Extract .NET metadata from il2cpp binaries. (types, methods, fields, etc.)
DummyDll
:- DLLs generated by Mono.Cecil which contain the .NET metadata extracted from the binary (no code included). Can be viewed in .NET decompilers (ILSPy, DnsPy, JetBrains dotPeek (recommended) ).script.py
:- Requires IDA (I use IDA 7.0 Pro ) and IDAPython.dump.cs
:- C# pseudocode. Can be viewed in text editors (syntax highlighting recommended)
-
git clone https://github.com/Shubzz-02/Il2CppDumper.git
- Copy your
libil2cpp.so
andglobal-metadata.dat
to Il2CppDumper/ folder. - Run
Il2CppDumper.exe
chooselibil2cpp.so
andglobal-metadata.dat
. - To find unity version open
/assets/bin/Data/Resources/unity_builtin_extra
in any hex editor ( try hexed) and look at address0x00000014
(see screenshots attached below) you will find something like2018.3.14f
this is the unity version you need, type this in terminal and press enter. - In mode selection Select 3 (recommended) wait until process finish.
- Now in DummyDll folder you will find some .dll files these contain .NET metadata extracted from the binary, Open
Assembly-CSharp.dll
in any .NET decompilers (ILSPy, DnsPy, JetBrains dotPeek (recommended) ).
-
- Follow above Step 1 to 5.
- Open
libil2cpp.so
in Ida (Note :- Use IDA Pro ) and wait until Ida load it completely. - Load
script.py
in Ida viaFile -> Script file
, and wait for script to execute. - Now you will see functions name in Ida Function Window.
- Done! happy Reversing