Tracing results in "TypeError: cannot read property 'internal' of null

[PeteSpencer]

Hello,

I am just starting to explore an game with dnSpy and frida.
My problem is that if I try to get a trace into a class i got that error:
TypeError: cannot read property 'internal' of null
I12Cpp.trace(true).classes(ClassName).and().attach()

I can get into it with hooking the class and methods and I tried to debug there, because it seems the only working method in this app.

Is this because the target app is protected against tracing? Or did I something wrong?

I am using the latest frida and latest libs.

Some ideas?

Best regards
Pete

[PeteSpencer]

I tried it with another game. And it works. :(
Is there a way to trace protected apps?

[vfsfitvnm]

Did you wrap your code inside a Il2Cpp.perform?

[vfsfitvnm]

If that snippet prints null, you can override il2cpp_thread_current as follows:

import "frida-il2cpp-bridge";

const il2cpp_thread_current_impl = new NativeCallback(
    () => Il2Cpp.corlib.class("System.Threading.Thread").method<Il2Cpp.Object>("GetCurrentThread").invoke().handle,
    "pointer",
    []
);

(globalThis as any).IL2CPP_EXPORTS = {
    il2cpp_thread_current: () => il2cpp_thread_current_impl
};

Il2Cpp.perform(() => {

});

[PeteSpencer]

Still got this. With and without your last added snippet.

TypeError: cannot read property 'internal' of null
starting main..
main loaded...
{
  "handle": "0x6d4b74a480"
}

Java.perform(async () => {
  await ensureModulesInitialized(...modulesList);
  il2cpp = Module.findBaseAddress('libil2cpp.so') as NativePointer;
  console.log('starting main..');
  Il2Cpp.perform(() => {
    // this changes everytime I deploy the script
    console.log('current Thread', JSON.stringify(Il2Cpp.currentThread, null, 2));
  });
  main().catch((e) => console.error(e));
});

my main

async function main() {
  console.log('main loaded...');

  const MainActivity = await getActivity(APP_MAIN_ACTIVITY);
  if (!MainActivity) throw new Error('MainActivity not found!');

  // Getting unity classes
  const AssemblyCSharp = Il2Cpp.domain.assembly('Assembly-CSharp').image;

  const PlayerState= AssemblyCSharp.class('com.the.class.PlayerState');

  Il2Cpp.trace(true).classes(PlayerState).and().attach();
}

Does the handle of the thread should change everytime the script is re-executed?

[PeteSpencer]

The strange thing is, that hooking the methods of the class working fine.

[vfsfitvnm]

Uhm, main isn't executed inside a Il2Cpp.perform block

[PeteSpencer]

ohh i see

[PeteSpencer]

Ohhh it works!!!
I just didn't see it... I have not seen Java.perform and Il2cpp.perform...

But why does it work with a different game?

Thank you being patient with me <3 ♡

[vfsfitvnm]

Perhaps main is executed before the callback passed to Il2Cpp.perform is done (for some reason), hence when main is executed, the current thread is still attached to IL2CPP

[vfsfitvnm]

FYI: https://github.com/vfsfitvnm/frida-il2cpp-bridge/wiki/Changelog#v081 (take a look at "▶ New threading model")