[Bug]: Can't work VRChat

[d0clan]

From the Developer

VRChat's guidelines ban bypassing the EAC and reverse engineering.
Therefore, I will no action to VRChat as I think it's a conflict of this.

Original Ticket

Are you on the latest version of UnityExplorer?

• Yes, I'm on the latest version of UnityExplorer.

Which release are you using?

MelonLoader IL2CPP CoreCLR

Which game did this occur on?

VRChat (Unity 2022.3.6.11724)

Describe the issue.

crashed when trying to access obfuscated component or any normal class including obfuscated class as member/variable.
how to trigger? inspect a gameobject and click on obfuscated component.
note: the game has eac, however, you can still use melonloader by launch the VRChat.exe in game folder. when in game, you might see error message but it doesnt matter, there will be PlayerManager xxx in scene, it has a obfuscated component for you to inspect.
i think this is not caused by obfuscate, this issue is starts from when VRChat switched to Unity 2022 from 2019 as far as i know.
thanks in advance.

Relevant log output

[06:35:41.588] ------------------------------
[06:35:41.613] MelonLoader v0.6.1 Open-Beta
[06:35:41.614] OS: Windows 10
[06:35:41.614] Hash Code: 696B58144EEC73C72FA36A811CA73312EEE4EC28AD5E3527BDA1E14F388A
[06:35:41.615] ------------------------------
[06:35:41.615] Game Type: Il2cpp
[06:35:41.615] Game Arch: x64
[06:35:41.615] ------------------------------
[06:35:41.615] Core::BasePath = F:\SteamLibrary\steamapps\common\VRChat
[06:35:41.615] Game::BasePath = F:\SteamLibrary\steamapps\common\VRChat
[06:35:41.615] Game::DataPath = F:\SteamLibrary\steamapps\common\VRChat\VRChat_Data
[06:35:41.616] Game::ApplicationPath = F:\SteamLibrary\steamapps\common\VRChat\VRChat.exe
[06:35:41.616] Runtime Type: net6
[06:35:41.729] ------------------------------
[06:35:41.729] Game Name: VRChat
[06:35:41.730] Game Developer: VRChat
[06:35:41.731] Unity Version: 2022.3.6a0
[06:35:41.731] Game Version: UNKNOWN
[06:35:41.731] ------------------------------

[06:35:42.301] Preferences Loaded!

[06:35:42.318] Loading Plugins from 'F:\SteamLibrary\steamapps\common\VRChat\Plugins'...
[06:35:42.319] 0 Plugins loaded.
[06:35:43.037] Loading Il2CppAssemblyGenerator...
[06:35:43.071] [Il2CppAssemblyGenerator] Contacting RemoteAPI...
[06:35:44.164] [Il2CppAssemblyGenerator] Game Not Found on RemoteAPI Host (https://api.melonloader.com/api/v1/game/vrchat)
[06:35:44.164] [Il2CppAssemblyGenerator] RemoteAPI.DumperVersion = null
[06:35:44.165] [Il2CppAssemblyGenerator] RemoteAPI.ObfuscationRegex = null
[06:35:44.165] [Il2CppAssemblyGenerator] RemoteAPI.MappingURL = null
[06:35:44.165] [Il2CppAssemblyGenerator] RemoteAPI.MappingFileSHA512 = null
[06:35:44.174] [Il2CppAssemblyGenerator] Using Dumper Version: 2022.1.0-pre-release.10
[06:35:44.174] [Il2CppAssemblyGenerator] Using Il2CppInterop Version = 1.4.5
[06:35:44.174] [Il2CppAssemblyGenerator] Using Unity Dependencies Version = 2022.3.6
[06:35:44.174] [Il2CppAssemblyGenerator] Using Deobfuscation Regex = null
[06:35:44.175] [Il2CppAssemblyGenerator] Cpp2IL is up to date.
[06:35:44.175] [Il2CppAssemblyGenerator] UnityDependencies is up to date.
[06:35:44.175] [Il2CppAssemblyGenerator] Checking GameAssembly...
[06:35:44.532] [Il2CppAssemblyGenerator] Assembly is up to date. No Generation Needed.

[06:35:44.534] Loading Mods from 'F:\SteamLibrary\steamapps\common\VRChat\Mods'...
[06:35:44.534] ------------------------------
[06:35:44.563] Melon Assembly loaded: '.\Mods\UnityExplorer.ML.IL2CPP.CoreCLR.dll'
[06:35:44.563] SHA256 Hash: 'e9acd35446592fa5a0cbb6f368cb9f7ee393cf7b7a322bfe356d00807e785255'

[06:35:44.685] ------------------------------
[06:35:44.685] UnityExplorer v4.11.2
[06:35:44.685] by Sinai, yukieiji
[06:35:44.686] Assembly: UnityExplorer.ML.IL2CPP.CoreCLR.dll
[06:35:44.686] ------------------------------
[06:35:44.686] ------------------------------
[06:35:44.687] 1 Mod loaded.

[06:35:45.995] Class::Init signatures have been exhausted, using a substitute!
[06:35:46.013] Registered mono type Il2CppInterop.Runtime.DelegateSupport+Il2CppToMonoDelegateReference in il2cpp domain
[06:35:46.039] Registered mono type MelonLoader.Support.MonoEnumeratorWrapper in il2cpp domain
[06:35:46.040] Registered mono type MelonLoader.Support.SM_Component in il2cpp domain
[06:35:46.049] Support Module Loaded: F:\SteamLibrary\steamapps\common\VRChat\MelonLoader\Dependencies\SupportModules\Il2Cpp.dll
[06:35:46.073] [UnityExplorer] UnityExplorer 4.11.2 initializing...
[06:35:46.096] [UnityExplorer] [UniverseLib] UniverseLib 1.5.6 initializing...
[06:35:46.098] Registered mono type UniverseLib.UniversalBehaviour in il2cpp domain
[06:35:46.330] Registered mono type UniverseLib.Runtime.Il2Cpp.Il2CppManagedEnumerator in il2cpp domain
[06:35:46.350] [UnityExplorer] [UniverseLib] Finished UniverseLib initial setup.
[06:35:46.360] Registered mono type UnityExplorer.ExplorerBehaviour in il2cpp domain
[06:35:46.429] [UnityExplorer] Initialized UnityCrashPrevention for: Canvas.get_renderingDisplaySize
[06:35:49.227] [UnityExplorer] [UniverseLib] Can't cache type named __c__51`1 Error: System.TypeLoadException: Could not load type 'Token' from assembly 'Il2CppVRCCore-Standalone, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null' because the format is invalid.
   at System.RuntimeTypeHandle.GetDeclaringType(RuntimeType type)
   at System.RuntimeType.RuntimeTypeCache.GetEnclosingType()
   at System.RuntimeType.RuntimeTypeCache.GetNameSpace()
   at System.RuntimeType.get_Namespace()
   at UniverseLib.ReflectionUtility.CacheTypes(Assembly asm) in D:\a\UnityExplorer\UnityExplorer\UniverseLib\src\Reflection\ReflectionUtility.cs:line 121
[06:35:49.227] [UnityExplorer] [UniverseLib] Can't cache type named MethodInfoStoreGeneric_TryFromObject_Public_Static_Boolean_byref_T_byref_Token_0`1 Error: System.TypeLoadException: Could not load type 'Token' from assembly 'Il2CppVRCCore-Standalone, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null' because the format is invalid.
   at System.RuntimeTypeHandle.GetDeclaringType(RuntimeType type)
   at System.RuntimeType.RuntimeTypeCache.GetEnclosingType()
   at System.RuntimeType.RuntimeTypeCache.GetNameSpace()
   at System.RuntimeType.get_Namespace()
   at UniverseLib.ReflectionUtility.CacheTypes(Assembly asm) in D:\a\UnityExplorer\UnityExplorer\UniverseLib\src\Reflection\ReflectionUtility.cs:line 121
[06:35:49.228] [UnityExplorer] [UniverseLib] Can't cache type named MethodInfoStoreGeneric_FromObject_Public_Static_Token_byref_T_0`1 Error: System.TypeLoadException: Could not load type 'Token' from assembly 'Il2CppVRCCore-Standalone, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null' because the format is invalid.
   at System.RuntimeTypeHandle.GetDeclaringType(RuntimeType type)
   at System.RuntimeType.RuntimeTypeCache.GetEnclosingType()
   at System.RuntimeType.RuntimeTypeCache.GetNameSpace()
   at System.RuntimeType.get_Namespace()
   at UniverseLib.ReflectionUtility.CacheTypes(Assembly asm) in D:\a\UnityExplorer\UnityExplorer\UniverseLib\src\Reflection\ReflectionUtility.cs:line 121
[06:35:51.438] [UnityExplorer] [UniverseLib] Loaded Unhollowed modules in 5.1070004 seconds.
[06:35:51.617] [UnityExplorer] [UniverseLib] Setup deobfuscation cache in 0.178 seconds.
[06:35:51.620] [UnityExplorer] [UniverseLib] Initialized Legacy Input support
[06:35:51.724] [UnityExplorer] [UniverseLib] 	 IL2CPP method has no corresponding pointer, aborting patch of UnityEngine.AssetBundle.UnloadAllAssetBundles
[06:35:51.726] Registered mono type UniverseLib.AssetBundle in il2cpp domain
[06:35:51.796] [UnityExplorer] [UniverseLib] Loaded modern bundle for Unity 2022.3.6f1-DWR
[06:35:51.822] [UnityExplorer] [UniverseLib] UniverseLib 1.5.6 initialized.
[06:35:51.823] [UnityExplorer] Creating UI...
[06:35:52.441] [UnityExplorer] UnityExplorer 4.11.2 (IL2CPP) initialized.
Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
Repeat 2 times:
--------------------------------
   at Il2CppInterop.Runtime.IL2CPP.il2cpp_runtime_class_init(IntPtr)
--------------------------------
   at Il2Cpp.MonoBehaviourPublicObLi1DiOb2InObGaDiUnique..cctor()
   at System.Runtime.CompilerServices.RuntimeHelpers.RunClassConstructor(System.Runtime.CompilerServices.QCallTypeHandle)
   at System.Runtime.CompilerServices.RuntimeHelpers.RunClassConstructor(System.Runtime.CompilerServices.QCallTypeHandle)
   at System.Runtime.CompilerServices.RuntimeHelpers.RunClassConstructor(System.RuntimeTypeHandle)
   at Il2CppInterop.Runtime.Il2CppClassPointerStore`1[[System.__Canon, System.Private.CoreLib, Version=6.0.0.0, Culture=neutral, PublicKeyToken=7cec85d7bea7798e]]..cctor()
   at System.RuntimeFieldHandle.GetValue(System.Reflection.RtFieldInfo, System.Object, System.RuntimeType, System.RuntimeType, Boolean ByRef)
   at System.Reflection.RtFieldInfo.GetValue(System.Object)
   at UniverseLib.Il2CppReflection.Il2CppTypeNotNull(System.Type, IntPtr ByRef)
   at UniverseLib.Il2CppReflection.Internal_TryCast(System.Object, System.Type)
   at UniverseLib.ReflectionExtensions.TryCast(System.Object)
   at UnityExplorer.InspectorManager.Inspect(System.Object, UnityExplorer.CacheObject.CacheObjectBase)
   at UnityExplorer.UI.Widgets.ComponentList.OnComponentClicked(Int32)
   at UniverseLib.UI.Widgets.ButtonList.ButtonCell.<CreateContent>b__23_0()
   at UniverseLib.UI.Models.ButtonRef.<.ctor>b__14_0()
   at DynamicClass.(il2cpp delegate trampoline) System.Void_System.Action(il2cpp delegate trampoline) System.Void_System.Action(IntPtr, Il2CppInterop.Runtime.Runtime.Il2CppMethodInfo*)

[yukieiji]

It appears to be starting bypassing EAC, but EAC seems to be working because of an access error to the protected memory area.

Will other mods besides UE work correctly?

[d0clan]

nah, when you starting the game with what i was saying, the eac is not loaded, you can literally even attach with cheat engine, besides you cant be get in game since the game cant find the eac.
other mods i tested HWIDPatch and RuntimeGraphicsSettings they are fine, here you can find https://github.com/knah/ML-UniversalMods
most of game mods stopped update due to EAC, and deobfuscate map provided by melonloader also deleted, so 90% of old mods are not working anymore, because these mods are build depend on deobfuscate map

[yukieiji]

nah, when you starting the game with what i was saying, the eac is not loaded, you can literally even attach with cheat engine, besides you cant be get in game since the game cant find the eac.

Even if the EAC isn't activated, it appears that some defense mechanism is activated because the memory allocated by the VRChat that the UE tried to access is protected.

other mods i tested HWIDPatch and RuntimeGraphicsSettings they are fine, here you can find https://github.com/knah/ML-UniversalMods

Are there any mods for VRChat that aren't generic mods that will work?

most of game mods stopped update due to EAC, and deobfuscate map provided by melonloader also deleted, so 90% of old mods are not working anymore, because these mods are build depend on deobfuscate map

As long as MelonLoader that mod's loader can't support VRChat (and has given up), there is almost nothing I can do about it(Even if there is a means, accessing protected memory areas is tantamount to an act of hacking VRChat, it against the spirit of wholesome modding)

[d0clan]

tried to access is protected.

Can you tell what is the behaviour like? is the il2cpp_runtime_class_init trying to init with unreadable memory? or maybe what you get from debugging?

Are there any mods for VRChat that aren't generic mods that will work?

I think no.

As long as MelonLoader that mod's loader can't support VRChat (and has given up), there is almost nothing I can do about it

No, in fact is not, they're more like rage quits because vrchat doesn't care about the mod community,

accessing protected memory areas is tantamount to an act of hacking VRChat, it against the spirit of wholesome modding

Technically, 90% of mods cant leave the 'protected' memory when they using hook, you know patching .text is also trying to write on protected memory right? (.text is readable,executable but not writable)

accessing protected memory areas is tantamount to an act of hacking VRChat, it against the spirit of wholesome modding

Modding itself is a hack(same behaviours in anticheats eyes), the only thing that differs from cheating is that what it's trying to do is not provide unfair features. i know this not sounds good

I still want your help, in vrchat's map development you can test any map locally (without any anti-cheat measures in local testing), I'm working on a mod to help people understand what's going wrong with their map script when the script halted.

[yukieiji]

Can you tell what is the behaviour like? is the il2cpp_runtime_class_init trying to init with unreadable memory? or maybe what you get from debugging?

The following error exists in the log provided.

Fatal error. System.AccessViolationException: Attempted to read or write protected memory. This is often an indication that other memory is corrupt.
Repeat 2 times:
--------------------------------
   at Il2CppInterop.Runtime.IL2CPP.il2cpp_runtime_class_init(IntPtr)
--------------------------------
   at Il2Cpp.MonoBehaviourPublicObLi1DiOb2InObGaDiUnique..cctor()
   at System.Runtime.CompilerServices.RuntimeHelpers.RunClassConstructor(System.Runtime.CompilerServices.QCallTypeHandle)

Looking at this error and the stack trace it appears that UE is trying to access and construct a Unity class when creating the GUI and it isn't working because the area is protected
So I think that the UnityEngine DLL used by VRChat is protected when loaded, etc.

I think no.

I haven't read the code of this generic mod in much detail, but I suspect that the reason these mods work is one of the following

1. Simple mod that only makes method calls
2. More native mods using unsafe, etc.

UE, by its nature, adds a lot of functionality, so it is possible that the above could work if rewritten natively as it is working.
However, I don't see the value of spending a lot of time and making a lot of changes to something that I don't even know if it will work and will likely stop working after future updates(Like any other modder)

Technically, 90% of mods cant leave the 'protected' memory when they using hook, you know patching .text is also trying to write on protected memory right? (.text is readable,executable but not writable)

It isn't possible to read the protected memory area, in fact, this issue occurs when trying to access the protected memory area for reading.

Modding itself is a hack(same behaviours in anticheats eyes), the only thing that differs from cheating is that what it's trying to do is not provide unfair features. i know this not sounds good

I think that bypassing what is protected and making it readable is almost like hacking...

[d0clan]

UnityEngine DLL used by VRChat is protected when loaded, etc.

I don't know if you think this is an anti-cheat issue, but if so, i'm no offensive to say you may not knowing how native things work, this is understandable.

It isn't possible to read the protected memory area, in fact, this issue occurs when trying to access the protected memory area for reading.

This is wrong, System.AccessViolationException: Attempted to read or write protected memory. is told the error at unmanaged code, the access violation is normal error when e.g. reading memory at non-exists address 0x0000001

also e.g. attemp to write memory at non-writable memory zone, you get same exception when you do this. The literal 'protected' is not meaning protected by anticheat, like how UE can detect if there is anticheat running and know the memory is protected? the answer is no, it doesn't.

So i would say better inspect what is the actually issue than say it's by like anticheat or other reasons.

Simple mod that only makes method calls

It's hook, check source.
https://github.com/knah/ML-UniversalMods/blob/main/HWIDPatch/HWIDPatchMod.cs#L47

I think that bypassing what is protected and making it readable is almost like hacking...

Let's say only in programming, changing protect attributes (read/write/execute) is very very normal thing. The bypassing is different than that, directly launch the game is means without anticheat on, if there is no anticheat, no way you call it bypass. Only way you call it bypass when somehow you can do same thing with anticheat is on.

UE, by its nature, adds a lot of functionality, so it is possible that the above could work if rewritten natively as it is working.
However, I don't see the value of spending a lot of time and making a lot of changes to something that I don't even know if it will work and will likely stop working after future updates(Like any other modder)

I think this maybe related to the internal structure changes since Unity 2022.3. I have seen similar issues talking about this in il2cpp related github repositories.

in short, i dont like to trouble others, if you think there is no need to check, i total understand.

[yukieiji]

First of all, this issues isn't an internal UE bug, but an internal issue that occurs when we call some ordinary C# code.

• error point
  https://github.com/yukieiji/UniverseLib/blob/c4f41b1e619f7c567dc6ec148b24558d44a6390c/src/Reflection/Il2CppReflection.cs#L537

So the solution is quite simple, just make this pointer-getting code something else, if I can ignore the fact that I can't find that other thing.

[yukieiji]

I don't know if you think this is an anti-cheat issue, but if so, i'm no offensive to say you may not knowing how native things work, this is understandable.
It isn't possible to read the protected memory area, in fact, this issue occurs when trying to access the protected memory area for reading.
This is wrong, System.AccessViolationException: Attempted to read or write protected memory. is told the error at unmanaged code, the access violation is normal error when e.g. reading memory at non-exists address 0x0000001
also e.g. attemp to write memory at non-writable memory zone, you get same exception when you do this. The literal 'protected' is not meaning protected by anticheat, like how UE can detect if there is anticheat running and know the memory is protected? the answer is no, it doesn't.
So i would say better inspect what is the actually issue than say it's by like anticheat or other reasons.

If you want to say that the information passed in the above method is incorrect (e.g. 0x0000001, etc.), can you provide details of the obfuscated component, e.g. with images?(What is the name of the component and is there a component that works properly?)

The current info alone doesn't give us any info beyond some protection has occurred and this issue is occurring.(It looks that way, including the fact that MelonLoader has given up on responding)(I'm telling you that.)

I think this maybe related to the internal structure changes since Unity 2022.3. I have seen similar issues talking about this in il2cpp related github repositories.

Can you give us more details about the issues? I'm not sure if it's a issue, but I'm sure it could help us solve it.

[d0clan]

I also tested other versions, but they produced different errors.
The UnityExplorer.ML.IL2CPP.dll release initialize failed with log

[13:34:12.876] [UnityExplorer] UnityExplorer 4.11.2 initializing...
[13:34:12.896] [UnityExplorer] [UniverseLib] UniverseLib 1.5.6 initializing...
[13:34:12.914] [UnityExplorer] System.ArgumentException: Class System.Object does not inherit from a class registered in il2cpp
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2CppImpl(Type type, Boolean logSuccess, INativeClassStruct[] interfaces)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2Cpp(Type type, Boolean logSuccess)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2CppImpl(Type type, Boolean logSuccess, INativeClassStruct[] interfaces)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2Cpp(Type type, Boolean logSuccess)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2CppImpl(Type type, Boolean logSuccess, INativeClassStruct[] interfaces)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2Cpp(Type type, Boolean logSuccess)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2CppImpl(Type type, Boolean logSuccess, INativeClassStruct[] interfaces)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2Cpp(Type type, Boolean logSuccess)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2CppImpl(Type type, Boolean logSuccess, INativeClassStruct[] interfaces)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2Cpp(Type type, Boolean logSuccess)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2CppImpl(Type type, Boolean logSuccess, INativeClassStruct[] interfaces)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2Cpp(Type type, Boolean logSuccess)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2CppImpl(Type type, Boolean logSuccess, INativeClassStruct[] interfaces)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2Cpp(Type type, Boolean logSuccess)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2CppImpl(Type type, Boolean logSuccess, INativeClassStruct[] interfaces)
   at UnhollowerRuntimeLib.ClassInjector.RegisterTypeInIl2Cpp[T]()
   at UniverseLib.UniversalBehaviour.Setup() in D:\a\UnityExplorer\UnityExplorer\UniverseLib\src\UniversalBehaviour.cs:line 25
   at UniverseLib.Universe.Init(Single startupDelay, Action onInitialized, Action`2 logHandler, UniverseLibConfig config) in D:\a\UnityExplorer\UnityExplorer\UniverseLib\src\Universe.cs:line 101
   at UnityExplorer.ExplorerCore.Init(IExplorerLoader loader)
   at UnityExplorer.ExplorerMelonMod.OnApplicationStart()
   at MelonLoader.MelonEvent.<>c.<Invoke>b__1_0(LemonAction x) in D:\a\MelonLoader\MelonLoader\MelonLoader\Melons\Events\MelonEvent.cs:line 174
   at MelonLoader.MelonEventBase`1.Invoke(Action`1 delegateInvoker) in D:\a\MelonLoader\MelonLoader\MelonLoader\Melons\Events\MelonEvent.cs:line 143

[d0clan]

If you want to say that the information passed in the above method is incorrect (e.g. 0x0000001, etc.), can you provide details of the obfuscated component, e.g. with images?(What is the name of the component and is there a component that works properly?)

I wrote down how to test it when I opened this issue. The game is free, but I still provide you with screenshots.
https://imgur.com/a/31mnLtI

this is called ResourceManager in deobfuscate map:
.MonoBehaviourPublicObLi1DiOb2StObObObUnique;I2.Loc.ResourceManager;164

The current info alone doesn't give us any info beyond some protection has occurred and this issue is occurring.(It looks that way, including the fact that MelonLoader has given up on responding)(I'm telling you that.)

i understand

Can you give us more details about the issues? I'm not sure if it's a issue, but I'm sure it could help us solve it.

I'm not very good with the internals of il2cpp, I can only find a few things for you that I 'think' it's relevant:
BepInEx/Il2CppInterop#70
sneakyevil/IL2CPP_Resolver#38