yuanshen/Yuanshen.Patch

Yuanshen.Patch

Our own client patch for Genshin Impact 0.9.10, replacing the third-party Redirect. A native version.dll proxy that embeds the Frida gadget and redirects all client HTTP traffic to our own dispatch/SDK server.

How it works

The game imports version.dll. Windows loads a version.dll sitting next to GenshinImpact.exe before the system one, which is our injection point.

1. version.dll (our proxy) — re-exports all 17 real version.dll functions and forwards each, at link time, to the genuine system DLL via the drive-independent NT path \\.\GLOBALROOT\SystemRoot\System32\version.dll.<fn> (the "perfect DLL proxy" technique — no self-recursion, the game runs normally). See src/exports.h.
2. On load it spawns a worker thread (never blocks the loader lock), waits for the IL2CPP runtime (UserAssembly.dll) to be ready, then LoadLibrarys the Frida gadget — this is the embedded Frida. See src/dllmain.cpp.
3. The gadget self-initializes from its own DllMain, reads gadget.config, and runs redirect.js, which hooks UnityWebRequest.set_url and Uri..ctor and rewrites every request's host to http://127.0.0.1:8899 (our SDK). Progress is written to YuanshenPatch.log in the game folder.

Why there is no RSA patch (for 0.9.10)

The reference (xeon/EncryptionPatch, "RSAPatch") targets Genshin 4.2 and does two things: bypass the RSA signature check on query_cur_region / server_rand_key, and force the session seed to 1337. Both defeat mechanisms that were introduced ~2.7 — two years after 0.9.10 — and are absent from this build:

• 0.9.10 accepts a plaintext, unsigned query_cur_region (no {content,sign} wrapper, no RSA), so there is no signature to bypass.
• 0.9.10 carries the session seed as the plaintext secretKey field in GetPlayerTokenRsp, fed straight into MT19937-64. Our gameserver already sets it to 1337, so the seed already matches with no patch.

So for 0.9.10 the dispatch redirect is the only client patch required. rsapatch.js is included as an optional, documented equivalent for signed builds (2.7+); it is NOT loaded by gadget.config and its byte patterns are 4.2-specific — fill in offsets/method names for the exact build before use.

Build

Requires the MSVC C++ toolset (VS 2022 BuildTools or newer).

powershell -ExecutionPolicy Bypass -File build.ps1

Produces dist/version.dll (x64, static CRT — depends only on KERNEL32.dll). CMake is also provided (cmake -B build -A x64 && cmake --build build --config Release).

Deploy

powershell -ExecutionPolicy Bypass -File deploy.ps1 -GameDir "D:\cbt1"

Copies version.dll, gadget.dll, gadget.config, redirect.js into the game folder (backs up any existing version.dll). Then start the SDK (:8899) and gameserver, and launch GenshinImpact.exe.

Files

File	Role
src/exports.h	17 forwarded version.dll exports
src/dllmain.cpp	proxy entry, IL2CPP wait, gadget bootstrap, logging
dist/redirect.js	Frida script: HTTP dispatch redirect
dist/gadget.config	Frida gadget config (script mode, auto-resume)
dist/rsapatch.js	optional RSA/seed patch for signed builds (unused on 0.9.10)
dist/gadget.dll	Frida gadget (x64)
build.ps1 / build.bat / CMakeLists.txt	build the proxy
deploy.ps1	copy the patch into the game folder