Taylor Meyer

thank you Batch I will check when I have a chance then let you know appreciate it 🙏

@Batch Hi everyone don't mean to be a bug I'm working on dumping Mario Kart Tour (iOS, Unity 2022.3.68f1) using a custom Il2CppDumper and I'm stuck on the correct `Il2CppCodeRegistration` and `Il2CppMetadataRegistration` pointers. I think the pointers are correct but whatever I do, it just refuses to dump the Global-Metadata.dat. It might be something with the XOR key? I obtained the Global-Metadata.dat at runtime using iGameGod. Because they embedded the metadata in the iOS binary. I'm also trying to get better at this and learn. (I do not have a jailbroken device) I've done extensive static analysis already: ### Key Findings - **Metadata Loader**: `sub_2478B14` (0x2478B14) — simple per-dword XOR decryptor. - Key: `dword_7AE6128` = `0x20015111` <--- the key might be wrong but not sure - Encrypted table: `dword_5F0FD1C` - Called from `sub_518AEF0` (main init function at 0x518AEF0) - **Registration Setup**: - `sub_518AEF0` loads decrypted metadata into `qword_7C8CBA0` / `qword_7C8CBA8` - Populates `qword_7C8CB98` (CodeRegistration) and `qword_7C8CBC0` (MetadataRegistration) - Pointer chain: `unk_5B96820` → `off_70E1050` → `unk_7A1D788` - **Critical Static Pointers** (from detailed xref tracing): ```c #define IL2CPP_OVERRIDE_CODE_REG 0x6E6C478 // 0x6E6C478 #define IL2CPP_OVERRIDE_META_REG 0x5B96820 // 0x5B96820 ``` These come from the stub `sub_24F51D8` which does: ```arm ADRL X0, unk_6E6C478 ADRL X1, unk_5B96820 ADRL X2, unk_54F5004 B sub_51382B4 ``` I tried 2 different dumpers and none worked, then resorted to running and debugging this one in VS Code via Kilo Code with the Rust Analyzer Via my SuperGrok Oauth Subscription: https://github.com/rodroidmods/il2cpp-dumper-rs Note: I did end up deleting the modified il2cpp-dumper-rs cloned project because I just could not get it to work additionally, I checked the iL2cpp classes and methods in the Binary and they seemed correct to me or I could have missed something. and the other thing is I noticed is as soon as I added the XOR key decryption function in the VS Code it seemed like it wanted to work but was still getting hung up on something. This is purely for educational / research purposes. Thanks in advance for any help or tips on what to try!

yes appears the Global-metadata.dat is obfuscated (yes I know about IGG) I will find offsets and send them over to you for a cheat package 🙏 when I get the chance

I will check it out FYI I might just release offsets for the community because as I do not have a jailbroken device 😞

I missed it 😞 can you PM it?

ok yes I am aware of the cheats already 😎 what were the gaps in the research?

Hi Batch Hope you have a great day

@Rook 😁

This is a analysis on the Eternium Games engine Called Marmalade SDK Note: I could not get the Asset key for the game it appears, it has to be done at runtime to decrypt the assets –I do not have a Jail-broken device sadly **Binary:** MageAndMinions (com.makingfun.mageandminions) App Store URL: https://apps.apple.com/us/app/eternium/id579931356 **Version:** 1.46.19.11 and later **Architecture:** ARM64e (64-bit) **Status:** Fully decrypted Mach-O binary, auto-analyzed in IDA Pro and used different local Uncensored LLM's this is 99.9 % verified there is a chance I may have got something wrong but I did 3 passes Here are my findings and there is also a verification report ## Executive Summary [Hidden Content]

yes will do

Update: successfully decrypted the Main.LUAC for Orb Master fully decrypted the first file holy s*** \\\\\\ only tested on one file but a little more information I'm giving it uses a Custom AXXTEA algorithm------non-padded or unpadded however you want to say it

Not yet still working on miscellaneous stuff with Post decryption and compression/decompression but should be able to get it just do not know when, but making slow progress.

UPDATE: found the Key for ORB Master was not that hard but like medium (not releasing it) because they will definitely fix it and make it really hard But I am actually working on post Decryption/ investigating and decrypting all the assets. And post stuff there also seems to be compression but still investigating that. https://apps.apple.com/us/app/orb-master/id1518970399 Also, credit to an AI Model really learned alot @VaaR it is the master Decryption key so be able to hopefully gain access to main assets (.LUAC/.LUA) as they are also encrypted Via XXTEA @Laxus

Good development on this not revealing much because I am still searching and trying to figure this out

ehhhhhh not alot but mainly to leak IDA PRO cracked versions 😝 to help out the community

ty

nice

Instructions: run setup .exe for what one you choose Profit 😁 [Hidden Content]

nice 👍