Seems like i've got a little problem.

[0xzer]

So there's 4 modules i can't find libil2cpp.so libmain.so libunity.so libbootstrap.so, this is most likely because i can't launch my frida in the emulated realm because the connection is always closed after attemtping. However without --realm=emulated my frida command works fine, but because of this i have to use this code to get the addresses of these libraries:

let libs = Process.enumerateRanges("rw")
let lib_names = ["libmain", "libbootstrap", "libil2cpp", "libunity"]
let actual_libs = []
for(let lib of libs) {
    if (lib.file) {
        let path = lib.file.path
        for(let l of lib_names) {
            if (path.includes(l)) {
                actual_libs.push(lib)
            }
        }

    }
}

for(let i = 0; i < actual_libs.length; i++) {
    console.log(actual_libs[i].base) // -> Logs the addr
    let m = Process.findModuleByAddress(actual_libs[i].base)
    console.log(m) // -> null
}

My problem is that i can not do anything with these addresses that i get from enumerateRanges because the process can't even find them by address either way. and frida-trace doesn't seem to be able either. How would i go about with this?

[dan4ik94]

Try using the Gadget, inject it into some game lib as a dependency then make frida attach to it. You can use LIEF for that.

[0xzer]

Try using the Gadget, inject it into some game lib as a dependency then make frida attach to it. You can use LIEF for that.

Hmm why wouldn't --realm=emulated work though? it returns this error for some reason.

[dan4ik94]

Try using the Gadget, inject it into some game lib as a dependency then make frida attach to it. You can use LIEF for that.

Hmm why wouldn't --realm=emulated work though? it returns this error for some reason.

That option never worked for me. The only way to hook arm libs on an x86 emulator is to use the gadget.