I've tracked down the error to in libil2cpp/os/Posix/Image.cpp, method GetELFImageBuildID(). The issue is with the expression "phdr[i].p_offset + imageBase" on lines 84 and 86. This is not the correct way to get the memory location of that section. The correct way to do this is described in a UNIX stackexchange post:

"How to tell whether the p_vaddr in ELF program header is the real memory address or is just an offset from the shared library base address?" (I cannot give the direct link as it is forbidden by this comment section)

Making edits to libil2cpp on our disk and re-exporting has fixed the issue for us, showing that this is the cause of the issue. In our case, the trigger was google automatic integrity protection modifying the libil2cpp.so file. Comparing the files pre and post google AIP, we see that google does not modify at all the contents of the PT_NOTE section that contains the build ID, or any other note section. However, it does relocate it in the file. In the unmodified library, the p_offset and the p_vaddr are the same. This is why it works, despite the code incorrectly using p_offset. After google edits the .so, it is relocated and p_offset is no longer equal to p_vaddr.

Swapping p_offset to p_vaddr was enough to stop the crashes for us. As stated in the stackexchange I linked earlier, in some cases you may also have to subtract the offset of the lowest PT_LOAD section. In our case this always turned out to be zero, so we're good for now, but to stop this coming up again in the future it shouldn't be difficult to factor that in as well. I'll include below some example code (I'm not super versed in C++ so don't take my word for it, do your own research etc):

// find lowest PT_LOAD section offset
uint32_t lowest_pt_load = -1;

for (int i = 0; i < ehdr->e_phnum; i++)
{
if (phdr[i].p_type == PT_LOAD && phdr[i].p_vaddr < lowest_pt_load)
{
lowest_pt_load = phdr[i].p_vaddr;
}
}

if (lowest_pt_load == -1) { lowest_pt_load = 0; }

and these 3 lines in the loop:

size_t nhdr_ptr = phdr[i].p_vaddr + imageBase - lowest_pt_load;
int j = 0;
while (nhdr_ptr < imageBase + phdr[i].p_vaddr - lowest_pt_load + phdr[i].p_memsz)

We recently started having the same issue and it is impacting many of our Google Play users. We believe it started happening after we started using Google's Automatic Integrity Protection.

I'm getting a lot of "[libil2cpp.so] Image.cpp - il2cpp::eek:s::Image::GetELFImageBuildID()" crashes..

https://forum.unity.com/threads/libil2cpp-so-il2cpp-os-image-getelfimagebuildid.1454485