Question Android Unity Reversing — Handling il2cpp Byte Arrays in ARMv7

[byte_corvus]

Anyone digging into libil2cpp.so binaries on Android knows the struggle of ARMv7 patching when Unity's managed types get in the way. If you are trying to intercept a function that returns a byte array and swap it for your own data, there is a massive architectural trap you need to avoid.

The Problem: Raw Bytes vs. Managed Objects
In C# (Unity), a byte[] is not just a raw pointer to a memory buffer. When it translates to il2cpp, it becomes a structural object. If you simply try to overwrite the branch link (BL) to point R0 to a raw DCB array in your .data section, the game will likely SIGSEGV or throw a managed exception because the caller is expecting an Il2CppArray descriptor, not raw binary.

il2cpp Array Structure
An array in the il2cpp runtime typically follows this layout in memory:

1. Il2CppObject header (contains the klass pointer and monitor data).
2. Il2CppArrayBounds (pointers to bounds information).
3. max_length (a 32-bit or 64-bit integer defining the array size).
4. The Vector (the actual raw byte data starts here).

If you have func1 returning a byte array and you want to hijack it inside func2 only, your proposed assembly patch has a logic flaw:

label DCB 1,2,3,4

@ Your proposed patch inside func2:
ADD R1, PC, #label
LDR R0, [R1] @ This loads the VALUE 0x04030201 into R0, not an object address!

Technical Reality Check
Even if you used ADR R0, label to get the address, the engine will still crash because it will try to read the object header at that address to determine the array length. To make this work via binary patching, you would need to define a "fake" static array in your .rodata that includes a valid Il2CppObject header and the correct length fields before your bytes.

[SOPILER='Implementation Notes']
Instead of trying to fake a static object in assembly, which is brittle and depends on the specific Unity version's Il2CppArray layout, a cleaner approach is often finding where the array is instantiated (Array.CreateInstance or similar) and hooking that, or using a memory-mapped bridge if you are running an external tool. If you are dead set on the .data patch, you must ensure the klass pointer in your fake header matches the system's byte array class pointer at runtime.
[/SPOILER]

Trying to patch this locally in func2 without touching func1 globally is the right mindset for staying undetected and avoiding side effects, but you have to respect the engine's object model.

Anyone else found a stable way to spoof these managed returns without the game checking the klass pointer integrity?