Il2CppDumper

Il2CppDumper

中文说明请戳这里

Unity il2cpp reverse engineer

Features

• Complete DLL restore (except code), can be used to extract MonoBehaviour and MonoScript
• Supports ELF, ELF64, Mach-O, PE, NSO and WASM format
• Supports Unity 5.3 - 2022.2
• Supports generate IDA, Ghidra and Binary Ninja scripts to help them better analyze il2cpp files
• Supports generate structures header file
• Supports Android memory dumped libil2cpp.so file to bypass protection
• Support bypassing simple PE protection

Usage

Run Il2CppDumper.exe and choose the il2cpp executable file and global-metadata.dat file, then enter the information as prompted

The program will then generate all the output files in current working directory

Command-line

Il2CppDumper.exe <executable-file> <global-metadata> <output-directory>

Outputs

DummyDll

Folder, containing all restored dll files

Use dnSpy, ILSpy or other .Net decompiler tools to view

Can be used to extract Unity MonoBehaviour and MonoScript, for UtinyRipper, UABE

ida.py

For IDA

ida_with_struct.py

For IDA, read il2cpp.h file and apply structure information in IDA

il2cpp.h

structure information header file

ghidra.py

For Ghidra

Il2CppBinaryNinja

For BinaryNinja

ghidra_wasm.py

For Ghidra, work with ghidra-wasm-plugin

script.json

For ida.py, ghidra.py and Il2CppBinaryNinja

stringliteral.json

Contains all stringLiteral information

Configuration

All the configuration options are located in config.json

Available options:

• DumpMethod, DumpField, DumpProperty, DumpAttribute, DumpFieldOffset, DumpMethodOffset, DumpTypeDefIndex

  • Whether to output these information to dump.cs

• GenerateDummyDll, GenerateScript

  • Whether to generate these things

• DummyDllAddToken

  • Whether to add token in DummyDll

• RequireAnyKey

  • Whether to press any key to exit at the end

• ForceIl2CppVersion, ForceVersion

  • If ForceIl2CppVersion is true, the program will use the version number specified in ForceVersion to choose parser for il2cpp binaries (does not affect the choice of metadata parser). This may be useful on some older il2cpp version (e.g. the program may need to use v16 parser on il2cpp v20 (Android) binaries in order to work properly)

• ForceDump

  • Force files to be treated as dumped

• NoRedirectedPointer

  • Treat pointers in dumped files as unredirected, This option needs to be true for files dumped from some devices

Common errors

ERROR: Metadata file supplied is not valid metadata file.

Make sure you choose the correct file. Sometimes games may obfuscate this file for content protection purposes and so on. Deobfuscating of such files is beyond the scope of this program, so please DO NOT file an issue regarding to deobfuscating.

If your file is libil2cpp.so and you have a rooted Android phone, you can try my other project Zygisk-Il2CppDumper, it can bypass this protection.

ERROR: Can't use auto mode to process file, try manual mode.

Please note that the executable file for the PC platform is GameAssembly.dll or *Assembly.dll

You can open a new issue and upload the file, I will try to solve.

ERROR: This file may be protected.

Il2CppDumper detected that the executable file has been protected, use GameGuardian to dump libil2cpp.so from the game memory, then use Il2CppDumper to load and follow the prompts, can bypass most protections.

If you have a rooted Android phone, you can try my other project Zygisk-Il2CppDumper, it can bypass almost all protections.

Credits

• Jumboperson - Il2CppDumper

Il2CppDumper

Unity il2cpp逆向工程

功能

• 还原DLL文件（不包含代码），可用于提取MonoBehaviour和MonoScript
• 支持ELF, ELF64, Mach-O, PE, NSO和WASM格式
• 支持Unity 5.3 - 2022.2
• 生成IDA和Ghidra的脚本，帮助IDA和Ghidra更好的分析il2cpp文件
• 生成结构体头文件
• 支持从内存dump的libil2cpp.so文件以绕过保护
• 支持绕过简单的PE保护

使用说明

直接运行Il2CppDumper.exe并依次选择il2cpp的可执行文件和global-metadata.dat文件，然后根据提示输入相应信息。

程序运行完成后将在当前运行目录下生成输出文件

命令行

Il2CppDumper.exe <executable-file> <global-metadata> <output-directory>

输出文件

DummyDll

文件夹，包含所有还原的DLL文件

使用dnSpy，ILSpy或者其他.Net反编译工具即可查看具体信息

可用于提取Unity的MonoBehaviour和MonoScript，适用于UtinyRipper或者UABE等

ida.py

用于IDA

ida_with_struct.py

用于IDA, 读取il2cpp.h文件并在IDA中应用结构信息

il2cpp.h

包含结构体的头文件

ghidra.py

用于Ghidra

Il2CppBinaryNinja

用于BinaryNinja

ghidra_wasm.py

用于Ghidra, 和ghidra-wasm-plugin一起工作

script.json

用于IDA和Ghidra脚本

stringliteral.json

包含所有stringLiteral信息

关于config.json

• DumpMethod，DumpField，DumpProperty，DumpAttribute，DumpFieldOffset, DumpMethodOffset, DumpTypeDefIndex

  • 是否在dump.cs输出相应的内容

• GenerateDummyDll，GenerateScript

  • 是否生成这些内容

• DummyDllAddToken

  • 是否在DummyDll中添加token

• RequireAnyKey

  • 在程序结束时是否需要按键退出

• ForceIl2CppVersion，ForceVersion

  • 当ForceIl2CppVersion为true时，程序将根据ForceVersion指定的版本读取il2cpp的可执行文件（Metadata仍然使用header里的版本），在部分低版本的il2cpp中可能会用到（比如安卓20版本下，你可能需要设置ForceVersion为16程序才能正常工作）

• ForceDump

  • 强制将文件视为dump文件

• NoRedirectedPointer

  • 将dump文件中的指针视为未重定向的, 从某些设备dump出的文件需要设置该项为true

常见问题

ERROR: Metadata file supplied is not valid metadata file.

global-metadata.dat已被加密。关于解密的问题请去相关破解论坛寻求帮助，请不要在issues提问！

如果你的文件是libil2cpp.so并且你拥有一台已root的安卓手机，你可以尝试我的另一个项目Zygisk-Il2CppDumper，它能够无视global-metadata.dat加密

ERROR: Can't use auto mode to process file, try manual mode.

请注意PC平台的可执行文件是GameAssembly.dll或者*Assembly.dll

你可以打开一个新的issue，并上传文件，我会尝试解决

ERROR: This file may be protected.

Il2CppDumper检测到可执行文件已被保护，使用GameGuardian从游戏内存中dump libil2cpp.so，然后使用Il2CppDumper载入按提示操作，可绕过大部分保护

如果你拥有一台已root的安卓手机，你可以尝试我的另一个项目Zygisk-Il2CppDumper，它能够绕过几乎所有保护

感谢

• Jumboperson - Il2CppDumper