perfare / il2cppdumper

Unity il2cpp reverse engineer

Il2CppDumper

中文说明请戳这里

Unity il2cpp reverse engineer

Features

• Complete DLL restore (except code), can be used to extract MonoBehaviour and MonoScript
• Supports ELF, ELF64, Mach-O, PE, NSO and WASM format
• Supports Unity 5.3 - 2022.2
• Supports generate IDA, Ghidra and Binary Ninja scripts to help them better analyze il2cpp files
• Supports generate structures header file
• Supports Android memory dumped libil2cpp.so file to bypass protection
• Support bypassing simple PE protection

Usage

Run Il2CppDumper.exe and choose the il2cpp executable file and global-metadata.dat file, then enter the information as prompted

The program will then generate all the output files in current working directory

Command-line

Il2CppDumper.exe <executable-file> <global-metadata> <output-directory>

Outputs

DummyDll

Folder, containing all restored dll files

Use dnSpy, ILSpy or other .Net decompiler tools to view

Can be used to extract Unity MonoBehaviour and MonoScript, for UtinyRipper, UABE

ida.py

For IDA

ida_with_struct.py

For IDA, read il2cpp.h file and apply structure information in IDA

il2cpp.h

structure information header file

ghidra.py

For Ghidra

Il2CppBinaryNinja

For BinaryNinja

ghidra_wasm.py

For Ghidra, work with ghidra-wasm-plugin

script.json

For ida.py, ghidra.py and Il2CppBinaryNinja

stringliteral.json

Contains all stringLiteral information

Configuration

All the configuration options are located in config.json

Available options:

• DumpMethod, DumpField, DumpProperty, DumpAttribute, DumpFieldOffset, DumpMethodOffset, DumpTypeDefIndex

  • Whether to output these information to dump.cs

• GenerateDummyDll, GenerateScript

  • Whether to generate these things

• DummyDllAddToken

  • Whether to add token in DummyDll

• RequireAnyKey

  • Whether to press any key to exit at the end

• ForceIl2CppVersion, ForceVersion

  • If ForceIl2CppVersion is true, the program will use the version number specified in ForceVersion to choose parser for il2cpp binaries (does not affect the choice of metadata parser). This may be useful on some older il2cpp version (e.g. the program may need to use v16 parser on il2cpp v20 (Android) binaries in order to work properly)

• ForceDump

  • Force files to be treated as dumped

• NoRedirectedPointer

  • Treat pointers in dumped files as unredirected, This option needs to be true for files dumped from some devices

Common errors

ERROR: Metadata file supplied is not valid metadata file.

Make sure you choose the correct file. Sometimes games may obfuscate this file for content protection purposes and so on. Deobfuscating of such files is beyond the scope of this program, so please DO NOT file an issue regarding to deobfuscating.

If your file is libil2cpp.so and you have a rooted Android phone, you can try my other project Zygisk-Il2CppDumper, it can bypass this protection.

ERROR: Can't use auto mode to process file, try manual mode.

Please note that the executable file for the PC platform is GameAssembly.dll or *Assembly.dll

You can open a new issue and upload the file, I will try to solve.

ERROR: This file may be protected.

Il2CppDumper detected that the executable file has been protected, use GameGuardian to dump libil2cpp.so from the game memory, then use Il2CppDumper to load and follow the prompts, can bypass most protections.

If you have a rooted Android phone, you can try my other project Zygisk-Il2CppDumper, it can bypass almost all protections.

Credits

• Jumboperson - Il2CppDumper

il2cppdumper's Issues

Metadata can't be dumped

How to solve that?
https://i.imgur.com/XAvKvpQ.jpg

Add method/property offset info to dummyDll?

public void Update(); // 0xC387EC

Is it possible to add offset comment show in dump.cs to generated dummyDll?

It will be more convenient for static analyze, cause dump.cs is hard to read.

Failed in dumping metadata if metadata file was encrypted

Is there a way to decrtpt a ecrypted metadata.dat file?

Il2cppdumper

I tried to dump with your software but it force close after 1.Auto 2.Manual although never press 1 or 2!! And i don't see dump.cs be created!!!

x86 binary support?

Can you add x86 binary support for dumping?

Can't dump 64-bit binary using auto mode (iOS)

Dumping 32-bit works but not 64-bit, I got this error. I tried to dump other iOS il2cpp games but same issue.
I can't do manual mode because i don't know where to find offsets in 64-bit binary

Link to binary file: http://www.mediafire.com/file/um78d8285govpg9/iosbinary.zip

ERROR: Unable to process file automatically, try to use manual mode.
   ved Il2CppDumper.Program.Main(String[] args) i C:\projects\il2cppdumper\Il2CppDumper\Program.cs:linje 88
Press any key to exit...

.

ll2CppDumper Manual Mode

Hi buddy,

The new version you have released is awesome. You were are to show me how to find offset with the last tricky binary but this one ive added is very unique do you have a solution to make your awesome tool work?
and is there another way for me to contact you??

http://iosddl.net/dd1bc7e98a687708/zaca.rar

Got error with metadata v20

at Il2CppDumper.Elf.Searchv20() in C:\projects\il2cppdumper\Il2CppDumper\Elf.cs:string 66
at Il2CppDumper.Program.Main(String[] args) in C:\projects\il2cppdumper\Il2CppDumper\Program.cs:string 67

Files: https://drive.google.com/open?id=0Bzd9YzWlU2ffU3JSZGNDbDJQbkU

help me dump arm64 binary in iOS?

I have a binary ios with 2 arm7 and arm64 codes. I've done auto dump and the result is dump of arm7. I want to have dump of arm64 then i need to do?

Using decompiler to generate dump.cs

Using decompiler such as ICSharpCode.Decompiler or dnSpy.Decompiler(replace Mono.Cecil to dnlib) to generate dump.cs from DummyDll.

error dump arm64 binary!

help me

I can not dump this data
" metadata file supplied is not valid metadata file " with v24 (
because new global-metadata)
https://drive.google.com/file/d/1WsLbiH55UZv_VS-txJt1llgjUkpK6Dpx/view?usp=sharing

iOS 64bits support

If I'm not mistaken, the current version does not support ARM 64 bits. Are you planning to do it?
I may be able to help if you point me toward the right direction.

How calculate to decrypt Metadata encrypted?

As you said "It look like Metadata has been encrypted, You should decrypt the data by yourself." But I don't know where to start...
FF FF 00 00 00 00 FF FF FF FF 93 55 00 00 2C 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 C0 00 00 06 86 00 00 00 FF FF 00 00 F8 3F 06 00 5E 0E 00 00 DC 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 94 55 00 00 2C 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 C1 00 00 06 86 00 00 00 FF FF 00 00 04 40 06 00 5E 0E 00 00 A0 05 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 95 55 00 00 04 00 00 00 FF FF FF FF FF FF FF FF 00 00

ll2CppDumper Manual Mode

Hi just seeing if you can supply a guide for using in manual mode? , the picture supplied does not show clearly how to use. Obviously you need an address as a pointer tried on a few different games with no success . Please and thank you

Is mach-o with metadata v20 supported?

I decompiled the latest release version and find mach-o 32bit with metadata v21 and metadata v16 are supported but my package is mash-o 32bit with metadata v20, I tried automode but got error.

Create DummyDll -> BUG: Object reference not set to an instance of an object

Here is the files: http://www119.zippyshare.com/v/GqFS2150/file.html

Select Mode: 1.Manual 2.Auto 3.Auto(Advanced) 4.Auto(Plus) 5.Auto(Symbol)
Initializing il2cpp file...
Applying relocations...
Searching...
CodeRegistration : 18b3a3c
MetadataRegistration : 18c72f4
Dumping...
Done !
Create DummyDll...
Object reference not set to an instance of an object.
at Il2CppDumper.DummyAssemblyCreator.GetTypeReference(MemberReference memberReference, Il2CppType pType) in C:\projects\il2cppdumper\Il2CppDumper\DummyAssemblyCreator.cs:line 223
at Il2CppDumper.DummyAssemblyCreator..ctor(Metadata metadata, Il2Cpp il2cpp) in C:\projects\il2cppdumper\Il2CppDumper\DummyAssemblyCreator.cs:line 97
at Il2CppDumper.Program.Main(String[] args) in C:\projects\il2cppdumper\Il2CppDumper\Program.cs:line 451
Press any key to exit...

Offset off by 1

Thanks for you work. I'm using part of you logic for iOS in a similar project of mine, and at the end it seems the method offset are off by 1.

I'm wondering if it has something to do with the "-1" you have here: https://github.com/Perfare/Il2CppDumper/blob/master/Il2CppDumper/Macho.cs#L70.

However, offset I found are 1 bigger, not 1 lower from the correct ones...

About the global-metadata.dat file Chinese string content ~!

Excuse me, how to localize the global-metadata.dat file inside the string? Or is it extracted after the finished, how to back into the global-metadata.dat file ah?

支持metadata版本20支持

能否添加metadata版本20支持？

麻烦解决一下，谢谢了

Unable to process file automatically, try to use manual mode.
http://pan.baidu.com/s/1mixJXfa

none of the mode works with Unity 2017.2.0p2

libil2cpp.so and global-metadata.dat

遇到几个有问题的,都是两种模式不能执行解决的......

第一个文件:1.zip
第二个文件:2.zip

这些文件,我手头经常会遇到,如果需要一些测试的,我可以提供...

ERROR: Some errors in dumping

im using Auto(Advanced) Mode.
i think, this file is not supported on IL2CppDumper.
please support this file.

(other mode also failed)

Error log

Select Mode: 1.Manual 2.Auto 3.Auto(Advanced) 4.Auto(Plus) 5.Auto(Symbol)
Initializing il2cpp file...
ERROR: Unable to get section.
Applying relocations...
Searching...
CodeRegistration : 1c42970
MetadataRegistration : 1c429e4
Dumping...
ERROR: Some errors in dumping
...
ERROR: Some errors in dumping
ERROR: Some errors in dumping
ERROR: Some errors in dumping
Done !
Create DummyDll...

Image

Files

https://mega.nz/#F!nXJBhA6A!0EVslozIgpoV6f0ZPdv5Qw

My Environment

Windows 10 64bit 1709 (16299.309)

Unable to translate Unicode character (auto mode)

I got error when I try to dump CSR2, both Android and iOS version (32-bit).
Older version like v1.0.8 also got some errors in dumping but it dump successful.
Download link: http://www.mediafire.com/file/wnko633gfocvfs9/1.13.2.zip

ERROR: Some errors in dumping
Unable to translate Unicode character \uD800 at index 508 to specified code page
   at System.Text.EncoderExceptionFallbackBuffer.Fallback(Char charUnknown, Int32 index)
   at System.Text.EncoderFallbackBuffer.InternalFallback(Char ch, Char*& chars)
   at System.Text.UTF8Encoding.GetBytes(Char* chars, Int32 charCount, Byte* bytes, Int32 byteCount, EncoderNLS baseEncoder)
   at System.Text.EncoderNLS.GetBytes(Char[] chars, Int32 charIndex, Int32 charCount, Byte[] bytes, Int32 byteIndex, Boolean flush)
   at System.IO.StreamWriter.Flush(Boolean flushStream, Boolean flushEncoder)
   at System.IO.StreamWriter.Write(String value)
   at Il2CppDumper.Program.Main(String[] args) i C:\projects\il2cppdumper\Il2CppDumper\Program.cs:linje 359
Press any key to exit...

Can't dump 64-bit binary using auto mode (iOS)

Select Platform: 1.32bit 2.64bit
Select Mode: 1.Manual 2.Auto 3.Auto(Advanced)
WARNING: Version 16 can only get CodeRegistration
CodeRegistration : 102d9f800
ERROR: Unable to process file automatically, try to use other mode.
at Il2CppDumper.Program.Main(String[] args) in C:\projects\il2cppdumper\Il2CppDumper\Program.cs:line 94
Press any key to exit...

Only find CodeRegistration address, try another mode

README.md should be written in english

Not an issue but it would be great if you can write README.md in english so everyone can read without having to translate using online tool.

Finding offsets in Unity games with Metadata v22

Most games with metadata v22 no longer have unk offsets (R0, and R1) and auto mode does not work on obfuscated games
Can you explain where can i find another offsets?

Auto mode can't deal. How to find addresses manually?

Tried to dump these: https://drive.google.com/drive/folders/0B9E0BjdgxRlzUlNya1ZhQzFOcW8?usp=sharing

Could not handle to get addresses manually. Tried to find bytes { 0x55, 0x89, 0xE5, 0x53, 0x83, 0xE4, 0xF0, 0x83, 0xEC, 0x20, 0xE8, 0x00, 0x00, 0x00, 0x00, 0x5B }. Can you point me an instruction please?

处理64位Mach-O文件时出错

ERROR: Unable to process file automatically, try to use manual mode.
在 Il2CppDumper.Program.Main(String[] args)
使用的是已经脱壳的il2cpp编译的某u3d游戏的二进制文件（定语好多啊2333）
链接: http://pan.baidu.com/s/1c2IkPPY 密码: cyyn

可以Dump出函数体的内容吗？

请教：DummyDll中的函数体没有解析出来，有办法把函数体也反编译出来吗？

Create DummyDll => BUG: Value cannot be null, Parameter name: returnType

Here is the files: http://www119.zippyshare.com/v/yBEIMn3e/file.html

Select Mode: 1.Manual 2.Auto 3.Auto(Advanced) 4.Auto(Plus) 5.Auto(Symbol)
Initializing il2cpp file...
Applying relocations...
Searching...
CodeRegistration : 23faa40
MetadataRegistration : 2429d5c
Dumping...
Done !
Create DummyDll...
Value cannot be null.
Parameter name: returnType
at Mono.Cecil.MethodReference..ctor(String name, TypeReference returnType)
at Il2CppDumper.DummyAssemblyCreator..ctor(Metadata metadata, Il2Cpp il2cpp) in C:\projects\il2cppdumper\Il2CppDumper\DummyAssemblyCreator.cs:line 117
at Il2CppDumper.Program.Main(String[] args) in C:\projects\il2cppdumper\Il2CppDumper\Program.cs:line 452
Press any key to exit...

Metadata file supplied is not a supported version[16]

Downloaded Il2CppDumper v0.4 @ http://pan.baidu.com/s/1bpKQ5Uv#list/path=%2F

The data I am trying to get a hand with
https://drive.google.com/file/d/0B5w-PkG-Uyi7eVN1ZXJsQWxBNTA/view?usp=sharing

I try to run with these metadata and binary (from iOS)

Metadata file supplied is not a supported version[16]
at Il2CppDumper.Program.Main(String[] args)

But I thought 16 is supported ?

1

if (version != 16 && version != 20 && version != 21 && version != 22 && version != 23)
  | throw new Exception($"ERROR: Metadata file supplied is not a supported version[{version}].");

Wrong issue. Please delete!

I read old issues and read README again, it was my mistake, please delete it. Sorry about this!

All of the auto modes cannot work on these files

Hi, I found the attached that cannot be decompiled by all the auto modes.
Archive.zip

加载ida脚本出错

加载生成的ida python脚本时报错：
C:\script.py, 1: Function declaration is expected

exporting interfaces

Did you had a look at exporting interfaces?
I tried to dump interface and types implementing interfaces but with no luck so far

Unable to process [32Bit Binary][Auto]

so, i have the latest version, the .20

error code

ERROR: Unable to process file automatically, try to use manual mode.
at Il2CppDumper.Program.Main(String[] args) in C:\projects\il2cppdumper\Il2CppDumper\Program.cs:line 88
Press any key to exit...

Getting asset encryption keys from a il2cpp game?

Hello Perfare, I could not figure out any way to contact you other than an issue here. I'm looking to get the aes encryption keys they use to decrypt oggs and other assets in Super Mario Run. I noticed its a il2cpp game and tried everything possible to find them but could not.
An example of an encrypted file is here: https://download-cdn-supermariorun.akamaized.net/native/e07e1191b490a31c/3.0.1/raw/RawSound/DeALProject.json
And one of the encrypted OGG: https://download-cdn-supermariorun.akamaized.net/native/e07e1191b490a31c/3.0.1/raw/RawSound/sound/BGM/Athletic_RB_32.ogg

il2cppdumper dumped things like get_OggEncryptionAesKey but I cannot figure out how to actually get the key it refers to?

hopper disassembler 有可能支持吗?

请问mac 下 hopper disassembler 有可能支持吗?

楼主大大方便看下字符串的索引么？

楼主大大方便看下字符串的索引么？因为游戏作者经常会将字符串写在代码中，如果能找到字符串的位置，那游戏就好处理了

ERROR: il2cpp file is not supported on window 10

I'm running a vm window 10 on my mac and when I try to dump subway surfer it gives me this error ERROR: il2cpp file is not supported.
at Il2CppDumper.FormGUI.A(Object , DoWorkEventArgs )
please tell me what do I need to do to fix it ASAP

你好，你博客里的文章好像失效了

https://www.perfare.net/659.html

我按照里面的教程，发现无法再IDA里找到

这条函数，是不是新版本方法不一样了？我是Unity 5.6

Which offsets should i use for manual dump in metadata v24

I tried many ways to dump in different offsets but not working.
I also tried to dump my own il2cpp game uses latest il2cpp version but not working.
il2cpp::vm::MetadataCache::Register looks different. Which offset should i use for manual dump?

还想跟一下昨天那个问题

就是突然发现 函数名是看到了，但是偏移和返回类型硬是没看到。求大大指路

Original Offset Addition +/-1

Noticed it when I decrypt iOS Binaries (v16, 23 tested), it either +/- to the original offset.
What I mean by this is let us say,

Original Offset is : 11455
The Decrypted Offset Shows the Instruction to be in : 11456 or 11454

This causes the IDA to not rename the function names when script is loaded because its below or above the instruction.

Here is a v16 binary for you to test:
http://www8.zippyshare.com/v/rrOhfBam/file.html
(fat binary)

Bug with arm64 binaries

Tried to decrypt arm64 (mach-o) and it gave me following errors:

Select Mode: 1. Manual 2.Auto
ERROR: Unable to process file automatically, try to use manual mode.
   at Il2CppDumper.Program.Main(String[] args) in C:\projects\il2cppdumper\Il2CppDumper\Program.cs:line 39
Press any key to exit...

Binary + MetaData for you to test: http://www8.zippyshare.com/v/uF4e3Aa4/file.html

关于IDA中函数自动识别的问题

-测试了一下最新的版本,之前提出的两个问题都已经解决(多谢作者的勤奋).自动Dump和识别不同的版本都没有问题的.

• -就是还有一个小问题,在IDA中的"Functions window"函数窗口,对已识别的函数,不能搜索出来.

• -但是可以在"IDA View-A"通过选中从函数头到函数尾全部选中,按快捷键"P",自动识别修复.

• -然后就可以在函数窗口搜索了.

• 如果可以在代码中集成用IDAPython脚本实现自动修复不能识别的函数就完美了.

• 附上SO文件:
  libil2cpp.zip
  global-metadata文件:
  global-metadata.zip