2026-04-16 04:48:08 网络安全文章来源：ZONE.CI 全球网 0 阅读模式

文章总结： 本文分析Unityil2cpp游戏逆向过程中遇到的保护机制触发和JSON解析异常问题。针对文件加密状态检测，建议通过内存Dump获取未加密数据；对于NullPointerException错误，提出增加空值校验和异常处理的代码修复方案。文章提供Frida脚本示例和具体代码修改建议，帮助解决逆向分析中的常见技术障碍。 综合评分： 82 文章分类： 逆向分析,移动安全,二进制安全,漏洞分析,安全工具

cover_image

Unity il2cpp游戏逆向分析浅析

原创

云天实验室云天实验室

哆啦安全

2025年7月3日 08:01 四川

在小说阅读器读本章

去阅读

手游逆向与防护(建议收藏)

威胁手游安全的对象有哪些吗？

手游修改器锁机APP的逆向分析

Unity il2cpp游戏逆向分析技巧

手游安全之cocos2d-x的源码浅析(手游逆向与防护)

搭建云手机(无需Root权限)

Zygisk注入器 – 动动手指轻松注入并隐藏你的SO文件

车载系统的安全启动（Secure Boot）、可信执行环境（TEE）、硬件安全模块（HSM）和固件更新安全

Initializing&nbsp;metadata...Metadata&nbsp;Version:&nbsp;31Initializing&nbsp;il2cpp file...Applying&nbsp;relocations...WARNING: find JNI_OnLoadERROR: This file may be protected.Il2Cpp&nbsp;Version:&nbsp;31Searching...CodeRegistration&nbsp;:&nbsp;798be98MetadataRegistration&nbsp;:&nbsp;7ca6550Dumping...Done!Generate&nbsp;struct...Done!Generate&nbsp;dummy dll...Done!Press&nbsp;any key to exit...buffer&nbsp;is not enoughException&nbsp;in thread&nbsp;"AWT-EventQueue-0"&nbsp;java.lang.NullPointerException: Cannot invoke&nbsp;"org.json.JSONObject.getJSONArray(String)"&nbsp;because&nbsp;"jsonObject"&nbsp;is null&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;Main.getScriptJsonArray(Main.java:423)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;Main.doFunctions(Main.java:290)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;Main.doJob(Main.java:148)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;Main.access$000(Main.java:44)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;Main$1.actionPerformed(Main.java:100)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/javax.swing.AbstractButton.fireActionPerformed(AbstractButton.java:1972)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/javax.swing.AbstractButton$Handler.actionPerformed(AbstractButton.java:2313)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/javax.swing.DefaultButtonModel.fireActionPerformed(DefaultButtonModel.java:405)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/javax.swing.DefaultButtonModel.setPressed(DefaultButtonModel.java:262)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/javax.swing.plaf.basic.BasicButtonListener.mouseReleased(BasicButtonListener.java:279)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.Component.processMouseEvent(Component.java:6626)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/javax.swing.JComponent.processMouseEvent(JComponent.java:3389)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.Component.processEvent(Component.java:6391)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.Container.processEvent(Container.java:2266)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.Component.dispatchEventImpl(Component.java:5001)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2324)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.Component.dispatchEvent(Component.java:4833)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.LightweightDispatcher.retargetMouseEvent(Container.java:4948)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.LightweightDispatcher.processMouseEvent(Container.java:4575)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.LightweightDispatcher.dispatchEvent(Container.java:4516)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.Container.dispatchEventImpl(Container.java:2310)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.Window.dispatchEventImpl(Window.java:2780)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.Component.dispatchEvent(Component.java:4833)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventQueue.dispatchEventImpl(EventQueue.java:773)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventQueue$4.run(EventQueue.java:722)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventQueue$4.run(EventQueue.java:716)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.base/java.security.AccessController.doPrivileged(AccessController.java:399)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:86)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:97)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventQueue$5.run(EventQueue.java:746)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventQueue$5.run(EventQueue.java:744)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.base/java.security.AccessController.doPrivileged(AccessController.java:399)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.base/java.security.ProtectionDomain$JavaSecurityAccessImpl.doIntersectionPrivilege(ProtectionDomain.java:86)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventQueue.dispatchEvent(EventQueue.java:743)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventDispatchThread.pumpOneEventForFilters(EventDispatchThread.java:203)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventDispatchThread.pumpEventsForFilter(EventDispatchThread.java:124)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventDispatchThread.pumpEventsForHierarchy(EventDispatchThread.java:113)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:109)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventDispatchThread.pumpEvents(EventDispatchThread.java:101)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;at&nbsp;java.desktop/java.awt.EventDispatchThread.run(EventDispatchThread.java:90)

根据日志和错误信息分析，该问题涉及‌IL2CPP逆向过程中的文件保护机制触发和JSON解析异常‌，以下是分步解决方案：

一、针对IL2CPP保护机制的处理

‌确认文件加密状态‌

日志中ERROR: This file may be protected表明目标文件（如libil2cpp.so或global-metadata.dat）可能被加固或加密。需检查文件头特征：

正常global-metadata.dat应以魔数AF 1B B1 FA开头，若被加密则熵值较高‌。

使用010 Editor分析文件结构，若发现异常字节或抹除的符号表，需通过内存Dump绕过保护‌。

‌内存Dump未加密数据‌

若静态分析失败，可通过动态注入（如Frida）从内存中提取未加密的global-metadata.dat和libil2cpp.so

// Frida脚本示例：搜索并Dump内存中的global-metadata.datfunction&nbsp;dump_metadata() {&nbsp; &nbsp;&nbsp;Memory.scan(...,&nbsp;"AF 1B B1 FA", {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;onMatch:&nbsp;(address) =>&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;const&nbsp;file =&nbsp;new&nbsp;File("/path/output.dat",&nbsp;"wb");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; file.write(Memory.readByteArray(address, size));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; file.close();&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; });}

此方法可绕过文件静态加密，直接获取运行时解密后的数据‌。

二、解决JSON解析异常（NullPointerException）

‌错误根源分析‌

NullPointerException发生在Main.getScriptJsonArray()，原因为jsonObject未初始化或输入数据无效。需检查：

输入JSON文件路径是否正确，文件内容是否为空或格式错误。

确保JSONObject初始化前已通过new JSONObject(inputString)加载有效数据。

‌

代码修复建议‌

在Main.java中增加空值校验和异常处理

// 修改getScriptJsonArray方法public&nbsp;JSONArray&nbsp;getScriptJsonArray(String&nbsp;jsonPath) {&nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;jsonStr =&nbsp;Files.readString(Paths.get(jsonPath));&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(jsonStr ==&nbsp;null&nbsp;|| jsonStr.isEmpty()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new&nbsp;IllegalArgumentException("JSON文件为空");&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;JSONObject&nbsp;jsonObject =&nbsp;new&nbsp;JSONObject(jsonStr);&nbsp;// 显式初始化&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;jsonObject.getJSONArray("targetArray");&nbsp; &nbsp; }&nbsp;catch&nbsp;(Exception&nbsp;e) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;System.err.println("解析失败: "&nbsp;+ e.getMessage());&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;null;&nbsp; &nbsp; }}

三、综合调试建议

‌分步验证流程‌

优先解决保护机制：确保global-metadata.dat和libil2cpp.so可被正常解析‌。

再处理JSON异常：通过日志输出中间数据，确认JSON文件路径和内容有效性。

‌工具链检查‌

使用最新版IL2CppDumper（如GitHub Perfare版本），部分旧版本可能不支持高版本Unity生成的元数据‌。

四、扩展资源

若需进一步分析IL2CPP内存结构或加固对抗技术，可参考以下方向：

‌延迟加载优化‌：通过动态加载元数据减少内存占用‌。

‌加固对抗案例‌：某讯libtprt.so加固的逆向分析方法‌。

Android逆向资料(2025)

链接: https://pan.baidu.com/s/18bQwLJgv4vUKgLC-XqtxWg&nbsp;提取码: 46s4

安全研究资料库大全(2025)

https://pan.quark.cn/s/0812c8cb47a1#/list/share

版权声明

本站仅做备份收录，仅供研究与教学参考之用。
读者将信息用于其他用途的，全部法律及连带责任由读者自行承担，本站不承担任何责任。

ZONE.CI 全球网 | 安全领域涉猎者-乌云独行地带

ZONE.CI 全球网

安全领域涉猎者-乌云独行地带

ZONE.CI 全球网

Plugins

WordPress

Web前端

设计资源

Unityil2cpp游戏逆向分析浅析

Unity il2cpp游戏逆向分析浅析

版权声明