perfare/il2cppdumper

Il2CppDumper is a reverse engineering tool for Unity games. Unity is a game engine used to build games for mobile, PC, and consoles. When Unity compiles a game using a mode called il2cpp, it converts the game code into native machine instructions to make the game run faster. The downside is that it becomes much harder to read or analyze the original code structure. Il2CppDumper reads the compiled game files and recovers the class names, method names, field names, and type information that were lost during that conversion. The tool takes two input files from a Unity il2cpp game: the compiled binary (the executable or library file) and a file called global-metadata.dat which stores the game's type information. From these it produces a folder of stub DLL files that contain no actual runnable code but do contain all the class and method definitions in a form that standard .NET decompiler tools can browse. It also produces scripts for professional reverse engineering tools like IDA Pro, Ghidra, and Binary Ninja, which help analysts map the recovered function names back onto the compiled code. The tool supports a wide range of binary formats across different platforms, including Android, iOS, PC, and Nintendo Switch, and covers Unity versions from 5.3 through 2022.2. A separate companion project called Zygisk-Il2CppDumper handles cases where a game applies extra protections to its binary by extracting it live from device memory on a rooted Android phone. Il2CppDumper is primarily used by game modders, security researchers, and developers doing compatibility work. Using it to cheat in online games or violate a game's terms of service is a separate matter from the tool itself.