Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Does not work with v2020.9.22s #16

Open
Kneesnap opened this issue Sep 25, 2020 · 14 comments
Open

Does not work with v2020.9.22s #16

Kneesnap opened this issue Sep 25, 2020 · 14 comments

Comments

@Kneesnap
Copy link

Unfortunately, it appears upgrading to v2020.9.22s will provide some additional hurdles.
After updating the il2cpp mappings, it appears some obfuscation has been applied, which will make updating to new versions somewhat of a pain. I propose some kind of macro-based solution, if not trying some kind of automated obfuscation mappings generator which uses the data from previous versions before obfuscation was applied. I'm not familiar with how such a thing could be applied to il2cpp unfortunately.

This issue is likely a duplicate of #12.

@v0idp
Copy link
Contributor

v0idp commented Sep 25, 2020

I am currently looking into the obfuscation. It appears that function names and parameter names are being obfuscated by BeeByte here, everything else can be easily de-obfuscated by beeless. A beebyte deobfuscator. I've read that someone on unknowncheats actually made a deobfuscator for amongus obfuscation, but until we can't confirm that it works we will have to wait.

My thoughts on this:
We could take the previous version of the decompiled .hpp/.cpp and compare it to the current de-obfuscated one. If functions are still in the same position we could write a script which translates all the function names and parameter names to the new files. After that is finished we could repeat this step from previous version to next version and so on.

@Kneesnap
Copy link
Author

Kneesnap commented Sep 25, 2020 via email

@v0idp
Copy link
Contributor

v0idp commented Sep 25, 2020

I just compared the files and noticed the line counts aren't the same in il2cpp-functions.h and il2cpp-types.h

Maybe obfuscation by adding garbage functions and datastructs or actual new functionality ? Hard to believe that 30k+ lines were added to il2cpp-functions.h with actual functionality. I assume it's part of the obfuscation.

Maybe we could integrate de4dot into Il2CppInspector to implement the de-obfuscation process in there.

Any other ideas ?

@Kneesnap
Copy link
Author

Kneesnap commented Sep 25, 2020 via email

@v0idp
Copy link
Contributor

v0idp commented Sep 25, 2020

I almost finished manually reversing all the necessary functions and types to make the cheat work again. I could need your help. I need the obfuscated name for Palette if somebody can find out which one it is, we can make this cheat run again! Everything else I already finished.

@v0idp
Copy link
Contributor

v0idp commented Sep 26, 2020

For some reason it's missing in the il2cpp-types-ptr.h only thing left there is the obfuscated TempData Type. Everything else I was able to find. If anyone can find the obfuscated name for Palette I would appreciate it !

previous version:
image

new version:
image

@v0idp
Copy link
Contributor

v0idp commented Sep 26, 2020

There we go. I was finally able to update all the necessary Types and Functions to make it work again !

image

@ExtraJuiceMan
Copy link
Owner

The issue with hardcoding new names like that is that the obfuscator can just generate new names on build different from the current ones.

A good solution for this is creating signatures so that function offsets may be found automatically by the cheat, but that requires some effort.

We also need to access TypeInfo which may be harder to create signatures for since they are all in a huge contiguous list of pointers

@antianticheat
Copy link

antianticheat commented Sep 26, 2020

For some reason it's missing in the il2cpp-types-ptr.h only thing left there is the obfuscated TempData Type. Everything else I was able to find. If anyone can find the obfuscated name for Palette I would appreciate it !

DO_TYPEDEF(0x01468854, Palette);

@evoredact
Copy link

Hello, why I can't compile the dll, for upgrade something. I got so many errors "462"
Example: cannot open source file "vcruntime.h", "stdarg.h", "vcruntime-string.h", attribute "noreturn" does not apply here, expected a ')'
image_2020-09-29_171440
image_2020-09-29_171502

I use VS Code, (Release, x86), or I stupid, or my VSC not support, or something else...

@mathmakgakpak
Copy link

mathmakgakpak commented Oct 10, 2020

cracked among us v2020.9.9s

taken from https://igg-games.com/among-us-free-download.html using wayback machine

@Kneesnap
Copy link
Author

Kneesnap commented Oct 10, 2020 via email

@mathmakgakpak
Copy link

i know but i didn't know where i could post it

@stretch07
Copy link

@Kneesnap you seem to know a bit about code; is christware a virus? see the latest issue i opened to see what i mean

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

7 participants