how to judge parameter‘type？？byte[]??

[zbx911]

const mscorlib = Il2Cpp.Domain.reference.assemblies.mscorlib.image;
const SystemString = mscorlib.classes["System.String"];

SystemString.methods.IsNullOrEmpty.intercept({
onEnter(instance, parameters) {
parameters.value = Il2Cpp.String.from("Replaced!");
assert((parameters.value.value as Il2Cpp.String).content == "Replaced!");
},
onLeave(returnValue) {
returnValue.value = true;
}
});

how to judge parameter‘type？

[vfsfitvnm]

@zbx911
Uhm, are you asking how to debug a System.Byte[]?

If so, the signature of that method is:

System.Void ProcessBlock(System.Byte[] inputBuffer, System.Int32 inputOffset);

You can manipulate it as follows:

async function main() {
    await Il2Cpp.initialize();

    const mscorlib = Il2Cpp.Domain.reference.assemblies.mscorlib.image;
    const MD5CryptoServiceProvider = mscorlib.classes["System.Security.Cryptography.MD5CryptoServiceProvider"];

    MD5CryptoServiceProvider.methods.ProcessBlock.intercept({
        onEnter(instance, parameters) {
            const inputBuffer = parameters.inputBuffer.value as Il2Cpp.Array<number>;
            console.log(`inputBuffer length: ${inputBuffer.length}`);

            // you can manipulate it with inputBuffer.set(x, y); ...

            // ... or
            const jsBuffer: number[] = Array.from(inputBuffer);

            // ...
        }
    });
}

Btw, the translator didn't really help!

[zbx911]

@zbx911
Uhm, are you asking how to debug a System.Byte[]?

If so, the signature of that method is:

System.Void ProcessBlock(System.Byte[] inputBuffer, System.Int32 inputOffset);

You can manipulate it as follows:

async function main() {
    await Il2Cpp.initialize();

    const mscorlib = Il2Cpp.Domain.reference.assemblies.mscorlib.image;
    const MD5CryptoServiceProvider = mscorlib.classes["System.Security.Cryptography.MD5CryptoServiceProvider"];

    MD5CryptoServiceProvider.methods.ProcessBlock.intercept({
        onEnter(instance, parameters) {
            const inputBuffer = parameters.inputBuffer.value as Il2Cpp.Array<number>;
            console.log(`inputBuffer length: ${inputBuffer.length}`);

            // you can manipulate it with inputBuffer.set(x, y); ...

            // ... or
            const jsBuffer: number[] = Array.from(inputBuffer);

            // ...
        }
    });
}

Btw, the translator didn't really help!

我的意思是根据hook对象的参数类型，进行分类处理，
if(a.type.name=="string"){}
else if (a.type,name=="byte[]"){}
这样？
不是进行 断言.

[zbx911]

@zbx911
Uhm, are you asking how to debug a System.Byte[]?

If so, the signature of that method is:

System.Void ProcessBlock(System.Byte[] inputBuffer, System.Int32 inputOffset);

You can manipulate it as follows:

async function main() {
    await Il2Cpp.initialize();

    const mscorlib = Il2Cpp.Domain.reference.assemblies.mscorlib.image;
    const MD5CryptoServiceProvider = mscorlib.classes["System.Security.Cryptography.MD5CryptoServiceProvider"];

    MD5CryptoServiceProvider.methods.ProcessBlock.intercept({
        onEnter(instance, parameters) {
            const inputBuffer = parameters.inputBuffer.value as Il2Cpp.Array<number>;
            console.log(`inputBuffer length: ${inputBuffer.length}`);

            // you can manipulate it with inputBuffer.set(x, y); ...

            // ... or
            const jsBuffer: number[] = Array.from(inputBuffer);

            // ...
        }
    });
}

Btw, the translator didn't really help!

你的例子太少了，可以多增加些。

[UlyssesWu]

I'll suggest ignoring him before he following your words to use English, or he will keep asking in other languages next time.

[vfsfitvnm]

@zbx911
You can use Il2Cpp.Type.name getter: you will get strings like "System.Byte[]", "System.String" etc.

You can gather a Il2Cpp.Type using the type getter: Il2Cpp.Object.class.type, Il2Cpp.Field.type, Il2Cpp.Parameter.type...

I suggest you to read the source code, it's quite simple imho (but yes, it deserves a better documentation...).

However, like @UlyssesWu suggested, I will ignore/close this issue if you keep answering in your language! Non ti darebbe fastidio se rispondessi nella mia lingua?

[zbx911]

I'll suggest ignoring him before he following your words to use English, or he will keep asking in other languages next time.

my english can read，not write！

[zbx911]

@zbx911
You can use Il2Cpp.Type.name getter: you will get strings like "System.Byte[]", "System.String" etc.

You can gather a Il2Cpp.Type using the type getter: Il2Cpp.Object.class.type, Il2Cpp.Field.type, Il2Cpp.Parameter.type...

I suggest you to read the source code, it's quite simple imho (but yes, it deserves a better documentation...).

However, like @UlyssesWu suggested, I will ignore/close this issue if you keep answering in your language! Non ti darebbe fastidio se rispondessi nella mia lingua?

this.info=this.info+"arg"+index+" |"+parameter.value+"|"+parameter.class.type+"|\n"


traceback 
{'columnNumber': 1,
 'description': "TypeError: cannot read property 'type' of undefined",
 'fileName': 'agent/index.ts',
 'lineNumber': 385,
 'stack': "TypeError: cannot read property 'type' of undefined\n"
          '    at onEnter (agent/index.ts:385)\n'
          '    at call (native)\n'
          '    at <anonymous> '
          '(node_modules/frida-il2cpp-bridge/dist/il2cpp/structs/method.js:120)',
 'type': 'error'}
[C] call func: System.Security.Cryptography.MD5CryptoServiceProvider.ProcessBlock()
ret  |undefined|
retbs||

[zbx911]

const v = parameter as Il2Cpp.Parameter;
this.info=this.info+"arg"+index+" |"+parameter.value+"|"+v.type+"|\n"
this.info=this.info+"arg"+index+" |"+bin2hex(parameter.value)+"|\n"

[C] call func: System.Security.Cryptography.MD5CryptoServiceProvider.ProcessBlock()
arg1 |[object Object]|undefined|
arg1 |636865636b5f636f64653d312e392e302e366639363637363626706c6174666f726d3d32265f746d5f3d313045525f5f41422080000000009801000000000000|
arg2 |0|undefined|
arg2 ||
ret |undefined|
retbs||

[zbx911]

var v = parameter.value as Il2Cpp.ValueType;
this.info=this.info+"arg"+index+" |"+parameter.value+"|"+v.class+"|\n"

traceback
[C] call func: System.Security.Cryptography.MD5CryptoServiceProvider.ProcessBlock()
arg1 |[object Object]|undefined|
arg1 |636865636b5f636f64653d312e392e302e366639363637363626706c6174666f726d3d32265f746d5f3d313045525f5f41422080000000009801000000000000|
arg2 |0|undefined|
arg2 ||
ret |undefined|
retbs||

[vfsfitvnm]

@zbx911
The onEnter parameters are not bound to their corresponding Il2Cpp.Parameters.
onEnter(instance: Il2Cpp.Object | null, parameters: Accessor<WithValue>).
WithValue has only two fields: value (of type Il2Cpp.AllowedType), and valueHandle, the pointer to it, if there is one.

You have to do something like this:

    const mscorlib = Il2Cpp.Domain.reference.assemblies.mscorlib.image;
    const MD5CryptoServiceProvider = mscorlib.classes["System.Security.Cryptography.MD5CryptoServiceProvider"];
    const ProcessBlock = MD5CryptoServiceProvider.methods.ProcessBlock;
    
    ProcessBlock.intercept({
        onEnter(instance, parameters) {
            for (const parameterName in parameters) {
                const typeName = ProcessBlock.parameters[parameterName].type.name;
                const value = parameters[parameterName].value;
            }
        }
    }); 

[zbx911]

@zbx911
The onEnter parameters are not bound to their corresponding Il2Cpp.Parameters.
onEnter(instance: Il2Cpp.Object | null, parameters: Accessor<WithValue>).
WithValue has only two fields: value (of type Il2Cpp.AllowedType), and valueHandle, the pointer to it, if there is one.

You have to do something like this:

    const mscorlib = Il2Cpp.Domain.reference.assemblies.mscorlib.image;
    const MD5CryptoServiceProvider = mscorlib.classes["System.Security.Cryptography.MD5CryptoServiceProvider"];
    const ProcessBlock = MD5CryptoServiceProvider.methods.ProcessBlock;
    
    ProcessBlock.intercept({
        onEnter(instance, parameters) {
            for (const parameterName in parameters) {
                const typeName = ProcessBlock.parameters[parameterName].type.name;
                const value = parameters[parameterName].value;
            }
        }
    }); 

ok,thanks for this!!!! You can add this to readme.