I reverse engineered libil2cpp.so using ghidra. I found these lines of code in a function in the decompiler view:

UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,0);

it is apparently getting the value of a shared_preferences. the syntax of when getting a shared_preference in unity games is as follows as described in the documentation:

UnityEngine.PlayerPrefs.GetInt(string key, int defaultValue)

so as apparently the *(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8) in the reversed code is the corresponding string key. while in general I know where the key is in the reversed code which is at this address

010e94b8      undefined4      ??       ; ScoreID                                                                                            

so what I wanted to learn is that how *(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8) is reffering to that address 010e94b8 holding the string key.

what I tried so far?

referring to this answer, I double clicked the value Class$ItemPref in the decompiled code *(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8) and take its memory address 010dd710 and then adding 0x5c yeilds 10DD76C and then adding 8 yeilds 10DD774 so going to this address 10DD774 does not contain the string ScoringID.

also I did this taking memory address of Class$ItemPref which is 010dd710 and then adding 0x5c and the multiply the size of the typecast which is int which is 4 then the result is 4375DB0 then adding 8 equals to 4375DB8 but this is not quite right.

but what I really wanted to learn is that how that string ScoreID is referred in the decompiled code UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,0); please help this as my limited knowledge of reversing and ghidra.

if it helps, the corresponding disassembled view of the code is as follows:

    003e60f0 5c 00 90 e5              ldr             r0, [r0,#0x5c]
    003e60f4 05 10 a0 e3              mov             r1, #0x5
    003e60f8 00 20 a0 e3              mov             r2, #0x0
    003e60fc 08 00 90 e5              ldr             r0, [r0,#0x8]
    003e6100 10 4c bd e8              ldmia           sp!,{r4 r10 r11 lr}
    003e6104 1a 63 14 ea              b               UnityEngine.PlayerPrefs$$GetInt                                                                        ; undefined UnityEngine.PlayerPrefs$$GetInt()
                    -- Flow Override: CALL_RETURN (CALL_TERMIN

  • I don't think the type string is equivalent to a char* where you would find the characters at the referenced memory address. Instead string is a struct so the pointer just leads you to that struct. See e.g. stackoverflow.com/questions/53654062/… (not sure if this also applies to the used string type in your case)
    – Robert
    Aug 14, 2022 at 15:53


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.