How To Unlink Unity Functions (IL2CPP)

New Products

Jul 24, 2020
1
Well modding Android Games is fun and I wanted to completely kill a function so I did some research.

Imagine we have a Character Class, this class has an Update function, and this class also has a function something like this private void Die();
Yeah I know, it's not that crazy but I'm trying to keep it simple for the sake of this tutorial 😅.

Let's say we wanna hook the update function
C++:
//This is a function pointer to the function private void Die
//Since this is a non-static function the first parameter is always the
//instance of the class (this)
void (*Character_Die)(void* instance) =  (void (*)(void*))getAbsoluteAddress("libIl2Cpp.so", 0x38E8168);

//Example hook for the update function in the Imaginary class Character
void(*old_Update)(void *instance);
void Update(void *instance) {
  //code comes here
Character_Die(instance);
}
But without any check, that would everything and everyone right? Even us. So what we want to achieve is to unlink this function thus keeping us alive.
Let's suppose we found a BOOL that checks if it's you: private bool isMine; // 0x1D

now for the funsies let's say it's not in the same class, it's in the " CharacterAttributes " class.
So we try to find an instance to this class. Lucky! Our Character class has a field for CharacterAttributes!
private CharacterAttributes characterAttributes; // 0x1C
So we will use this instance to get the field in CharacterAttributes and check if is our character.

That would pretty much look like this, in case you were wondering :D
C++:
void (*Character_Die)(void* instance) =  (void (*)(void*))getAbsoluteAddress("libIl2Cpp.so", 0x38E8168);
void(*old_Update)(void *instance);
void Update(void *instance) {

  //get a pointer to the CharacterAttributes class
    void *getCharacterAttributes = *(void**)((uint64_t)instance + 0x1C);
    //check if valid pointer (not null)
    if(getCharacterAttributes){
        //get the bool from the field private bool isMine; //0x1D
        bool isMine = *(bool*)((uint64_t)getCharacterAttributes + 0x1D);
        //if its not ourself kill it
        if(!isMine){
            Character_Die(instance);
        }
    }

}
So know you successfully unlinked this carnage from yourself and everyone else dies except you! 😁
Easy as that, hope it helped. if you also care about knowing how to get or set fields check out this, How to Get/Set Fields (and Unlink Unity Functions(IL2CPP) ) Might help, that's easy as well.
 
  • Like
Reactions: Jacknator