base on Unity il2cpp reverse engineer # Il2CppDumper [](https://ci.appveyor.com/project/Perfare/il2cppdumper/branch/master/artifacts) 中文说明请戳[这里](README.zh-CN.md) Unity il2cpp reverse engineer ## Features * Complete DLL restore (except code), can be used to extract `MonoBehaviour` and `MonoScript` * Supports ELF, ELF64, Mach-O, PE, NSO and WASM format * Supports Unity 5.3 - 2022.2 * Supports generate IDA, Ghidra and Binary Ninja scripts to help them better analyze il2cpp files * Supports generate structures header file * Supports Android memory dumped `libil2cpp.so` file to bypass protection * Support bypassing simple PE protection ## Usage Run `Il2CppDumper.exe` and choose the il2cpp executable file and `global-metadata.dat` file, then enter the information as prompted The program will then generate all the output files in current working directory ### Command-line ``` Il2CppDumper.exe <executable-file> <global-metadata> <output-directory> ``` ### Outputs #### DummyDll Folder, containing all restored dll files Use [dnSpy](https://github.com/0xd4d/dnSpy), [ILSpy](https://github.com/icsharpcode/ILSpy) or other .Net decompiler tools to view Can be used to extract Unity `MonoBehaviour` and `MonoScript`, for [UtinyRipper](https://github.com/mafaca/UtinyRipper), [UABE](https://7daystodie.com/forums/showthread.php?22675-Unity-Assets-Bundle-Extractor) #### ida.py For IDA #### ida_with_struct.py For IDA, read il2cpp.h file and apply structure information in IDA #### il2cpp.h structure information header file #### ghidra.py For Ghidra #### Il2CppBinaryNinja For BinaryNinja #### ghidra_wasm.py For Ghidra, work with [ghidra-wasm-plugin](https://github.com/nneonneo/ghidra-wasm-plugin) #### script.json For ida.py, ghidra.py and Il2CppBinaryNinja #### stringliteral.json Contains all stringLiteral information ### Configuration All the configuration options are located in `config.json` Available options: * `DumpMethod`, `DumpField`, `DumpProperty`, `DumpAttribute`, `DumpFieldOffset`, `DumpMethodOffset`, `DumpTypeDefIndex` * Whether to output these information to dump.cs * `GenerateDummyDll`, `GenerateScript` * Whether to generate these things * `DummyDllAddToken` * Whether to add token in DummyDll * `RequireAnyKey` * Whether to press any key to exit at the end * `ForceIl2CppVersion`, `ForceVersion` * If `ForceIl2CppVersion` is `true`, the program will use the version number specified in `ForceVersion` to choose parser for il2cpp binaries (does not affect the choice of metadata parser). This may be useful on some older il2cpp version (e.g. the program may need to use v16 parser on il2cpp v20 (Android) binaries in order to work properly) * `ForceDump` * Force files to be treated as dumped * `NoRedirectedPointer` * Treat pointers in dumped files as unredirected, This option needs to be `true` for files dumped from some devices ## Common errors #### `ERROR: Metadata file supplied is not valid metadata file.` Make sure you choose the correct file. Sometimes games may obfuscate this file for content protection purposes and so on. Deobfuscating of such files is beyond the scope of this program, so please **DO NOT** file an issue regarding to deobfuscating. If your file is `libil2cpp.so` and you have a rooted Android phone, you can try my other project [Zygisk-Il2CppDumper](https://github.com/Perfare/Zygisk-Il2CppDumper), it can bypass this protection. #### `ERROR: Can't use auto mode to process file, try manual mode.` Please note that the executable file for the PC platform is `GameAssembly.dll` or `*Assembly.dll` You can open a new issue and upload the file, I will try to solve. #### `ERROR: This file may be protected.` Il2CppDumper detected that the executable file has been protected, use `GameGuardian` to dump `libil2cpp.so` from the game memory, then use Il2CppDumper to load and follow the prompts, can bypass most protections. If you have a rooted Android phone, you can try my other project [Zygisk-Il2CppDumper](https://github.com/Perfare/Zygisk-Il2CppDumper), it can bypass almost all protections. ## Credits - Jumboperson - [Il2CppDumper](https://github.com/Jumboperson/Il2CppDumper) ", Assign "at most 3 tags" to the expected json: {"id":"4365","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"