frida script to find imposter (amongus 2020.9.9 arm64-v8a)

index.ts

import { log } from "./logger";
import { AssertionError } from "assert";

const libil2cpp = Process.getModuleByName("libil2cpp.so");
const libil2cppb = libil2cpp.base;
const playerinfo_serialize = libil2cppb.add(0x6c2e30);
const playerinfo_deserialize = libil2cppb.add(0x6c316c);

console.log("Starting script..");
function readString(pointr:NativePointer){
    let length = pointr.add(16).readInt()
    const stringBytes = pointr.add(20).readByteArray(length*2)
    if(stringBytes instanceof ArrayBuffer){
        const view = new Uint16Array(stringBytes)
        return String.fromCharCode.apply(null,[...view])
    }
    return "Cant read"

}
function processPlayerInfo(rawPlayer: NativePointer) {
    const buffer = rawPlayer.readByteArray(0x41);
    const playername_ptr = rawPlayer.add(0x18).readPointer()
    const playername = readString(playername_ptr)

    if (buffer instanceof ArrayBuffer) {
        const playerInfoView = new DataView(buffer);
        const player = {
            PlayerId: playerInfoView.getInt8(0x10),
            PlayerName: playername, //0x18
            ColorId: playerInfoView.getInt32(0x20, true),
            HatId: playerInfoView.getInt16(0x24, true),
            PetId: playerInfoView.getInt16(0x28, true),
            SkinId: `0x${playerInfoView.getInt16(0x2c, true).toString(16)}`,
            Disconnected: `0x${playerInfoView.getInt32(0x30, true).toString(16)}`,
            Tasks: playerInfoView.getInt32(0x38, true),
            IsImpostor: playerInfoView.getInt8(0x40),
        };
        console.log("[+] Player Serialize");
        console.log(JSON.stringify(player,null,"-- "))
    }
}

Interceptor.attach(playerinfo_serialize, {
    onEnter: function (args) {
        const rawPlayer = args[0];
        processPlayerInfo(rawPlayer);
        // console.log(
        //     hexdump(rawPlayer.add(0x20), {
        //         offset: 0,
        //         length: 0x50,
        //         header: true,
        //         ansi: true,
        //     })
        // );
    },
    onLeave: retval => {},
});

Interceptor.attach(playerinfo_deserialize, {
    onEnter: function (args) {
       //save playerInfo pointer
       this.pInfo = args[0];

    },
    onLeave: function (retval) {
        if(this.pInfo instanceof NativePointer){
            //playerInfo deserialized into pInfo
            processPlayerInfo(this.pInfo);
        }
     },

});