Taylor Meyer

here is additional finding's

here is full code set up

Hi Thanks again for the info earlier. I spent basically the whole day trying to implement the Mario Kart Tour support based on what you posted. **Quick update:** - I added the 128-byte name XOR key logic + the CodeGen Modules table handling. - I also have the manual CR/MR fields working in the GUI. - Unfortunately it’s still not working. The dumper either fails at auto-detection or the name decryption / CodeGen module part doesn’t apply correctly. I didn’t delete the project this time, so everything is still there. Would you be able to help me with one of these? 1. A good **placeholder prompt** I can feed it to my AI (Grok Build / KiloCode) so it can properly implement the MKT name decryption and CodeGen table logic? 2. Or some key things I should check / verify in the code to see where it’s going wrong? Here’s the current information I tried on, also if there is somehow I could copy - **Unity Version**: 2022.3.68f1 - **Metadata Version**: 31 - **Il2CppCodeRegistration**: `0x6E6C478` - **Il2CppMetadataRegistration**: `0x5B96820` - **Main Metadata XOR Key**: `0x20015111` - **Name XOR Key Location**: `0x706CF50` (128 bytes) - **Key Prefix**: `[0x2C, 0xC5, 0xD5, 0x9F, 0xCC, 0xCE, 0x8C, 0xFE]` - **CodeGen Modules Table**: `0x7B01720`

interesting would like to know what the issue is so I can learn from this? like is it one of the _IL2cpp functions? Edit: or maybe a bug with the XOR Decryption?

thank you Batch I will check when I have a chance then let you know appreciate it 🙏

@Batch Hi everyone don't mean to be a bug I'm working on dumping Mario Kart Tour (iOS, Unity 2022.3.68f1) using a custom Il2CppDumper and I'm stuck on the correct `Il2CppCodeRegistration` and `Il2CppMetadataRegistration` pointers. I think the pointers are correct but whatever I do, it just refuses to dump the Global-Metadata.dat. It might be something with the XOR key? I obtained the Global-Metadata.dat at runtime using iGameGod. Because they embedded the metadata in the iOS binary. I'm also trying to get better at this and learn. (I do not have a jailbroken device) I've done extensive static analysis already: ### Key Findings - **Metadata Loader**: `sub_2478B14` (0x2478B14) — simple per-dword XOR decryptor. - Key: `dword_7AE6128` = `0x20015111` <--- the key might be wrong but not sure - Encrypted table: `dword_5F0FD1C` - Called from `sub_518AEF0` (main init function at 0x518AEF0) - **Registration Setup**: - `sub_518AEF0` loads decrypted metadata into `qword_7C8CBA0` / `qword_7C8CBA8` - Populates `qword_7C8CB98` (CodeRegistration) and `qword_7C8CBC0` (MetadataRegistration) - Pointer chain: `unk_5B96820` → `off_70E1050` → `unk_7A1D788` - **Critical Static Pointers** (from detailed xref tracing): ```c #define IL2CPP_OVERRIDE_CODE_REG 0x6E6C478 // 0x6E6C478 #define IL2CPP_OVERRIDE_META_REG 0x5B96820 // 0x5B96820 ``` These come from the stub `sub_24F51D8` which does: ```arm ADRL X0, unk_6E6C478 ADRL X1, unk_5B96820 ADRL X2, unk_54F5004 B sub_51382B4 ``` I tried 2 different dumpers and none worked, then resorted to running and debugging this one in VS Code via Kilo Code with the Rust Analyzer Via my SuperGrok Oauth Subscription: https://github.com/rodroidmods/il2cpp-dumper-rs Note: I did end up deleting the modified il2cpp-dumper-rs cloned project because I just could not get it to work additionally, I checked the iL2cpp classes and methods in the Binary and they seemed correct to me or I could have missed something. and the other thing is I noticed is as soon as I added the XOR key decryption function in the VS Code it seemed like it wanted to work but was still getting hung up on something. This is purely for educational / research purposes. Thanks in advance for any help or tips on what to try!

I missed it 😞 can you PM it?

ok yes I am aware of the cheats already 😎 what were the gaps in the research?

Hi Batch Hope you have a great day

@Rook 😁

This is a analysis on the Eternium Games engine Called Marmalade SDK Note: I could not get the Asset key for the game it appears, it has to be done at runtime to decrypt the assets –I do not have a Jail-broken device sadly **Binary:** MageAndMinions (com.makingfun.mageandminions) App Store URL: https://apps.apple.com/us/app/eternium/id579931356 **Version:** 1.46.19.11 and later **Architecture:** ARM64e (64-bit) **Status:** Fully decrypted Mach-O binary, auto-analyzed in IDA Pro and used different local Uncensored LLM's this is 99.9 % verified there is a chance I may have got something wrong but I did 3 passes Here are my findings and there is also a verification report ## Executive Summary [Hidden Content]

yes will do

Update: successfully decrypted the Main.LUAC for Orb Master fully decrypted the first file holy s*** \\\\\\ only tested on one file but a little more information I'm giving it uses a Custom AXXTEA algorithm------non-padded or unpadded however you want to say it

Not yet still working on miscellaneous stuff with Post decryption and compression/decompression but should be able to get it just do not know when, but making slow progress.

UPDATE: found the Key for ORB Master was not that hard but like medium (not releasing it) because they will definitely fix it and make it really hard But I am actually working on post Decryption/ investigating and decrypting all the assets. And post stuff there also seems to be compression but still investigating that. https://apps.apple.com/us/app/orb-master/id1518970399 Also, credit to an AI Model really learned alot @VaaR it is the master Decryption key so be able to hopefully gain access to main assets (.LUAC/.LUA) as they are also encrypted Via XXTEA @Laxus

ehhhhhh not alot but mainly to leak IDA PRO cracked versions 😝 to help out the community

ty

nice

Instructions: run setup .exe for what one you choose Profit 😁 [Hidden Content]

nice 👍