Il2CppInspector helps you to reverse engineer IL2CPP applications, providing the most complete analysis currently available.
Main features
- Output IL2CPP type definitions, metadata and method pointers as C# stub code
- Create C++ scaffolding for all types, methods, function pointers and API functions in an IL2CPP application for use in x64dbg, Cydia Substrate etc.
- Create IDA and Ghidra Python scripts to populate symbol, function and type information; includes API hooks to implement scripts for other targets
- Create Visual Studio C++ DLL injection projects directly from IL2CPP files
- Create Visual Studio C# code stub solutions directly from IL2CPP files
- Create JSON metadata with a complete address map directly from IL2CPP Files.
- Create IL2CPP binaries from arbitrary C# source code without a Unity project
- Three major APIs for use in your own custom static analysis projects for querying low level binary metadata, the .NET type model and the whole C++ application. These are also available as a NuGet Package.
- Supports all major file formats and processor architectures
- Defeats certain types of basic obfuscation
- Works on Windows, MacOS X and Linux. Integrated GUI for Windows users with drag & drop support
- Tested with every release of IL2CPP since Unity 5.3.0
You can read more about IL2CPP in my series IL2CPP Reverse Engineering.
Using Il2CppInspector's type model to extract protobuf-net definitions (Case Study: Fall Guys)
Other features
File format and architecture support:
- Supports ELF (Android .so), PE (Windows .exe), Mach-O (Apple iOS/Mac), Universal Binary (Fat Mach-O) and FSELF (PlayStation 4 .prx/.sprx) file formats
- Also supports APK (Android) and decrypted IPA (iOS) application package files as input
- 32-bit and 64-bit support for all file formats
- Supports ARMv7, Thumb-2, ARMv8 (A64), x86 and x64 architectures regardless of file format
- Supports applications created with Unity 5.3.0 onwards (full IL2CPP version table below)
- Support for assemblies, classes, methods, constructors, fields, properties, enumerations, events, interfaces, structs, pointers, references, attributes, nested types, generic types, generic methods, generic constraints, default field values and default method parameter values
- C# syntactic sugar for CTS value types, compiler-generated types, delegates, extension methods, operator overloading, indexers, user-defined conversion operators, explicit interface instantiations, finalizers, nullable types, unsafe contexts, fixed-size arrays, variable length argument lists, method hiding and escaped strings
- Partition C# code output by namespace, assembly, class, full tree or single file; sort by index or type name; output flat or nested folder hierarchy. Each file includes the necessary using directives. Scope and type name conflicts are resolved automatically to produce code that compiles.
- API function export processing for PE, ELF, Mach-O and SELF (PRX) binaries
- Symbol table processing and name demangling for ELF and Mach-O binaries
- Relocation processing for ELF binaries
- Automatically defeats certain basic obfuscation methods
- Test chassis for automated integration testing of IL2CPP binaries
NOTE: Il2CppInspector is not a decompiler. It can provide you with the structure of an application and function addresses for every method so that you can easily jump straight to methods of interest in your disassembler. It does not attempt to recover the entire source code of the application.
Download link:
View Folder - SBUpload - The next-gen File Hosting
File folder on MEGA
Box
app.box.com
Attachments
Last edited:
