) {
|
||
if (this.isStatic) {
|
||
raise(`cannot bind static method ${this.class.type.name}::${this.name} to an instance`);
|
||
}
|
||
return new Proxy(this, {
|
||
get(target, property, receiver) {
|
||
switch (property) {
|
||
case "invoke":
|
||
const handle = instance instanceof Il2Cpp3.ValueType ? target.class.isValueType ? instance.handle.sub(structMethodsRequireObjectInstances() ? Il2Cpp3.Object.headerSize : 0) : raise(`cannot invoke method ${target.class.type.name}::${target.name} against a value type, you must box it first`) : target.class.isValueType ? instance.handle.add(structMethodsRequireObjectInstances() ? 0 : Il2Cpp3.Object.headerSize) : instance.handle;
|
||
return target.invokeRaw.bind(target, handle);
|
||
case "overloads":
|
||
return function* () {
|
||
for (const method of target[property]()) {
|
||
if (!method.isStatic) {
|
||
yield method;
|
||
}
|
||
}
|
||
};
|
||
case "inflate":
|
||
case "overload":
|
||
case "tryOverload":
|
||
const member = Reflect.get(target, property).bind(receiver);
|
||
return function(...args) {
|
||
return member(...args)?.bind(instance);
|
||
};
|
||
}
|
||
return Reflect.get(target, property);
|
||
}
|
||
});
|
||
}
|
||
/** @internal */
|
||
wrap(block) {
|
||
const startIndex = +!this.isStatic | +Il2Cpp3.unityVersionIsBelow201830;
|
||
return new NativeCallback((...args) => {
|
||
const thisObject = this.isStatic ? this.class : this.class.isValueType ? new Il2Cpp3.ValueType(args[0].add(structMethodsRequireObjectInstances() ? Il2Cpp3.Object.headerSize : 0), this.class.type) : new Il2Cpp3.Object(args[0]);
|
||
const parameters = this.parameters.map((_, i) => Il2Cpp3.fromFridaValue(args[i + startIndex], _.type));
|
||
const result = block.call(thisObject, ...parameters);
|
||
return Il2Cpp3.toFridaValue(result);
|
||
}, this.returnType.fridaAlias, this.fridaSignature);
|
||
}
|
||
}
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "class", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "flags", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "implementationFlags", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "fridaSignature", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "generics", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "isExternal", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "isGeneric", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "isInflated", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "isStatic", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "isSynchronized", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "modifier", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "name", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "nativeFunction", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "object", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "parameterCount", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "parameters", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "relativeVirtualAddress", null);
|
||
__decorate([
|
||
lazy
|
||
], Method.prototype, "returnType", null);
|
||
Il2Cpp3.Method = Method;
|
||
let structMethodsRequireObjectInstances = () => {
|
||
const object = Il2Cpp3.corlib.class("System.Int64").alloc();
|
||
object.field("m_value").value = 3735928559;
|
||
const result = object.method("Equals", 1).overload(object.class).invokeRaw(object, 3735928559);
|
||
return (structMethodsRequireObjectInstances = () => result)();
|
||
};
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class Object2 extends NativeStruct {
|
||
/** Gets the Il2CppObject struct size, possibly equal to `Process.pointerSize * 2`. */
|
||
static get headerSize() {
|
||
return Il2Cpp3.corlib.class("System.Object").instanceSize;
|
||
}
|
||
/**
|
||
* Returns the same object, but having its parent class as class.
|
||
* It basically is the C# `base` keyword, so that parent members can be
|
||
* accessed.
|
||
*
|
||
* **Example** \
|
||
* Consider the following classes:
|
||
* ```csharp
|
||
* class Foo
|
||
* {
|
||
* int foo()
|
||
* {
|
||
* return 1;
|
||
* }
|
||
* }
|
||
* class Bar : Foo
|
||
* {
|
||
* new int foo()
|
||
* {
|
||
* return 2;
|
||
* }
|
||
* }
|
||
* ```
|
||
* then:
|
||
* ```ts
|
||
* const Bar: Il2Cpp.Class = ...;
|
||
* const bar = Bar.new();
|
||
*
|
||
* console.log(bar.foo()); // 2
|
||
* console.log(bar.base.foo()); // 1
|
||
* ```
|
||
*/
|
||
get base() {
|
||
if (this.class.parent == null) {
|
||
raise(`class ${this.class.type.name} has no parent`);
|
||
}
|
||
return new Proxy(this, {
|
||
get(target, property, receiver) {
|
||
if (property == "class") {
|
||
return Reflect.get(target, property).parent;
|
||
} else if (property == "base") {
|
||
return Reflect.getOwnPropertyDescriptor(Il2Cpp3.Object.prototype, property).get.bind(receiver)();
|
||
}
|
||
return Reflect.get(target, property);
|
||
}
|
||
});
|
||
}
|
||
/** Gets the class of this object. */
|
||
get class() {
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.objectGetClass(this));
|
||
}
|
||
/** Returns a monitor for this object. */
|
||
get monitor() {
|
||
return new Il2Cpp3.Object.Monitor(this);
|
||
}
|
||
/** Gets the size of the current object. */
|
||
get size() {
|
||
return Il2Cpp3.exports.objectGetSize(this);
|
||
}
|
||
/** Gets the non-static field with the given name of the current class hierarchy. */
|
||
field(name) {
|
||
return this.tryField(name) ?? raise(`couldn't find non-static field ${name} in hierarchy of class ${this.class.type.name}`);
|
||
}
|
||
/** Gets the non-static method with the given name (and optionally parameter count) of the current class hierarchy. */
|
||
method(name, parameterCount = -1) {
|
||
return this.tryMethod(name, parameterCount) ?? raise(`couldn't find non-static method ${name} in hierarchy of class ${this.class.type.name}`);
|
||
}
|
||
/** Creates a reference to this object. */
|
||
ref(pin) {
|
||
return new Il2Cpp3.GCHandle(Il2Cpp3.exports.gcHandleNew(this, +pin));
|
||
}
|
||
/** Gets the correct virtual method from the given virtual method. */
|
||
virtualMethod(method) {
|
||
return new Il2Cpp3.Method(Il2Cpp3.exports.objectGetVirtualMethod(this, method)).bind(this);
|
||
}
|
||
/** Gets the non-static field with the given name of the current class hierarchy, if it exists. */
|
||
tryField(name) {
|
||
const field = this.class.tryField(name);
|
||
if (field?.isStatic) {
|
||
for (const klass of this.class.hierarchy({ includeCurrent: false })) {
|
||
for (const field2 of klass.fields) {
|
||
if (field2.name == name && !field2.isStatic) {
|
||
return field2.bind(this);
|
||
}
|
||
}
|
||
}
|
||
return void 0;
|
||
}
|
||
return field?.bind(this);
|
||
}
|
||
/** Gets the non-static method with the given name (and optionally parameter count) of the current class hierarchy, if it exists. */
|
||
tryMethod(name, parameterCount = -1) {
|
||
const method = this.class.tryMethod(name, parameterCount);
|
||
if (method?.isStatic) {
|
||
for (const klass of this.class.hierarchy()) {
|
||
for (const method2 of klass.methods) {
|
||
if (method2.name == name && !method2.isStatic && (parameterCount < 0 || method2.parameterCount == parameterCount)) {
|
||
return method2.bind(this);
|
||
}
|
||
}
|
||
}
|
||
return void 0;
|
||
}
|
||
return method?.bind(this);
|
||
}
|
||
/** */
|
||
toString() {
|
||
return this.isNull() ? "null" : this.method("ToString", 0).invoke().content ?? "null";
|
||
}
|
||
/** Unboxes the value type (either a primitive, a struct or an enum) out of this object. */
|
||
unbox() {
|
||
return this.class.isValueType ? new Il2Cpp3.ValueType(Il2Cpp3.exports.objectUnbox(this), this.class.type) : raise(`couldn't unbox instances of ${this.class.type.name} as they are not value types`);
|
||
}
|
||
/** Creates a weak reference to this object. */
|
||
weakRef(trackResurrection) {
|
||
return new Il2Cpp3.GCHandle(Il2Cpp3.exports.gcHandleNewWeakRef(this, +trackResurrection));
|
||
}
|
||
}
|
||
__decorate([
|
||
lazy
|
||
], Object2.prototype, "class", null);
|
||
__decorate([
|
||
lazy
|
||
], Object2.prototype, "size", null);
|
||
__decorate([
|
||
lazy
|
||
], Object2, "headerSize", null);
|
||
Il2Cpp3.Object = Object2;
|
||
(function(Object3) {
|
||
class Monitor {
|
||
handle;
|
||
/** @internal */
|
||
constructor(handle) {
|
||
this.handle = handle;
|
||
}
|
||
/** Acquires an exclusive lock on the current object. */
|
||
enter() {
|
||
return Il2Cpp3.exports.monitorEnter(this.handle);
|
||
}
|
||
/** Release an exclusive lock on the current object. */
|
||
exit() {
|
||
return Il2Cpp3.exports.monitorExit(this.handle);
|
||
}
|
||
/** Notifies a thread in the waiting queue of a change in the locked object's state. */
|
||
pulse() {
|
||
return Il2Cpp3.exports.monitorPulse(this.handle);
|
||
}
|
||
/** Notifies all waiting threads of a change in the object's state. */
|
||
pulseAll() {
|
||
return Il2Cpp3.exports.monitorPulseAll(this.handle);
|
||
}
|
||
/** Attempts to acquire an exclusive lock on the current object. */
|
||
tryEnter(timeout) {
|
||
return !!Il2Cpp3.exports.monitorTryEnter(this.handle, timeout);
|
||
}
|
||
/** Releases the lock on an object and attempts to block the current thread until it reacquires the lock. */
|
||
tryWait(timeout) {
|
||
return !!Il2Cpp3.exports.monitorTryWait(this.handle, timeout);
|
||
}
|
||
/** Releases the lock on an object and blocks the current thread until it reacquires the lock. */
|
||
wait() {
|
||
return Il2Cpp3.exports.monitorWait(this.handle);
|
||
}
|
||
}
|
||
Object3.Monitor = Monitor;
|
||
})(Object2 = Il2Cpp3.Object || (Il2Cpp3.Object = {}));
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class Parameter {
|
||
/** Name of this parameter. */
|
||
name;
|
||
/** Position of this parameter. */
|
||
position;
|
||
/** Type of this parameter. */
|
||
type;
|
||
constructor(name, position, type) {
|
||
this.name = name;
|
||
this.position = position;
|
||
this.type = type;
|
||
}
|
||
/** */
|
||
toString() {
|
||
return `${this.type.name} ${this.name}`;
|
||
}
|
||
}
|
||
Il2Cpp3.Parameter = Parameter;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class Pointer extends NativeStruct {
|
||
type;
|
||
constructor(handle, type) {
|
||
super(handle);
|
||
this.type = type;
|
||
}
|
||
/** Gets the element at the given index. */
|
||
get(index) {
|
||
return Il2Cpp3.read(this.handle.add(index * this.type.class.arrayElementSize), this.type);
|
||
}
|
||
/** Reads the given amount of elements starting at the given offset. */
|
||
read(length, offset = 0) {
|
||
const values = new globalThis.Array(length);
|
||
for (let i = 0; i < length; i++) {
|
||
values[i] = this.get(i + offset);
|
||
}
|
||
return values;
|
||
}
|
||
/** Sets the given element at the given index */
|
||
set(index, value) {
|
||
Il2Cpp3.write(this.handle.add(index * this.type.class.arrayElementSize), value, this.type);
|
||
}
|
||
/** */
|
||
toString() {
|
||
return this.handle.toString();
|
||
}
|
||
/** Writes the given elements starting at the given index. */
|
||
write(values, offset = 0) {
|
||
for (let i = 0; i < values.length; i++) {
|
||
this.set(i + offset, values[i]);
|
||
}
|
||
}
|
||
}
|
||
Il2Cpp3.Pointer = Pointer;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class Reference extends NativeStruct {
|
||
type;
|
||
constructor(handle, type) {
|
||
super(handle);
|
||
this.type = type;
|
||
}
|
||
/** Gets the element referenced by the current reference. */
|
||
get value() {
|
||
return Il2Cpp3.read(this.handle, this.type);
|
||
}
|
||
/** Sets the element referenced by the current reference. */
|
||
set value(value) {
|
||
Il2Cpp3.write(this.handle, value, this.type);
|
||
}
|
||
/** */
|
||
toString() {
|
||
return this.isNull() ? "null" : `->${this.value}`;
|
||
}
|
||
}
|
||
Il2Cpp3.Reference = Reference;
|
||
function reference(value, type) {
|
||
const handle = Memory.alloc(Process.pointerSize);
|
||
switch (typeof value) {
|
||
case "boolean":
|
||
return new Il2Cpp3.Reference(handle.writeS8(+value), Il2Cpp3.corlib.class("System.Boolean").type);
|
||
case "number":
|
||
switch (type?.enumValue) {
|
||
case Il2Cpp3.Type.Enum.UBYTE:
|
||
return new Il2Cpp3.Reference(handle.writeU8(value), type);
|
||
case Il2Cpp3.Type.Enum.BYTE:
|
||
return new Il2Cpp3.Reference(handle.writeS8(value), type);
|
||
case Il2Cpp3.Type.Enum.CHAR:
|
||
case Il2Cpp3.Type.Enum.USHORT:
|
||
return new Il2Cpp3.Reference(handle.writeU16(value), type);
|
||
case Il2Cpp3.Type.Enum.SHORT:
|
||
return new Il2Cpp3.Reference(handle.writeS16(value), type);
|
||
case Il2Cpp3.Type.Enum.UINT:
|
||
return new Il2Cpp3.Reference(handle.writeU32(value), type);
|
||
case Il2Cpp3.Type.Enum.INT:
|
||
return new Il2Cpp3.Reference(handle.writeS32(value), type);
|
||
case Il2Cpp3.Type.Enum.ULONG:
|
||
return new Il2Cpp3.Reference(handle.writeU64(value), type);
|
||
case Il2Cpp3.Type.Enum.LONG:
|
||
return new Il2Cpp3.Reference(handle.writeS64(value), type);
|
||
case Il2Cpp3.Type.Enum.FLOAT:
|
||
return new Il2Cpp3.Reference(handle.writeFloat(value), type);
|
||
case Il2Cpp3.Type.Enum.DOUBLE:
|
||
return new Il2Cpp3.Reference(handle.writeDouble(value), type);
|
||
}
|
||
case "object":
|
||
if (value instanceof Il2Cpp3.ValueType || value instanceof Il2Cpp3.Pointer) {
|
||
return new Il2Cpp3.Reference(value.handle, value.type);
|
||
} else if (value instanceof Il2Cpp3.Object) {
|
||
return new Il2Cpp3.Reference(handle.writePointer(value), value.class.type);
|
||
} else if (value instanceof Il2Cpp3.String || value instanceof Il2Cpp3.Array) {
|
||
return new Il2Cpp3.Reference(handle.writePointer(value), value.object.class.type);
|
||
} else if (value instanceof NativePointer) {
|
||
switch (type?.enumValue) {
|
||
case Il2Cpp3.Type.Enum.NUINT:
|
||
case Il2Cpp3.Type.Enum.NINT:
|
||
return new Il2Cpp3.Reference(handle.writePointer(value), type);
|
||
}
|
||
} else if (value instanceof Int64) {
|
||
return new Il2Cpp3.Reference(handle.writeS64(value), Il2Cpp3.corlib.class("System.Int64").type);
|
||
} else if (value instanceof UInt64) {
|
||
return new Il2Cpp3.Reference(handle.writeU64(value), Il2Cpp3.corlib.class("System.UInt64").type);
|
||
}
|
||
default:
|
||
raise(`couldn't create a reference to ${value} using an unhandled type ${type?.name}`);
|
||
}
|
||
}
|
||
Il2Cpp3.reference = reference;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class String2 extends NativeStruct {
|
||
/** Gets the content of this string. */
|
||
get content() {
|
||
return Il2Cpp3.exports.stringGetChars(this).readUtf16String(this.length);
|
||
}
|
||
/** @unsafe Sets the content of this string - it may write out of bounds! */
|
||
set content(value) {
|
||
const offset = Il2Cpp3.string("vfsfitvnm").handle.offsetOf((_) => _.readInt() == 9) ?? raise("couldn't find the length offset in the native string struct");
|
||
globalThis.Object.defineProperty(Il2Cpp3.String.prototype, "content", {
|
||
set(value2) {
|
||
Il2Cpp3.exports.stringGetChars(this).writeUtf16String(value2 ?? "");
|
||
this.handle.add(offset).writeS32(value2?.length ?? 0);
|
||
}
|
||
});
|
||
this.content = value;
|
||
}
|
||
/** Gets the length of this string. */
|
||
get length() {
|
||
return Il2Cpp3.exports.stringGetLength(this);
|
||
}
|
||
/** Gets the encompassing object of the current string. */
|
||
get object() {
|
||
return new Il2Cpp3.Object(this);
|
||
}
|
||
/** */
|
||
toString() {
|
||
return this.isNull() ? "null" : `"${this.content}"`;
|
||
}
|
||
}
|
||
Il2Cpp3.String = String2;
|
||
function string(content) {
|
||
return new Il2Cpp3.String(Il2Cpp3.exports.stringNew(Memory.allocUtf8String(content ?? "")));
|
||
}
|
||
Il2Cpp3.string = string;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class Thread extends NativeStruct {
|
||
/** Gets the native id of the current thread. */
|
||
get id() {
|
||
let get = function() {
|
||
return this.internal.field("thread_id").value.toNumber();
|
||
};
|
||
if (Process.platform != "windows") {
|
||
const currentThreadId = Process.getCurrentThreadId();
|
||
const currentPosixThread = ptr(get.apply(Il2Cpp3.currentThread));
|
||
const offset = currentPosixThread.offsetOf((_) => _.readS32() == currentThreadId, 1024) ?? raise(`couldn't find the offset for determining the kernel id of a posix thread`);
|
||
const _get = get;
|
||
get = function() {
|
||
return ptr(_get.apply(this)).add(offset).readS32();
|
||
};
|
||
}
|
||
getter(Il2Cpp3.Thread.prototype, "id", get, lazy);
|
||
return this.id;
|
||
}
|
||
/** Gets the encompassing internal object (System.Threding.InternalThreead) of the current thread. */
|
||
get internal() {
|
||
return this.object.tryField("internal_thread")?.value ?? this.object;
|
||
}
|
||
/** Determines whether the current thread is the garbage collector finalizer one. */
|
||
get isFinalizer() {
|
||
return !Il2Cpp3.exports.threadIsVm(this);
|
||
}
|
||
/** Gets the managed id of the current thread. */
|
||
get managedId() {
|
||
return this.object.method("get_ManagedThreadId").invoke();
|
||
}
|
||
/** Gets the encompassing object of the current thread. */
|
||
get object() {
|
||
return new Il2Cpp3.Object(this);
|
||
}
|
||
/** @internal */
|
||
get staticData() {
|
||
return this.internal.field("static_data").value;
|
||
}
|
||
/** @internal */
|
||
get synchronizationContext() {
|
||
const get_ExecutionContext = this.object.tryMethod("GetMutableExecutionContext") ?? this.object.method("get_ExecutionContext");
|
||
const executionContext = get_ExecutionContext.invoke();
|
||
const synchronizationContext = executionContext.tryField("_syncContext")?.value ?? executionContext.tryMethod("get_SynchronizationContext")?.invoke() ?? this.tryLocalValue(Il2Cpp3.corlib.class("System.Threading.SynchronizationContext"));
|
||
return synchronizationContext?.asNullable() ?? null;
|
||
}
|
||
/** Detaches the thread from the application domain. */
|
||
detach() {
|
||
return Il2Cpp3.exports.threadDetach(this);
|
||
}
|
||
/** Schedules a callback on the current thread. */
|
||
schedule(block) {
|
||
const Post = this.synchronizationContext?.tryMethod("Post");
|
||
if (Post == null) {
|
||
return Process.runOnThread(this.id, block);
|
||
}
|
||
return new Promise((resolve) => {
|
||
const delegate = Il2Cpp3.delegate(Il2Cpp3.corlib.class("System.Threading.SendOrPostCallback"), () => {
|
||
const result = block();
|
||
setImmediate(() => resolve(result));
|
||
});
|
||
Script.bindWeak(globalThis, () => {
|
||
delegate.field("method_ptr").value = delegate.field("invoke_impl").value = Il2Cpp3.exports.domainGet;
|
||
});
|
||
Post.invoke(delegate, NULL);
|
||
});
|
||
}
|
||
/** @internal */
|
||
tryLocalValue(klass) {
|
||
for (let i = 0; i < 16; i++) {
|
||
const base = this.staticData.add(i * Process.pointerSize).readPointer();
|
||
if (!base.isNull()) {
|
||
const object = new Il2Cpp3.Object(base.readPointer()).asNullable();
|
||
if (object?.class?.isSubclassOf(klass, false)) {
|
||
return object;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
__decorate([
|
||
lazy
|
||
], Thread.prototype, "internal", null);
|
||
__decorate([
|
||
lazy
|
||
], Thread.prototype, "isFinalizer", null);
|
||
__decorate([
|
||
lazy
|
||
], Thread.prototype, "managedId", null);
|
||
__decorate([
|
||
lazy
|
||
], Thread.prototype, "object", null);
|
||
__decorate([
|
||
lazy
|
||
], Thread.prototype, "staticData", null);
|
||
__decorate([
|
||
lazy
|
||
], Thread.prototype, "synchronizationContext", null);
|
||
Il2Cpp3.Thread = Thread;
|
||
getter(Il2Cpp3, "attachedThreads", () => {
|
||
if (Il2Cpp3.exports.threadGetAttachedThreads.isNull()) {
|
||
const currentThreadHandle = Il2Cpp3.currentThread?.handle ?? raise("Current thread is not attached to IL2CPP");
|
||
const pattern = currentThreadHandle.toMatchPattern();
|
||
const threads = [];
|
||
for (const range of Process.enumerateRanges("rw-")) {
|
||
if (range.file == void 0) {
|
||
const matches = Memory.scanSync(range.base, range.size, pattern);
|
||
if (matches.length == 1) {
|
||
while (true) {
|
||
const handle = matches[0].address.sub(matches[0].size * threads.length).readPointer();
|
||
if (handle.isNull() || !handle.readPointer().equals(currentThreadHandle.readPointer())) {
|
||
break;
|
||
}
|
||
threads.unshift(new Il2Cpp3.Thread(handle));
|
||
}
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
return threads;
|
||
}
|
||
return readNativeList(Il2Cpp3.exports.threadGetAttachedThreads).map((_) => new Il2Cpp3.Thread(_));
|
||
});
|
||
getter(Il2Cpp3, "currentThread", () => {
|
||
return new Il2Cpp3.Thread(Il2Cpp3.exports.threadGetCurrent()).asNullable();
|
||
});
|
||
getter(Il2Cpp3, "mainThread", () => {
|
||
return Il2Cpp3.attachedThreads[0];
|
||
});
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
let Type = class Type extends NativeStruct {
|
||
/** */
|
||
static get Enum() {
|
||
const _ = (_2, block = (_3) => _3) => block(Il2Cpp3.corlib.class(_2)).type.enumValue;
|
||
const initial = {
|
||
VOID: _("System.Void"),
|
||
BOOLEAN: _("System.Boolean"),
|
||
CHAR: _("System.Char"),
|
||
BYTE: _("System.SByte"),
|
||
UBYTE: _("System.Byte"),
|
||
SHORT: _("System.Int16"),
|
||
USHORT: _("System.UInt16"),
|
||
INT: _("System.Int32"),
|
||
UINT: _("System.UInt32"),
|
||
LONG: _("System.Int64"),
|
||
ULONG: _("System.UInt64"),
|
||
NINT: _("System.IntPtr"),
|
||
NUINT: _("System.UIntPtr"),
|
||
FLOAT: _("System.Single"),
|
||
DOUBLE: _("System.Double"),
|
||
POINTER: _("System.IntPtr", (_2) => _2.field("m_value")),
|
||
VALUE_TYPE: _("System.Decimal"),
|
||
OBJECT: _("System.Object"),
|
||
STRING: _("System.String"),
|
||
CLASS: _("System.Array"),
|
||
ARRAY: _("System.Void", (_2) => _2.arrayClass),
|
||
NARRAY: _("System.Void", (_2) => new Il2Cpp3.Class(Il2Cpp3.exports.classGetArrayClass(_2, 2))),
|
||
GENERIC_INSTANCE: _("System.Int32", (_2) => _2.interfaces.find((_3) => _3.name.endsWith("`1")))
|
||
};
|
||
Reflect.defineProperty(this, "Enum", { value: initial });
|
||
return addFlippedEntries({
|
||
...initial,
|
||
VAR: _("System.Action`1", (_2) => _2.generics[0]),
|
||
MVAR: _("System.Array", (_2) => _2.method("AsReadOnly", 1).generics[0])
|
||
});
|
||
}
|
||
/** Gets the class of this type. */
|
||
get class() {
|
||
return new Il2Cpp3.Class(Il2Cpp3.exports.typeGetClass(this));
|
||
}
|
||
/** */
|
||
get fridaAlias() {
|
||
function getValueTypeFields(type) {
|
||
const instanceFields = type.class.fields.filter((_) => !_.isStatic);
|
||
return instanceFields.length == 0 ? ["char"] : instanceFields.map((_) => _.type.fridaAlias);
|
||
}
|
||
if (this.isByReference) {
|
||
return "pointer";
|
||
}
|
||
switch (this.enumValue) {
|
||
case Il2Cpp3.Type.Enum.VOID:
|
||
return "void";
|
||
case Il2Cpp3.Type.Enum.BOOLEAN:
|
||
return "bool";
|
||
case Il2Cpp3.Type.Enum.CHAR:
|
||
return "uchar";
|
||
case Il2Cpp3.Type.Enum.BYTE:
|
||
return "int8";
|
||
case Il2Cpp3.Type.Enum.UBYTE:
|
||
return "uint8";
|
||
case Il2Cpp3.Type.Enum.SHORT:
|
||
return "int16";
|
||
case Il2Cpp3.Type.Enum.USHORT:
|
||
return "uint16";
|
||
case Il2Cpp3.Type.Enum.INT:
|
||
return "int32";
|
||
case Il2Cpp3.Type.Enum.UINT:
|
||
return "uint32";
|
||
case Il2Cpp3.Type.Enum.LONG:
|
||
return "int64";
|
||
case Il2Cpp3.Type.Enum.ULONG:
|
||
return "uint64";
|
||
case Il2Cpp3.Type.Enum.FLOAT:
|
||
return "float";
|
||
case Il2Cpp3.Type.Enum.DOUBLE:
|
||
return "double";
|
||
case Il2Cpp3.Type.Enum.NINT:
|
||
case Il2Cpp3.Type.Enum.NUINT:
|
||
case Il2Cpp3.Type.Enum.POINTER:
|
||
case Il2Cpp3.Type.Enum.STRING:
|
||
case Il2Cpp3.Type.Enum.ARRAY:
|
||
case Il2Cpp3.Type.Enum.NARRAY:
|
||
return "pointer";
|
||
case Il2Cpp3.Type.Enum.VALUE_TYPE:
|
||
return this.class.isEnum ? this.class.baseType.fridaAlias : getValueTypeFields(this);
|
||
case Il2Cpp3.Type.Enum.CLASS:
|
||
case Il2Cpp3.Type.Enum.OBJECT:
|
||
case Il2Cpp3.Type.Enum.GENERIC_INSTANCE:
|
||
return this.class.isStruct ? getValueTypeFields(this) : this.class.isEnum ? this.class.baseType.fridaAlias : "pointer";
|
||
default:
|
||
return "pointer";
|
||
}
|
||
}
|
||
/** Determines whether this type is passed by reference. */
|
||
get isByReference() {
|
||
return this.name.endsWith("&");
|
||
}
|
||
/** Determines whether this type is primitive. */
|
||
get isPrimitive() {
|
||
switch (this.enumValue) {
|
||
case Il2Cpp3.Type.Enum.BOOLEAN:
|
||
case Il2Cpp3.Type.Enum.CHAR:
|
||
case Il2Cpp3.Type.Enum.BYTE:
|
||
case Il2Cpp3.Type.Enum.UBYTE:
|
||
case Il2Cpp3.Type.Enum.SHORT:
|
||
case Il2Cpp3.Type.Enum.USHORT:
|
||
case Il2Cpp3.Type.Enum.INT:
|
||
case Il2Cpp3.Type.Enum.UINT:
|
||
case Il2Cpp3.Type.Enum.LONG:
|
||
case Il2Cpp3.Type.Enum.ULONG:
|
||
case Il2Cpp3.Type.Enum.FLOAT:
|
||
case Il2Cpp3.Type.Enum.DOUBLE:
|
||
case Il2Cpp3.Type.Enum.NINT:
|
||
case Il2Cpp3.Type.Enum.NUINT:
|
||
return true;
|
||
default:
|
||
return false;
|
||
}
|
||
}
|
||
/** Gets the name of this type. */
|
||
get name() {
|
||
const handle = Il2Cpp3.exports.typeGetName(this);
|
||
try {
|
||
return handle.readUtf8String();
|
||
} finally {
|
||
Il2Cpp3.free(handle);
|
||
}
|
||
}
|
||
/** Gets the encompassing object of the current type. */
|
||
get object() {
|
||
return new Il2Cpp3.Object(Il2Cpp3.exports.typeGetObject(this));
|
||
}
|
||
/** Gets the {@link Il2Cpp.Type.Enum} value of the current type. */
|
||
get enumValue() {
|
||
return Il2Cpp3.exports.typeGetTypeEnum(this);
|
||
}
|
||
is(other) {
|
||
if (Il2Cpp3.exports.typeEquals.isNull()) {
|
||
return this.object.method("Equals").invoke(other.object);
|
||
}
|
||
return !!Il2Cpp3.exports.typeEquals(this, other);
|
||
}
|
||
/** */
|
||
toString() {
|
||
return this.name;
|
||
}
|
||
};
|
||
__decorate([
|
||
lazy
|
||
], Type.prototype, "class", null);
|
||
__decorate([
|
||
lazy
|
||
], Type.prototype, "fridaAlias", null);
|
||
__decorate([
|
||
lazy
|
||
], Type.prototype, "isByReference", null);
|
||
__decorate([
|
||
lazy
|
||
], Type.prototype, "isPrimitive", null);
|
||
__decorate([
|
||
lazy
|
||
], Type.prototype, "name", null);
|
||
__decorate([
|
||
lazy
|
||
], Type.prototype, "object", null);
|
||
__decorate([
|
||
lazy
|
||
], Type.prototype, "enumValue", null);
|
||
__decorate([
|
||
lazy
|
||
], Type, "Enum", null);
|
||
Type = __decorate([
|
||
recycle
|
||
], Type);
|
||
Il2Cpp3.Type = Type;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
var Il2Cpp2;
|
||
(function(Il2Cpp3) {
|
||
class ValueType extends NativeStruct {
|
||
type;
|
||
constructor(handle, type) {
|
||
super(handle);
|
||
this.type = type;
|
||
}
|
||
/** Boxes the current value type in a object. */
|
||
box() {
|
||
return new Il2Cpp3.Object(Il2Cpp3.exports.valueTypeBox(this.type.class, this));
|
||
}
|
||
/** Gets the non-static field with the given name of the current class hierarchy. */
|
||
field(name) {
|
||
return this.tryField(name) ?? raise(`couldn't find non-static field ${name} in hierarchy of class ${this.type.name}`);
|
||
}
|
||
/** Gets the non-static method with the given name (and optionally parameter count) of the current class hierarchy. */
|
||
method(name, parameterCount = -1) {
|
||
return this.tryMethod(name, parameterCount) ?? raise(`couldn't find non-static method ${name} in hierarchy of class ${this.type.name}`);
|
||
}
|
||
/** Gets the non-static field with the given name of the current class hierarchy, if it exists. */
|
||
tryField(name) {
|
||
const field = this.type.class.tryField(name);
|
||
if (field?.isStatic) {
|
||
for (const klass of this.type.class.hierarchy()) {
|
||
for (const field2 of klass.fields) {
|
||
if (field2.name == name && !field2.isStatic) {
|
||
return field2.bind(this);
|
||
}
|
||
}
|
||
}
|
||
return void 0;
|
||
}
|
||
return field?.bind(this);
|
||
}
|
||
/** Gets the non-static method with the given name (and optionally parameter count) of the current class hierarchy, if it exists. */
|
||
tryMethod(name, parameterCount = -1) {
|
||
const method = this.type.class.tryMethod(name, parameterCount);
|
||
if (method?.isStatic) {
|
||
for (const klass of this.type.class.hierarchy()) {
|
||
for (const method2 of klass.methods) {
|
||
if (method2.name == name && !method2.isStatic && (parameterCount < 0 || method2.parameterCount == parameterCount)) {
|
||
return method2.bind(this);
|
||
}
|
||
}
|
||
}
|
||
return void 0;
|
||
}
|
||
return method?.bind(this);
|
||
}
|
||
/** */
|
||
toString() {
|
||
const ToString = this.method("ToString", 0);
|
||
return this.isNull() ? "null" : (
|
||
// If ToString is defined within a value type class, we can
|
||
// avoid a boxing operation.
|
||
ToString.class.isValueType ? ToString.invoke().content ?? "null" : this.box().toString() ?? "null"
|
||
);
|
||
}
|
||
}
|
||
Il2Cpp3.ValueType = ValueType;
|
||
})(Il2Cpp2 || (Il2Cpp2 = {}));
|
||
globalThis.Il2Cpp = Il2Cpp2;
|
||
|
||
|
||
"use strict";
|
||
|
||
|
||
// ================= 保龄球场景实体探针（bowl_probe） =================
|
||
// 独立探针：前置是 frida-il2cpp-bridge bundle（由 _build_bowl_probe.py 拼接），
|
||
// 所以这里可以直接用 Il2Cpp / Il2Cpp.perform，不需要 gym_agent 的任何东西。
|
||
// 目的：回答 P0 —— 保龄球/球瓶的 sceneItem 是「场景里已存在」还是「需服务端生成」。
|
||
|
||
var BP_CACHE = {};
|
||
|
||
function bpClass(full) {
|
||
if (BP_CACHE[full] !== undefined) return BP_CACHE[full];
|
||
var res = null;
|
||
// 快路径：image.class(fullName) 直接查（gym_agent 同款）
|
||
try {
|
||
var asms = Il2Cpp.domain.assemblies;
|
||
for (var i = 0; i < asms.length; i++) {
|
||
try { var c = asms[i].image.class(full); if (c) { res = c; break; } } catch (e) { }
|
||
}
|
||
} catch (e) { }
|
||
BP_CACHE[full] = res;
|
||
return res;
|
||
}
|
||
|
||
function bpStr(v) {
|
||
if (v === null || v === undefined) return null;
|
||
try { if (v.isNull && v.isNull()) return null; } catch (e) { }
|
||
try {
|
||
var c = v.content;
|
||
if (typeof c === "string") return c;
|
||
} catch (e) { }
|
||
try { return String(v); } catch (e) { }
|
||
return null;
|
||
}
|
||
|
||
function bpNum(v) {
|
||
try {
|
||
if (v === null || v === undefined) return null;
|
||
if (typeof v === "number" || typeof v === "bigint") return Number(v);
|
||
if (typeof v === "boolean") return v;
|
||
var x = Number(v);
|
||
if (!isNaN(x)) return x;
|
||
} catch (e) { }
|
||
return null;
|
||
}
|
||
|
||
// ★ 2026-09-24 修复：IL2CPP 里 System.String 的类名是 "System.String"（带命名空间），
|
||
// 旧代码只判 === "String" ⇒ 判等恒假 ⇒ 所有字符串字段一律落到 "<obj>"。
|
||
// 后果：paths() 的「按资源名搜」从未生效（命中全靠 BP_BOWL_CFGIDS 白名单兜底），
|
||
// so 它永远搜不到「以另一个 cfg 存在的球瓶」。此函数统一收口。
|
||
// ★★ 2026-09-24 二次修复（致命）：上一版写成了
|
||
// return bpIsStr(cn) || cn === "System.String" || ...
|
||
// 第一个操作数就是自己 ⇒ **无限递归** ⇒ RangeError: Maximum call stack size exceeded
|
||
// ⇒ bpField() 一调用就抛 ⇒ holds() / bowlst() / paths() / blobstat() 全部只返回
|
||
// out.err="Maximum call stack size exceeded"，一条有效数据都拿不到。
|
||
// 正确写法就是下面这行纯字符串比对，**不许再引用自身**。
|
||
function bpIsStr(cn) {
|
||
return cn === "String" || cn === "System.String" || cn === "string";
|
||
}
|
||
|
||
// 读字段：字符串类字段自动取 content；枚举自动取数值
|
||
function bpField(o, name) {
|
||
var v;
|
||
try { v = o.field(name).value; } catch (e) { return "<err>"; }
|
||
if (v === null || v === undefined) return null;
|
||
try { if (v.isNull && v.isNull()) return null; } catch (e) { }
|
||
var cn = "";
|
||
try { cn = String(v.class.name); } catch (e) { }
|
||
if (bpIsStr(cn)) return bpStr(v);
|
||
if (typeof v === "number" || typeof v === "bigint" || typeof v === "boolean") return Number(v);
|
||
try { if (v.class.isEnum) return bpNum(bpEnumNum(v)); } catch (e) { }
|
||
return "<obj>";
|
||
}
|
||
|
||
// 枚举对象 → 数值
|
||
function bpEnumNum(v) {
|
||
// frida-il2cpp-bridge：enum 实例的 value 是底层整数
|
||
try { var u = v.value; if (typeof u === "number" || typeof u === "bigint") return u; } catch (e) { }
|
||
try { var f = v.field("value__").value; return f; } catch (e) { }
|
||
try { return v.method("get_value__").invoke(); } catch (e) { }
|
||
return null;
|
||
}
|
||
|
||
var BP_BOWL_MODELIDS = [52007069, 52007070, 52007071, 52007072, 52007073];
|
||
var BP_BOWL_CFGIDS = [80002967, 80002968, 80002969, 80002970, 80003145, 80004058];
|
||
|
||
function bpRpc(name, fn) { return { name: name, fn: fn }; }
|
||
|
||
var BOWL_RPCS = [];
|
||
|
||
// ---------- R1: sceneItem 注册表扫描（决定性） ----------
|
||
BOWL_RPCS.push(bpRpc("paths", function (kw, maxOut) {
|
||
var t0 = Date.now();
|
||
var out = { rpc: "paths", kw: String(kw || ""), total: 0, hits: [], err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemPathInfoRuntime");
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var objs = Il2Cpp.gc.choose(K);
|
||
out.total = objs ? objs.length : 0;
|
||
var kwl = out.kw.toLowerCase();
|
||
var limit = parseInt(maxOut || "400", 10);
|
||
var F = ["path", "pathId", "modelId", "sceneItemConfigId", "interactionType",
|
||
"sizeType", "destructionType", "isConfigCanMove", "isConfigCanMind"];
|
||
for (var i = 0; i < out.total; i++) {
|
||
var o = objs[i];
|
||
var rec = null;
|
||
try {
|
||
var p = bpField(o, "path");
|
||
var mid = bpField(o, "modelId");
|
||
var cid = bpField(o, "sceneItemConfigId");
|
||
var pid = bpField(o, "pathId");
|
||
var ps = (p === null ? "" : String(p));
|
||
var hit = false;
|
||
if (kwl) {
|
||
hit = ps.toLowerCase().indexOf(kwl) >= 0;
|
||
} else {
|
||
hit = true;
|
||
}
|
||
if (!hit && BP_BOWL_MODELIDS.indexOf(mid) >= 0) hit = true;
|
||
if (!hit && BP_BOWL_CFGIDS.indexOf(cid) >= 0) hit = true;
|
||
if (hit) {
|
||
rec = { path: ps, pathId: pid, modelId: mid, sceneItemConfigId: cid };
|
||
for (var k = 4; k < F.length; k++) {
|
||
try { rec[F[k]] = bpField(o, F[k]); } catch (e) { }
|
||
}
|
||
}
|
||
} catch (e) { }
|
||
if (rec) {
|
||
out.hits.push(rec);
|
||
if (out.hits.length >= limit) { out.capped = true; break; }
|
||
}
|
||
}
|
||
out.ms = Date.now() - t0;
|
||
out.ok = true;
|
||
} catch (e) {
|
||
out.err = String(e && e.message ? e.message : e);
|
||
}
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R2: 枚举真值（数值） ----------
|
||
BOWL_RPCS.push(bpRpc("enumv", function (cls) {
|
||
var out = { rpc: "enumv", cls: String(cls || ""), items: [], err: null };
|
||
try {
|
||
var K = bpClass(out.cls);
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var flds = K.fields;
|
||
for (var i = 0; i < flds.length; i++) {
|
||
var f = flds[i];
|
||
try {
|
||
if (!f.isStatic) continue;
|
||
if (String(f.name).indexOf("NativeFieldInfoPtr") === 0) continue;
|
||
if (String(f.name) === "value__") continue;
|
||
var v = f.value;
|
||
var n = bpNum(bpEnumNum(v));
|
||
if (n === null) n = bpNum(v);
|
||
out.items.push(String(f.name) + "=" + String(n));
|
||
} catch (e) { out.items.push(String(f.name) + "=ERR"); }
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R3: SceneItemMgr 集合/网格状态 ----------
|
||
BOWL_RPCS.push(bpRpc("simgrid", function () {
|
||
var out = { rpc: "simgrid", err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemMgr");
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var inst = null;
|
||
try { inst = K.method("get_Instance").invoke(); } catch (e) { }
|
||
if (!inst || (inst.isNull && inst.isNull())) {
|
||
var all = Il2Cpp.gc.choose(K);
|
||
inst = (all && all.length) ? all[0] : null;
|
||
}
|
||
if (!inst) { out.err = "no-instance"; return JSON.stringify(out); }
|
||
var colls = ["SceneItemInWorld", "SceneItemInAwake", "BallsInstanceIdSet",
|
||
"BasketballInstanceIdSet", "interactItemIds", "AllSceneItemGrid",
|
||
"GridIndexInfoDic", "IdToMetro", "waitToAddSceneItemId",
|
||
"sceneItemOccupyData", "playerOccupyDataMap", "noClearWhiteList"];
|
||
out.counts = {};
|
||
for (var i = 0; i < colls.length; i++) {
|
||
var n = colls[i], c = null, kind = "";
|
||
var v;
|
||
try { v = inst.field(n).value; } catch (e) { out.counts[n] = "nofield"; continue; }
|
||
if (v === null || v === undefined) { out.counts[n] = "null"; continue; }
|
||
try { if (v.isNull && v.isNull()) { out.counts[n] = "null"; continue; } } catch (e) { }
|
||
try { c = Number(v.method("get_Count").invoke()); kind = "count"; } catch (e) { }
|
||
if (c === null || isNaN(c)) {
|
||
try { c = Number(v.method("get_Length").invoke()); kind = "len"; } catch (e) { }
|
||
}
|
||
if (c === null || isNaN(c)) {
|
||
try { c = Number(v.method("get_Count").invoke()); kind = "count"; } catch (e) { }
|
||
}
|
||
out.counts[n] = (c === null || isNaN(c)) ? "<obj>" : (kind + ":" + c);
|
||
}
|
||
// BallsInstanceIdSet 内容（若有）
|
||
try {
|
||
var bs = inst.field("BallsInstanceIdSet").value;
|
||
if (bs && !(bs.isNull && bs.isNull())) {
|
||
var cnt = Number(bs.method("get_Count").invoke());
|
||
var en = bs.method("GetEnumerator").invoke();
|
||
var arr = [];
|
||
for (var q = 0; q < Math.min(cnt, 64); q++) {
|
||
if (!en.method("MoveNext").invoke()) break;
|
||
arr.push(String(en.method("get_Current").invoke()));
|
||
}
|
||
out.balls = { count: cnt, sample: arr };
|
||
}
|
||
} catch (e) { out.ballsErr = String(e && e.message ? e.message : e); }
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R4: 玩家坐标 ----------
|
||
BOWL_RPCS.push(bpRpc("pos", function () {
|
||
var out = { rpc: "pos", err: null };
|
||
try {
|
||
var KU = bpClass("LX6.Game.MyPlayerManager");
|
||
if (!KU) { out.err = "no-player-mgr"; return JSON.stringify(out); }
|
||
var u = KU.method("get_PlayerUnit").invoke();
|
||
if (!u || (u.isNull && u.isNull())) { out.err = "no-player-unit"; return JSON.stringify(out); }
|
||
var v = u.field("lastPosition").value;
|
||
out.pos = [v.handle.readFloat(), v.handle.add(4).readFloat(), v.handle.add(8).readFloat()];
|
||
out.unitId = String(u.field("instanceId").value);
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R6: 活着的 SceneItemHold 实例（决定性：球/瓶在不在世界里） ----------
|
||
BOWL_RPCS.push(bpRpc("holds", function (maxOut, kw) {
|
||
var t0 = Date.now();
|
||
var out = { rpc: "holds", count: 0, byCfg: {}, hits: [], err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemHold");
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var objs = Il2Cpp.gc.choose(K);
|
||
out.count = objs ? objs.length : 0;
|
||
var limit = parseInt(maxOut || "40", 10);
|
||
var kwl = String(kw || "").toLowerCase();
|
||
// 字段名只取一次
|
||
var names = [];
|
||
try {
|
||
var c = K, guard = 0;
|
||
while (c && guard++ < 8) {
|
||
for (var i = 0; i < c.fields.length; i++) {
|
||
var fn = String(c.fields[i].name);
|
||
if (fn.indexOf("Native") === 0) continue;
|
||
if (names.indexOf(fn) < 0) names.push(fn);
|
||
}
|
||
c = c.baseType;
|
||
}
|
||
} catch (e) { out.fieldErr = String(e && e.message ? e.message : e); }
|
||
out.fieldCount = names.length;
|
||
for (var q = 0; q < out.count; q++) {
|
||
var o = objs[q];
|
||
var rec = {};
|
||
var goName = null;
|
||
for (var k = 0; k < names.length; k++) {
|
||
var nm = names[k];
|
||
var val;
|
||
try { val = bpField(o, nm); } catch (e) { continue; }
|
||
if (val === "<obj>") {
|
||
// 尝试拿 GameObject 名字 / 配置名
|
||
try {
|
||
var ob = o.field(nm).value;
|
||
var cn = String(ob.class.name);
|
||
if (cn === "GameObject" || (ob.class.namespace === "UnityEngine" && cn === "GameObject")) {
|
||
var g = bpStr(ob.method("get_name").invoke());
|
||
rec[nm] = "<GO:" + g + ">";
|
||
goName = g;
|
||
} else {
|
||
var sf = null;
|
||
try { sf = bpStr(ob.field("name").value); } catch (e2) { }
|
||
if (sf === null) { try { sf = bpStr(ob.method("get_name").invoke()); } catch (e2) { } }
|
||
rec[nm] = "<" + cn + (sf ? ":" + sf : "") + ">";
|
||
}
|
||
} catch (e2) { rec[nm] = "<obj>"; }
|
||
} else {
|
||
rec[nm] = val;
|
||
}
|
||
}
|
||
var blob = JSON.stringify(rec).toLowerCase();
|
||
var keep = (kwl === "" ? true : blob.indexOf(kwl) >= 0);
|
||
// 也按保龄球 cfg id 抓
|
||
if (!keep) {
|
||
for (var z = 0; z < BP_BOWL_CFGIDS.length; z++) {
|
||
if (blob.indexOf('"' + BP_BOWL_CFGIDS[z] + '"') >= 0) { keep = true; break; }
|
||
}
|
||
}
|
||
if (keep && out.hits.length < limit) {
|
||
rec.__go = goName;
|
||
out.hits.push(rec);
|
||
}
|
||
// 统计 cfg id
|
||
try {
|
||
var cfg = rec["sceneItemConfigId"] !== undefined ? rec["sceneItemConfigId"]
|
||
: (rec["SceneItemConfigId"] !== undefined ? rec["SceneItemConfigId"] : rec["cfgId"]);
|
||
if (cfg !== undefined && cfg !== null) {
|
||
var kk = String(cfg);
|
||
out.byCfg[kk] = (out.byCfg[kk] || 0) + 1;
|
||
}
|
||
} catch (e3) { }
|
||
}
|
||
out.ms = Date.now() - t0;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R6b: 极轻量 hold 汇总（★ 自动监视专用） ----------
|
||
// 与 holds() 的区别：只读 1~2 个字段、不遍历类字段名、不 JSON.stringify 全字段
|
||
// ⇒ 可以每 3~5 秒调一次做趋势监视（holds() 全量太贵，只能手动按需调）。
|
||
//
|
||
// ★ 决胜读数：bowlCfg["80003145"].obj = 「场景里真实存在、且带 GameObject 的球瓶 hold 个数」。
|
||
// · 交互前 > 0 且交互后变 0 ⇒ 就是 hideSceneItem 干的（SetActive(false)）
|
||
// · 交互后 obj 也 > 0 ⇒ 瓶还在，问题在渲染/位置而不是 hold
|
||
// · 全程都是 0/缺失 ⇒ 关卡里真没有球瓶场景物，只能靠 BF1 骗出来
|
||
BOWL_RPCS.push(bpRpc("holdsum", function () {
|
||
var t0 = Date.now();
|
||
var out = { rpc: "holdsum", count: 0, withObj: 0, cfgs: 0, bowlCfg: {}, top: [], ms: 0, err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemHold");
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var objs = Il2Cpp.gc.choose(K);
|
||
out.count = objs ? objs.length : 0;
|
||
var hist = {};
|
||
var want = {};
|
||
for (var w = 0; w < BP_BOWL_CFGIDS.length; w++) {
|
||
want[String(BP_BOWL_CFGIDS[w])] = { n: 0, obj: 0, xMin: null, xMax: null, y: null, s: null };
|
||
}
|
||
var CFG_FIELDS = ["sceneItemConfigId", "SceneItemConfigId", "cfgId", "CfgId", "configId", "ConfigId"];
|
||
for (var q = 0; q < out.count; q++) {
|
||
var h = objs[q];
|
||
// ---- ① SceneItemObj 是否非空（= hold 有没有真正的 GameObject）----
|
||
var hasObj = false;
|
||
try {
|
||
var ov = h.field("SceneItemObj").value;
|
||
hasObj = !(ov === null || ov === undefined);
|
||
if (hasObj) { try { if (ov.isNull && ov.isNull()) hasObj = false; } catch (e) { } }
|
||
} catch (e) {
|
||
try { hasObj = bpFieldTry(h, ["SceneItemObj", "sceneItemObj"]) !== null; } catch (e2) { }
|
||
}
|
||
if (hasObj) out.withObj++;
|
||
// ---- ①b 只对「球瓶/球的 cfg」读一次世界坐标 + 缩放（≤20 个 hold，开销可忽略）----
|
||
// 这是回答「瓶到底摆在哪 / 音效为什么偏晚」的核心读数。
|
||
var gx = null, gy = null, gs = null;
|
||
if (hasObj) {
|
||
var cfgWant = false;
|
||
for (var w3 = 0; w3 < BP_BOWL_CFGIDS.length; w3++) {
|
||
try {
|
||
var cv3 = bpField(h, "sceneItemConfigId");
|
||
if (typeof cv3 === "number" && Math.round(cv3) === BP_BOWL_CFGIDS[w3]) { cfgWant = true; }
|
||
} catch (e) { }
|
||
if (cfgWant) break;
|
||
}
|
||
if (cfgWant) {
|
||
try {
|
||
var ov2 = h.field("SceneItemObj").value;
|
||
if (ov2 && !(ov2.isNull && ov2.isNull())) {
|
||
var tt = ov2.method("get_transform").invoke();
|
||
var pp = tt.method("get_position").invoke();
|
||
gx = +Number(pp.field("x").value).toFixed(3);
|
||
gy = +Number(pp.field("y").value).toFixed(3);
|
||
var ss = tt.method("get_localScale").invoke();
|
||
gs = +Number(ss.field("x").value).toFixed(4);
|
||
}
|
||
} catch (e) { }
|
||
}
|
||
}
|
||
// ---- ② cfg id（走与 holds() 相同的 bpField 通道，保证读数一致）----
|
||
var cfg = null;
|
||
for (var ci = 0; ci < CFG_FIELDS.length; ci++) {
|
||
var cv;
|
||
try { cv = bpField(h, CFG_FIELDS[ci]); } catch (e) { continue; }
|
||
if (typeof cv === "number" && isFinite(cv) && cv > 1000) { cfg = Math.round(cv); break; }
|
||
}
|
||
var kk = (cfg === null ? "?" : String(cfg));
|
||
if (hist[kk] === undefined) hist[kk] = { n: 0, obj: 0 };
|
||
hist[kk].n++;
|
||
if (hasObj) hist[kk].obj++;
|
||
if (want[kk]) {
|
||
want[kk].n++;
|
||
if (hasObj) want[kk].obj++;
|
||
if (gx !== null) {
|
||
if (want[kk].xMin === null || gx < want[kk].xMin) want[kk].xMin = gx;
|
||
if (want[kk].xMax === null || gx > want[kk].xMax) want[kk].xMax = gx;
|
||
want[kk].y = gy;
|
||
want[kk].s = gs;
|
||
}
|
||
}
|
||
}
|
||
out.bowlCfg = want;
|
||
for (var key in hist) { out.top.push([key, hist[key].n, hist[key].obj]); }
|
||
out.cfgs = out.top.length;
|
||
out.top.sort(function (a, b) { return b[1] - a[1]; });
|
||
out.top = out.top.slice(0, 12);
|
||
out.ms = Date.now() - t0;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R6b2: ★★ scale 读数对照实验（判断读出来的 [0,0,1] 是真值还是读法有误）----------
|
||
// 动机：holdpos 读出「球瓶 SceneItemObj 的 localScale = (0,0,1)」—— x/y 为 0 会让模型
|
||
// 退化到画不出来，正好解释「有碰撞有音效但看不见」。但必须排除**读法**的问题。
|
||
// 做法：拿一批「确定带 MeshRenderer」的 GameObject（一定在画面上）做对照样本，
|
||
// 读 localScale + lossyScale。若它们也返回 (0,0,1)，就是读法坏，不是瓶子坏。
|
||
BOWL_RPCS.push(bpRpc("ctrlscale", function (n) {
|
||
var t0 = Date.now();
|
||
var out = { rpc: "ctrlscale", samples: [], dist: {}, err: null };
|
||
try {
|
||
var lim = parseInt(n || "24", 10);
|
||
var R = bpClass("UnityEngine.MeshRenderer");
|
||
if (!R) { out.err = "no-meshrenderer"; return JSON.stringify(out); }
|
||
var rs = Il2Cpp.gc.choose(R);
|
||
out.renderers = rs ? rs.length : 0;
|
||
if (!rs || !rs.length) { out.err = "no-renderer-instances"; return JSON.stringify(out); }
|
||
var step = Math.max(1, Math.floor(rs.length / lim));
|
||
function v3(v) {
|
||
try {
|
||
return [+Number(v.field("x").value).toFixed(4),
|
||
+Number(v.field("y").value).toFixed(4),
|
||
+Number(v.field("z").value).toFixed(4)];
|
||
} catch (e) { return null; }
|
||
}
|
||
for (var i = 0; i < rs.length && out.samples.length < lim; i += step) {
|
||
var rec = {};
|
||
try {
|
||
var go = rs[i].method("get_gameObject").invoke();
|
||
try { rec.name = String(bpStr(go.method("get_name").invoke())); } catch (e) { }
|
||
var tt = go.method("get_transform").invoke();
|
||
rec.local = v3(tt.method("get_localScale").invoke());
|
||
rec.lossy = v3(tt.method("get_lossyScale").invoke());
|
||
rec.pos = v3(tt.method("get_position").invoke());
|
||
} catch (e) { rec.err = String(e && e.message ? e.message : e).slice(0, 80); }
|
||
out.samples.push(rec);
|
||
var k = JSON.stringify(rec.local);
|
||
out.dist[k] = (out.dist[k] || 0) + 1;
|
||
}
|
||
out.ms = Date.now() - t0;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R6c: ★★ 生成位置 + 可见性 实测（回答「交互后瓶生成在哪 / 为什么看不见」）----------
|
||
// 背景：用户观测到「听得到击瓶音效（有碰撞）但看不见瓶，且音效明显偏晚」。
|
||
// 本 RPC 一次给三组硬读数：
|
||
// ① objPos —— hold.SceneItemObj 的**世界坐标**（= 物理/碰撞实际生效的位置）
|
||
// ② subR/subN—— SceneItemObj 子树里 Renderer 的个数 / 节点总数
|
||
// subR = 0 ⇒ GameObject 是空壳 ⇒ 「有碰撞没画面」的直接原因
|
||
// ③ actSelf —— 是否被 SetActive(false)（hideSceneItem 干的）
|
||
// 再配合 bowlst("pin") 量「旁边道看得见的瓶」的世界坐标 ⇒ 两者 X 一减就是「音效偏晚」的米数。
|
||
BOWL_RPCS.push(bpRpc("holdpos", function (maxOut) {
|
||
var t0 = Date.now();
|
||
var out = { rpc: "holdpos", holdCount: 0, rows: [], agg: {}, err: null };
|
||
var limit = parseInt(maxOut || "60", 10);
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemHold");
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
|
||
// ---- 先建「哪些 GameObject 上有 Renderer」的指针集合（同 bowlst 的做法）----
|
||
var hasR = {};
|
||
var RSETS = ["UnityEngine.MeshRenderer", "UnityEngine.SkinnedMeshRenderer"];
|
||
for (var q = 0; q < RSETS.length; q++) {
|
||
var RC = null;
|
||
try { RC = bpClass(RSETS[q]); } catch (e) { }
|
||
if (!RC) continue;
|
||
var rs = null;
|
||
try { rs = Il2Cpp.gc.choose(RC); } catch (e) { continue; }
|
||
if (!rs) continue;
|
||
for (var z = 0; z < rs.length; z++) {
|
||
try {
|
||
var g = rs[z].method("get_gameObject").invoke();
|
||
if (g && g.handle && !g.handle.isNull()) hasR[g.handle.toString()] = 1;
|
||
} catch (e) { }
|
||
}
|
||
}
|
||
out.rendererGos = Object.keys(hasR).length;
|
||
|
||
function goName(g) { try { return String(bpStr(g.method("get_name").invoke())); } catch (e) { return "?"; } }
|
||
function actOf(g, m) { try { return String(g.method(m).invoke()); } catch (e) { return "?"; } }
|
||
|
||
var hs = Il2Cpp.gc.choose(K);
|
||
out.holdCount = hs ? hs.length : 0;
|
||
var CFG_FIELDS = ["sceneItemConfigId", "SceneItemConfigId", "cfgId", "CfgId", "configId", "ConfigId"];
|
||
var want = {};
|
||
for (var w = 0; w < BP_BOWL_CFGIDS.length; w++) want[BP_BOWL_CFGIDS[w]] = { n: 0, objOk: 0, subR: 0, active: 0, xMin: null, xMax: null };
|
||
|
||
for (var i = 0; i < out.holdCount && out.rows.length < limit; i++) {
|
||
var cfg = null;
|
||
for (var ci = 0; ci < CFG_FIELDS.length; ci++) {
|
||
try {
|
||
var cv = bpField(hs[i], CFG_FIELDS[ci]);
|
||
if (typeof cv === "number" && isFinite(cv) && cv > 1000) { cfg = Math.round(cv); break; }
|
||
} catch (e) { }
|
||
}
|
||
if (cfg === null || !want[cfg]) continue;
|
||
|
||
var r = { cfg: cfg };
|
||
try { r.id = String(bpField(hs[i], "instanceId")); } catch (e) { }
|
||
var ov = null;
|
||
try { ov = hs[i].field("SceneItemObj").value; } catch (e) { }
|
||
var objOk = !(ov === null || ov === undefined);
|
||
if (objOk) { try { if (ov.isNull && ov.isNull()) objOk = false; } catch (e) { } }
|
||
r.objOk = objOk;
|
||
want[cfg].n++;
|
||
if (objOk) {
|
||
want[cfg].objOk++;
|
||
r.name = goName(ov);
|
||
r.actSelf = actOf(ov, "get_activeSelf");
|
||
r.actHier = actOf(ov, "get_activeInHierarchy");
|
||
// ★ 2026-09-24：这里原来写 `r.actSelf === "True"`，而 actOf 返回的是**小写** "true"
|
||
// ⇒ active 恒为 0，和旁边 actSelf 分布打印出 {'true':10} 自相矛盾，误导判读。
|
||
if (String(r.actSelf).toLowerCase() === "true") want[cfg].active++;
|
||
try {
|
||
var t = ov.method("get_transform").invoke();
|
||
var p = t.method("get_position").invoke();
|
||
r.pos = [+Number(p.field("x").value).toFixed(3),
|
||
+Number(p.field("y").value).toFixed(3),
|
||
+Number(p.field("z").value).toFixed(3)];
|
||
var ls = t.method("get_localScale").invoke();
|
||
r.scale = [+Number(ls.field("x").value).toFixed(4),
|
||
+Number(ls.field("y").value).toFixed(4),
|
||
+Number(ls.field("z").value).toFixed(4)];
|
||
// ★ 加 lossyScale（不含父级缩放的对照）+ 父链，便于判断 scale=0 是真值还是读法问题
|
||
try {
|
||
var ly = t.method("get_lossyScale").invoke();
|
||
r.lossy = [+Number(ly.field("x").value).toFixed(4),
|
||
+Number(ly.field("y").value).toFixed(4),
|
||
+Number(ly.field("z").value).toFixed(4)];
|
||
} catch (e) { }
|
||
try {
|
||
var chain = [], cur = t, gch = 0;
|
||
while (cur && cur.handle && !cur.handle.isNull() && gch++ < 6) {
|
||
chain.push(String(bpStr(cur.method("get_gameObject").invoke()
|
||
.method("get_name").invoke())));
|
||
var pt = cur.method("get_parent").invoke();
|
||
if (!pt || !pt.handle || pt.handle.isNull()) break;
|
||
cur = pt;
|
||
}
|
||
r.path = chain.reverse().join("/");
|
||
} catch (e) { }
|
||
// ★★ 父级 lossy（最多上溯 3 层）：用来区分两种可能 ——
|
||
// (a) 我们写进 placeInfo 的缩放是 0 ⇒ 本级 local 就是 0；
|
||
// (b) 容器（SceneItemInstanceRoot / DefaultSceneItem）被压成 0 ⇒ 本级 local=1 但 lossy=0。
|
||
try {
|
||
var pcur = t, pch2 = 0, lply = [];
|
||
while (pcur && pcur.handle && !pcur.handle.isNull() && pch2++ < 3) {
|
||
var pyt = pcur.method("get_parent").invoke();
|
||
if (!pyt || !pyt.handle || pyt.handle.isNull()) break;
|
||
var ly2 = pyt.method("get_lossyScale").invoke();
|
||
lply.push([+Number(ly2.field("x").value).toFixed(4),
|
||
+Number(ly2.field("y").value).toFixed(4),
|
||
+Number(ly2.field("z").value).toFixed(4)]);
|
||
pcur = pyt;
|
||
}
|
||
r.lossyP = lply;
|
||
} catch (e) { }
|
||
// 子树：数节点 + 数 Renderer
|
||
var nSub = 0, nR = 0, firstR = null;
|
||
var q2 = [{ t: t, d: 0 }];
|
||
while (q2.length && nSub < 300) {
|
||
var it2 = q2.shift();
|
||
nSub++;
|
||
try {
|
||
var gk = it2.t.method("get_gameObject").invoke();
|
||
if (gk && gk.handle && hasR[gk.handle.toString()]) {
|
||
nR++;
|
||
if (firstR === null) firstR = goName(gk);
|
||
}
|
||
} catch (e) { }
|
||
if (it2.d < 5) {
|
||
try {
|
||
var cc = Number(it2.t.method("get_childCount").invoke());
|
||
for (var k2 = 0; k2 < cc; k2++) {
|
||
try { q2.push({ t: it2.t.method("GetChild").invoke(k2), d: it2.d + 1 }); } catch (e) { }
|
||
}
|
||
} catch (e) { }
|
||
}
|
||
}
|
||
r.subN = nSub; r.subR = nR; r.subRName = firstR;
|
||
if (nR > 0) want[cfg].subR++;
|
||
if (r.pos) {
|
||
var A = want[cfg];
|
||
if (A.xMin === null || r.pos[0] < A.xMin) A.xMin = r.pos[0];
|
||
if (A.xMax === null || r.pos[0] > A.xMax) A.xMax = r.pos[0];
|
||
}
|
||
} catch (e) { r.tErr = String(e && e.message ? e.message : e); }
|
||
}
|
||
out.rows.push(r);
|
||
}
|
||
// 排序：按 X 升序（道头 → 瓶台）
|
||
out.rows.sort(function (a, b) {
|
||
var ax = (a.pos ? a.pos[0] : 1e9), bx = (b.pos ? b.pos[0] : 1e9);
|
||
return ax - bx;
|
||
});
|
||
out.agg = want;
|
||
out.ms = Date.now() - t0;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R6d: ★★ 锚点子树实测（回答「看得见的瓶到底在哪」）----------
|
||
// 背景（服务端 GameRouter.GameGround.cs 第148~163行的实测记录）：
|
||
// · 官方场景里有锚点 GameObject，名字形如 BowlingPinPlacementL / R、BowlingGameNode、
|
||
// BowlingGameStart、MiniGameMachine_Bowling —— 共 4 台机器、每台 2 条道 = 8 条道。
|
||
// · 服务端 BowlingLanes[] 的 PinApexX 就是抄自 BowlingPinPlacement 的世界坐标。
|
||
// · **看得见的那些瓶网格 = BowlingPinPlacement 的子节点**（名字里未必有 "pin"）。
|
||
// ⇒ 想回答「瓶该在哪 / 现在在哪 / 差多少米」，必须把锚点的**整棵子树连世界坐标**倒出来。
|
||
// 用法：kids("BowlingPinPlacement", 8, 4, 80)
|
||
BOWL_RPCS.push(bpRpc("kids", function (kw, maxRoots, maxDepth, maxKids) {
|
||
var t0 = Date.now();
|
||
var out = { rpc: "kids", kw: String(kw || ""), goTotal: 0, roots: [], err: null };
|
||
try {
|
||
var kwl = out.kw.toLowerCase();
|
||
if (!kwl) { out.err = "need-keyword"; return JSON.stringify(out); }
|
||
var G = bpClass("UnityEngine.GameObject");
|
||
if (!G) { out.err = "no-gameobject-class"; return JSON.stringify(out); }
|
||
|
||
// 先建「有 Renderer 的 GameObject」指针集合，用来判断哪些节点是看得见的
|
||
var hasR = {};
|
||
var RSETS = ["UnityEngine.MeshRenderer", "UnityEngine.SkinnedMeshRenderer"];
|
||
for (var q = 0; q < RSETS.length; q++) {
|
||
var RC = null;
|
||
try { RC = bpClass(RSETS[q]); } catch (e) { }
|
||
if (!RC) continue;
|
||
var rs = null;
|
||
try { rs = Il2Cpp.gc.choose(RC); } catch (e) { continue; }
|
||
if (!rs) continue;
|
||
for (var z = 0; z < rs.length; z++) {
|
||
try {
|
||
var g = rs[z].method("get_gameObject").invoke();
|
||
if (g && g.handle && !g.handle.isNull()) hasR[g.handle.toString()] = 1;
|
||
} catch (e) { }
|
||
}
|
||
}
|
||
out.rendererGos = Object.keys(hasR).length;
|
||
|
||
function nm(g) { try { return String(bpStr(g.method("get_name").invoke())); } catch (e) { return "?"; } }
|
||
function wpos(t) {
|
||
try {
|
||
var p = t.method("get_position").invoke();
|
||
return [+Number(p.field("x").value).toFixed(3),
|
||
+Number(p.field("y").value).toFixed(3),
|
||
+Number(p.field("z").value).toFixed(3)];
|
||
} catch (e) { return null; }
|
||
}
|
||
function hasRen(g) { try { return !!(g.handle && hasR[g.handle.toString()]); } catch (e) { return false; } }
|
||
function act(g, m) { try { return String(g.method(m).invoke()); } catch (e) { return "?"; } }
|
||
|
||
// ★★ 关键改动（2026-09-24 08:17 事故后）：**不再用 Il2Cpp.gc.choose(GameObject)**。
|
||
// 那是"遍历整个 GC 堆"，是全部探针里最贵的一类调用（现场就是这一族把游戏拖住 30 秒）。
|
||
// 改成从 SceneManager 的活动场景根节点做 BFS：节点数带硬上限、不碰 GC 堆、
|
||
// 而且场景里的对象本来就都在根节点的子树里 ⇒ 覆盖率等价。
|
||
var sm = bpClass("UnityEngine.SceneManagement.SceneManager");
|
||
if (!sm) { out.err = "no-scenemanager"; return JSON.stringify(out); }
|
||
var sc = sm.method("GetActiveScene").invoke();
|
||
try { out.scene = String(bpStr(sc.method("get_name").invoke())); } catch (e) { }
|
||
var rts = sc.method("GetRootGameObjects").invoke();
|
||
var rc = 0;
|
||
try { rc = Number(rts.method("get_Length").invoke()); } catch (e) { }
|
||
out.rootCount = rc;
|
||
|
||
var wantRoots = parseInt(maxRoots || "8", 10);
|
||
var wantDepth = parseInt(maxDepth || "4", 10);
|
||
var wantKids = parseInt(maxKids || "80", 10);
|
||
var maxNodes = 120000;
|
||
|
||
var bfs = [];
|
||
for (var i0 = 0; i0 < rc; i0++) {
|
||
try { bfs.push({ t: rts.method("get_Item").invoke(i0).method("get_transform").invoke(), d: 0 }); }
|
||
catch (e) { }
|
||
}
|
||
var visited = 0;
|
||
while (bfs.length && visited < maxNodes && out.roots.length < wantRoots) {
|
||
var node = bfs.shift();
|
||
visited++;
|
||
var g1 = null, name = "?";
|
||
try { g1 = node.t.method("get_gameObject").invoke(); name = nm(g1); } catch (e) { }
|
||
if (String(name).toLowerCase().indexOf(kwl) >= 0) {
|
||
var r = { name: name, actSelf: act(g1, "get_activeSelf"),
|
||
actHier: act(g1, "get_activeInHierarchy") };
|
||
try {
|
||
var rt = node.t;
|
||
r.pos = wpos(rt);
|
||
r.hasR = hasRen(g1);
|
||
var sc3 = rt.method("get_localScale").invoke();
|
||
r.scale = [+Number(sc3.field("x").value).toFixed(4),
|
||
+Number(sc3.field("y").value).toFixed(4),
|
||
+Number(sc3.field("z").value).toFixed(4)];
|
||
// 子树 BFS：连世界坐标一起给
|
||
var kids = [];
|
||
var q2 = [];
|
||
var cc0 = 0;
|
||
try { cc0 = Number(rt.method("get_childCount").invoke()); } catch (e) { }
|
||
for (var c0 = 0; c0 < cc0; c0++) {
|
||
try { q2.push({ t: rt.method("GetChild").invoke(c0), d: 1 }); } catch (e) { }
|
||
}
|
||
while (q2.length && kids.length < wantKids) {
|
||
var it2 = q2.shift();
|
||
var k = { d: it2.d };
|
||
try {
|
||
var g2 = it2.t.method("get_gameObject").invoke();
|
||
k.name = nm(g2);
|
||
k.hasR = hasRen(g2);
|
||
k.actSelf = act(g2, "get_activeSelf");
|
||
k.actHier = act(g2, "get_activeInHierarchy");
|
||
} catch (e) { }
|
||
k.pos = wpos(it2.t);
|
||
kids.push(k);
|
||
if (it2.d < wantDepth) {
|
||
var cn = 0;
|
||
try { cn = Number(it2.t.method("get_childCount").invoke()); } catch (e) { }
|
||
for (var k2 = 0; k2 < cn; k2++) {
|
||
try { q2.push({ t: it2.t.method("GetChild").invoke(k2), d: it2.d + 1 }); } catch (e) { }
|
||
}
|
||
}
|
||
}
|
||
r.kidN = kids.length;
|
||
r.kids = kids;
|
||
} catch (e) { r.tErr = String(e && e.message ? e.message : e); }
|
||
out.roots.push(r);
|
||
}
|
||
if (node.d < wantDepth) {
|
||
var cc1 = 0;
|
||
try { cc1 = Number(node.t.method("get_childCount").invoke()); } catch (e) { }
|
||
for (var c1 = 0; c1 < cc1; c1++) {
|
||
try { bfs.push({ t: node.t.method("GetChild").invoke(c1), d: node.d + 1 }); } catch (e) { }
|
||
}
|
||
}
|
||
}
|
||
out.visited = visited;
|
||
// 按 X 排序（道头 → 瓶台），便于和 PinApexX 直接比
|
||
out.roots.sort(function (a, b) {
|
||
var ax = (a.pos ? a.pos[0] : 1e9), bx = (b.pos ? b.pos[0] : 1e9);
|
||
return ax - bx;
|
||
});
|
||
out.ms = Date.now() - t0;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R7: 枚举所有活着的 GameObject（名字搜索，兜底用） ----------
|
||
BOWL_RPCS.push(bpRpc("gobjs", function (kw, maxOut) {
|
||
var t0 = Date.now();
|
||
var out = { rpc: "gobjs", kw: String(kw || ""), count: 0, hits: [], err: null };
|
||
try {
|
||
var K = bpClass("UnityEngine.GameObject");
|
||
if (!K) { out.err = "no-gameobject-class"; return JSON.stringify(out); }
|
||
var objs = Il2Cpp.gc.choose(K);
|
||
out.count = objs ? objs.length : 0;
|
||
var kwl = out.kw.toLowerCase();
|
||
var limit = parseInt(maxOut || "100", 10);
|
||
for (var i = 0; i < out.count; i++) {
|
||
var go = objs[i];
|
||
var nm = null;
|
||
try { nm = bpStr(go.method("get_name").invoke()); } catch (e) { continue; }
|
||
if (nm === null) continue;
|
||
if (kwl && String(nm).toLowerCase().indexOf(kwl) < 0) continue;
|
||
var p3 = null;
|
||
try {
|
||
var t = go.method("get_transform").invoke();
|
||
if (t && !(t.isNull && t.isNull())) {
|
||
var wp = t.method("get_position").invoke();
|
||
p3 = [wp.field("x").value, wp.field("y").value, wp.field("z").value];
|
||
}
|
||
} catch (e) { }
|
||
out.hits.push({ name: nm, pos: p3 });
|
||
if (out.hits.length >= limit) { out.capped = true; break; }
|
||
}
|
||
out.ms = Date.now() - t0;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R5: 场景 GameObject 名称搜索 ----------
|
||
BOWL_RPCS.push(bpRpc("objs", function (kw, maxNodes, maxDepth) {
|
||
var out = { rpc: "objs", kw: String(kw || ""), visited: 0, hits: [], err: null };
|
||
try {
|
||
kw = out.kw.toLowerCase();
|
||
maxNodes = parseInt(maxNodes || "8000", 10);
|
||
maxDepth = parseInt(maxDepth || "6", 10);
|
||
var sm = bpClass("UnityEngine.SceneManagement.SceneManager");
|
||
if (!sm) { out.err = "no-scenemanager"; return JSON.stringify(out); }
|
||
var sc = sm.method("GetActiveScene").invoke();
|
||
out.scene = bpStr(sc.method("get_name").invoke());
|
||
var roots = sc.method("GetRootGameObjects").invoke();
|
||
var rc = 0;
|
||
try { rc = Number(roots.method("get_Length").invoke()); } catch (e) { }
|
||
out.rootCount = rc;
|
||
var queue = [];
|
||
for (var i = 0; i < rc; i++) {
|
||
try { queue.push({ go: roots.method("get_Item").invoke(i), depth: 0, path: "?" }); } catch (e) { }
|
||
}
|
||
var visited = 0;
|
||
while (queue.length && visited < maxNodes) {
|
||
var it = queue.shift();
|
||
visited++;
|
||
var nm = "?";
|
||
try { nm = bpStr(it.go.method("get_name").invoke()); } catch (e) { }
|
||
var path = it.path === "?" ? nm : (it.path + "/" + nm);
|
||
if (kw && String(nm).toLowerCase().indexOf(kw) >= 0) {
|
||
var w = null;
|
||
try {
|
||
var t = it.go.method("get_transform").invoke();
|
||
var wp = t.method("get_position").invoke();
|
||
w = [wp.field("x").value, wp.field("y").value, wp.field("z").value];
|
||
} catch (e) { }
|
||
out.hits.push({ path: path, pos: w, active: String(it.go.method("get_activeSelf").invoke()) });
|
||
if (out.hits.length >= 200) break;
|
||
}
|
||
if (it.depth < maxDepth) {
|
||
var ch = null;
|
||
try { ch = it.go.method("get_transform").invoke().method("get_childCount").invoke(); } catch (e) { }
|
||
if (ch !== null) {
|
||
for (var c = 0; c < Number(ch); c++) {
|
||
try {
|
||
queue.push({
|
||
go: it.go.method("get_transform").invoke().method("GetChild").invoke(c),
|
||
depth: it.depth + 1, path: path
|
||
});
|
||
} catch (e) { }
|
||
}
|
||
}
|
||
}
|
||
}
|
||
out.visited = visited;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R9: 保龄球专项状态（★ 只读）：名字 + active + 父链 + 组件 + 缩放 ----------
|
||
// 用途：回答「交互前看得见的瓶，交互后去哪了」——
|
||
// · 若它们还在 gc 里、只是 actSelf/actHier = false ⇒ 被 SetActive(false) 藏了（可逆！）
|
||
// · 若 hasRenderer = false ⇒ 被换成了空壳
|
||
// · 若连对象都没了 ⇒ 被 Destroy 了
|
||
BOWL_RPCS.push(bpRpc("bowlst", function (kw, maxOut, wantComps) {
|
||
var t0 = Date.now();
|
||
var out = { rpc: "bowlst", kw: String(kw || ""), total: 0, hits: [], err: null };
|
||
try {
|
||
var K = bpClass("UnityEngine.GameObject");
|
||
if (!K) { out.err = "no-gameobject-class"; return JSON.stringify(out); }
|
||
|
||
// ★ wantComps：默认只建 Renderer 两个集合（"r"）。
|
||
// 以前无条件建 7 个集合（4 种 Collider + Rigidbody），在 2026-09-24 08:17 现场
|
||
// 正是它把游戏拖住 ~30 秒。要 collider/rigidbody 就显式传 "rc" 或 "all"。
|
||
var wc = String(wantComps || "r").toLowerCase();
|
||
out.want = wc;
|
||
var hasR = {}, hasC = {}, hasRb = {};
|
||
var sets = [["UnityEngine.MeshRenderer", hasR], ["UnityEngine.SkinnedMeshRenderer", hasR]];
|
||
if (wc === "rc" || wc === "all") {
|
||
sets.push(["UnityEngine.BoxCollider", hasC], ["UnityEngine.SphereCollider", hasC],
|
||
["UnityEngine.CapsuleCollider", hasC], ["UnityEngine.MeshCollider", hasC]);
|
||
}
|
||
if (wc === "all") sets.push(["UnityEngine.Rigidbody", hasRb]);
|
||
for (var q = 0; q < sets.length; q++) {
|
||
var CC = null;
|
||
try { CC = bpClass(sets[q][0]); } catch (e) { }
|
||
if (!CC) continue;
|
||
var cs = null;
|
||
try { cs = Il2Cpp.gc.choose(CC); } catch (e) { continue; }
|
||
if (!cs) continue;
|
||
for (var z = 0; z < cs.length; z++) {
|
||
try {
|
||
var g = cs[z].method("get_gameObject").invoke();
|
||
if (g && g.handle && !g.handle.isNull()) sets[q][1][g.handle.toString()] = 1;
|
||
} catch (e) { }
|
||
}
|
||
}
|
||
out.rC = Object.keys(hasR).length;
|
||
out.cC = Object.keys(hasC).length;
|
||
out.rbC = Object.keys(hasRb).length;
|
||
|
||
var objs = Il2Cpp.gc.choose(K);
|
||
out.total = objs ? objs.length : 0;
|
||
var kwl = out.kw.toLowerCase();
|
||
var limit = parseInt(maxOut || "300", 10);
|
||
for (var i = 0; i < out.total; i++) {
|
||
var go = objs[i];
|
||
var nm = null;
|
||
try { nm = bpStr(go.method("get_name").invoke()); } catch (e) { continue; }
|
||
if (nm === null || nm === undefined) continue;
|
||
nm = String(nm);
|
||
if (kwl && nm.toLowerCase().indexOf(kwl) < 0) continue;
|
||
|
||
var r = { name: nm };
|
||
var h = null;
|
||
try { h = go.handle.toString(); } catch (e) { }
|
||
r.hasRenderer = !!(h && hasR[h]);
|
||
r.hasCollider = !!(h && hasC[h]);
|
||
r.hasRigidbody = !!(h && hasRb[h]);
|
||
try { r.actSelf = String(go.method("get_activeSelf").invoke()); } catch (e) { }
|
||
try { r.actHier = String(go.method("get_activeInHierarchy").invoke()); } catch (e) { }
|
||
try { r.layer = Number(go.method("get_layer").invoke()); } catch (e) { }
|
||
|
||
try {
|
||
var t = go.method("get_transform").invoke();
|
||
if (t && t.handle && !t.handle.isNull()) {
|
||
try {
|
||
var wp = t.method("get_position").invoke();
|
||
r.pos = [+Number(wp.field("x").value).toFixed(3),
|
||
+Number(wp.field("y").value).toFixed(3),
|
||
+Number(wp.field("z").value).toFixed(3)];
|
||
} catch (e) { }
|
||
try {
|
||
var ls = t.method("get_localScale").invoke();
|
||
r.scale = [+Number(ls.field("x").value).toFixed(4),
|
||
+Number(ls.field("y").value).toFixed(4),
|
||
+Number(ls.field("z").value).toFixed(4)];
|
||
} catch (e) { }
|
||
try { r.child = Number(t.method("get_childCount").invoke()); } catch (e) { }
|
||
try {
|
||
var chain = [], cur = t, guard = 0;
|
||
while (cur && cur.handle && !cur.handle.isNull() && guard++ < 14) {
|
||
try {
|
||
chain.push(String(bpStr(cur.method("get_gameObject").invoke()
|
||
.method("get_name").invoke())));
|
||
} catch (e) { chain.push("?"); }
|
||
try {
|
||
var pt = cur.method("get_parent").invoke();
|
||
if (!pt || !pt.handle || pt.handle.isNull()) break;
|
||
cur = pt;
|
||
} catch (e) { break; }
|
||
}
|
||
r.path = chain.reverse().join("/");
|
||
} catch (e) { }
|
||
}
|
||
} catch (e) { r.tErr = String(e); }
|
||
out.hits.push(r);
|
||
if (out.hits.length >= limit) { out.capped = true; break; }
|
||
}
|
||
out.ms = Date.now() - t0;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R8: 类字段/静态值 ----------
|
||
BOWL_RPCS.push(bpRpc("clsfields", function (cn) {
|
||
var out = { rpc: "clsfields", cls: String(cn || ""), fields: [], methods: [], bases: [], err: null };
|
||
try {
|
||
var K = bpClass(out.cls);
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var c = K, guard = 0;
|
||
while (c && guard++ < 8) {
|
||
var own = [];
|
||
try {
|
||
for (var i = 0; i < c.fields.length; i++) {
|
||
var f = c.fields[i];
|
||
var tn = "?";
|
||
try { tn = String(f.type.name); } catch (e) { }
|
||
own.push(String(f.name) + ":" + tn + (f.isStatic ? " (static)" : ""));
|
||
}
|
||
} catch (e) { own.push("ERRFIELD"); }
|
||
out.fields.push({ cls: String(c.fullName), fields: own });
|
||
out.bases.push(String(c.fullName));
|
||
try {
|
||
if (guard === 1) {
|
||
for (var m = 0; m < c.methods.length; m++) {
|
||
var mm = c.methods[m];
|
||
var ps = [];
|
||
try {
|
||
for (var p = 0; p < mm.parameters.length; p++) ps.push(String(mm.parameters[p].type.name));
|
||
} catch (e) { }
|
||
out.methods.push(String(mm.name) + "(" + ps.join(",") + ")");
|
||
}
|
||
}
|
||
} catch (e) { }
|
||
try { c = c.baseType; } catch (e) { c = null; }
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R9: SceneItemBlobGrid 网格清单（决定性：网格坐标系 + 覆盖范围） ----------
|
||
BOWL_RPCS.push(bpRpc("grids", function (samples) {
|
||
var t0 = Date.now();
|
||
var out = { rpc: "grids", count: 0, xs: [], zs: [], pairs: [], err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemBlobGrid");
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var objs = Il2Cpp.gc.choose(K);
|
||
out.count = objs ? objs.length : 0;
|
||
var sx = {}, sz = {};
|
||
for (var i = 0; i < out.count; i++) {
|
||
try {
|
||
var x = Number(objs[i].field("indexX").value);
|
||
var z = Number(objs[i].field("indexZ").value);
|
||
if (!isNaN(x)) sx[x] = (sx[x] || 0) + 1;
|
||
if (!isNaN(z)) sz[z] = (sz[z] || 0) + 1;
|
||
} catch (e) { }
|
||
}
|
||
out.xs = Object.keys(sx).map(Number).sort(function (a, b) { return a - b; });
|
||
out.zs = Object.keys(sz).map(Number).sort(function (a, b) { return a - b; });
|
||
out.xRange = out.xs.length ? [out.xs[0], out.xs[out.xs.length - 1]] : null;
|
||
out.zRange = out.zs.length ? [out.zs[0], out.zs[out.zs.length - 1]] : null;
|
||
out.ms = Date.now() - t0;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R10: 指定网格的完整字段（找出里面装了什么） ----------
|
||
BOWL_RPCS.push(bpRpc("griddump", function (ix, iz) {
|
||
var out = { rpc: "griddump", want: [Number(ix), Number(iz)], found: 0, rows: [], err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemBlobGrid");
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var objs = Il2Cpp.gc.choose(K);
|
||
var names = [];
|
||
var c = K, guard = 0;
|
||
while (c && guard++ < 8) {
|
||
for (var i = 0; i < c.fields.length; i++) {
|
||
var fn = String(c.fields[i].name);
|
||
if (fn.indexOf("Native") === 0) continue;
|
||
if (names.indexOf(fn) < 0) names.push(fn);
|
||
}
|
||
c = c.baseType;
|
||
}
|
||
out.fieldNames = names;
|
||
for (var q = 0; q < (objs ? objs.length : 0); q++) {
|
||
var o = objs[q];
|
||
var x, z;
|
||
try { x = Number(o.field("indexX").value); z = Number(o.field("indexZ").value); } catch (e) { continue; }
|
||
if (x !== out.want[0] || z !== out.want[1]) continue;
|
||
out.found++;
|
||
if (out.rows.length >= 3) continue;
|
||
var rec = {};
|
||
for (var k = 0; k < names.length; k++) {
|
||
var nm = names[k];
|
||
var v;
|
||
try { v = o.field(nm).value; } catch (e) { rec[nm] = "<err>"; continue; }
|
||
if (v === null || v === undefined) { rec[nm] = null; continue; }
|
||
try { if (v.isNull && v.isNull()) { rec[nm] = null; continue; } } catch (e) { }
|
||
var cn = "";
|
||
try { cn = String(v.class.name); } catch (e) { }
|
||
if (bpIsStr(cn)) { rec[nm] = bpStr(v); continue; }
|
||
if (typeof v === "number" || typeof v === "bigint" || typeof v === "boolean") { rec[nm] = Number(v); continue; }
|
||
if (cn === "Int32" || cn === "UInt32" || cn === "Single") {
|
||
try { rec[nm] = Number(v.method("ToString").invoke().content); } catch (e) { rec[nm] = "<num>"; }
|
||
continue;
|
||
}
|
||
var cnt = null;
|
||
try { cnt = Number(v.method("get_Count").invoke()); } catch (e) { }
|
||
if (cnt === null) { try { cnt = Number(v.method("get_Length").invoke()); } catch (e) { } }
|
||
rec[nm] = cnt === null ? ("<" + cn + ">") : ("<" + cn + ":" + cnt + ">");
|
||
}
|
||
out.rows.push(rec);
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R11: SceneItemBlob 静态状态 ----------
|
||
BOWL_RPCS.push(bpRpc("blobstat", function () {
|
||
var out = { rpc: "blobstat", cls: {}, err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemBlob");
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
out.name = String(K.fullName);
|
||
out.fields = [];
|
||
var c = K, guard = 0;
|
||
while (c && guard++ < 6) {
|
||
for (var i = 0; i < c.fields.length; i++) {
|
||
var f = c.fields[i];
|
||
var nm = String(f.name);
|
||
if (nm.indexOf("Native") === 0) continue;
|
||
var tn = "?";
|
||
try { tn = String(f.type.name); } catch (e) { }
|
||
var val = "";
|
||
try {
|
||
var v = f.value;
|
||
if (v === null || v === undefined) val = "null";
|
||
else if (typeof v === "number" || typeof v === "bigint" || typeof v === "boolean") val = String(v);
|
||
else {
|
||
var cn = ""; try { cn = String(v.class.name); } catch (e) { }
|
||
if (bpIsStr(cn)) val = String(bpStr(v));
|
||
else {
|
||
var cnt = null;
|
||
try { cnt = Number(v.method("get_Count").invoke()); } catch (e) { }
|
||
if (cnt === null) { try { cnt = Number(v.method("get_Length").invoke()); } catch (e) { } }
|
||
val = cnt === null ? ("<" + cn + ">") : ("<" + cn + ":" + cnt + ">");
|
||
}
|
||
}
|
||
} catch (e) { val = "<err>"; }
|
||
out.fields.push(nm + ":" + tn + (f.isStatic ? " static" : "") + " = " + val);
|
||
}
|
||
try { c = c.baseType; } catch (e) { c = null; }
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R12: 注册表 path 字符串（找出真实 prefab 名，用来搜 GameObject） ----------
|
||
BOWL_RPCS.push(bpRpc("pathstr", function (kw, maxOut) {
|
||
var t0 = Date.now();
|
||
var out = { rpc: "pathstr", kw: String(kw || ""), total: 0, rows: [], err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemPathInfoRuntime");
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var objs = Il2Cpp.gc.choose(K);
|
||
out.total = objs ? objs.length : 0;
|
||
var kwl = out.kw.toLowerCase();
|
||
var limit = parseInt(maxOut || "40", 10);
|
||
var strategies = [];
|
||
for (var i = 0; i < out.total && out.rows.length < limit; i++) {
|
||
var o = objs[i];
|
||
var cfg, mid, raw = null, how = "";
|
||
try { cfg = Number(o.field("sceneItemConfigId").value); } catch (e) { continue; }
|
||
try { mid = Number(o.field("modelId").value); } catch (e) { }
|
||
// 多策略取 path 字符串
|
||
try {
|
||
var v = o.field("path").value;
|
||
var cn = ""; try { cn = String(v.class.name); } catch (e) { }
|
||
var cand = [
|
||
["content", function () { return v.content; }],
|
||
["ToString", function () { return v.method("ToString").invoke().content; }],
|
||
["str", function () { return String(v); }],
|
||
["field_value", function () { return bpStr(v.field("value").value); }],
|
||
["f_name", function () { return bpStr(v.field("name").value); }],
|
||
["f_path", function () { return bpStr(v.field("path").value); }],
|
||
["f_str", function () { return bpStr(v.field("str").value); }]
|
||
];
|
||
for (var s = 0; s < cand.length; s++) {
|
||
try {
|
||
var r = cand[s][1]();
|
||
if (typeof r === "string" && r.length && r !== "<obj>") { raw = r; how = cand[s][0]; break; }
|
||
} catch (e) { }
|
||
}
|
||
if (raw === null) {
|
||
if (strategies.indexOf(cn) < 0) strategies.push(cn);
|
||
raw = "<objclass:" + cn + ">";
|
||
how = "none";
|
||
}
|
||
} catch (e) { raw = "<err>"; how = "err"; }
|
||
var blob = String(raw).toLowerCase();
|
||
var keep = !kwl || blob.indexOf(kwl) >= 0
|
||
|| BP_BOWL_CFGIDS.indexOf(cfg) >= 0;
|
||
if (keep) out.rows.push({ cfg: cfg, modelId: mid, path: raw, how: how });
|
||
}
|
||
out.objClasses = strategies;
|
||
out.ms = Date.now() - t0;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R13: 读类静态字段的「值」（找 blob 文件路径 / 注册表大小） ----------
|
||
BOWL_RPCS.push(bpRpc("statv", function (cn, nameFilter) {
|
||
var out = { rpc: "statv", cls: String(cn || ""), rows: [], err: null };
|
||
try {
|
||
var K = bpClass(out.cls);
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var nf = String(nameFilter || "").toLowerCase();
|
||
var c = K, guard = 0;
|
||
while (c && guard++ < 8) {
|
||
var flds = [];
|
||
try { flds = c.fields; } catch (e) { }
|
||
for (var i = 0; i < flds.length; i++) {
|
||
var f = flds[i];
|
||
var nm = String(f.name);
|
||
if (!f.isStatic) continue;
|
||
if (nm.indexOf("NativeFieldInfoPtr") === 0) continue;
|
||
if (nf && nm.toLowerCase().indexOf(nf) < 0) continue;
|
||
var tn = "?";
|
||
try { tn = String(f.type.name); } catch (e) { }
|
||
var val = "";
|
||
try {
|
||
var v = f.value;
|
||
if (v === null || v === undefined) val = "null";
|
||
else if (typeof v === "number" || typeof v === "bigint" || typeof v === "boolean") val = String(v);
|
||
else {
|
||
var cn2 = ""; try { cn2 = String(v.class.name); } catch (e) { }
|
||
if (bpIsStr(cn2)) val = "STR:" + String(bpStr(v));
|
||
else {
|
||
var cnt = null;
|
||
try { cnt = Number(v.method("get_Count").invoke()); } catch (e) { }
|
||
if (cnt === null || isNaN(cnt)) { try { cnt = Number(v.method("get_Length").invoke()); } catch (e) { } }
|
||
val = (cnt === null || isNaN(cnt)) ? ("<" + cn2 + ">") : ("<" + cn2 + ":" + cnt + ">");
|
||
}
|
||
}
|
||
} catch (e) { val = "<err:" + String(e && e.message ? e.message : e) + ">"; }
|
||
out.rows.push({ cls: String(c.fullName), field: nm, type: tn, value: val });
|
||
}
|
||
try { c = c.baseType; } catch (e) { c = null; }
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R14: 泛型/嵌套类型的字段清单（SceneItemPlaceInfoData 等） ----------
|
||
BOWL_RPCS.push(bpRpc("placefields", function () {
|
||
var out = { rpc: "placefields", classes: [], err: null };
|
||
var names = ["LX6.Item.SceneItemPlaceInfoData", "LX6.Item.ChunkBlobData`1",
|
||
"LX6.Item.SceneItemBlobHeadInfo", "LX6.Item.DestructionType",
|
||
"LX6.Item.SceneItemSizeType", "LX6.Item.GridItemType"];
|
||
for (var n = 0; n < names.length; n++) {
|
||
var rec = { cls: names[n], found: false, fields: [], methods: [] };
|
||
try {
|
||
var K = bpClass(names[n]);
|
||
if (K) {
|
||
rec.found = true;
|
||
rec.real = String(K.fullName);
|
||
var c = K, guard = 0;
|
||
while (c && guard++ < 4) {
|
||
try {
|
||
for (var i = 0; i < c.fields.length; i++) {
|
||
var f = c.fields[i];
|
||
var tn = "?";
|
||
try { tn = String(f.type.name); } catch (e) { }
|
||
rec.fields.push(String(c.fullName) + "." + String(f.name) + ":" + tn);
|
||
}
|
||
} catch (e) { }
|
||
try { c = c.baseType; } catch (e) { c = null; }
|
||
}
|
||
}
|
||
} catch (e) { rec.err = String(e && e.message ? e.message : e); }
|
||
out.classes.push(rec);
|
||
}
|
||
out.ok = true;
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R15: 枚举 NativeHashMap / Dictionary 的键值（SceneItemChunkMap / placeIdToGridSeekId） ----------
|
||
BOWL_RPCS.push(bpRpc("mapdump", function (cn, fieldName, maxOut) {
|
||
var out = { rpc: "mapdump", cls: String(cn || ""), field: String(fieldName || ""), count: null, rows: [], err: null };
|
||
try {
|
||
var K = bpClass(out.cls);
|
||
if (!K) { out.err = "class-not-found"; return JSON.stringify(out); }
|
||
var v = null;
|
||
try { v = K.field(out.field).value; } catch (e) { out.err = "no-field"; return JSON.stringify(out); }
|
||
if (v === null || v === undefined) { out.err = "null"; return JSON.stringify(out); }
|
||
try { if (v.isNull && v.isNull()) { out.err = "null-inst"; return JSON.stringify(out); } } catch (e) { }
|
||
try { out.count = Number(v.method("get_Count").invoke()); } catch (e) {
|
||
try { out.count = Number(v.method("get_Length").invoke()); } catch (e2) { }
|
||
}
|
||
var lim = parseInt(maxOut || "60", 10);
|
||
// 尝试多种枚举姿势
|
||
var tried = [];
|
||
function tryIt(tag, fn) {
|
||
try { var r = fn(); tried.push(tag + "=OK(" + r + ")"); return true; }
|
||
catch (e) { tried.push(tag + "=" + String(e && e.message ? e.message : e).slice(0, 60)); return false; }
|
||
}
|
||
// 姿势1: GetEnumerator
|
||
tryIt("GetEnumerator", function () {
|
||
var en = v.method("GetEnumerator").invoke();
|
||
var n = 0;
|
||
while (n < lim && en.method("MoveNext").invoke()) {
|
||
var kv = en.method("get_Current").invoke();
|
||
var ks = "", vs = "";
|
||
try { ks = String(bpField(kv, "Key")); } catch (e) { try { ks = String(bpField(kv, "key")); } catch (e2) { } }
|
||
try { vs = String(bpField(kv, "Value")); } catch (e) { try { vs = String(bpField(kv, "value")); } catch (e2) { } }
|
||
out.rows.push({ k: ks, v: vs });
|
||
n++;
|
||
}
|
||
return n;
|
||
});
|
||
out.tried = tried;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R16: Dictionary 内省 + 尝试枚举 placeIdToGridSeekId ----------
|
||
BOWL_RPCS.push(bpRpc("placekeys", function (maxOut, fieldName) {
|
||
var out = { rpc: "placekeys", dictCls: null, dictFields: [], count: null,
|
||
entriesField: null, arrCls: null, arrLen: null,
|
||
entryFields: [], rows: [], tried: [], err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemBlob");
|
||
if (!K) { out.err = "no-blob"; return JSON.stringify(out); }
|
||
var d;
|
||
try { d = K.field(fieldName || "placeIdToGridSeekId").value; } catch (e) { out.err = "no-field"; return JSON.stringify(out); }
|
||
if (!d) { out.err = "null-dict"; return JSON.stringify(out); }
|
||
try { out.dictCls = String(d.class.fullName); } catch (e) { }
|
||
// 1) dict 自身字段名
|
||
try {
|
||
for (var i = 0; i < d.class.fields.length; i++) {
|
||
var fn = String(d.class.fields[i].name);
|
||
if (fn.indexOf("Native") === 0) continue;
|
||
out.dictFields.push(fn);
|
||
}
|
||
} catch (e) { }
|
||
// 2) count
|
||
try { out.count = Number(d.field("_count").value); } catch (e) { out.tried.push("_count:" + String(e.message).slice(0, 50)); }
|
||
if (out.count === null) { try { out.count = Number(d.method("get_Count").invoke()); } catch (e) { } }
|
||
// 3) entries 数组
|
||
var arr = null;
|
||
var cands = ["_entries", "entries"];
|
||
for (var c = 0; c < cands.length; c++) {
|
||
try { arr = d.field(cands[c]).value; if (arr) { out.entriesField = cands[c]; break; } } catch (e) { }
|
||
}
|
||
if (!arr) { out.err = "no-entries-array"; return JSON.stringify(out); }
|
||
try { out.arrCls = String(arr.class.fullName); } catch (e) { }
|
||
try { out.arrLen = Number(arr.method("get_Length").invoke()); } catch (e) { out.tried.push("arrLen:" + String(e.message).slice(0, 40)); }
|
||
// 4) 取一个 Entry 看字段
|
||
var e0 = null;
|
||
var getters = ["GetValue", "Get"];
|
||
for (var g = 0; g < getters.length && !e0; g++) {
|
||
try { e0 = arr.method(getters[g]).invoke(0); out.tried.push(getters[g] + "=OK"); }
|
||
catch (e) { out.tried.push(getters[g] + "=" + String(e.message).slice(0, 50)); }
|
||
}
|
||
if (!e0) { out.err = "no-entry-getter"; return JSON.stringify(out); }
|
||
try {
|
||
out.entryCls = String(e0.class.fullName);
|
||
for (var q = 0; q < e0.class.fields.length; q++) {
|
||
var ef = String(e0.class.fields[q].name);
|
||
if (ef.indexOf("Native") === 0) continue;
|
||
out.entryFields.push(ef);
|
||
}
|
||
} catch (e) { out.entryCls_err = String(e.message); }
|
||
// 5) 正式枚举
|
||
var lim = parseInt(maxOut || "40", 10);
|
||
var n = out.count !== null ? out.count : out.arrLen;
|
||
for (var i = 0; i < n && out.rows.length < lim; i++) {
|
||
var e = null;
|
||
for (var g2 = 0; g2 < getters.length && !e; g2++) {
|
||
try { e = arr.method(getters[g2]).invoke(i); } catch (err) { }
|
||
}
|
||
if (!e) continue;
|
||
var rec = {};
|
||
for (var w = 0; w < out.entryFields.length; w++) {
|
||
var nm = out.entryFields[w];
|
||
try {
|
||
var val = e.field(nm).value;
|
||
if (val === null || val === undefined) { rec[nm] = null; continue; }
|
||
var cn = ""; try { cn = String(val.class.name); } catch (err) { }
|
||
if (typeof val === "number" || typeof val === "bigint" || typeof val === "boolean") { rec[nm] = Number(val); continue; }
|
||
if (bpIsStr(cn)) { rec[nm] = String(bpStr(val)); continue; }
|
||
// 值类型/结构：展开一层
|
||
var sub = {};
|
||
try {
|
||
for (var z = 0; z < val.class.fields.length && z < 16; z++) {
|
||
var zf = String(val.class.fields[z].name);
|
||
if (zf.indexOf("Native") === 0) continue;
|
||
try { sub[zf] = String(bpField(val, zf)); } catch (err) { }
|
||
}
|
||
} catch (err) { }
|
||
rec[nm] = sub;
|
||
} catch (err) { rec[nm] = "<err>"; }
|
||
}
|
||
out.rows.push(rec);
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// 内存 hex dump 小工具
|
||
function hexOf(ptr, len) {
|
||
try {
|
||
var bytes = new Uint8Array(ptr.readByteArray(len));
|
||
var s = "";
|
||
for (var i = 0; i < bytes.length; i++) {
|
||
var h = bytes[i].toString(16);
|
||
if (h.length < 2) h = "0" + h;
|
||
s += h;
|
||
}
|
||
return s;
|
||
} catch (e) { return "hexx:" + String(e.message || e); }
|
||
}
|
||
|
||
// 多名字段取读：全部失败返回 null（区别于 bpField 的 "<err>"）
|
||
function bpFieldTry(o, names) { for (var i = 0; i < names.length; i++) {
|
||
try {
|
||
var v = o.field(names[i]).value;
|
||
if (v === null || v === undefined) continue;
|
||
try { if (v.isNull && v.isNull()) continue; } catch (e) { }
|
||
return v;
|
||
} catch (e) { }
|
||
}
|
||
return null;
|
||
}
|
||
|
||
// 把「可能装箱的值/结构」拍平成一个对象
|
||
function bpFlatten(v, maxFields) {
|
||
if (v === null || v === undefined) return null;
|
||
if (typeof v === "number" || typeof v === "bigint" || typeof v === "boolean") return Number(v);
|
||
var cn = "";
|
||
try { cn = String(v.class.name); } catch (e) { }
|
||
if (bpIsStr(cn)) return String(bpStr(v));
|
||
try { if (v.class.isEnum) return bpNum(bpEnumNum(v)); } catch (e) { }
|
||
var out = {};
|
||
try {
|
||
var lim = maxFields || 20;
|
||
for (var z = 0; z < v.class.fields.length && z < lim; z++) {
|
||
var zf = String(v.class.fields[z].name);
|
||
if (zf.indexOf("Native") === 0) continue;
|
||
try {
|
||
var zv = v.field(zf).value;
|
||
if (zv === null || zv === undefined) { out[zf] = null; continue; }
|
||
var zcn = ""; try { zcn = String(zv.class.name); } catch (e) { }
|
||
if (bpIsStr(zcn)) out[zf] = String(bpStr(zv));
|
||
else if (typeof zv === "number" || typeof zv === "bigint" || typeof zv === "boolean") out[zf] = Number(zv);
|
||
else { try { if (zv.class.isEnum) out[zf] = bpNum(bpEnumNum(zv)); else out[zf] = "<" + zcn + ">"; } catch (e) { out[zf] = "<obj>"; } }
|
||
} catch (e) { out[zf] = "<err>"; }
|
||
}
|
||
} catch (e) { }
|
||
return out;
|
||
}
|
||
|
||
// ---------- R16: 用 GetEnumerator 枚举 Dictionary（key/value 多名字兜底） ----------
|
||
BOWL_RPCS.push(bpRpc("dictdump", function (fieldName, maxOut, clsName) {
|
||
var out = { rpc: "dictdump", cls: String(clsName || "LX6.Item.SceneItemBlob"), field: String(fieldName || ""),
|
||
count: null, kvFields: [], valCls: null, valFields: [], rows: [], err: null };
|
||
try {
|
||
var K = bpClass(out.cls);
|
||
if (!K) { out.err = "no-class"; return JSON.stringify(out); }
|
||
var d;
|
||
try { d = K.field(out.field).value; } catch (e) { out.err = "no-field:" + String(e.message).slice(0, 80); return JSON.stringify(out); }
|
||
if (!d) { out.err = "null"; return JSON.stringify(out); }
|
||
try { out.count = Number(d.field("_count").value); } catch (e) { }
|
||
if (out.count === null) { try { out.count = Number(d.method("get_Count").invoke()); } catch (e) { } }
|
||
|
||
var en = d.method("GetEnumerator").invoke(); // Enumerator 结构
|
||
var lim = parseInt(maxOut || "40", 10);
|
||
var n = (out.count === null ? lim : out.count);
|
||
for (var i = 0; i < n && out.rows.length < lim; i++) {
|
||
var more = false;
|
||
try { more = !!en.method("MoveNext").invoke(); } catch (e) { out.err = "MoveNext:" + String(e.message).slice(0, 60); break; }
|
||
if (!more) break;
|
||
var kv = null;
|
||
try { kv = en.method("get_Current").invoke(); } catch (e) { out.err = "get_Current:" + String(e.message).slice(0, 60); break; }
|
||
if (!kv) continue;
|
||
if (out.kvFields.length === 0) {
|
||
try {
|
||
for (var q = 0; q < kv.class.fields.length; q++) {
|
||
var qn = String(kv.class.fields[q].name);
|
||
if (qn.indexOf("Native") === 0) continue;
|
||
out.kvFields.push(qn);
|
||
}
|
||
} catch (e) { }
|
||
}
|
||
var kk = bpFieldTry(kv, ["key", "Key", "Item1"]);
|
||
var vv = bpFieldTry(kv, ["value", "Value", "Item2"]);
|
||
if (vv && out.valCls === null) {
|
||
try {
|
||
out.valCls = String(vv.class.fullName);
|
||
for (var w = 0; w < vv.class.fields.length; w++) {
|
||
var wn = String(vv.class.fields[w].name);
|
||
if (wn.indexOf("Native") === 0) continue;
|
||
out.valFields.push(wn);
|
||
}
|
||
} catch (e) { }
|
||
}
|
||
var row = { k: bpFlatten(kk, 4), v: bpFlatten(vv, 20) };
|
||
// 泛型字段枚举失败时：直接读装箱结构内存（header 0x10 之后是内联字段）
|
||
if (out.kvFields.length === 0) {
|
||
row.raw = {};
|
||
try {
|
||
var hv = kv.handle;
|
||
row.raw.at0 = hexOf(hv, 32);
|
||
var b = hv.add(0x10);
|
||
row.raw.u64b0 = b.readU64().toString();
|
||
row.raw.u32a = b.readU32();
|
||
row.raw.u32b = b.add(4).readU32();
|
||
row.raw.u32c = b.add(8).readU32();
|
||
row.raw.u32d = b.add(12).readU32();
|
||
row.raw.u32e = b.add(16).readU32();
|
||
row.raw.u32f = b.add(20).readU32();
|
||
row.raw.u32g = b.add(24).readU32();
|
||
row.raw.u32h = b.add(28).readU32();
|
||
} catch (e) { row.raw.err = String(e.message || e); }
|
||
}
|
||
out.rows.push(row);
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R17: seekIndex 是否有数据（= 该网格有没有授权摆位） ----------
|
||
// 约定（实测）：seekIndex = (indexX + 34) * 10000 + (indexZ + 75)
|
||
BOWL_RPCS.push(bpRpc("seekat", function (listStr) {
|
||
var out = { rpc: "seekat", rows: [], err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemBlob");
|
||
if (!K) { out.err = "no-blob"; return JSON.stringify(out); }
|
||
var d = K.field("seekIndexToDetailHeadListIndex").value;
|
||
var ks = String(listStr || "").split(",");
|
||
for (var i = 0; i < ks.length; i++) {
|
||
var k = parseInt(ks[i], 10);
|
||
if (isNaN(k)) continue;
|
||
var rec = { seek: k, ix: Math.floor(k / 10000) - 34, iz: (k % 10000) - 75 };
|
||
try {
|
||
rec.has = !!d.method("ContainsKey").invoke(k);
|
||
if (rec.has) rec.head = Number(d.method("get_Item").invoke(k));
|
||
} catch (e) { rec.err = String(e.message || e).slice(0, 80); }
|
||
out.rows.push(rec);
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R18: 手动激活网格 AOI（让客户端把授权摆位实例化出来） ----------
|
||
BOWL_RPCS.push(bpRpc("aoiadd", function (ixList, izList, mode) {
|
||
var out = { rpc: "aoiadd", grids: [], holdsBefore: 0, holdsAfter: 0, hits: [], err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemBlobGrid");
|
||
var HK = bpClass("LX6.Item.SceneItemHold");
|
||
if (!K) { out.err = "no-grid-class"; return JSON.stringify(out); }
|
||
var before = HK ? Il2Cpp.gc.choose(HK) : null;
|
||
out.holdsBefore = before ? before.length : 0;
|
||
|
||
var objs = Il2Cpp.gc.choose(K);
|
||
var gmap = {};
|
||
for (var i = 0; i < (objs ? objs.length : 0); i++) {
|
||
try {
|
||
var x = Number(objs[i].field("indexX").value);
|
||
var z = Number(objs[i].field("indexZ").value);
|
||
gmap[x + "," + z] = objs[i];
|
||
} catch (e) { }
|
||
}
|
||
out.gridsTotal = objs ? objs.length : 0;
|
||
|
||
var ixs = String(ixList || "").split(","), izs = String(izList || "").split(",");
|
||
var useStatic = String(mode || "") === "static";
|
||
for (var a = 0; a < ixs.length; a++) {
|
||
for (var b = 0; b < izs.length; b++) {
|
||
var ix = parseInt(ixs[a], 10), iz = parseInt(izs[b], 10);
|
||
if (isNaN(ix) || isNaN(iz)) continue;
|
||
var g = gmap[ix + "," + iz];
|
||
if (!g) { out.grids.push({ ix: ix, iz: iz, r: "no-grid" }); continue; }
|
||
var rr = [];
|
||
for (var v = 0; v < 2; v++) {
|
||
try { g.method("OnAoiAdd").invoke(v); rr.push("OnAoiAdd(" + v + ")=ok"); }
|
||
catch (e) { rr.push("OnAoiAdd(" + v + ")=" + String(e.message || e).slice(0, 70)); }
|
||
}
|
||
if (useStatic) {
|
||
for (var v2 = 0; v2 < 2; v2++) {
|
||
try { K.method("LocalOnAOIAdd").invoke(g, v2); rr.push("LocalOnAOIAdd(" + v2 + ")=ok"); }
|
||
catch (e) { rr.push("LocalOnAOIAdd(" + v2 + ")=" + String(e.message || e).slice(0, 70)); }
|
||
}
|
||
}
|
||
out.grids.push({ ix: ix, iz: iz, r: rr.join(" | ") });
|
||
}
|
||
}
|
||
var after = HK ? Il2Cpp.gc.choose(HK) : null;
|
||
out.holdsAfter = after ? after.length : 0;
|
||
// 采样 hold 的 id + GameObject 名
|
||
for (var q = 0; q < (after ? after.length : 0) && out.hits.length < 40; q++) {
|
||
var rec = {};
|
||
try {
|
||
var iid = bpFieldTry(after[q], ["InstanceId", "instanceId", "SceneItemId", "sceneItemId"]);
|
||
rec.id = String(bpFlatten(iid, 2));
|
||
} catch (e) { }
|
||
try {
|
||
var o = bpFieldTry(after[q], ["SceneItemObj", "sceneItemObj", "gameObject", "GameObject"]);
|
||
if (o) { try { rec.go = String(bpStr(o.method("get_name").invoke())); } catch (e) { rec.go = "<n>"; } }
|
||
} catch (e) { }
|
||
out.hits.push(rec);
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R19: 造 Vector3 / Quaternion 值类型 ----------
|
||
// 值类型参数：bundle 的 fromFridaValue 对「数组」按字段声明顺序写入
|
||
// Vector3 = {x,y,z}、Quaternion = {x,y,z,w} → 直接传 JS 数组
|
||
function bpVec3Arr(x, y, z) { return [Number(x), Number(y), Number(z)]; }
|
||
function bpQuatArr(x, y, z, w) { return [Number(x), Number(y), Number(z), Number(w)]; }
|
||
function bpVec3Obj(x, y, z) {
|
||
var K = bpClass("UnityEngine.Vector3");
|
||
if (!K) return null;
|
||
var o = null;
|
||
try { o = K.alloc(); } catch (e) { try { o = K.new(); } catch (e2) { return null; } }
|
||
try { o.field("x").value = x; o.field("y").value = y; o.field("z").value = z; } catch (e) { }
|
||
return o;
|
||
}
|
||
function bpQuat(x, y, z, w) {
|
||
var K = bpClass("UnityEngine.Quaternion");
|
||
if (!K) return null;
|
||
var o = null;
|
||
try { o = K.alloc(); } catch (e) { try { o = K.new(); } catch (e2) { return null; } }
|
||
try { o.field("x").value = x; o.field("y").value = y; o.field("z").value = z; o.field("w").value = w; } catch (e) { }
|
||
return o;
|
||
}
|
||
function bpHoldName(id) {
|
||
try {
|
||
var M = bpClass("LX6.Item.SceneItemMgr");
|
||
var inst = M.method("get_Instance").invoke();
|
||
var h = inst.method("GetSceneItemHold").invoke(Number(id));
|
||
if (!h) return null;
|
||
try { if (h.isNull && h.isNull()) return null; } catch (e) { }
|
||
var o = bpFieldTry(h, ["SceneItemObj", "sceneItemObj", "Obj", "obj", "Go", "go", "m_Obj"]);
|
||
if (!o) {
|
||
var names = ["get_SceneItemObj", "get_Obj", "get_Go", "get_GameObject", "get_SceneItemGo"];
|
||
for (var i = 0; i < names.length; i++) {
|
||
try { var t = h.method(names[i]).invoke(); if (t) { o = t; break; } } catch (e) { }
|
||
}
|
||
}
|
||
if (!o) return "<hold-no-obj>";
|
||
try { if (o.isNull && o.isNull()) return "<hold-obj-null>"; } catch (e) { }
|
||
try { return String(bpStr(o.method("get_name").invoke())); } catch (e) { return "<no-name>"; }
|
||
} catch (e) { return "<err:" + String(e.message || e).slice(0, 60) + ">"; }
|
||
}
|
||
|
||
// ---------- R20: 直接生成保龄球（试探哪条 API 可用） ----------
|
||
BOWL_RPCS.push(bpRpc("spawnball", function (instId, idA, idB, x, y, z, yaw) {
|
||
var out = { rpc: "spawnball", tries: [], err: null };
|
||
var M = bpClass("LX6.Item.SceneItemMgr");
|
||
if (!M) { out.err = "no-mgr"; return JSON.stringify(out); }
|
||
var inst = M.method("get_Instance").invoke();
|
||
if (!inst) { out.err = "no-inst"; return JSON.stringify(out); }
|
||
|
||
// 先确认 Vector3/Quaternion 能造
|
||
var v = bpVec3Arr(x, y, z);
|
||
var q = bpQuatArr(0, 0, 0, 1);
|
||
var sv = bpVec3Arr(1, 1, 1);
|
||
out.vec = v; out.quat = q;
|
||
|
||
// 试读回一个分量验证
|
||
var vobj = bpVec3Obj(x, y, z); try { out.vecRead = [Number(vobj.field("x").value), Number(vobj.field("y").value), Number(vobj.field("z").value)]; } catch (e) { out.vecReadErr = String(e.message); }
|
||
|
||
var ii = Number(instId);
|
||
var ids = [["pathIdA", Number(idA)], ["pathIdB", Number(idB)]];
|
||
|
||
// 姿势1: AddSceneItemBySceneItemIdSync
|
||
for (var i = 0; i < ids.length; i++) {
|
||
var rec = { api: "AddSceneItemBySceneItemIdSync", which: ids[i][0], id: ids[i][1] };
|
||
try {
|
||
r = inst.method("AddSceneItemBySceneItemIdSync").invoke(
|
||
Number(ii), Number(ids[i][1]), v, q, sv,
|
||
Number(0), 0, 0, null, null, true, false);
|
||
rec.r = "ok";
|
||
} catch (e) { rec.r = String(e.message || e).slice(0, 160); }
|
||
rec.hold = bpHoldName(ii);
|
||
out.tries.push(rec);
|
||
}
|
||
// 姿势2: AddSceneItemByPrefabNameSync
|
||
for (var j = 0; j < ids.length; j++) {
|
||
var rec2 = { api: "AddSceneItemByPrefabNameSync", which: ids[j][0], id: ids[j][1] };
|
||
try {
|
||
inst.method("AddSceneItemByPrefabNameSync").invoke(
|
||
Number(ii + 1), Number(ids[j][1]), v, q, sv,
|
||
Number(0), 0, 0, null, null, true, false);
|
||
rec2.r = "ok";
|
||
} catch (e) { rec2.r = String(e.message || e).slice(0, 160); }
|
||
rec2.hold = bpHoldName(ii + 1);
|
||
out.tries.push(rec2);
|
||
}
|
||
// 姿势3: AddSceneItemBySceneItemIdWithGameObject 变体
|
||
var rec3 = { api: "SyncAddSceneItemBySceneItemIdWithGameObject", id: Number(idA) };
|
||
try {
|
||
inst.method("SyncAddSceneItemBySceneItemIdWithGameObject").invoke(
|
||
Number(ii + 2), Number(Number(idA)), v, q, sv, 0, 0,
|
||
Number(0), null, Number(0), true, 0.0, false, null, 0, Number(0), false);
|
||
rec3.r = "ok";
|
||
} catch (e) { rec3.r = String(e.message || e).slice(0, 200); }
|
||
rec3.hold = bpHoldName(ii + 2);
|
||
out.tries.push(rec3);
|
||
|
||
out.ok = true;
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R21: 保龄球模板 id 一览（从注册表按 cfgId 取） ----------
|
||
BOWL_RPCS.push(bpRpc("tpl", function () {
|
||
var out = { rpc: "tpl", rows: [], err: null };
|
||
try {
|
||
var K = bpClass("LX6.Item.SceneItemPathInfoRuntime");
|
||
var objs = Il2Cpp.gc.choose(K);
|
||
for (var i = 0; i < (objs ? objs.length : 0); i++) {
|
||
var cfg = null;
|
||
try { cfg = Number(objs[i].field("sceneItemConfigId").value); } catch (e) { continue; }
|
||
if (BP_BOWL_CFGIDS.indexOf(cfg) < 0) continue;
|
||
var rec = { cfg: cfg };
|
||
try { rec.pathId = Number(objs[i].field("pathId").value); } catch (e) { }
|
||
try { rec.modelId = Number(objs[i].field("modelId").value); } catch (e) { }
|
||
try { rec.path = String(bpStr(objs[i].field("path").value)); } catch (e) { }
|
||
try { rec.sizeType = bpNum(bpEnumNum(objs[i].field("sizeType").value)); } catch (e) { }
|
||
try { rec.destruction = bpNum(bpEnumNum(objs[i].field("destructionType").value)); } catch (e) { }
|
||
try { rec.canMove = objs[i].field("isConfigCanMove").value; } catch (e) { }
|
||
out.rows.push(rec);
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R22: 查单个 hold + Hold 总数 ----------
|
||
BOWL_RPCS.push(bpRpc("holdat", function (idsCsv) {
|
||
var out = { rpc: "holdat", rows: [], err: null };
|
||
try {
|
||
var list = String(idsCsv || "").split(",");
|
||
for (var i = 0; i < list.length; i++) {
|
||
var id = parseInt(list[i], 10);
|
||
if (isNaN(id)) continue;
|
||
out.rows.push({ id: id, go: bpHoldName(id) });
|
||
}
|
||
var HK = bpClass("LX6.Item.SceneItemHold");
|
||
var objs = HK ? Il2Cpp.gc.choose(HK) : null;
|
||
out.holdCount = objs ? objs.length : 0;
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R23: 方法签名内省（frida 签名 + 参数类型） ----------
|
||
BOWL_RPCS.push(bpRpc("msig", function (cls, name) {
|
||
var out = { rpc: "msig", cls: String(cls || ""), name: String(name || ""), rows: [], err: null };
|
||
try {
|
||
var K = bpClass(out.cls);
|
||
if (!K) { out.err = "no-class"; return JSON.stringify(out); }
|
||
var ms = null;
|
||
try { ms = K.methods; } catch (e) { out.err = "no-methods"; return JSON.stringify(out); }
|
||
for (var i = 0; i < ms.length; i++) {
|
||
var m = ms[i];
|
||
if (String(m.name) !== out.name) continue;
|
||
var rec = { paramCount: null, ret: null, sig: null, params: [] };
|
||
try { rec.paramCount = Number(m.parameterCount); } catch (e) { }
|
||
try { rec.ret = String(m.returnType.name); } catch (e) { }
|
||
try { rec.sig = String(m.fridaSignature); } catch (e) { rec.sig = "<" + String(e.message).slice(0, 60) + ">"; }
|
||
try {
|
||
for (var p = 0; p < m.parameters.length; p++) {
|
||
var pm = m.parameters[p];
|
||
var pt = pm.type;
|
||
var one = String(pm.name) + " : " + String(pt.name);
|
||
try { one += " | ev=" + pt.enumValue; } catch (e) { }
|
||
try { one += " | byref=" + (!!pt.isByReference); } catch (e) { }
|
||
try { one += " | vt=" + (!!(pt.class && pt.class.isValueType)); } catch (e) { }
|
||
try { one += " | vsz=" + (pt.class ? pt.class.valueTypeSize : "?"); } catch (e) { }
|
||
rec.params.push(one);
|
||
}
|
||
} catch (e) { rec.params.push("<perr>"); }
|
||
out.rows.push(rec);
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R24: 值类型参数封送方式正交试验（用 Vector3.Distance 静态方法，无害可观测） ----------
|
||
BOWL_RPCS.push(bpRpc("vectest", function () {
|
||
var out = { rpc: "vectest", modes: [], err: null };
|
||
try {
|
||
out.hasValueType = (typeof Il2Cpp.ValueType === "function");
|
||
out.hasArray = (typeof Il2Cpp.array === "function");
|
||
out.hasString = (typeof Il2Cpp.string === "function");
|
||
var V = bpClass("UnityEngine.Vector3");
|
||
if (!V) { out.err = "no-vector3"; return JSON.stringify(out); }
|
||
// 静态方法
|
||
var M = null;
|
||
try { M = V.method("Distance"); } catch (e) { out.err = "no-Distance:" + String(e.message).slice(0, 80); return JSON.stringify(out); }
|
||
try { out.distSig = String(M.fridaSignature); } catch (e) { }
|
||
try { out.distParamCount = Number(M.parameterCount); } catch (e) { }
|
||
|
||
var A = [1, 0, 0], B = [4, 0, 0]; // 期望距离 3
|
||
|
||
// mode 0: 原生 JS 数组
|
||
(function () {
|
||
var r = { mode: "js-array" };
|
||
try { r.res = String(M.invoke(A, B)); } catch (e) { r.err = String(e.message || e).slice(0, 140); }
|
||
out.modes.push(r);
|
||
})();
|
||
|
||
// mode 1: Il2Cpp.ValueType
|
||
(function () {
|
||
var r = { mode: "ValueType" };
|
||
if (typeof Il2Cpp.ValueType !== "function") { r.err = "no-Il2Cpp.ValueType"; out.modes.push(r); return; }
|
||
function mk(a, b, c) {
|
||
var vt = new Il2Cpp.ValueType(Memory.alloc(V.class.valueTypeSize), V.type);
|
||
vt.field("x").value = a; vt.field("y").value = b; vt.field("z").value = c;
|
||
return vt;
|
||
}
|
||
try {
|
||
var va = mk(1, 0, 0), vb = mk(4, 0, 0);
|
||
try { r.readback = [Number(va.field("x").value), Number(va.field("y").value), Number(va.field("z").value)]; } catch (e) { }
|
||
r.res = String(M.invoke(va, vb));
|
||
} catch (e) { r.err = String(e.message || e).slice(0, 140); }
|
||
out.modes.push(r);
|
||
})();
|
||
|
||
// mode 2: 3 个扁平标量（若签名为扁平）
|
||
(function () {
|
||
var r = { mode: "flat-scalars" };
|
||
try { r.res = String(M.invoke(1, 0, 0, 4, 0, 0)); } catch (e) { r.err = String(e.message || e).slice(0, 140); }
|
||
out.modes.push(r);
|
||
})();
|
||
|
||
// mode 3: 指针（12 字节缓冲）
|
||
(function () {
|
||
var r = { mode: "pointer12" };
|
||
try {
|
||
var pa = Memory.alloc(12); pa.writeFloat(1); pa.add(4).writeFloat(0); pa.add(8).writeFloat(0);
|
||
var pb = Memory.alloc(12); pb.writeFloat(4); pb.add(4).writeFloat(0); pb.add(8).writeFloat(0);
|
||
r.res = String(M.invoke(pa, pb));
|
||
} catch (e) { r.err = String(e.message || e).slice(0, 140); }
|
||
out.modes.push(r);
|
||
})();
|
||
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R25: 列出一个类的全部方法（名字/参数数/返回/是否静态/frida 签名） ----------
|
||
BOWL_RPCS.push(bpRpc("mlist", function (cls, reStr, cap) {
|
||
var out = { rpc: "mlist", cls: String(cls || ""), rows: [], err: null };
|
||
try {
|
||
var K = bpClass(out.cls);
|
||
if (!K) { out.err = "no-class"; return JSON.stringify(out); }
|
||
var rx = reStr ? new RegExp(String(reStr), "i") : null;
|
||
var lim = cap ? Number(cap) : 400;
|
||
var ms = K.methods;
|
||
out.total = ms.length;
|
||
for (var i = 0; i < ms.length && out.rows.length < lim; i++) {
|
||
var m = ms[i], nm = "";
|
||
try { nm = String(m.name); } catch (e) { continue; }
|
||
if (rx && !rx.test(nm)) continue;
|
||
var rec = { n: nm };
|
||
try { rec.pc = Number(m.parameterCount); } catch (e) { }
|
||
try { rec.ret = String(m.returnType.name); } catch (e) { }
|
||
try { rec.st = !!m.isStatic; } catch (e) { }
|
||
try { rec.sig = String(m.fridaSignature); } catch (e) { }
|
||
out.rows.push(rec);
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R26: 通用强类型调用器 ----------
|
||
// spec = JSON 数组，元素 {"t":类型,"v":值}
|
||
// t: u64|u32|i32|f|bool|null|ptr|str|v3|q|vt(按形参类型构造值类型)
|
||
// instMode: "static" 静态 | "instance" 走 get_Instance | 其它 = 静态字段名（取其对象后实例调用）
|
||
BOWL_RPCS.push(bpRpc("invk", function (cls, mname, pcStr, instMode, specStr) {
|
||
var out = { rpc: "invk", cls: String(cls || ""), m: String(mname || ""), ts: [], err: null };
|
||
try {
|
||
var K = bpClass(out.cls);
|
||
if (!K) { out.err = "no-class"; return JSON.stringify(out); }
|
||
var pc = (pcStr === "" || pcStr === null || pcStr === undefined) ? -1 : Number(pcStr);
|
||
var spec = JSON.parse(String(specStr || "[]"));
|
||
var target = null;
|
||
if (String(instMode) === "static") {
|
||
target = K.method(out.m, pc);
|
||
} else {
|
||
var holder = null;
|
||
if (String(instMode) === "instance") {
|
||
try { holder = K.method("get_Instance").invoke(); } catch (e) { }
|
||
} else {
|
||
try { holder = K.field(String(instMode)).value; } catch (e) { }
|
||
}
|
||
if (!holder) { out.err = "no-holder(" + instMode + ")"; return JSON.stringify(out); }
|
||
try { if (holder.isNull && holder.isNull()) { out.err = "null-holder"; return JSON.stringify(out); } } catch (e) { }
|
||
target = holder.method(out.m, pc);
|
||
}
|
||
try { out.pc = Number(target.parameterCount); } catch (e) { }
|
||
try { out.ret = String(target.returnType.name); } catch (e) { }
|
||
var args = [];
|
||
for (var i = 0; i < spec.length; i++) {
|
||
var a = spec[i], t = String(a.t);
|
||
out.ts.push(t);
|
||
if (t === "null") args.push(null);
|
||
else if (t === "ptr") args.push(ptr(Number(a.v || 0)));
|
||
else if (t === "bool") args.push(!!a.v);
|
||
else if (t === "str") args.push(Il2Cpp.string(String(a.v)));
|
||
else if (t === "v3") args.push([Number(a.v[0]), Number(a.v[1]), Number(a.v[2])]);
|
||
else if (t === "q") args.push([Number(a.v[0]), Number(a.v[1]), Number(a.v[2]), Number(a.v[3])]);
|
||
else if (t === "vt") {
|
||
var pt = target.parameters[i].type;
|
||
args.push(Il2Cpp.fromFridaValue(a.v, pt));
|
||
}
|
||
// vtref: 按形参类型构造值类型，但传它的 handle（用于 ref/out 形参）
|
||
else if (t === "vtref") {
|
||
var pt2 = target.parameters[i].type;
|
||
var vt2 = Il2Cpp.fromFridaValue(a.v, pt2);
|
||
args.push(vt2.handle);
|
||
}
|
||
// new: 新建托管对象。v = [类名, 泛型参数类名...]；泛型用反引号，如 HashSet`1
|
||
else if (t === "new") {
|
||
var names = a.v;
|
||
var K2 = null, nm0 = String(names[0]);
|
||
K2 = bpClass(nm0);
|
||
if (!K2) K2 = bpClass(nm0.replace("`1", ""));
|
||
if (!K2) throw new Error("no-cls:" + nm0);
|
||
if (names.length > 1) {
|
||
var tas = [];
|
||
for (var q = 1; q < names.length; q++) {
|
||
var tc = bpClass(String(names[q]));
|
||
if (!tc) throw new Error("no-arg-cls:" + names[q]);
|
||
tas.push(tc);
|
||
}
|
||
K2 = K2.inflate.apply(K2, tas);
|
||
}
|
||
args.push(K2.new());
|
||
} else args.push(Number(a.v));
|
||
}
|
||
var rr = target.invoke.apply(target, args);
|
||
try { out.res = String(rr); } catch (e) { out.res = "<unprintable>"; }
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R27: 封送正交试验 2（无害 API：null 指针 / 值类型+标量混合） ----------
|
||
BOWL_RPCS.push(bpRpc("ptest", function () {
|
||
var out = { rpc: "ptest", rows: [], err: null };
|
||
function T(name, fn) {
|
||
var r = { n: name };
|
||
try { r.res = String(fn()); } catch (e) { r.err = String(e && e.message ? e.message : e).slice(0, 190); }
|
||
out.rows.push(r);
|
||
}
|
||
var O = bpClass("UnityEngine.Object");
|
||
out.hasObjectCls = !!O;
|
||
if (O) {
|
||
T("op_Equality(null,null)", function () {
|
||
return O.method("op_Equality").invoke(null, null);
|
||
});
|
||
T("op_Equality(inst,inst)", function () {
|
||
var M = bpClass("LX6.Item.SceneItemMgr");
|
||
var inst = M.method("get_Instance").invoke();
|
||
return O.method("op_Equality").invoke(inst, inst);
|
||
});
|
||
}
|
||
var C = bpClass("UnityEngine.Color");
|
||
out.hasColorCls = !!C;
|
||
if (C) {
|
||
T("Color.Lerp([4],[4],f)", function () {
|
||
return String(C.method("Lerp").invoke([1, 1, 1, 1], [0, 0, 0, 0], 0.5));
|
||
});
|
||
}
|
||
var Q = bpClass("UnityEngine.Quaternion");
|
||
out.hasQuatCls = !!Q;
|
||
if (Q) {
|
||
T("Quaternion.Angle([q],[q])", function () {
|
||
return String(Q.method("Angle").invoke([0, 0, 0, 1], [0, 0, 0.7071068, 0.7071068]));
|
||
});
|
||
}
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R28: 打印一个 hold 的全部字段 + 关联 GameObject ----------
|
||
BOWL_RPCS.push(bpRpc("holdf", function (id) {
|
||
var out = { rpc: "holdf", id: Number(id), fields: [], err: null };
|
||
try {
|
||
var M = bpClass("LX6.Item.SceneItemMgr");
|
||
var inst = M.method("get_Instance").invoke();
|
||
var h = inst.method("GetSceneItemHold").invoke(Number(id));
|
||
if (!h) { out.err = "no-hold"; return JSON.stringify(out); }
|
||
try { out.cls = String(h.class.name); } catch (e) { }
|
||
try {
|
||
var fs = h.class.fields;
|
||
for (var i = 0; i < fs.length; i++) {
|
||
var f = fs[i], nm = "";
|
||
try { nm = String(f.name); } catch (e) { continue; }
|
||
var rec = { n: nm };
|
||
try { rec.st = !!f.isStatic; } catch (e) { }
|
||
try { rec.t = String(f.type.name); } catch (e) { }
|
||
if (!rec.st) {
|
||
try { rec.v = bpFlatten(f.bind(h).value, 8); } catch (e) { rec.v = "<err>"; }
|
||
}
|
||
out.fields.push(rec);
|
||
}
|
||
} catch (e) { out.fErr = String(e.message); }
|
||
try { out.go = bpHoldName(Number(id)); } catch (e) { }
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- R29: 按 instanceId 设置 hold 的字段（用于关掉 ECS 渲染等） ----------
|
||
BOWL_RPCS.push(bpRpc("holdset", function (id, specStr) {
|
||
var out = { rpc: "holdset", id: Number(id), done: [], err: null };
|
||
try {
|
||
var M = bpClass("LX6.Item.SceneItemMgr");
|
||
var inst = M.method("get_Instance").invoke();
|
||
var h = inst.method("GetSceneItemHold").invoke(Number(id));
|
||
if (!h) { out.err = "no-hold"; return JSON.stringify(out); }
|
||
var spec = JSON.parse(String(specStr || "{}"));
|
||
for (var k in spec) {
|
||
var rec = { n: k };
|
||
try {
|
||
var f = h.field(k);
|
||
f.value = spec[k];
|
||
try { rec.back = String(f.value); } catch (e) { }
|
||
rec.ok = true;
|
||
} catch (e) { rec.err = String(e && e.message ? e.message : e).slice(0, 130); }
|
||
out.done.push(rec);
|
||
}
|
||
out.ok = true;
|
||
} catch (e) { out.err = String(e && e.message ? e.message : e); }
|
||
return JSON.stringify(out);
|
||
}));
|
||
|
||
// ---------- 入口 ----------
|
||
// ★★ 重调用互斥闸（2026-09-24 08:17 现场事故之后加的，**这是防卡死的核心**）：
|
||
// 事故：自动快照里连着调 bowlst（内部要跑 7 次 Il2Cpp.gc.choose）+ 监视线程每 4 秒
|
||
// 调一次 holdsum（也要 gc.choose），把 GC 堆全量遍历叠在一起，
|
||
// 游戏主线程被拖住 ~30 秒不动（Player.log 08:17:38 停写，08:18:09 才断开）。
|
||
// 现在三条规则：
|
||
// ① 任何"重"RPC 之间**互斥**：重入直接返回 busy，不会叠成风暴。
|
||
// ② 每次耗时记进 BP_COST，`bpsCost()` 可查；>5s 计入 BP_SLOW，>8s 直接 send 一条告警。
|
||
// ③ 轻 RPC（只读 JS 变量 / 类元数据，不碰 gc）不受限，可以高频轮询 ——
|
||
// `bfStatus` 就属于这一类，它**一个 IL2CPP 调用都不做**，所以心跳用它。
|
||
var BP_HEAVY_BUSY = false, BP_HEAVY_OWNER = null, BP_COST = {}, BP_SLOW = 0;
|
||
var BP_LIGHT_RPCS = { pos: 1, clsfields: 1, enumv: 1 };
|
||
|
||
var BOWL_EXPORTS = {};
|
||
BOWL_RPCS.forEach(function (r) {
|
||
var isLight = !!BP_LIGHT_RPCS[r.name];
|
||
BOWL_EXPORTS[r.name] = function () {
|
||
var args = Array.prototype.slice.call(arguments);
|
||
var res = null;
|
||
if (!isLight && BP_HEAVY_BUSY) {
|
||
return JSON.stringify({
|
||
rpc: r.name, err: "busy: heavy probe already running (" + BP_HEAVY_OWNER + ")"
|
||
});
|
||
}
|
||
if (!isLight) { BP_HEAVY_BUSY = true; BP_HEAVY_OWNER = r.name; }
|
||
var t = Date.now();
|
||
try {
|
||
res = r.fn.apply(null, args);
|
||
} catch (e) {
|
||
res = JSON.stringify({ rpc: r.name, err: String(e && e.message ? e.message : e) });
|
||
} finally {
|
||
if (!isLight) {
|
||
var ms = Date.now() - t;
|
||
BP_COST[r.name] = ms;
|
||
if (ms > 5000) BP_SLOW++;
|
||
if (ms > 8000) {
|
||
try { send(JSON.stringify({ bf: "[SLOW] " + r.name + " took " + ms + "ms" })); } catch (e) { }
|
||
}
|
||
BP_HEAVY_BUSY = false; BP_HEAVY_OWNER = null;
|
||
}
|
||
}
|
||
// 只把小结果回送（避免几百 KB 的 dump 反复走通道 / 刷屏）
|
||
if ("window" in globalThis && typeof globalThis.send === "function") {
|
||
try { if (String(res).length <= 1200) send(String(res)); } catch (e) { }
|
||
}
|
||
return res;
|
||
};
|
||
});
|
||
|
||
// ★ 代价查询（轻）：看哪些 RPC 慢、有没有卡在 busy
|
||
BOWL_EXPORTS.bpsCost = function () {
|
||
return JSON.stringify({
|
||
rpc: "bpsCost", cost: BP_COST, slow: BP_SLOW,
|
||
busy: BP_HEAVY_BUSY, owner: BP_HEAVY_OWNER
|
||
});
|
||
};
|
||
|
||
Il2Cpp.perform(function () {
|
||
rpc.exports = Object.assign(rpc.exports || {}, BOWL_EXPORTS);
|
||
try { send(JSON.stringify({ ready: true, rpcs: BOWL_RPCS.length })); } catch (e) { }
|
||
});
|
||
|
||
// ================== 保龄球客户端补丁 BF1（常驻版）==================
|
||
//
|
||
// 原理（v7..v12 实测闭环）：
|
||
// 客户端造 SceneItemHold 的**唯一**入口是
|
||
// LX6.Item.SceneItemBlob.TryGetSceneItemPlaceInfoDataByPlaceId(
|
||
// UInt64 uniqueId, out MA_Ref<SceneItemPlaceInfoData> data, out SceneItemBlobType& blobType)
|
||
// 它是对「关卡烘焙摆位表」的一次查表。官方关卡里**没有烘焙任何球瓶/球**
|
||
// （离线证据：StreamingAssets/Blocks/vfc_1286 里 cell(67,39) 的 blob 只有 19 个
|
||
// 椅子/长椅/垃圾桶/广告牌；BowlingConfig.json 记录数为 0），
|
||
// 所以服务端推来的球瓶 id 查不到 → 返回 false → 不调 SyncAddSceneItemByLocalData
|
||
// → 不建 hold → 「球瓶按下按钮后消失」、「投球时手上没球」、「pool[101] is nil」。
|
||
//
|
||
// 本补丁让这个函数对「服务端的球瓶/球 id」返回 true，并把一个我们构造好的
|
||
// SceneItemPlaceInfoData 交出去 ⇒ 客户端原生流程全通：
|
||
// SyncAddSceneItemByLocalData → SyncAddSceneItemByIdData → DoSceneItemHolderEnterWorld
|
||
//
|
||
// SceneItemPlaceInfoData 实测内存布局（instanceSize=112；frida 报的 field.offset 比实际大 16）：
|
||
// +0x00 BlobArray<Int32> linkPath {ptr,len} +0x10 UInt64 uniqueId
|
||
// +0x18 UInt32 sceneItemCfgId +0x1C Int32 pathId
|
||
// +0x20 Int32 groupId +0x24 f32 posX
|
||
// +0x28 f32 posY +0x2C f32 posZ
|
||
// +0x30 f32 eulerX +0x34 f32 eulerY
|
||
// +0x38 f32 eulerZ +0x3C Int32 iScale
|
||
// +0x40 Int32 navmeshId +0x44 BlobArray<SpecialParamData>
|
||
// +0x54 BlobArray<UInt64> linkSceneItemId
|
||
//
|
||
// 做法：先主动查一个真 placeId 拿「合法模板」，再克隆成我们的 15 个条目。
|
||
(function () {
|
||
'use strict';
|
||
|
||
function sendlog(s) { try { send(JSON.stringify({ bf: String(s) })); } catch (e) { } }
|
||
|
||
// ★★ 2026-09-30 卡死修复 ①：热路径（hook 回调）**绝不能**直接 send()。
|
||
// send() 是给 Python 宿主的 IPC：宿主正忙 / 出站队列有背压时会**阻塞调用它的线程**，
|
||
// 而 hook 回调跑在**客户端物件加载线程**上 ⇒ 整条加载流水线停摆
|
||
// （症状正是实测到的：CPU≈0.05 核、日志 0 增长的静默死锁）。
|
||
// ⇒ 热路径只往缓冲区塞一行，由 setInterval 在 frida 自己的 JS 线程上批量发出。
|
||
var LOGBUF = [];
|
||
var LOGBUF_MAX = 200; // 满了就丢，绝不扩张、绝不阻塞
|
||
function sendlogLater(s) {
|
||
try { if (LOGBUF.length < LOGBUF_MAX) LOGBUF.push(String(s)); } catch (e) { }
|
||
}
|
||
function flushLog() {
|
||
if (!LOGBUF.length) return;
|
||
try {
|
||
var n = Math.min(LOGBUF.length, 30); // 每次最多 30 行，避免刷屏
|
||
for (var i = 0; i < n; i++) send(JSON.stringify({ bf: LOGBUF[i] }));
|
||
LOGBUF.splice(0, n);
|
||
} catch (e) { }
|
||
}
|
||
var LOGIV = setInterval(flushLog, 700);
|
||
|
||
// ---- 数据：与 GameRouter.GameGround.cs 的 BowlingLanes / 常量 完全一致 ----
|
||
// (laneZ, PinApexX, GameNodeX) 顺序 = C# BowlingLanes[]（按 z 降序）
|
||
var LANES = [
|
||
[1566.7732, 2710.2510, 2692.2559],
|
||
[1564.7737, 2710.2056, 2692.2559],
|
||
[1572.1193, 2710.3689, 2692.3738],
|
||
[1570.1198, 2710.3235, 2692.3738],
|
||
[1576.1143, 2710.4600, 2692.4648],
|
||
[1574.1147, 2710.4146, 2692.4648],
|
||
[1581.4462, 2710.5840, 2692.5889],
|
||
[1579.4467, 2710.5386, 2692.5889]
|
||
];
|
||
var PIN_CFG = 80003145, PIN_PATH = 1959229003;
|
||
var BALL_CFG = 80002967, BALL_PATH = 1838106492;
|
||
var ID_BASE = 0xd3e03a0c01; // _bowlingSceneItemSeq 起点 910000000000 + 1
|
||
var BATCH = 15; // 10 瓶 + 5 球
|
||
|
||
// 模板候选（球馆格 (67,39) 的 5 个真实烘焙 placeId）
|
||
var TPL_CANDIDATES = [
|
||
'0x482716fd0e9d2f30', '0x92204198eaef66de', '0x9bc102684b95d776',
|
||
'0xce21103f6e9c1809', '0xebf189795fb8d298'
|
||
];
|
||
|
||
var TPL = null, TPLPTR = null, SLOTS = null;
|
||
var ARMED = false, FAKED = 0, HITS = 0;
|
||
var LANEIDX = -1, ITEMS = null;
|
||
var PMGR = null, PCACHE = { t: 0, z: null };
|
||
var QUERY_VA = null;
|
||
|
||
function bfClass(full) {
|
||
var asms;
|
||
try { asms = Il2Cpp.domain.assemblies; } catch (e) { return null; }
|
||
for (var j = 0; j < asms.length; j++) {
|
||
try { var cc = asms[j].image.class(full); if (cc) return cc; } catch (e) { }
|
||
}
|
||
for (var i = 0; i < asms.length; i++) {
|
||
var classes = null;
|
||
try { classes = asms[i].image.classes; } catch (e) { continue; }
|
||
if (!classes) continue;
|
||
for (var c = 0; c < classes.length; c++) {
|
||
var nm = null;
|
||
try { nm = String(classes[c].name); } catch (e) { continue; }
|
||
if (nm === full) return classes[c];
|
||
}
|
||
}
|
||
return null;
|
||
}
|
||
function cp(dst, src, len) {
|
||
try { dst.writeByteArray(src.readByteArray(len)); return true; } catch (e) { return false; }
|
||
}
|
||
// ★ 热路径优化（2026-09-24）：isOurs 被 GetSceneItemHold / 查表 hook 的**每一次**调用触发，
|
||
// 原来每次都 toString(16) + indexOf，字符串分配很贵。改成指针区间比较。
|
||
// 我们关心的 id 全在 0xD3E03A0000..0xD3E0400000（= 十进制 910000000000 起）这一段。
|
||
var OURS_LO = null, OURS_HI = null;
|
||
function isOurs(p) {
|
||
try {
|
||
if (OURS_LO === null) { OURS_LO = ptr('0xd3e03a0000'); OURS_HI = ptr('0xd3e0400000'); }
|
||
if (p && typeof p.compare === 'function') {
|
||
if (p.compare(OURS_LO) < 0) return false;
|
||
if (p.compare(OURS_HI) >= 0) return false;
|
||
return true;
|
||
}
|
||
if (typeof p === 'number') return p >= 0xd3e03a0000 && p < 0xd3e0400000;
|
||
return p.toString(16).indexOf('d3e03a') === 0;
|
||
} catch (e) { return false; }
|
||
}
|
||
// ★ 紧急刹车：把三个 Interceptor 全部摘掉（游戏一卡就能立刻停手，不需要关客户端）
|
||
var LISTENERS = [];
|
||
// ★★ 停机标志：置上之后所有 hook 回调立刻短路，配合 detach 保证「卸载时没有任何
|
||
// JS 正在跑」—— 这是「关掉加载器 → 游戏卡死」那种事故的对症解法。
|
||
var DISARMED = false;
|
||
|
||
// ---- 由玩家 z 选最近的道（与 C# BowlingPickLane 同规则）----
|
||
function pickLaneIdx(z) {
|
||
if (typeof z !== 'number' || !isFinite(z)) return -1;
|
||
var best = -1, bd = 1e9;
|
||
for (var i = 0; i < LANES.length; i++) {
|
||
var d = Math.abs(LANES[i][0] - z);
|
||
if (d < bd) { bd = d; best = i; }
|
||
}
|
||
return best;
|
||
}
|
||
|
||
// ---- 15 个条目（10 瓶 1-2-3-4 三角 + 5 球一排），与 C# PushBowlingSceneItemsAsync 同公式 ----
|
||
function buildItems(laneIdx) {
|
||
var L = LANES[laneIdx];
|
||
var laneZ = L[0], pinApexX = L[1], gameNodeX = L[2];
|
||
var laneHeadX = gameNodeX + 0.24;
|
||
var out = [];
|
||
for (var r = 0; r < 4; r++) {
|
||
var n = r + 1;
|
||
for (var c = 0; c < n; c++) {
|
||
out.push({
|
||
cfg: PIN_CFG, path: PIN_PATH, x: pinApexX + r * 0.26, y: 0.02,
|
||
z: laneZ + (c - (n - 1) * 0.5) * 0.30, s: 100
|
||
});
|
||
}
|
||
}
|
||
for (var b = 0; b < 5; b++) {
|
||
out.push({
|
||
cfg: BALL_CFG, path: BALL_PATH, x: laneHeadX - 1.0, y: 0.12,
|
||
z: laneZ + (b - 2) * 0.35, s: 100
|
||
});
|
||
}
|
||
return out;
|
||
}
|
||
|
||
Il2Cpp.perform(function () {
|
||
var blob = bfClass('LX6.Item.SceneItemBlob');
|
||
if (!blob) { sendlog('ERR: SceneItemBlob not found'); return; }
|
||
try { QUERY_VA = blob.method('TryGetSceneItemPlaceInfoDataByPlaceId').virtualAddress; }
|
||
catch (e) { sendlog('ERR: query method ' + e); return; }
|
||
|
||
SLOTS = Memory.alloc(112 * BATCH);
|
||
|
||
function writeSlot(slot, idPtr, it) {
|
||
if (TPL) cp(slot, TPL, 112);
|
||
slot.add(0x10).writePointer(idPtr);
|
||
slot.add(0x18).writeU32(it.cfg);
|
||
slot.add(0x1C).writeS32(it.path);
|
||
slot.add(0x24).writeFloat(it.x);
|
||
slot.add(0x28).writeFloat(it.y);
|
||
slot.add(0x2C).writeFloat(it.z);
|
||
// ★★ 「最小覆写」原则 —— 2026-09-24 08:32 实测定案（bfTplDump 逐字段对比得出）：
|
||
//
|
||
// 旧实现（v12）在拷完模板后还额外做了：
|
||
// +0x20 groupId 写 0 → 模板本来就是 0，无影响
|
||
// +0x30 eulerX 写 0 → 模板本来就是 0，无影响
|
||
// +0x34 eulerY 写 0 → 模板是 359.963（≈整圈），与缩放无关
|
||
// +0x38 eulerZ 写 0 → 模板本来就是 0，无影响
|
||
// +0x3C iScale 写 100 → 模板是 **0** ← ★★★ 就是它
|
||
//
|
||
// 症状：生成对象的 localScale 退化成 **[0, 0, 1]** ⇒ 尺寸压塌、画不出来
|
||
// （有碰撞、有音效，就是没画面）。改回沿用模板后 localScale = [1, 1, 1]，
|
||
// 用户实测「可以看到球了，也有击中的物理效果」。
|
||
//
|
||
// `iScale` 很可能是**尺寸类型枚举/索引**（资源表里球瓶 sizeType=0、球 sizeType=1），
|
||
// 0 = 默认尺寸；写 100 是非法值 ⇒ 退化。
|
||
//
|
||
// ⇒ 教训：**含义没吃透的字段，"保持模板原值"永远比"写个我猜的值"安全。**
|
||
// 想改什么就改什么，别顺手清零。诊断用 bfTplDump / bfSetField。
|
||
}
|
||
|
||
function fetchTpl() {
|
||
for (var i = 0; i < TPL_CANDIDATES.length; i++) {
|
||
try {
|
||
var fn = new NativeFunction(ptr(QUERY_VA), 'int',
|
||
['uint64', 'pointer', 'pointer']);
|
||
var bA = Memory.alloc(64), bB = Memory.alloc(64);
|
||
var zero = new ArrayBuffer(64);
|
||
bA.writeByteArray(zero); bB.writeByteArray(zero);
|
||
var ok = fn(uint64(TPL_CANDIDATES[i]), bA, bB);
|
||
if (!ok) continue;
|
||
var p = bA.readPointer();
|
||
if (!p || p.toString() === '0x0') continue;
|
||
var t = Memory.alloc(112);
|
||
if (!cp(t, p, 112)) continue;
|
||
TPL = t; TPLPTR = p;
|
||
sendlog('template captured from ' + TPL_CANDIDATES[i] + ' -> ' + p.toString(16) +
|
||
' cfg=' + TPL.add(0x18).readU32() + ' z=' + TPL.add(0x2C).readFloat().toFixed(2));
|
||
return true;
|
||
} catch (e) { sendlog('tpl try err ' + e); }
|
||
}
|
||
return false;
|
||
}
|
||
|
||
// ★★ 2026-09-30 卡死修复 ②（**主犯**）：热路径里绝不调用任何 IL2CPP API。
|
||
//
|
||
// 原实现：onLeave → playerZ() → PMGR.method('get_PlayerUnit',0).invoke()
|
||
// invoke() = il2cpp_runtime_invoke：要进 VM、可能触发**类加载**与 **GC**，
|
||
// 还要拿 VM / 类加载器相关的锁。而我们的回调就跑在**客户端物件加载线程**上，
|
||
// 那个线程此刻正在做类加载 + 反序列化 —— 两边互抢同一把锁 ⇒ **死锁**。
|
||
//
|
||
// 修法：
|
||
// · 解析动作搬到 Il2Cpp.perform 的安全上下文里做（启动时一次，且不在任何
|
||
// hook 回调内）⇒ 只拿到 PlayerUnit 句柄 + lastPosition 字段偏移；
|
||
// · 热路径退化成 **纯原始内存读**（零 IL2CPP 调用、零锁、零 GC）；
|
||
// · 需要刷新时由 Il2Cpp.perform 在 frida 自己的线程上做，不碰游戏线程。
|
||
var PUNIT = null, POFF = -1, PKLASS = null;
|
||
|
||
function refreshPlayer() {
|
||
try {
|
||
if (!PMGR) PMGR = bfClass('LX6.Game.MyPlayerManager');
|
||
if (!PMGR) return;
|
||
var u = PMGR.method('get_PlayerUnit', 0).invoke();
|
||
if (!u || u.handle.isNull()) return;
|
||
var v = u.field('lastPosition').value;
|
||
if (!v || !v.handle) return;
|
||
var off = v.handle.sub(u.handle).toInt32(); // 字段相对对象头的偏移
|
||
if (off < 0 || off > 0x4000) return;
|
||
PUNIT = u.handle; POFF = off;
|
||
try { PKLASS = u.handle.readPointer(); } catch (e) { PKLASS = null; }
|
||
var zz = u.handle.add(off + 8).readFloat(); // Vector3: x=+0 y=+4 z=+8
|
||
if (isFinite(zz)) PCACHE = { t: Date.now(), z: zz };
|
||
} catch (e) { }
|
||
}
|
||
|
||
function playerZ() {
|
||
if (PUNIT && POFF >= 0) {
|
||
try {
|
||
// 类指针不变 ⇒ 对象没被回收（IL2CPP 的 GC 是非移动式）
|
||
if (PKLASS && !PUNIT.readPointer().equals(PKLASS)) return PCACHE.z;
|
||
var zz = PUNIT.add(POFF + 8).readFloat();
|
||
if (isFinite(zz) && zz !== 0) { PCACHE = { t: Date.now(), z: zz }; return zz; }
|
||
} catch (e) { }
|
||
}
|
||
return PCACHE.z; // 拿不到就用上一次的值 —— 永远不阻塞、永远不进 IL2CPP
|
||
}
|
||
|
||
// ★ 卡死修复 ③（配套）：模板探测必须**在挂 hook 之前**做。
|
||
// 挂上之后再调 fetchTpl() 就是通过被 hook 的地址重入同一个函数（见 onLeave 里的说明）。
|
||
try { fetchTpl(); } catch (e) { }
|
||
if (TPL) sendlog('template captured (pre-hook probe) -> ' + TPLPTR.toString(16));
|
||
|
||
// 启动时解析一次玩家句柄（此刻不在任何 hook 回调里 ⇒ 可以安全调用 IL2CPP API）
|
||
try { refreshPlayer(); } catch (e) { }
|
||
sendlog('player resolved: unit=' + (PUNIT ? PUNIT.toString(16) : 'null') +
|
||
' off=' + POFF + ' z=' + (PCACHE.z === null ? '?' : PCACHE.z.toFixed(2)));
|
||
|
||
// ---------------- 核心 hook ----------------
|
||
LISTENERS.push(Interceptor.attach(ptr(QUERY_VA), {
|
||
onEnter: function (args) {
|
||
this.id = args[0];
|
||
this.outA = args[1];
|
||
this.outB = args[2];
|
||
},
|
||
onLeave: function (retval) {
|
||
if (DISARMED) return; // ★ 已停机：一个字节都不再碰
|
||
var ok = 0;
|
||
try { ok = retval.toInt32(); } catch (e) { }
|
||
if (ok !== 0) {
|
||
// 真实 placeId 成功 —— 若还没模板，立刻收一份
|
||
if (!TPL) {
|
||
try {
|
||
var p = this.outA.readPointer();
|
||
if (p && p.toString() !== '0x0') {
|
||
var t = Memory.alloc(112);
|
||
if (cp(t, p, 112)) {
|
||
TPL = t; TPLPTR = p;
|
||
sendlogLater('template captured (hook) -> ' + p.toString(16));
|
||
}
|
||
}
|
||
} catch (e) { }
|
||
}
|
||
return;
|
||
}
|
||
if (!isOurs(this.id)) return;
|
||
HITS++;
|
||
if (!ARMED) return;
|
||
// ★ 卡死修复 ③：这里原本是 `if (!TPL) { if (!fetchTpl()) return; }`。
|
||
// fetchTpl() 会通过 NativeFunction **直接调用 QUERY_VA**，而 QUERY_VA 此刻
|
||
// 已经被我们 hook 了 ⇒ 等于「在自己的 onLeave 里重入同一个被 hook 的函数」。
|
||
// 一旦该函数内部有非重入锁（或它自己也要进 VM）就会自锁 ⇒ 死锁。
|
||
// ⇒ 模板只留两个来源：① 挂 hook **之前**的探测；② 真实查表成功时的**被动**
|
||
// 捕获（纯内存读，安全）。拿不到模板就这一次不伪造，等下一次。
|
||
if (!TPL) return;
|
||
|
||
// 选道：按玩家 z；拿不到就退回上一次/第 0 条
|
||
var z = playerZ();
|
||
var li = pickLaneIdx(z);
|
||
if (li >= 0 && li !== LANEIDX) {
|
||
LANEIDX = li;
|
||
ITEMS = buildItems(LANEIDX);
|
||
sendlogLater('lane -> #' + LANEIDX + ' (laneZ=' + LANES[LANEIDX][0] +
|
||
', playerZ=' + (z === null ? '?' : z.toFixed(2)) + ')');
|
||
}
|
||
if (LANEIDX < 0) { LANEIDX = 0; ITEMS = buildItems(0); }
|
||
|
||
var n = 0;
|
||
try { n = parseInt(this.id.toString(16), 16); } catch (e) { }
|
||
var idx = (n - ID_BASE) % BATCH;
|
||
if (idx < 0) idx += BATCH;
|
||
var it = ITEMS[idx];
|
||
try {
|
||
writeSlot(SLOTS.add(idx * 112), this.id, it);
|
||
this.outA.writePointer(SLOTS.add(idx * 112));
|
||
retval.replace(ptr(1));
|
||
FAKED++;
|
||
if (FAKED <= 20) {
|
||
sendlogLater('FAKED id=' + this.id.toString(16) + ' idx=' + idx +
|
||
' cfg=' + it.cfg + ' pos=(' + it.x.toFixed(2) + ',' +
|
||
it.y.toFixed(2) + ',' + it.z.toFixed(2) + ')');
|
||
}
|
||
} catch (e) { sendlogLater('fake err ' + e); }
|
||
}
|
||
}));
|
||
|
||
ARMED = true;
|
||
sendlog('armed. waiting for template... (hint: stand inside the bowling alley so the AOI table loads)');
|
||
|
||
// ---- 观测 hook（★ 卡死修复 ④：默认**不挂**）----
|
||
// 这两个 hook 只统计/打日志，对伪造功能零贡献，却挂在 GetSceneItemHold /
|
||
// DoSceneItemHolderEnterWorld 上 —— 与核心 hook 是同一条物件加载热路径。
|
||
// 每多一个 Interceptor，每次调用就多一次 trampoline 跳转 + 一次 JS 回调
|
||
// （而且另一个模块 balloon_fix.js 也 hook 了 QUERY_VA，热路径上本来就有两份）。
|
||
// ⇒ 默认关；要诊断时用 rpc `bfDiag(true)` 现挂，`bfDiag(false)` 摘掉。
|
||
var DIAG = false;
|
||
var DIAG_LS = [];
|
||
var HOLDS_OK = 0, HOLDS_NIL = 0;
|
||
function attachDiag() {
|
||
if (DIAG_LS.length) return;
|
||
try {
|
||
var mgrCls = bfClass('LX6.Item.SceneItemMgr');
|
||
var GET_VA = mgrCls.method('GetSceneItemHold').virtualAddress;
|
||
DIAG_LS.push(Interceptor.attach(ptr(GET_VA), {
|
||
onEnter: function (args) {
|
||
if (DISARMED) return;
|
||
// ★ 顺序反了会多跑一次 isOurs：这里先试更可能是 id 的那个实参
|
||
var a1 = isOurs(args[1]) ? args[1] : null;
|
||
this.idp = a1 !== null ? a1 : (isOurs(args[0]) ? args[0] : null);
|
||
},
|
||
onLeave: function (rv) {
|
||
if (DISARMED || !this.idp) return; // ★ 停机后一个字节都不再碰
|
||
var s = '0x' + rv.toString(16);
|
||
if (s === '0x0') {
|
||
HOLDS_NIL++;
|
||
if (HOLDS_NIL <= 20) sendlogLater('hold NIL for ' + this.idp.toString(16));
|
||
} else {
|
||
HOLDS_OK++;
|
||
if (HOLDS_OK <= 20) sendlogLater('hold OK for ' + this.idp.toString(16));
|
||
}
|
||
}
|
||
}));
|
||
// DoSceneItemHolderEnterWorld：hold 真正进世界的时刻
|
||
try {
|
||
var EW_VA = mgrCls.method('DoSceneItemHolderEnterWorld').virtualAddress;
|
||
DIAG_LS.push(Interceptor.attach(ptr(EW_VA), {
|
||
onEnter: function (args) {
|
||
if (DISARMED) return;
|
||
if (isOurs(args[1])) sendlogLater('holder entered world: ' + args[1].toString(16));
|
||
}
|
||
}));
|
||
} catch (e) { }
|
||
} catch (e) { sendlog('watch hook err ' + e); }
|
||
}
|
||
if (DIAG) attachDiag();
|
||
|
||
// ★ 卡死修复 ③（配套）：这个 tick 不再调 fetchTpl() —— 挂上 hook 之后再调它就是
|
||
// 重入被 hook 的函数。模板只靠「挂 hook 前的探测」+「真实查表成功时的被动捕获」。
|
||
//
|
||
// ⛑⛑ 2026-09-30 11:0x 二次修正：这里**曾经**是 `Il2Cpp.perform(refreshPlayer)`，
|
||
// 那是个错误 —— `Il2Cpp.perform` 要把任务投递到 IL2CPP 线程执行并等待结果，
|
||
// 而与此同时「物件加载线程」可能正堵在这个 script 的运行时锁上等 hook 回调 ⇒
|
||
// 两边互等（定时器等游戏线程 / 游戏线程等锁）。这是**我自己引入的**新死锁面。
|
||
// ⇒ 干脆不再周期性刷新：启动时解析一次就够了（IL2CPP 用非移动 GC，句柄长期有效），
|
||
// 解析失败时 playerZ() 会安全返回上一次的值，不会阻塞、不会进 IL2CPP。
|
||
// （真的要重新解析，用 rpc `bfRefetch` 或重启注入器。）
|
||
var tick = setInterval(function () {
|
||
if (DISARMED) return;
|
||
}, 3000);
|
||
|
||
// 供外部查询状态
|
||
rpc.exports = rpc.exports || {};
|
||
rpc.exports.bfStatus = function () {
|
||
return JSON.stringify({
|
||
armed: ARMED, tpl: !!TPL,
|
||
tplPtr: TPLPTR ? TPLPTR.toString(16) : null,
|
||
tplCfg: TPL ? TPL.add(0x18).readU32() : null,
|
||
lane: LANEIDX, hits: HITS, faked: FAKED,
|
||
holdsOk: HOLDS_OK, holdsNil: HOLDS_NIL,
|
||
playerZ: PCACHE.z, hooks: LISTENERS.length,
|
||
punit: PUNIT ? PUNIT.toString(16) : null, poff: POFF, diag: DIAG,
|
||
disarmed: DISARMED
|
||
});
|
||
};
|
||
// ★ 卡死修复 ③：挂上 hook 之后**不能**再用 fetchTpl() 主动探测
|
||
// （= 通过被 hook 的地址重入同一个函数）⇒ 只清模板，交给被动捕获。
|
||
rpc.exports.bfRefetch = function () {
|
||
TPL = null;
|
||
if (LISTENERS.length > 0) return 'cleared — will re-capture passively on next real lookup';
|
||
return fetchTpl() ? 'ok' : 'fail';
|
||
};
|
||
// ★ 卡死修复 ④：观测 hook 的开关（默认关，见 attachDiag 的说明）
|
||
rpc.exports.bfDiag = function (on) {
|
||
DIAG = !!on;
|
||
if (DIAG) { attachDiag(); return 'diag on (' + DIAG_LS.length + ' listener(s))'; }
|
||
var n = 0;
|
||
for (var i = 0; i < DIAG_LS.length; i++) { try { DIAG_LS[i].detach(); n++; } catch (e) { } }
|
||
DIAG_LS = [];
|
||
return 'diag off (detached ' + n + ')';
|
||
};
|
||
|
||
// ★★ 诊断 RPC：把 112 字节的 placeInfo 逐字段摊开。
|
||
// 目的：回答「+0x30/+0x34/+0x38 到底是 euler 角还是缩放分量」
|
||
// —— 拿**真实模板**（合法 scene item）的值做基准，一看便知。
|
||
function dump112(p, tag) {
|
||
var o = { tag: tag, hex: null, dec: [], err: null };
|
||
try {
|
||
var b = new Uint8Array(p.readByteArray(112));
|
||
var h = [];
|
||
for (var i = 0; i < 112; i++) h.push(('0' + b[i].toString(16)).slice(-2));
|
||
o.hex = h.join('');
|
||
for (var off = 0; off < 112; off += 4) {
|
||
var s = null, f = null;
|
||
try { s = p.add(off).readS32(); } catch (e) { }
|
||
try { f = p.add(off).readFloat(); } catch (e) { }
|
||
o.dec.push('+0x' + ('0' + off.toString(16)).slice(-2) +
|
||
' i32=' + s + ' f32=' + (f === null ? '?' : (Math.abs(f) < 1e-7 ? '0' : f.toFixed(5))));
|
||
}
|
||
} catch (e) { o.err = String(e); }
|
||
return o;
|
||
}
|
||
rpc.exports.bfTplDump = function () {
|
||
var out = { rpc: 'bfTplDump', tplCfg: null, template: null, slot0: null, err: null };
|
||
if (!TPL) { out.err = 'no-template-yet'; return JSON.stringify(out); }
|
||
try { out.tplCfg = TPL.add(0x18).readU32(); } catch (e) { }
|
||
out.template = dump112(TPL, 'template(real)');
|
||
if (SLOTS) { try { out.slot0 = dump112(SLOTS, 'slot0(what-we-write)'); } catch (e) { } }
|
||
return JSON.stringify(out);
|
||
};
|
||
|
||
// ★ 实验用：改「我们写入的 slot」里任意 4 字节字段。
|
||
// 例：bfSetField(0, 0x3c, 1) 把条 0 的 +0x3C 改成 1
|
||
// bfSetField(0, 0x3c, 0) 改回模板原值
|
||
// kind：'i'（默认，Int32）或 'f'（float）。
|
||
// ⚠ 只影响**之后**新建的 hold；已经进世界的对象不会变（要重开一局才生效）。
|
||
rpc.exports.bfSetField = function (idx, off, val, kind) {
|
||
if (!SLOTS) return 'no-slots';
|
||
idx = parseInt(idx, 10); off = parseInt(off, 10);
|
||
if (!(idx >= 0 && idx < BATCH) || off < 0 || off > 108) return 'bad-args';
|
||
var p = SLOTS.add(idx * 112 + off);
|
||
if (kind === 'f') p.writeFloat(Number(val)); else p.writeS32(parseInt(val, 10));
|
||
return 'slot[' + idx + ']+0x' + off.toString(16) + ' = ' + val + ' (' + (kind || 'i32') + ')';
|
||
};
|
||
// ★ 紧急刹车：游戏一卡就调它，三个 Interceptor 全摘掉，立刻停止一切干扰。
|
||
// （不需要关客户端；Python 侧 Ctrl+C 也行，但钩子会留在进程里直到游戏退出。）
|
||
rpc.exports.bfDisarm = function () {
|
||
DISARMED = true;
|
||
var n = 0;
|
||
for (var i = 0; i < LISTENERS.length; i++) {
|
||
try { LISTENERS[i].detach(); n++; } catch (e) { }
|
||
}
|
||
LISTENERS = [];
|
||
for (var j = 0; j < DIAG_LS.length; j++) {
|
||
try { DIAG_LS[j].detach(); n++; } catch (e) { }
|
||
}
|
||
DIAG_LS = [];
|
||
ARMED = false;
|
||
try { clearInterval(tick); } catch (e) { }
|
||
try { clearInterval(LOGIV); } catch (e) { }
|
||
try { flushLog(); } catch (e) { } // 停机前把缓冲区里剩的打出来
|
||
sendlog('DISARMED: detached ' + n + ' listener(s)');
|
||
return 'detached ' + n;
|
||
};
|
||
|
||
// ★★ 停机协议（加载器关闭前**必调**，也是唯一该在 unload 脚本之前调的接口）
|
||
// ① 置 DISARMED ⇒ 所有 hook 回调立刻短路（在途的那次也安全）
|
||
// ② detach 全部 Interceptor
|
||
// ③ 清掉 setInterval（补模板用的那个）
|
||
// 返回后 agent 已彻底停手 —— 这时才允许 Python 侧 unload 脚本。
|
||
rpc.exports.bowlShutdown = function () {
|
||
DISARMED = true;
|
||
try { clearInterval(tick); } catch (e) { }
|
||
try { clearInterval(LOGIV); } catch (e) { }
|
||
var n = 0;
|
||
for (var i = 0; i < LISTENERS.length; i++) {
|
||
try { LISTENERS[i].detach(); n++; } catch (e) { }
|
||
}
|
||
LISTENERS = [];
|
||
for (var j = 0; j < DIAG_LS.length; j++) {
|
||
try { DIAG_LS[j].detach(); n++; } catch (e) { }
|
||
}
|
||
DIAG_LS = [];
|
||
ARMED = false;
|
||
try { flushLog(); } catch (e) { } // 停机前把缓冲区里剩的打出来
|
||
try { sendlog('SHUTDOWN: disabled + detached ' + n + ' listener(s)'); } catch (e) { }
|
||
return JSON.stringify({ ok: true, detached: n, faked: FAKED, holdsOk: HOLDS_OK });
|
||
};
|
||
});
|
||
})();
|