/*
如何使用
设置一个倒计时后dump指定的so文件，timeout单位是ms，默认为3000ms
*/
function dump(soName: string, timeout: number = 3000) {
    setTimeout(() => {
        let libSo = Process.getModuleByName(soName);
        let base = libSo.base;
        let size = libSo.size;
        let sectionRanges = libSo.enumerateRanges("");
        for (let i = 0; i < sectionRanges.length; i++) {
            console.log(sectionRanges[i].base.sub(base), sectionRanges[i].size, sectionRanges[i].base.add(sectionRanges[i].size).sub(base), sectionRanges[i].protection);
            Memory.protect(sectionRanges[i].base, sectionRanges[i].size, 'rwx');
            let buffer = sectionRanges[i].base.readByteArray(sectionRanges[i].size);
            console.log(`write ${sectionRanges[i].size} bytes sections`);
            send(["dumpso", soName], buffer);
            if (i + 1 < sectionRanges.length && sectionRanges[i].base.add(sectionRanges[i].size).compare(sectionRanges[i + 1].base) !== 0) {
                let gap = Memory.alloc(sectionRanges[i + 1].base.sub(sectionRanges[i].base.add(sectionRanges[i].size)).toUInt32());
                let buffer = gap.readByteArray(sectionRanges[i + 1].base.sub(sectionRanges[i].base.add(sectionRanges[i].size)).toUInt32());
                console.log(`write ${sectionRanges[i + 1].base.sub(sectionRanges[i].base.add(sectionRanges[i].size)).toUInt32()} bytes gap`);
                send(["dumpso", soName], buffer);
            }
        }
        console.log("base: ", base);
        console.log("size: ", size);
        console.log("base + size: ", base.add(size));
    }, timeout);
}
dump("libil2cpp.so");

setTimeout(() => {
    let lib = Process.getModuleByName("libil2cpp.so");
    console.log(lib.base);
    let offset = 0x6EF9C28000;
    let addr = [0x0000006EFA08E300,
        0x0000006EFA08E18C,
        0x0000006EFA08D880,
        0x0000006EFA08DAB0,
        0x0000006EFA08DFDC,
        0x0000006EFA08DE90,
        0x0000006EFA08E184,
        0x0000006EFA08E2F8,
        0x0000006EFA08E3B0,
        0x0000006EFA08E3A8
    ]
    var name = ["SmallKeyboard___ctor(SmallKeyboard_o *this, const MethodInfo *method)",
        "SmallKeyboard__Start(SmallKeyboard_o *this, const MethodInfo *method)",
        "void SmallKeyboard__iI1Ii(SmallKeyboard_o *this, SmallKeyboard_iII1i_o *info, const MethodInfo *method)",
        "SmallKeyboard__iI1Ii_469567457968(SmallKeyboard_o *this, uint64_t i1I, const MethodInfo *method)",
        "void SmallKeyboard__iI1Ii_476641288156(SmallKeyboard_o *this, UnityEngine_GameObject_o *go, const MethodInfo *method",
        "SmallKeyboard__oO0oOo0(SmallKeyboard_o *this, const MethodInfo *method)",
        "SmallKeyboard__oO0oOoO(SmallKeyboard_o *this, const MethodInfo *method)",
        "SmallKeyboard___c__DisplayClass14_0___ctor(SmallKeyboard___c__DisplayClass14_0_o *this, const MethodInfo *method)",
        "SmallKeyboard___c__DisplayClass14_0___Start_b__0(SmallKeyboard___c__DisplayClass14_0_o *this, const MethodInfo *method)",
        "SmallKeyboard_iII1i___ctor(SmallKeyboard_iII1i_o *this, const MethodInfo *method)"
    ]
    for (let i = 0; i < addr.length; i++) {
        console.log("hook " + name[i]);
        Interceptor.attach(lib.base.add(addr[i]).sub(offset), {
            onEnter: function () {
                console.log("called " + name[i]);
            }
        })
    }
    Interceptor.attach(lib.base.add(0x0000006EFA4839C4).sub(offset), {
        onLeave(retval) {
            console.log(retval);
        },
    })
}, 3000);

/*
如何使用
这个gadget通过hook libart.so中的getStaticMethodID函数来获取so层获取的dex函数信息
一般直接运行即可，注意本gadget依赖libart.so的加载
配套python解析message的函数
def handleGetStaticMethodID(message):
    print("----------------------------------------")
    print("JAVA method name: {}".format(message['payload'][1]))
    print("JAVA method signature: {}".format(message['payload'][2]))
    print("Which file get It: {}".format(message['payload'][3]))


*/
function hookJNIgetStaticMethodID() {
    console.log("hook JNIgetStaticMethodID");
    let symbols = Module.load("libart.so").enumerateSymbols();
    for (let i = 0; i < symbols.length; i++) {
        let symbol = symbols[i];
        if (symbol.name.indexOf("art") >= 0 &&
            symbol.name.indexOf("JNI") >= 0 &&
            symbol.name.indexOf("GetStaticMethodID") >= 0 &&
            symbol.name.indexOf("CheckJNI") < 0) {
            console.log(symbol.name);
            Interceptor.attach(symbol.address, {
                onEnter: function (args) {
                    var Name = args[2].readUtf8String();
                    var sig = args[3].readUtf8String();
                    let whoCallIt = DebugSymbol.fromAddress(this.returnAddress).toString();
                    send(["getStaticMethodID", Name, sig, whoCallIt]);
                }
            })
        }
    }
}
setTimeout(hookJNIgetStaticMethodID, 3000);

Interceptor.attach(lib.base.add(0x311a0), {
    onEnter: function () {
        console.log(DebugSymbol.fromAddress(this.context.x2));
    }
})

Interceptor.attach(ll2.base.add(0x46AE1C), {
    onEnter: function () {
        console.log("[handle]", ptr(this.context.x9).sub(ll2.base).add(0x6D54207000))
    }
})

function main() {
    var ll2 = Process.getModuleByName("libil2cpp.so");

    var idabase = 0x6D54207000;
    var basePtr = ll2.base.sub(idabase);
    Interceptor.attach(basePtr.add(0x6D5466CBD0), {
        onEnter() {
            console.log("low32 of input:  ", this.context.x0);
        }
    })
    Interceptor.attach(basePtr.add(0x6D5466CBF4), {
        onEnter() {
            console.log("hig32 of input:  ", this.context.x0);
        }
    })
    Interceptor.attach(basePtr.add(0x6D5466CC3C), {
        onEnter() {
            console.log("ret:  ", this.context.x21, this.context.x22);
        }
    })
    Interceptor.attach(basePtr.add(0x6D546725CC), {
        // pushU16toStack
        onEnter() {
            console.log(`stack[${this.context.x10}] = ${this.context.x8}`);
        }
    })
    var heapIdx = 0, stackIdx = 0;
    // popStacktoHeap
    Interceptor.attach(basePtr.add(0x6D54672548), {
        onEnter() {
            stackIdx = this.context.x9;
            heapIdx = this.context.x8;
            let value = ptr(this.context.x10).add(this.context.x9 * 4 + 0x20).readU32();
            console.log(`heap[${heapIdx}] = stack[${stackIdx}] // stack[${stackIdx}] = ${value}`)
        }
    })
    // pushHeaptoStack
    Interceptor.attach(basePtr.add(0x6D54672438), {
        onEnter() {
            heapIdx = this.context.x8;
        }
    })
    Interceptor.attach(basePtr.add(0x6D54672460), {
        onEnter() {
            stackIdx = this.context.x10;
            console.log(`stack[${stackIdx}] = heap[${heapIdx}] // heap[${heapIdx}] = ${this.context.x8}`)
        }
    })
    // shiftR
    Interceptor.attach(basePtr.add(0x6D54672088), {
        onEnter() {
            console.log(`push ${this.context.x10} >> ${this.context.x11} to stack // ${this.context.x10 >> this.context.x11}`)
        }
    })
    // and
    Interceptor.attach(basePtr.add(0x6D54672104), {
        onEnter() {
            console.log(`push ${this.context.x10} & ${this.context.x11} to stack  // ${this.context.x10 & this.context.x11}`)
        }
    })
    // sub
    Interceptor.attach(basePtr.add(0x6D54671F14), {
        onEnter() {
            console.log(`push ${this.context.x10} - ${this.context.x11} to stack  // ${this.context.x10 - this.context.x11}`)
        }
    })
    // less
    Interceptor.attach(basePtr.add(0x6D5467220C), {
        onEnter() {
            console.log(`push ${this.context.x10} < ${this.context.x11} to stack  // ${this.context.x10 < this.context.x11}`)
        }
    })
    // xor
    Interceptor.attach(basePtr.add(0x6D54672180), {
        onEnter() {
            console.log(`push ${this.context.x10} ^ ${this.context.x12} to stack  // ${this.context.x10 ^ this.context.x12}`)
        }
    })
    // loadi32toStack
    Interceptor.attach(basePtr.add(0x6D546723D8), {
        onEnter() {
            heapIdx = this.context.x10;
            let value = ptr(this.context.x11).add(this.context.x10 * 4 + 0x20).readU32();
            console.log(`load heap[${heapIdx}] to stack  // heap[${heapIdx}] = ${value}`)
        }
    })
    // shiftL
    Interceptor.attach(basePtr.add(0x6D54672008), {
        onEnter() {
            console.log(`push ${this.context.x10} << ${this.context.x11} to stack // ${this.context.x10 << this.context.x11}`)
        }
    })
    // add
    Interceptor.attach(basePtr.add(0x6D54671E98), {
        onEnter() {
            console.log(`push ${this.context.x10} + ${this.context.x11} to stack  // ${this.context.x10 + this.context.x11}`)
        }
    })
    Interceptor.attach(basePtr.add(0x6D5467232C), {
        onEnter() {
            console.log("jmp if zero");
        }
    })
    Interceptor.attach(basePtr.add(0x6D546722C4), {
        onEnter() {
            console.log("jmp if not zero");
        }
    })
}

setTimeout(main, 1000);

Interceptor.attach(ll2.base.add(0x465C60), {
        onEnter() {
            for (let i = 0; i < 12; i++) {
                console.log(`key[${i}]: `, this.context.x0.add(i * 4).readU32().toString(16));
            }
        }
    })