Il2CppInspector
Il2CppInspector copied to clipboard
How to get field offsets in il2cpp.h header file?
First of all, thanks a lot for the wonderful project!
I trying to access/modify in memory game structures for an ARM 32 bit game externally (using RPM). I was able to dump all the game structures successfully using IL2CppInspector and noticed that although the C# dump contained field offsets, the il2cpp.h containing the game structures as present in memory did not contain any. Is it possible to get field offsets and padding (if present) in the il2cpp.h file? I have a feeling that it will require playing with the toString() implementation in CppTypes.cs, however, I am unsure of how exactly to progress.
I am looking for output like below.
struct HelicopterTurret
{
char pad_0x0[0x10]; //0x0
void* m_CachedPtr; //0x10
PatrolHelicopterAI* _heliAI; //0x18
Transform* gun_yaw; //0x20
Transform* gun_pitch; //0x28
Transform* muzzleTransform; //0x30
BaseCombatEntity* _target; //0x38
float lastBurstTime; //0x40
float lastFireTime; //0x44
float lastSeenTargetTime; //0x48
bool targetVisible; //0x4c
char pad_0x4d[0x3]; //0x4d
float fireRate; //0x50
float burstLength; //0x54
float timeBetweenBursts; //0x58
float maxTargetRange; //0x5c
float loseTargetAfter; //0x60
bool left; //0x64
};
You'd want to select c++ scaffolding instead as that generates files that contains pointers to classes and methods. These are located in the appdata folder eg. appdata/il2cpp-types-ptr.h
I took a look at appdata/il2cpp-types-ptr.h
and I believe it contains a pointer to type definitions and not the classes themselves.
I am looking for particular instances of a class, like for example the player Camera in a game.
appdata/il2cpp-types-ptr.h
contains an entry like
DO_TYPEDEF(0x07FE1734, List_1_GameEngine_PlayerCamera_);
How can I use this to find a specific instance of this class? I don't think it is possible, as my approach is completely external. I need to navigate pointer chains and need offsets for that.
Any quick way to add offsets to the il2cpp-types.h
file, keeping in mind inheritance and any padding that may be present?
Basically, it's about going from this
struct HelicopterTurret
{
void* m_CachedPtr;
PatrolHelicopterAI* _heliAI;
Transform* gun_yaw;
}
To this
struct HelicopterTurret
{
char pad_0x0[0x10]; //0x0
void* m_CachedPtr; //0x10
PatrolHelicopterAI* _heliAI; //0x18
Transform* gun_yaw; //0x20
}
I'm personally not really experienced with external trainers but what you could do is look at il2cpp-method-ptr.h and get method pointers and then use those methods to either hook MonoBehaviour::Update/FixedUpdate loops or get GameObjects/Components.