逆向和调试Unity3D游戏手记之一

一、背景和意义

Unity3D是手游领域的主要游戏引擎，熟练掌握对其的逆向方法，对我们而言十分重要。目前主流的方法是对其dll进行反汇编，然而越来越多游戏对其dll进行加密。因此本文的目的在于从另外一个方向对Unity3D游戏进行逆向和调试，第一步是要找到自定义函数的代码。

二、准备工作

1. 逆向对象，Unity3D官方例程 ——SpaceShooter，发布于Android平台
2. 工具：ida 6.5

三、相关代码分析

1. 调用自定义函数的总体过程
   

   
    info->compiled_method
    runtime_invoke()
    mono_jit_runtime_invoke() at mini.c:4,789 0x8065cc1
    mono_runtime_invoke() at object.c:2,613 0x8195d35
    create_exception_two_strings() at exception.c:133 0x81e6a9f
    mono_exception_from_name_two_strings() at exception.c:156 0x81e6adf
    create_exceptions() at appdomain.c:185 0x818b9e4
    mono_runtime_init() at appdomain.c:262 0x818bc0d
    mini_init() at mini.c:5,520 0x806734a
    mono_main() at driver.c:1,623 0x80ec127
    main() at main.c:34 0x805b950
    

   
   主要要关注的是从mono_runtime_invoke()到info->compile_method()的这样一个调用过程

2. 分析mono_runtime_invoke()
   相关汇编代码
   

   
    .text:001FA9AC ; MonoObject *__cdecl mono_runtime_invoke(MonoMethod *method, void *obj, void **params, MonoObject **exc)
    .text:001FA9AC EXPORT mono_runtime_invoke
    .text:001FA9AC mono_runtime_invoke ; CODE XREF: mono_jit_compile_method_inner+7B0�p
    .text:001FA9AC ; load_agent+240�p ...
    .text:001FA9AC
    .text:001FA9AC exc = -0x1C
    .text:001FA9AC params = -0x18
    .text:001FA9AC obj = -0x14
    .text:001FA9AC method = -0x10
    .text:001FA9AC result = -8
    .text:001FA9AC
    .text:001FA9AC STMFD SP!, {R11,LR}
    .text:001FA9B0 ADD R11, SP, #4
    .text:001FA9B4 SUB SP, SP, #0x18
    .text:001FA9B8 STR R0, [R11,#method]
    .text:001FA9BC STR R1, [R11,#obj]
    .text:001FA9C0 STR R2, [R11,#params]
    .text:001FA9C4 STR R3, [R11,#exc]
    .text:001FA9C8 BL mono_runtime_get_no_exec
    .text:001FA9CC MOV R3, R0
    .text:001FA9D0 CMP R3, #0
    .text:001FA9D4 BEQ loc_1FA9FC
    .text:001FA9D8 LDR R0, [R11,#method] ; method
    .text:001FA9DC MOV R1, #1 ; signature
    .text:001FA9E0 BL mono_method_full_name
    .text:001FA9E4 MOV R3, R0
    .text:001FA9E8 MOV R0, #0 ; log_domain
    .text:001FA9EC MOV R1, #0x10 ; log_level
    .text:001FA9F0 LDR R2, =(aInvokingMethod - 0x1FA9FC)
    .text:001FA9F4 ADD R2, PC, R2 ; "Invoking method '%s' when running in no"...
    .text:001FA9F8 BL g_log
    .text:001FA9FC
    .text:001FA9FC loc_1FA9FC ; CODE XREF: mono_runtime_invoke+28�j
    .text:001FA9FC BL mono_profiler_get_events
    .text:001FAA00 MOV R3, R0
    .text:001FAA04 AND R3, R3, #0x10000
    .text:001FAA08 CMP R3, #0
    .text:001FAA0C BEQ loc_1FAA18
    .text:001FAA10 LDR R0, [R11,#method] ; method
    .text:001FAA14 BL mono_profiler_method_start_invoke
    .text:001FAA18
    .text:001FAA18 loc_1FAA18 ; CODE XREF: mono_runtime_invoke+60�j
    .text:001FAA18 LDR R3, =(default_mono_runtime_invoke - 0x1FAA24)
    .text:001FAA1C ADD R3, PC, R3 ; default_mono_runtime_invoke
    .text:001FAA20 LDR R12, [R3]
    .text:001FAA24 LDR R0, [R11,#method]
    .text:001FAA28 LDR R1, [R11,#obj]
    .text:001FAA2C LDR R2, [R11,#params]
    .text:001FAA30 LDR R3, [R11,#exc]
    .text:001FAA34 BLX R12
    .text:001FAA38 STR R0, [R11,#result]
    .text:001FAA3C BL mono_profiler_get_events
    .text:001FAA40 MOV R3, R0
    .text:001FAA44 AND R3, R3, #0x10000
    .text:001FAA48 CMP R3, #0
    .text:001FAA4C BEQ loc_1FAA58
    .text:001FAA50 LDR R0, [R11,#method] ; method
    .text:001FAA54 BL mono_profiler_method_end_invoke
    .text:001FAA58
    .text:001FAA58 loc_1FAA58 ; CODE XREF: mono_runtime_invoke+A0�j
    .text:001FAA58 LDR R3, [R11,#result]
    .text:001FAA5C MOV R0, R3
    .text:001FAA60 SUB SP, R11, #4
    .text:001FAA64 LDMFD SP!, {R11,PC}
    .text:001FAA64 ; End of function mono_runtime_invoke
    

   
   核心代码就是
   

   
    .text:001FAA20 LDR R12, [R3]
    .text:001FAA24 LDR R0, [R11,#method]
    .text:001FAA28 LDR R1, [R11,#obj]
    .text:001FAA2C LDR R2, [R11,#params]
    .text:001FAA30 LDR R3, [R11,#exc]
    .text:001FAA34 BLX R12
    

   
   在mono源码中对应的就是
   

   
    result = default_mono_runtime_invoke (method, obj, params, exc);
    

3.分析mono_jit_runtime_invoke()
这一层代码太长，就不全贴了
核心代码是在函数尾部

 .text:000238F4 loc_238F4 ; CODE XREF: mono_jit_runtime_invoke+908�j
 .text:000238F4 LDR R2, [R11,#obj]
 .text:000238F8 LDR R3, [R11,#info]
 .text:000238FC LDR R3, [R3,#4]
 .text:00023900 LDR R12, [R11,#runtime_invoke]
 .text:00023904 MOV R0, R2
 .text:00023908 LDR R1, [R11,#params]
 .text:0002390C LDR R2, [R11,#exc]
 .text:00023910 BLX R12
 .text:00023914 MOV R3, R0
 

对应的mono源码是

 return runtime_invoke (obj, params, exc, info->compiled_method);
 

4. 分析runtime_invoke()
   

   
    debug117:589E0300 MOV R12, SP
    debug117:589E0304 STMFD SP!, {R8,R11,R12,LR}
    debug117:589E0308 SUB SP, SP, #0x30
    debug117:589E030C MOV R11, SP
    debug117:589E0310 STR R0, [R11,#0x1C]
    debug117:589E0314 STR R1, [R11,#0x20]
    debug117:589E0318 STR R2, [R11,#0x24]
    debug117:589E031C STR R3, [R11,#0x28]
    debug117:589E0320 MOV R0, #0
    debug117:589E0324 STR R0, [R11]
    debug117:589E0328 MOV R0, #0
    debug117:589E032C STR R0, [R11,#4]
    debug117:589E0330 LDR R0, [R11,#0x24]
    debug117:589E0334 CMP R0, #0
    debug117:589E0338 BEQ loc_589E0348
    debug117:589E033C LDR R0, [R11,#0x24]
    debug117:589E0340 MOV R1, #0
    debug117:589E0344 STR R1, [R0]
    debug117:589E0348
    debug117:589E0348 loc_589E0348 ; CODE XREF: debug117:589E0338�j
    debug117:589E0348 MOV R0, #0x5CE151C8
    debug117:589E0350 LDR R0, [R0]
    debug117:589E0354 CMP R0, #0
    debug117:589E0358 BEQ loc_589E0360
    debug117:589E035C BL unk_589E0060
    debug117:589E0360
    debug117:589E0360 loc_589E0360 ; CODE XREF: debug117:589E0358�j
    debug117:589E0360 LDR R0, [R11,#0x28]
    debug117:589E0364 BLX R0
    debug117:589E0368 MOV R0, #0
    debug117:589E036C STR R0, [R11]
    debug117:589E0370 B loc_589E03C0
    

   
   核心代码是
   

   
    debug117:589E0360 LDR R0, [R11,#0x28]
    debug117:589E0364 BLX R0
    

   
   也就是调用info->compiled_method

5. 最后就是自定义函数的ARM汇编代码了
   C#源码是
   

   
    void Update ()
    {
    if (restart)
    {
    if (Input.GetKeyDown (KeyCode.R))
    {
    Application.LoadLevel (Application.loadedLevel);
    }
    }
    }
    

   
   相应的汇编代码
   

   
    debug118:589E54A8 MOV R12, SP
    debug118:589E54AC STMFD SP!, {R8,R11,R12,LR}
    debug118:589E54B0 SUB SP, SP, #8
    debug118:589E54B4 MOV R11, SP
    debug118:589E54B8 STR R0, [R11]
    debug118:589E54BC LDR R0, [R11]
    debug118:589E54C0 LDRB R0, [R0,#0x35]//获取bool restart
    debug118:589E54C4 CMP R0, #0
    debug118:589E54C8 BEQ loc_589E54E4//为假跳转
    debug118:589E54CC MOV R0, #0x72//KeyCode.R的常量值？
    debug118:589E54D0 BL unk_589E7408//应该是input.getKeyDown(KeyCode.R)
    debug118:589E54D4 CMP R0, #0
    debug118:589E54D8 BEQ loc_589E54E4//结果为假跳转
    debug118:589E54DC BL unk_589E54F8
    debug118:589E54E0 BL unk_589E54EC
    debug118:589E54E4
    debug118:589E54E4 loc_589E54E4 ; CODE XREF: debug118:589E54C8�j
    debug118:589E54E4 ; debug118:589E54D8�j
    debug118:589E54E4 ADD SP, R11, #8
    debug118:589E54E8 LDMFD SP, {R8,R11,SP,PC}