Game crashes only after frida has been hooked

[TheMegafuji]

I don't know if I can reveal the game name, but its a new mobile game, its using Il2cpp, I'm attempting to dump it but it crashes after hooking frida.

My starting thoughts were:

1. It is recognizing ROOT: False, I can play the game without any problem rooted
2. Its recognizing the frida-server: False, I can play the game with the server running
3. Its recognizing the frida port when its hooked: False, I changed the running port and hooked it and it still crashed

What happens is, only after hooking:
frida -U -p 14019 -l out/wr.js (14019 is the pid)
or spawning:
frida -U -f com.company.game -l out/wr.js

If I interact with the game (touch the screen) it crashes:

[MI 9::PID::13289 ]-> Process crashed: java.lang.Error: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***

***
FATAL EXCEPTION: main
Process: com.hidden.game, PID: 13289
java.lang.Error: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
Version '2021.3.9f1 (ba89c427e9fc)', Build type 'Release', Scripting Backend 'il2cpp', CPU 'arm64-v8a'
Build fingerprint: 'Xiaomi/cepheus_eea/cepheus:10/QKQ1.190825.002/V12.0.5.0.QFAEUXM:user/release-keys'
Revision: '0'
ABI: 'arm64'
Timestamp: 2023-11-06 20:47:30-0300
pid: 13289, tid: 13311, name: Thread-2  >>> com.hidden.game<<<
uid: 10274
signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x47a96dcb3edc7235
    x0  47a96dcb3edc721d  x1  00000000000000e8  x2  0000000000000000  x3  0000000000008d53
    x4  0000000000008d57  x5  0000000009293790  x6  000000000000001e  x7  ff7f7f7f7f7f7f7f
    x8  0000000000000001  x9  0000007abd3353c0  x10 00000000000022bd  x11 0000000062cf7415
    x12 0000000000040822  x13 00000000000052bb  x14 000000000001a3c3  x15 00000000000057d3
    x16 000000000000799e  x17 00000000000057d7  x18 0000007c6f892000  x19 47a96dcb3edc721d
    x20 47a96dcb3edc721d  x21 0000000000009455  x22 000000005951b8d1  x23 d0e3d156ca811ad0
    x24 000000009d301fbf  x25 00000000c0c02cdc  x26 00000000fffb6388  x27 60db26bd39af9176
    x28 016d0239115dadfa  x29 0000007ccbbe1020
    sp  0000007ccbbdfb10  lr  0000007ccbd1a790  pc  0000007ccbd21a90

backtrace:
      #00 pc 000000000003fa90  /data/app/com.hidden.game-qJreAl6P6y1PryzrGn5dhw==/split_config.arm64_v8a.apk

        at split_config.0x3fa90(Native Method)
***

And if I attempt to dump it:

il2cpp: dumping Assembly-CSharp...
il2cpp: dumping Company.GameService.Protocol...
il2cpp: dumping mscorlib...
il2cpp: dumping System.Xml...
il2cpp: dumping System...
il2cpp: dumping UnityEngine.UIElementsModule...
il2cpp: dumping Newtonsoft.Json...
il2cpp: dumping Company.GameService.SDK.Async...
il2cpp: dumping System.Data...
il2cpp: dumping System.Core...
il2cpp: dumping UnityEngine.CoreModule...
Failed to load script: timeout was reached

Thank you for using Frida!

any idea on how to bypass the protection?
how can I dump it using another method?
is there a way to dump only a specific assembly to file using this lib?

also worth note, after the game crashes for that reason, it won't open unless the system is restarted (I tried killing frida-server, restarting, forcing stop on the game, there is something listening to the background)

[DragonRiseo]

bypass frida using any video on youtube .

[TheMegafuji]

I've tried debugging some of the .so functions, but is a very broad attempt, would you know of any working bypass techniques for Il2cpp games? most of solutions for bypassing are for Android native banks.

[christiancoleman]

What game is it? I want to see if I get the same behavior. I'm having similar problems with Monopoly Go, but I've found that spawning the process rather than attaching it will let me do what I need.

[TheMegafuji]

Warcraft Rumble

[christiancoleman]

Yeah I'm seeing a crash as well, but my error was a little more informative:

Process crashed: Bad access due to protection failure

---

---

Build fingerprint: 'asus/WW_I001D/ASUS_I001_1:11/RKQ1.200710.002/18.0210.2201.215-0:user/release-keys'
Revision: '0'
ABI: 'arm64'
Timestamp: 2023-11-12 00:41:54-0500
pid: 2946, tid: 2946, name: om.blizzard.arc >>> com.blizzard.arc <<<
uid: 10335
signal 11 (SIGSEGV), code 2 (SEGV_ACCERR), fault addr 0x7499a27000
x0 00000100000001b3 x1 0000000000000000 x2 000000000000e310 x3 00000000000048c7
x4 000000000000bbb4 x5 000000000000815e x6 00000000000048ba x7 ff7f7f7f7fffff7f
x8 000000000001e055 x9 81a906565d3c742e x10 00000000af63bd4c x11 00000000c4746f2a
x12 00000000ba7bb6ed x13 ffffffffffffcf3a x14 b400007499a08040 x15 146d9d443ea0023b
x16 0000000000003c9f x17 b400007499a23361 x18 000000774303c000 x19 0000007fc59bd658
x20 0000000000000000 x21 000000001e779ddb x22 b4000074cd5ecc38 x23 0000000085656e1d
x24 0000007fc59bd710 x25 0000000000000000 x26 00000074991b31a0 x27 000000002aaec5ad
x28 00000000000052c1 x29 0000000069ea2ef2
lr 000000749918beec sp 0000007fc59bd5d0 pc 000000749918dac4 pst 0000000000000000
backtrace:
#00 pc 0000000000038ac4 /data/app/~~qXFJWTOwhK8pLpCKovkN6w==/com.blizzard.arc-_H988B_17LSFfLxcZT2L1A==/split_config.arm64_v8a.apk!libpairipcore.so (offset 0x5b0b000)

---

[christiancoleman]

Keep in mind I didn't try to attach to an existing process, but instead I tried to spawn the process anew and attach early and that's what I got. Hope it gives you something to go on.

[TheMegafuji]

Yeah, both attaching and spawning result in errors, I wanted to learn how to bypass it, but I'm not with too much free time to do so for now

[christiancoleman]

Yeah, both attaching and spawning result in errors, I wanted to learn how to bypass it, but I'm not with too much free time to do so for now

I'm equally pressed for time but would love to hear if you learn more about this. Hit me up on discord if you wanna collaborate: christiancoleman

[dvgmdvgm]

@TheMegafuji hello! It's because of new google protection library called "libpairipcore.so"
And we can't do nothing with this before someone can completely bypass it. How does it works?
When you opening your game some native code starts to executing in additional virtual machine inside of it and game will not works until this code will not be able executed completely. So for now i don't see any possibility to use frida with latest updates of any Unity game because all of them forcing to use this VM protecting.

[uunibic]

I am facing a similar issue with a different application. As per the error log mentioned by @christiancoleman, the app is crashing because integrity checks are in place. You can read more about pairip protection here.

Although, few guys have figured out a way to bypass but that doesn't seem to work for all the applications.

In my case, the application works absolutely fine on my android mobile phone but not in the Android studio emulator, even if I am downloading it from the official source (Google Playstore) and not attaching or hooking it with Frida.

[dvgmdvgm]

That's not really the point. Bypassing signature verification is not a problem for me by changing some data in the APK. The bigger problem is that when the game starts, the virtual machine is launched using the "pairip.VMRunner" command from Java.
And part of the security code is executed separately from the main library through this virtual machine. It is because of this that Frida experiences a memory access error. I don't know how to fix this.

[uunibic]

I see, Thanks for the clarification. I am still trying to understand how the same app works in the phone without any issues but not in the android studio emulator.