Il2CppInspector

Development of Il2CppInspector is suspended

It is with great regret that I have to announce that development work on Il2CppInspector has been halted for the foreseeable future.

The reason for this is that due to health and changes in my personal life, I simply do not have time to commit to working on the project anymore. This is very frustrating for me but there is little I can really do about it.

Please feel free to fork the project and make improvements! You can also continue to post issues as I would like to have a compendium of bugs and problems saved in case that I or someone else does have the opportunity to get back to working on this. Please note though, that I won't be responding to issues or PRs going forward for the foreseeable future.

If you need IL2CPP tooling, I recommend my friend and colleague's excellent project Cpp2IL which is a work-in-progress tool to convert IL2CPP binaries directly back into IL code which can be easily viewed in dnSpy etc. This is a mammoth task so please do go and support his work on this amazing project!

Happy hacking,

Katy.

Il2CppInspector 2021.1

Il2CppInspector helps you to reverse engineer IL2CPP applications, providing the most complete analysis currently available.

Main features

• Output IL2CPP type definitions, metadata and method pointers as C# stub code

• Create .NET assembly shim DLLs containing the IL2CPP application structure and metadata for use in decompilers such as ILSpy, dnSpy, Unity asset loading with AssetStudio or managed proxy generation with Il2CppAssemblyUnhollower

• Create C++ scaffolding for all types, methods, function pointers and API functions in an IL2CPP application for use in x64dbg, Cydia Substrate etc.

• Create IDA and Ghidra Python scripts to populate symbol, function and type information; includes API hooks to implement scripts for other targets

• Create Visual Studio C++ DLL injection projects directly from IL2CPP files

• Create Visual Studio C# code stub solutions directly from IL2CPP files

• Create JSON metadata with a complete address map directly from IL2CPP Files.

• Create IL2CPP binaries from arbitrary C# source code without a Unity project

• Three major APIs for use in your own custom static analysis projects for querying low level binary metadata, the .NET type model and the whole C++ application. These are also available as a NuGet Package.

• Plugin SDK allows you to create custom plugins to extend Il2CppInspector's capabilities

• Defeats certain types of obfuscation

  • Most types of packed PE files (Windows DLLs)
  • ROT encryption of API export names
  • Beebyte symbol obfuscation via automated differential analysis (requires Beebyte Deobfuscator plugin and an earlier unobfuscated IL2CPP or Mono version of the title)
  • XOR encryption style used in games such as Arknights and Call of Duty: Mobile
  • Striped XOR encryption style used in games such as Garena Free Fire, League of Legends: Wild Rift and Legends of Runeterra
  • String encryption style used in games such as League of Legends: Wild Rift
  • Reordering of registration metadata used in titles by Riot Games
  • Encryption/obfuscation used in titles by miHoYo (Honkai Impact 3rd and Genshin Impact) (requires miHoYo plugin)
  • For other supported obfuscated titles, see the list of loader plugins
  • Deobfuscated metadata and binary files can be saved back to disk

• Supports all major file formats and processor architectures

• Works on Windows, MacOS X and Linux. Integrated GUI for Windows users with drag & drop support

• Tested with every release of IL2CPP since Unity 5.3.0

Tutorials and Guides

You can read more about how IL2CPP works in my series IL2CPP Reverse Engineering:

How IL2CPP works

Part 1: Hello World and the IL2CPP Toolchain

Part 2: Structural Overview & Finding The Metadata

Il2CppInspector guides

Il2CppInspector Plugin Development Wiki

How to create, use and debug IL2CPP DLL injection projects

Working with code in IL2CPP DLL injection projects

Using Il2CppInspector's type model to extract protobuf-net definitions (Case Study: Fall Guys)

Reverse engineering walkthroughs

Finding loaders for obfuscated global-metadata.dat files - explains how to find the loader, deobfuscation and/or decryption code for global-metadata.dat in almost any IL2CPP application

Enable loading of League of Legends: Wild Rift - covers XOR decryption, XOR string decryption, API export ROT decryption, data obfuscation of binary metadata

Enable loading of Honkai Impact (3 parts) - covers finding functions in an image, data obfuscation of global-metadata.dat, IDA decompiler techniques, how to write a plugin

VMProtect control flow obfuscation in Honkai Impact - covers extrapolating the code path from a function with control flow flattening using x64dbg and the IDA decompiler

Reverse engineering Genshin Impact with PowerShell - covers writing a test harness to find a function in an obfuscated binary via brute-force attack / reverse fuzzing

Other features

File format and architecture support:

• Supports ELF (Android .so), PE (Windows .exe), Mach-O (Apple iOS/Mac), Universal Binary (Fat Mach-O) and FSELF (PlayStation 4 .prx/.sprx) file formats
• Also supports single and split APK (Android), AAB (Android App Bundle), XAPK, Zip and decrypted IPA (iOS) application package files as input
• Supports ELF files created from memory dumps
• Supports Linux process maps + corresponding .bin files - such as those produced by GameGuardian - without the need to manually extract the IL2CPP binary
• 32-bit and 64-bit support for all file formats
• Supports ARMv7, Thumb-2, ARMv8 (A64), x86 and x64 architectures regardless of file format
• Supports applications created with Unity 5.3.0 onwards (full IL2CPP version table below)

Nice to have:

• Support for assemblies, classes, methods, constructors, fields, properties, enumerations, events, interfaces, structs, pointers, references, attributes, nested types, generic types, generic methods, generic constraints, default field values and default method parameter values
• C# syntactic sugar for CTS value types, compiler-generated types, delegates, extension methods, operator overloading, indexers, user-defined conversion operators, explicit interface instantiations, finalizers, nullable types, unsafe contexts, fixed-size arrays, variable length argument lists, method hiding and escaped strings
• Partition C# code output by namespace, assembly, class, full tree or single file; sort by index or type name; output flat or nested folder hierarchy. Each file includes the necessary using directives. Scope and type name conflicts are resolved automatically to produce code that compiles.
• API function export processing for PE, ELF, Mach-O and SELF (PRX) binaries
• Symbol table processing and name demangling for ELF and Mach-O binaries
• Relocation processing for ELF binaries
• Automatically defeats certain basic obfuscation methods
• Test chassis for automated integration testing of IL2CPP binaries

Class library targets .NET Core 3.1. Built with Visual Studio 2019.

NOTE: Il2CppInspector is not a decompiler. It can provide you with the structure of an application and function addresses for every method so that you can easily jump straight to methods of interest in your disassembler. It does not attempt to recover the entire source code of the application.

Build instructions

git clone --recursive https://github.com/djkaty/Il2CppInspector
cd Il2CppInspector

Windows

Build the CLI and Windows GUI versions:

dotnet publish -c Release

Get all current plugins (optional):

powershell -f get-plugins.ps1

Mac OS X

Build the CLI version:

cd Il2CppInspector.CLI
dotnet publish -r osx-x64 -c Release

Get all current plugins (optional):

../get-plugins.sh

Linux

Build the CLI version:

cd Il2CppInspector.CLI
dotnet publish -r linux-x64 -c Release

Get all current plugins (optional):

../get-plugins.sh

For other operating systems supporting .NET Core, add -r xxx to the final command where xxx is a RID from https://docs.microsoft.com/en-us/dotnet/articles/core/rid-catalog

The output binary for command-line usage is placed in Il2CppInspector/Il2CppInspector.CLI/bin/Release/netcoreapp3.0/[win|osx|linux]-x64/publish/Il2CppInspector.exe.

The output binary for Windows GUI is placed in Il2CppInspector/Il2CppInspector.GUI/bin/Release/netcoreapp3.1/[win|osx|linux]-x64/publish/Il2CppInspector.exe.

The plugins folder should be placed in the same folder as Il2CppInspector.exe.

Command-line Usage

Run Il2CppInspector.exe at the command prompt.

File format and architecture are automatically detected.

All outputs are generated by default. To generate only specific outputs, use the --select-outputs switch in combination with the output selection switches.

…

File format considerations

Apple Universal Binaries and APKs/XAPKs with binaries for multiple architectures: when using the CLI, multiple output files will be generated, with each filename besides the first suffixed by the index of the image in the binary. Unsupport