Il2CppInspector icon indicating copy to clipboard operation
Il2CppInspector copied to clipboard

Ghidra Header - some headers don't get parsed correctly due to Il2CppStringBuilder

Open pengupengupengu opened this issue 3 years ago • 2 comments

Hi, I was having trouble getting the Ghidra header (generated by Il2CppInspector 2021.01 and from the current HEAD) working with Ghidra 9.2.3 before I realized that the issue was with the header template.

In headers from UnityHeaders/22-5.5.0.h to UnityHeaders/24-2017.4.15-2017.4.40.h, the Il2CppStringBuilder struct has a pointer with type Il2CppStringBuilder, but there is no declaration of Il2CppStringBuilder before this, so Ghidra's parsing engine quits out. In headers after this (starting from UnityHeaders/24-2018.1.0-2018.1.1.h), there is a typedef struct Il2CppStringBuilder Il2CppStringBuilder; forward declaration that prevents this error. I manually added that forward declaration to my il2cpp.h (generated from a 2017.4.40c1 il2cpp.so) and the rest of it parsed correctly.

I can provide the example il2cpp.so and global-metadata.dat if necessary. Thank you.

pengupengupengu avatar Apr 26 '21 06:04 pengupengupengu

Can confirm. Filed a ghidra bug about it, as it relates to ghidra's handling of nested type declarations.

A workaround is to emit the member in question as struct Il2CppStringBuilder*, as ghidra doesn't support nested typedefs (and I'm not sure C/C++ strictly do either)

baconwaifu avatar Oct 14 '21 17:10 baconwaifu

Some further comments on the ghidra thread put this (IMO) firmly as a codegen issue. C officially doesn't support nested typedef without some form of forward-declaration, and Ghidra's parser is this weird C implementation that falls over in a stiff breeze at anything resembling non-standard C.

Fix is to emit Il2CppStringBuilder's member variable as the struct-type rather than the typedefed type.

baconwaifu avatar Oct 19 '21 20:10 baconwaifu