I reverse engineered libil2cpp.so
using ghidra. I found these lines of code in a function in the decompiler view:
UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,0);
it is apparently getting the value of a shared_preferences
. the syntax of when getting a shared_preference in unity
games is as follows as described in the documentation:
UnityEngine.PlayerPrefs.GetInt(string key, int defaultValue)
so as apparently the *(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8)
in the reversed code is the corresponding string key
. while in general I know where the key is in the reversed code which is at this address
010e94b8 undefined4 ?? ; ScoreID
so what I wanted to learn is that how *(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8)
is reffering to that address 010e94b8
holding the string key.
what I tried so far?
referring to this answer, I double clicked the value Class$ItemPref
in the decompiled code *(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8)
and take its memory address 010dd710
and then adding 0x5c
yeilds 10DD76C
and then adding 8
yeilds 10DD774
so going to this address 10DD774
does not contain the string ScoringID
.
also I did this taking memory address of Class$ItemPref
which is 010dd710
and then adding 0x5c
and the multiply the size of the typecast which is int
which is 4
then the result is 4375DB0
then adding 8
equals to 4375DB8
but this is not quite right.
but what I really wanted to learn is that how that string ScoreID
is referred in the decompiled code UnityEngine.PlayerPrefs$$GetInt(*(undefined4 *)(*(int *)(Class$ItemPref + 0x5c) + 8),5,0);
please help this as my limited knowledge of reversing and ghidra.
if it helps, the corresponding disassembled view of the code is as follows:
003e60f0 5c 00 90 e5 ldr r0, [r0,#0x5c]
003e60f4 05 10 a0 e3 mov r1, #0x5
003e60f8 00 20 a0 e3 mov r2, #0x0
003e60fc 08 00 90 e5 ldr r0, [r0,#0x8]
003e6100 10 4c bd e8 ldmia sp!,{r4 r10 r11 lr}
003e6104 1a 63 14 ea b UnityEngine.PlayerPrefs$$GetInt ; undefined UnityEngine.PlayerPrefs$$GetInt()
-- Flow Override: CALL_RETURN (CALL_TERMIN
string
is equivalent to achar*
where you would find the characters at the referenced memory address. Insteadstring
is a struct so the pointer just leads you to that struct. See e.g. stackoverflow.com/questions/53654062/… (not sure if this also applies to the usedstring
type in your case)