Help/Support How to dump global-metadata.dat with Il2CppDumper v6.4.12 and inject in IDA pro 7.2.181105

[kzacxd 25 iPhone 6s 11.4]

so i really confused when i dump my binary with Il2CppDumper v6.4.12 the script that shows is script.json but in the ytb tutorial it show script.py (older version)

And i try put the script.json to IDA on File>Script File it wont work. Please help me @Laxus @Rook 

Is there anyway to put the dump script.json into IDA instead script.py. Or i missed somthing.

 

 

[Zahir 386.1k iPad Mini 4 13.6]

Hi @kzacxd,

You need to put ida.py then only script.json

Updated September 1, 2020 by Zahir

[kzacxd 25 iPhone 6s 11.4]

38 minutes ago, Zahir said:

Hi @kzacxd,

You need to put ida.py then only script.json

how i do that?

sorry im really nub with this thing but kinda cool to learn.

[Zahir 386.1k iPad Mini 4 13.6]

It's same process as you do, make sure you're using latest version of Il2CppDumper,

File>Script File then find ida.py inside the dumped folder, then it will ask you to select your script.json file.

So, instead of selecting just one file, you select two, one after another.

[kzacxd 25 iPhone 6s 11.4]

2 hours ago, Zahir said:

It's same process as you do, make sure you're using latest version of Il2CppDumper,

File>Script File then find ida.py inside the dumped folder, then it will ask you to select your script.json file.

So, instead of selecting just one file, you select two, one after another.

Oh, yea its work thank you. But nothing change on my string its still full of bunch of unityengine and stuff, is it normal?

[Zahir 386.1k iPad Mini 4 13.6]

3 minutes ago, kzacxd said:

Oh, yea its work thank you. But nothing change on my string its still full of bunch of unityengine and stuff, is it normal?

That depends if the dump worked or the dump has useful stuff

[kzacxd 25 iPhone 6s 11.4]

1 hour ago, Zahir said:

That depends if the dump worked or the dump has useful stuff

So i put the wrong global-metadata, or the dump is failed, or the the dump has less of usefull stuff. Is that what its mean?

[Hussen S 17 iPhone 7 14.6]

First I think you should load the binary file on the ida from file>>open (choose all file) to see it (unity framework) it’s your binary 

2-now you will see small window on (processor type) you have to choose (ARM Little-endan [ARM] if you don’t choose that you will not be able to see the functions or strings as you want (don’t change anything else )

now if you don’t have this option in processor type you have to change ida version and search in GitHub -another tip you should install (python) compatible with the ida version 

3- after you load the binary let it load and take time then you open the ida.py then choose script.json 

that how I open it then you will see what you want and if you don’t know how to hack the strings you should read the tutorials on the site and see more on YouTube lol

Updated March 22, 2022 by Hussen S