Error: access violation accessing 0x0 reading fields

[bluewave41]

The following code for Beatstar (https://play.google.com/store/apps/details?id=com.spaceapegames.beatstar&hl=en&gl=US) fails to work.

	metalogic.classes['com.spaceape.flamingo.model.UserBeatmaps'].methods.SubCmd_UnlockSong.implementation = function(template, source, transaction, transactionStep) {
		let box = transactionStep.methods.get_GachaBox.invoke() as Il2Cpp.Object;
		let beatmapSelection = box.fields.beatmapSelection.value as Il2Cpp.Object;
		let beatmaps = beatmapSelection.fields._beatmaps.value as Il2Cpp.Object;
                console.log(box.fields.box_id.value);
		console.log(beatmaps.fields.seed.value);
	}

TransactionStep is an instance of GachaBoxTransactionStep where get_GachaBox returns a com.spaceape.flamingo.model.GachaBoxTO.

// RakshaModel.dll
class com.spaceape.flamingo.model.GachaBoxTO : raksha.RakshaItem
{
    System.Nullable<System.UInt32> box_id; // 0x18
    com.spaceape.config.GachaBoxTemplate _box; // 0x20
    com.spaceape.flamingo.model.BeatmapSelectionTO beatmapSelection; // 0x28
    com.spaceape.flamingo.model.CardSelectionTO cardSelection; // 0x30
    static raksha.TypeConstructors _Constructors; // 0x0

// RakshaModel.dll
class com.spaceape.flamingo.model.BeatmapSelectionTO : raksha.RakshaItem
{
    System.Collections.Generic.List<System.UInt32> beatmaps_id; // 0x18
    System.Collections.Generic.List<com.spaceape.config.BeatmapTemplate> _beatmaps; // 0x20
    System.Int32 seed; // 0x28
    System.Nullable<System.UInt32> songTag_id; // 0x2c
    com.spaceape.config.SongTag _songTag; // 0x38
    System.Nullable<System.UInt32> difficulty_id; // 0x40
    com.spaceape.config.SongDifficulty _difficulty; // 0x48
    System.Collections.Generic.List<System.UInt32> beatmapPool_id; // 0x50
    System.Collections.Generic.List<com.spaceape.config.BeatmapTemplate> _beatmapPool; // 0x58
    static raksha.TypeConstructors _Constructors; // 0x0

The above code prints:

54
Error: access violation accessing 0x0
    at get class (node_modules/frida-il2cpp-bridge/dist/il2cpp/structs/object.js:21)
    at call (native)
    at <anonymous> (node_modules/decorator-cache-getter/dist/index.js:9)
    at get fields (node_modules/frida-il2cpp-bridge/dist/il2cpp/structs/object.js:25)
    at call (native)
    at <anonymous> (node_modules/decorator-cache-getter/dist/index.js:9)
    at <anonymous> (agent/index.ts:26)
    at call (native)
    at replaceCallback (node_modules/frida-il2cpp-bridge/dist/il2cpp/structs/method.js:124)

Why can't I access any of these fields?

[vfsfitvnm]

If box.fields.box_id.value yields 54, beatmaps.fields.seed.value throws that error probably because transactionStep is NULL; would you check that?

console.log(`beatmaps = ${beatmaps.handle}`);

[bluewave41]

If box.fields.box_id.value yields 54, beatmaps.fields.seed.value throws that error probably because transactionStep is NULL; would you check that?

console.log(`beatmaps = ${beatmaps.handle}`);

Yeah I guess you're right

beatmaps = 0x0

I had it in my mind that it must be set because of something previously that I've forgotten but I guess not. :/

[vfsfitvnm]

At this point you either have to wait for that field to be not null or to manually create it if it is:

const beatmaps = beatmapSelection.fields._beatmaps;

if ((beatmaps.value as Il2Cpp.Object).isNull()) {
    beatmaps.value = beatmaps.type.class.new();
}

But this choice depends on what you are trying to do.