1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

// attach到目标进程
const processName = 'your_process_name';
const targetProcess = Process.getFromName(processName);
const module = Process.getModuleByName('UnityPlayer.dll');
const baseAddr = module.base;

// 获取Mono类和方法信息
const monoImage = Module.findBaseAddress('mono.dll');
const monoClass = MonoApi.mono_class_from_name(monoImage, 'YourNamespace', 'YourClassName');
const monoMethod = MonoApi.mono_class_get_method_from_name(monoClass, 'YourMethodName', -1);

// 构造参数
const arg1 = MonoApi.mono_string_new(monoImage, Memory.allocUtf8String('your_string_argument'));
const arg2 = MonoApi.mono_object_new(monoImage, monoClass);

// 构造调用
const args = Memory.alloc(2 * Process.pointerSize);
Memory.writePointer(args, arg1);
Memory.writePointer(args.add(Process.pointerSize), arg2);
const result = Memory.alloc(Process.pointerSize);

// 调用方法
MonoApi.mono_runtime_invoke(monoMethod, null, args, result);

// 获取返回值
const returnValue = MonoApi.mono_object_to_string(result, null);
console.log(Memory.readUtf16String(returnValue));

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

#include <frida-core.h>

// Frida回调函数
static void on_message(FridaSession *session, const gchar *message, GBytes *data, gpointer user_data)
{
    // 处理回调消息
}

int main(int argc, char **argv)
{
    // 初始化Frida
    frida_init();

    // 连接到目标进程
    FridaSession *session = frida_attach("your_process_name");

    // 获取UnityPlayer.dll模块基址
    FridaModule *module = frida_session_find_module(session, "UnityPlayer.dll");
    guint64 base_addr = frida_module_get_base_address(module);

    // 获取Mono类和方法信息
    gpointer mono_image = frida_module_find_export_by_name(module, "mono_image_open_from_data_with_name");
    gpointer mono_class = frida_session_create_script(session, "YourNamespace", "YourClassName", NULL);
    gpointer mono_method = frida_class_find_method_by_name(mono_class, "YourMethodName");

    // 构造参数
    gpointer arg1 = frida_value_from_string("your_string_argument");
    gpointer arg2 = frida_value_new_object(mono_class);

    // 构造调用
    GArray *args = g_array_new(FALSE, FALSE, sizeof(GValue *));
    g_array_append_val(args, *((GValue *) arg1));
    g_array_append_val(args, *((GValue *) arg2));
    gpointer result = frida_value_new();

    // 调用方法
    frida_runtime_invoke_method(mono_method, NULL, args, result);

    // 获取返回值
    gchar *return_value = frida_value_to_string(result);
    g_print("%s\n", return_value);

    // 释放资源
    g_free(return_value);
    g_array_unref(args);
    frida_value_free(result);
    frida_value_free(arg1);
    frida_value_free(arg2);
    g_object_unref(mono_method);
    g_object_unref(mono_class);
    g_object_unref(mono_image);
    g_object_unref(module);
    g_object_unref(session);
    frida_deinit();

    return 0;
}