frida-il2cpp-bridge icon indicating copy to clipboard operation
frida-il2cpp-bridge copied to clipboard

Access violation accessing 0x100000135 when doing Il2Cpp.Object::field

Open CGxyol opened this issue 6 months ago • 5 comments

Error: access violation accessing 0x100000135
    at tryField (/script1.js:1764)
    at tryField (/script1.js:2688)
    at field (/script1.js:2672)
    at <anonymous> (/script1.js:4561)
    at call (native)
    at <anonymous> (/script1.js:2536)

When I'm using frida-il2cpp-bridge to hook a method, I call timeLog(this.isNull()) after the method is triggered. The output shows this.isNull() is false, which means this should be valid. Then I try to execute: const playerControl = this.field<Il2Cpp.Object>("currentVehicle").value;

However, this line throws an exception. I'm sure that the currentVehicle field exists on this object. Other hooked methods work fine, and I can access this without any problem in those cases. But in this particular method, even though this.isNull() returns false, accessing fields on this still fails.

public VehicleControl currentVehicle; // 0x70

Accessing other non-object fields also results in the same error.

RpcSyncVehTransform.implementation = function (_vehID: number, _vehData: Il2Cpp.String) {
            timeLog(this.isNull()+`=====${_vehID}`)
            const playerControl = this.field<number>("currentVehicleId").value;
            this.method(RpcSyncVehTransform.name).invoke(_vehID, _vehData);
        }

CGxyol avatar Jun 11 '25 10:06 CGxyol

what happens if you change this.field<number>("currentVehicleId").value to this.field("currentVehicleId").value ?

almostHacker avatar Jun 14 '25 11:06 almostHacker

what happens if you change this.field<number>("currentVehicleId").value to this.field("currentVehicleId").value ?

This doesn't affect the runtime execution, <number> is purely a TypeScript thing

vfsfitvnm avatar Jun 14 '25 16:06 vfsfitvnm

This looks unfortunate... retrieving a field should never fail due to access violation.

Would you console.log(this.class)?

vfsfitvnm avatar Jun 14 '25 16:06 vfsfitvnm

This looks unfortunate... retrieving a field should never fail due to access violation.

Would you console.log(this.class)?

I'll try it later.

CGxyol avatar Jun 16 '25 03:06 CGxyol

During the operation, this situation may occur. Sometimes I retrieve fields, and sometimes I retrieve methods. My device environment is an emulator. This problem only occurs in a very few cases.

434432773 avatar Aug 01 '25 12:08 434432773