From 37a470314b1e16ec1272ab1c9f31da2e9a3ba08d Mon Sep 17 00:00:00 2001 From: gggaa2152 <60614405+gggaa2152@users.noreply.github.com> Date: Tue, 7 Apr 2026 04:39:39 +0800 Subject: [PATCH] Update main.cpp --- main.cpp | 309 +++++++++++++------------------------------------------ 1 file changed, 72 insertions(+), 237 deletions(-) diff --git a/main.cpp b/main.cpp index d59cab3ae..290e82ea9 100644 --- a/main.cpp +++ b/main.cpp @@ -7,47 +7,25 @@ #include #include #include -#include #include -#include #include -#include -#include -#include // 必须包含 vector #include "dobby.h" #include "imgui.h" #include "imgui_impl_android.h" #include "imgui_impl_opengl3.h" -#define TAG "IL2CPP_Instrument" +#define TAG "SimpleHook" #define LOGI(...) __android_log_print(ANDROID_LOG_INFO, TAG, __VA_ARGS__) -// 日志缓冲区 -#define MAX_LOG_LINES 200 -#define MAX_LOG_LEN 256 -static std::mutex g_LogMutex; -static char g_LogBuffer[MAX_LOG_LINES][MAX_LOG_LEN]; -static int g_LogHead = 0, g_LogCount = 0; - -void AddLog(const char* fmt, ...) { - char buf[MAX_LOG_LEN]; - va_list args; - va_start(args, fmt); - vsnprintf(buf, sizeof(buf), fmt, args); - va_end(args); - std::lock_guard lock(g_LogMutex); - strncpy(g_LogBuffer[g_LogHead], buf, MAX_LOG_LEN-1); - g_LogBuffer[g_LogHead][MAX_LOG_LEN-1] = '\0'; - g_LogHead = (g_LogHead + 1) % MAX_LOG_LINES; - if (g_LogCount < MAX_LOG_LINES) g_LogCount++; - LOGI("%s", buf); -} - +// 全局变量 static uintptr_t g_ActorManager = 0; static int g_MemFd = -1; +static float g_touchX = 0, g_touchY = 0; +static std::atomic g_touchDown{false}; +// 安全读取 template -T SafeRead(uintptr_t addr) { +T Read(uintptr_t addr) { T val{}; if (addr < 0x10000) return val; if (g_MemFd == -1) g_MemFd = open("/proc/self/mem", O_RDONLY); @@ -55,85 +33,6 @@ T SafeRead(uintptr_t addr) { return val; } -// 偏移链（可调整） -struct { - uint32_t x0_to_addr1 = 0x20; - uint32_t addr1_to_addr2 = 0x10; - uint32_t item_to_addr3 = 0x18; - uint32_t addr3_to_addr4 = 0x30; - uint32_t addr3_to_addr5 = 0x100; - uint32_t addr3_to_addr6 = 0x70; - uint32_t prop_gold = 0x20; - uint32_t prop_hp = 0x30; - uint32_t prop_maxhp = 0x32; - uint32_t prop_level = 0x50; - uint32_t prop_mana = 0x28; -} g_Offsets; - -// 玩家数据结构 -struct PlayerData { - int hp = 0, maxHp = 0, mana = 0, gold = 0, level = 0; - float mapX = 0, mapY = 0; -}; - -// 快照结构 -struct GameSnapshot { - bool inMatch = false; - uintptr_t x0 = 0; - std::vector players; -}; - -static GameSnapshot g_Snapshot; -static std::mutex g_SnapMutex; - -// 后台数据读取线程 -void DataThread() { - while (true) { - GameSnapshot snap; - uintptr_t base = g_ActorManager; - if (base) { - snap.inMatch = true; - snap.x0 = base; - uintptr_t addr1 = SafeRead(base + g_Offsets.x0_to_addr1); - if (addr1) { - uintptr_t addr2 = SafeRead(addr1 + g_Offsets.addr1_to_addr2); - if (addr2) { - for (int i = 0; i < 15; i++) { - uintptr_t item = SafeRead(addr2 + i * 8); - if (!item) continue; - uintptr_t addr3 = SafeRead(item + g_Offsets.item_to_addr3); - if (!addr3) continue; - PlayerData p; - uintptr_t addr4 = SafeRead(addr3 + g_Offsets.addr3_to_addr4); - if (addr4) { - p.gold = SafeRead(addr4 + g_Offsets.prop_gold); - p.hp = SafeRead(addr4 + g_Offsets.prop_hp); - p.maxHp = SafeRead(addr4 + g_Offsets.prop_maxhp); - p.level = SafeRead(addr4 + g_Offsets.prop_level); - } - uintptr_t addr5 = SafeRead(addr3 + g_Offsets.addr3_to_addr5); - if (addr5) { - p.mana = SafeRead(addr5 + g_Offsets.prop_mana); - } - uintptr_t addr6 = SafeRead(addr3 + g_Offsets.addr3_to_addr6); - if (addr6) { - p.mapX = SafeRead(addr6 + 0x50); - p.mapY = SafeRead(addr6 + 0x54); - } - if (p.maxHp > 0) snap.players.push_back(p); - } - } - } - } - // 替换快照（使用锁保护） - { - std::lock_guard lock(g_SnapMutex); - g_Snapshot = std::move(snap); // 使用移动语义避免拷贝问题 - } - std::this_thread::sleep_for(std::chrono::milliseconds(16)); - } -} - // 获取模块基址 uintptr_t GetBase(const char* name) { FILE* f = fopen("/proc/self/maps", "r"); @@ -150,133 +49,85 @@ uintptr_t GetBase(const char* name) { return base; } -// ========== DobbyInstrument 回调（不需要知道参数个数）========== -#ifdef __aarch64__ -#include // RegisterContext 定义在此 -void instrument_InitActor(RegisterContext* ctx, void* userdata) { - uintptr_t x0 = ctx->general.x0; - AddLog("[Instrument] InitActor called, x0 = %p", (void*)x0); - if (x0) g_ActorManager = x0; +// 原函数只有1个参数，直接 Hook +void (*old_InitActor)(void* x0); +void hook_InitActor(void* x0) { + LOGI("[HOOK] InitActor x0 = %p", x0); + g_ActorManager = (uintptr_t)x0; + old_InitActor(x0); } -void instrument_ClearActor(RegisterContext* ctx, void* userdata) { - AddLog("[Instrument] ClearActor called, x0 = %p", (void*)ctx->general.x0); - g_ActorManager = 0; -} -#endif -// ========== 触摸处理 ========== -static float touchX, touchY; -static std::atomic touchDown{false}; -void HandleEvent(AInputEvent* e) { +void (*old_ClearActor)(void* x0); +void hook_ClearActor(void* x0) { + LOGI("[HOOK] ClearActor x0 = %p", x0); + g_ActorManager = 0; + old_ClearActor(x0); +} + +// 触摸事件处理 +void handleTouch(AInputEvent* e) { if (AInputEvent_getType(e) == AINPUT_EVENT_TYPE_MOTION) { int act = AMotionEvent_getAction(e) & AMOTION_EVENT_ACTION_MASK; - touchX = AMotionEvent_getX(e, 0); - touchY = AMotionEvent_getY(e, 0); - touchDown = (act == AMOTION_EVENT_ACTION_DOWN); + g_touchX = AMotionEvent_getX(e, 0); + g_touchY = AMotionEvent_getY(e, 0); + g_touchDown = (act == AMOTION_EVENT_ACTION_DOWN); } } -typedef int (*ConsumeFn)(void*, void*, bool, int64_t, uint32_t*, void**); -ConsumeFn oldConsume = nullptr; -int hookConsume(void* ins, void* fac, bool batch, int64_t time, uint32_t* seq, void** ev) { - int r = oldConsume(ins, fac, batch, time, seq, ev); - if (r == 0 && ev && *ev) HandleEvent((AInputEvent*)*ev); +typedef int (*Consume_t)(void*,void*,bool,int64_t,uint32_t*,void**); +Consume_t oldConsume = nullptr; +int hookConsume(void* a,void* b,bool c,int64_t d,uint32_t* e,void** f) { + int r = oldConsume(a,b,c,d,e,f); + if (r==0 && f && *f) handleTouch((AInputEvent*)*f); return r; } -// ========== eglSwapBuffers Hook ========== -typedef EGLBoolean (*SwapFn)(EGLDisplay, EGLSurface); -SwapFn oldSwap = nullptr; -static bool imguiInit = false; - +// eglSwapBuffers Hook +typedef EGLBoolean (*Swap_t)(EGLDisplay,EGLSurface); +Swap_t oldSwap = nullptr; +static bool imguiReady = false; EGLBoolean hookSwap(EGLDisplay dpy, EGLSurface surf) { EGLint w, h; eglQuerySurface(dpy, surf, EGL_WIDTH, &w); eglQuerySurface(dpy, surf, EGL_HEIGHT, &h); if (w > 0 && h > 0) { - if (!imguiInit) { + if (!imguiReady) { ImGui::CreateContext(); ImGui_ImplOpenGL3_Init("#version 300 es"); - ImGuiIO& io = ImGui::GetIO(); - io.Fonts->AddFontDefault(); - imguiInit = true; - AddLog("ImGui 初始化完成"); + ImGui::GetIO().Fonts->AddFontDefault(); + imguiReady = true; } ImGuiIO& io = ImGui::GetIO(); io.DisplaySize = ImVec2(w, h); - io.MousePos = ImVec2(touchX, touchY); - io.MouseDown[0] = touchDown.load(); + io.MousePos = ImVec2(g_touchX, g_touchY); + io.MouseDown[0] = g_touchDown.load(); ImGui_ImplOpenGL3_NewFrame(); ImGui::NewFrame(); - // 获取快照 - GameSnapshot snap; - { - std::lock_guard lock(g_SnapMutex); - snap = g_Snapshot; // 拷贝（vector 可拷贝） + // 简单显示 + int hp = 0; + if (g_ActorManager) { + uintptr_t addr1 = Read(g_ActorManager + 0x20); + if (addr1) { + uintptr_t addr2 = Read(addr1 + 0x10); + if (addr2) { + uintptr_t item = Read(addr2); + if (item) { + uintptr_t addr3 = Read(item + 0x18); + if (addr3) { + uintptr_t addr4 = Read(addr3 + 0x30); + if (addr4) hp = Read(addr4 + 0x30); + } + } + } + } } - // 主窗口 - ImGui::Begin("IL2CPP Hook"); - ImGui::Text("状态: %s", snap.inMatch ? "对局中" : "大厅"); - ImGui::Text("ActorManager x0: 0x%lx", snap.x0); - ImGui::Text("玩家数量: %d", (int)snap.players.size()); - ImGui::Separator(); - if (ImGui::BeginTable("Players", 5, ImGuiTableFlags_Borders)) { - ImGui::TableSetupColumn("等级"); - ImGui::TableSetupColumn("血量"); - ImGui::TableSetupColumn("蓝量"); - ImGui::TableSetupColumn("金币"); - ImGui::TableSetupColumn("小地图"); - ImGui::TableHeadersRow(); - for (const auto& p : snap.players) { - ImGui::TableNextRow(); - ImGui::TableNextColumn(); ImGui::Text("%d", p.level); - ImGui::TableNextColumn(); ImGui::Text("%d/%d", p.hp, p.maxHp); - ImGui::TableNextColumn(); ImGui::Text("%d", p.mana); - ImGui::TableNextColumn(); ImGui::Text("%d", p.gold); - ImGui::TableNextColumn(); ImGui::Text("%.0f,%.0f", p.mapX, p.mapY); - } - ImGui::EndTable(); - } + ImGui::Begin("Hook Test"); + ImGui::Text("ActorManager: 0x%lx", g_ActorManager); + ImGui::Text("Player HP: %d", hp); ImGui::End(); - // 日志窗口 - ImGui::Begin("日志"); - ImGui::BeginChild("LogScroll", ImVec2(0, 0), false); - { - std::lock_guard lock(g_LogMutex); - int start = (g_LogHead - g_LogCount + MAX_LOG_LINES) % MAX_LOG_LINES; - for (int i = 0; i < g_LogCount; i++) { - int idx = (start + i) % MAX_LOG_LINES; - ImGui::TextUnformatted(g_LogBuffer[idx]); - } - if (ImGui::GetScrollY() >= ImGui::GetScrollMaxY()) - ImGui::SetScrollHereY(1.0f); - } - ImGui::EndChild(); - ImGui::End(); - - // 小地图雷达 - if (snap.inMatch && !snap.players.empty()) { - ImGui::SetNextWindowPos(ImVec2(w - 250, 50), ImGuiCond_FirstUseEver); - ImGui::SetNextWindowSize(ImVec2(200, 200), ImGuiCond_FirstUseEver); - ImGui::Begin("雷达", nullptr, ImGuiWindowFlags_NoTitleBar); - ImVec2 p0 = ImGui::GetCursorScreenPos(); - ImVec2 sz = ImGui::GetContentRegionAvail(); - ImDrawList* dl = ImGui::GetWindowDrawList(); - dl->AddRect(p0, ImVec2(p0.x+sz.x, p0.y+sz.y), IM_COL32(255,255,255,100)); - for (const auto& p : snap.players) { - float nx = p.mapX / 10000.0f; - float ny = p.mapY / 10000.0f; - float rx = p0.x + nx * sz.x; - float ry = p0.y + sz.y - ny * sz.y; - if (nx>0 && nx<1 && ny>0 && ny<1) - dl->AddCircleFilled(ImVec2(rx, ry), 5.0f, IM_COL32(255,0,0,255)); - } - ImGui::End(); - } - ImGui::Render(); glViewport(0, 0, w, h); ImGui_ImplOpenGL3_RenderDrawData(ImGui::GetDrawData()); @@ -284,39 +135,23 @@ EGLBoolean hookSwap(EGLDisplay dpy, EGLSurface surf) { return oldSwap(dpy, surf); } -// ========== 延迟初始化线程 ========== -void* DelayedHookThread(void*) { - AddLog("插件启动，等待游戏模块..."); - // 等待 libil2cpp.so 加载并注册 Instrument - while (true) { - uintptr_t base = GetBase("libil2cpp.so"); - if (base) { - uintptr_t initAddr = base + 0x73507bc; - uintptr_t clearAddr = base + 0x734bc10; - AddLog("基址: 0x%lx, InitActor: 0x%lx, ClearActor: 0x%lx", base, initAddr, clearAddr); -#ifdef __aarch64__ - int ret1 = DobbyInstrument((void*)initAddr, instrument_InitActor); - int ret2 = DobbyInstrument((void*)clearAddr, instrument_ClearActor); - AddLog("DobbyInstrument 结果: InitActor=%d, ClearActor=%d", ret1, ret2); -#endif - break; - } - sleep(1); - } - +// 初始化线程 +void* InitThread(void*) { + // 等待 libil2cpp.so 加载 + uintptr_t base; + while (!(base = GetBase("libil2cpp.so"))) sleep(1); + uintptr_t initAddr = base + 0x73507bc; + uintptr_t clearAddr = base + 0x734bc10; + LOGI("Base=0x%lx, Init=0x%lx, Clear=0x%lx", base, initAddr, clearAddr); + DobbyHook((void*)initAddr, (void*)hook_InitActor, (void**)&old_InitActor); + DobbyHook((void*)clearAddr, (void*)hook_ClearActor, (void**)&old_ClearActor); // Hook EGL 和 Input - void* egl = DobbySymbolResolver("libEGL.so", "eglSwapBuffers"); - if (egl) DobbyHook(egl, (void*)hookSwap, (void**)&oldSwap); - void* inp = DobbySymbolResolver("libinput.so", "_ZN7android13InputConsumer7consumeEPNS_26InputEventFactoryInterfaceEblPjPPNS_10InputEventE"); - if (inp) DobbyHook(inp, (void*)hookConsume, (void**)&oldConsume); - - // 启动后台数据线程 - std::thread(DataThread).detach(); - AddLog("所有初始化完成"); + DobbyHook(DobbySymbolResolver("libEGL.so", "eglSwapBuffers"), (void*)hookSwap, (void**)&oldSwap); + DobbyHook(DobbySymbolResolver("libinput.so", "_ZN7android13InputConsumer7consumeEPNS_26InputEventFactoryInterfaceEblPjPPNS_10InputEventE"), (void*)hookConsume, (void**)&oldConsume); return nullptr; } -__attribute__((constructor)) void init() { +__attribute__((constructor)) void entry() { pthread_t t; - pthread_create(&t, nullptr, DelayedHookThread, nullptr); + pthread_create(&t, nullptr, InitThread, nullptr); }