Jump to content

How to dump Il2Cpp-based Unity Games to find functions + offsets to hack (iOS)


ThePianoGuy

28 posts in this topic

Recommended Posts

yPzDzQO.png

As requested, here is the tutorial how to dump il2cpp of iOS Unity games. With Il2CppDumper, it will be much easier to find useful functions and offsets to hack. No need to waste your time debugging the game.

Requirements:

- ARM/ASM knowledge

- IDA hacking experience

- IDA Pro. Download link

- Notepad++. Download link

- Il2CppDumper (Windows). Download link

- Clutch or Rasticrac for jailbroken devices or visit appvn.com to download latest cracked free games

- Winrar or 7-zip to open .ipa file

 

Instructions:

Download Il2CppDumper released version by Perfare and extract the program

 

To open .ipa file, simply rename file extension to .zip and open it

If you are using 7-zip, right click -> 7-zip -> Open Archive to open .ipa file directly

ySZdlPx.png

 

Navigate to \Payload\<app or game name>.app\ and extract the big binary file that doesn't have file extension

Navigate to \Payload\iosfps.app\Data\Managed\Metadata\ and extract global-metadata.dat

 

32-bit:

Press 1 for 32-bit and press 2 for auto. Please use Auto mode to get the program to find offsets and dump code for you because looking for 2 required pointers (CodeRegistration and MetadataRegistration) in IDA Pro to dump is too complicated and Unity already stripped all names of functions which means it will be harder to find,

As you used auto mode, the program will tell the pointers, but you do not need to know it if you have no idea what it is.

 

Skip 64-bit steps if you are working with 32-bit

 

64-bit:

Auto mode does not work on 64-bit binary yet. Here is dev's response

"I have to say, these same questions will make me feel that adding auto feature is a bad decision

We have to find 2 required offsets (CodeRegistration and MetadataRegistration) in IDA to dump. Open IDA Pro 64-bit (idaq64.exe), and disassemble the binary in 64-bit. Search function name InitFunc_1.

Above InitFunc_1, there is sub function that contains 2 pointers we need.

sub_100C46D8C                           ; DATA XREF: InitFunc_1+8o

                 ADRP            X0, #unk_101D48FE8@PAGE

                 ADD             X0, X0, #unk_101D48FE8@PAGEOFF

                 ADRP            X1, #dword_101D948C8@PAGE

sSkslSi.png

In Il2CppDumper, Press 2 for 64-bit and Press 1 for manual. Input your pointers:

Input CodeRegistration(X0): your first pointer

Input MetadataRegistration(X1): your second pointer

 

The dump.cs file should be created at the location where Il2CppDumper.exe is located

 

Open dump.cs with Notepad++ by right click and select Edit with Notepad++

Inside dump.cs, you'll see C# codes. Method bodies are not dumped but it's a very simple code that tells you function names and offsets to mod.

 

 

launch Il2CppDumper.exe. It will open the dialog twice to select file. For ELF file or Mach-O file, select the binary file. For global-metadata.dat, select global-metadata.dat

 

It will ask you to select platform, 32-bit or 64-bit. Press 1 for 32-bit or press 2 for 64-bit. Now for Mode, Press 1 for manual and press 2 for auto. Please use Auto mode to get the program to find offsets and dump code for you because looking for 2 required offsets (CodeRegistration and MetadataRegistration) in IDA Pro to dump is too complicated and Unity already stripped all names of functions which means it will be harder to find, and I haven't find out where to find 2 offsets in 64-bit binary yet. As you used auto mode, the program will tell the offsets, but you do not need to know it if you have no idea what it is.

 

The dump.cs file should be created at the location where Il2CppDumper.exe is located

 

Open dump.cs with Notepad++ by right click and select Edit with Notepad++

Inside dump.cs, you'll see C# codes. Method bodies are not dumped but it's a very simple code that tells you function names and offsets to mod.

 

To search, click Search -> Find...

To find all keyword, click on Find All in Current Document

 lnwqXUy.png

If you never seen C# code before, I'll explain a bit what the codes mean. I'm bad at explaining what these code means but I hope it goes well

This comment you see on top is just a list .dll files that are been converted into il2cpp

// Image 0: mscorlib.dll - 0

// Image 1: System.Security.dll - xxxx

// Image xx: Assembly-CSharp.dll - xxxx

The Assembly-CSharp.dll (Android users know this) is a game logic thing and it is what we looking for. The full code of "Assembly-CSharp.dll" thingy is always located somewhere at the bottom of the dumped file

 

This class body is like a group to make programmers easier to find codes. For example PlayerAntiHack class contains anti-hack code related.

// Namespace:

public class PlayerScript : MonoBehaviour // TypeDefIndex: 4303

{

}

 

In IDA you'll probarly see function names like

Player::Get_Gold…

Player::Get_Cash…

Player::Isbanned…

….

 

I'll bring this better details for you:

A class is a construct that enables you to create your own custom types by grouping together variables of other types, methods and events. A class is like a blueprint. It defines the data and behavior of a type. ... Unlike structs, classes support inheritance, a fundamental characteristic of object-oriented programming.

 

In the class, you'll see something like this:

// Fields

private int primaryWeaponIndex; // 0x10

private float minSpread; // 0x820

private float spread; // 0x824

private float visualSpread; // 0x828

….

 

Fields is not what we looking for so let's look into Methods.

 

// Methods

private int findNextAvailableWeapon(int currentWeaponIndex); // 1e704c

private bool IsLookingAtPlayer(PlayerScript player); // 1f3894

public bool HasBeenVisible(); // 1f2fa0

….

public int get_Gold_Example(); // 1a2b3c

public float float_example(); // 1a2b3d

….

 

This is what we looking for. These simple codes explains the name of the methods/functions, what type and the REAL IDA OFFSETS are written in the green commenented text.

 

public, private, protected etc, are access modifier. It's not important to know

static is a static modified to declare a static member. It's not important to know

int, float, double, boolean etc are data type.

 

If you look up the offset in IDA, you will see a sub_xxxxxx

vePK7YP.png

 

Write down all useful functions + offsets you found inside the dumped .cs file and start writing your code injection.

 

Note: It is suggested that you disassemble the binary file and look up the offsets to see if there are enough spaces to replace the instructions to hack.

 

That's all. Good luck hacking iOS games!

Credits:

AndnixSH#

Perfare (Il2CppDumper https://github.com/Perfare/Il2CppDumper)

 

If you have any issues with Il2CppDumper, please report the issue at: https://github.com/Perfare/Il2CppDumper/issues/

Updated by AndnixSH
  • Like 10
  • Winner 2
  • Thanks 1
  • Informative 2
Link to comment
Share on other sites

First of all, thank you very very much for this tutorial.
I was wondering if you have an example Tweak.xm for a game with how to hook the class functions.

I have found the following info for the game I am trying to 'hack'

// Namespace: IAS.Proto
public class ItemDefinition : IExtensible // TypeDefIndex: 3153
{

	// Methods
	public void .ctor(); // 100dbd3f8
	public int get_water(); // 100dbd5c0
	public void set_water(int value); // 100dbd5c8
	public int get_premium(); // 100dbd600
	public void set_premium(int value); // 100dbd608
}

In IDA I have the following code on offset 100dbd5c0:
__text:0000000100DBD5C0 sub_100DBD5C0                           ; CODE XREF: sub_1002E1114+378↑p
__text:0000000100DBD5C0                                         ; sub_100DD1FF8+A88↓p
__text:0000000100DBD5C0                                         ; DATA XREF: ...
__text:0000000100DBD5C0                 LDR             W0, [X0,#0x70]
__text:0000000100DBD5C4                 RET
__text:0000000100DBD5C4 ; End of function sub_100DBD5C0

Which translates to the following pseudocode:
__int64 __fastcall sub_100DBD5C0(__int64 a1)
{
  return *(unsigned int *)(a1 + 112);
}

What I want is to display the current value (so I know I am in the right place) and then hook the set_ functions to set a new value.

I am hoping you can help me.
If you need more info please let me know.

 

[edit]

In my search of more tools I stumbled across something interesting.

https://github.com/nevermoe/unity_metadata_loader

This little tool lets you add the strings from the global*.dat file directly into IDA which makes searching easiere :)

Updated by QuasaR
Link to comment
Share on other sites

19 hours ago, QuasaR said:

First of all, thank you very very much for this tutorial.
I was wondering if you have an example Tweak.xm for a game with how to hook the class functions.

I have found the following info for the game I am trying to 'hack'

What I want is to display the current value (so I know I am in the right place) and then hook the set_ functions to set a new value.

I am hoping you can help me.
If you need more info please let me know

[edit]

In my search of more tools I stumbled across something interesting.

https://github.com/nevermoe/unity_metadata_loader

This little tool lets you add the strings from the global*.dat file directly into IDA which makes searching easiere :)

If there is no class names in ida, you can't hook the class function. do code injection instead. 

There are lot of tutorials in iosgods. Just search and search

Nevermoe's loader is unstable

Updated by evildog1
Link to comment
Share on other sites

Ok, but code injection mostly assumes it's a mov /add instruction and about R registers, not W or X and not an STR instructionlike in the following example (set_water):

__text:0000000100DBD5C0                 LDR             W0, [X0,#0x70]
__text:0000000100DBD5C4                 RET
__text:0000000100DBD5C4 ; End of function ItemDefinition$$get_water
__text:0000000100DBD5C4
__text:0000000100DBD5C8
__text:0000000100DBD5C8 ; =============== S U B R O U T I N E =======================================
__text:0000000100DBD5C8
__text:0000000100DBD5C8
__text:0000000100DBD5C8 ItemDefinition$$set_water               ; CODE XREF: ProtoSerializer$$Read_85953+C5C↓p
__text:0000000100DBD5C8                                         ; DATA XREF: __const:00000001022EB878↓o
__text:0000000100DBD5C8                 STR             W1, [X0,#0x70]
__text:0000000100DBD5CC                 RET
__text:0000000100DBD5CC ; End of function ItemDefinition$$set_water
__text:0000000100DBD5CC

 

The set_water is called from the following code:

__text:0000000100DDF618 loc_100DDF618                           ; CODE XREF: ProtoSerializer$$Read_85953+698↑j
__text:0000000100DDF618                 MOV             X0, X21
__text:0000000100DDF61C                 MOV             X2, #0
__text:0000000100DDF620                 BL              ItemDefinition$$set_water
__text:0000000100DDF624                 B               loc_100DDFB00
__text:0000000100DDF628 ; ---------------------------------------------------------------------------

 

Updated by QuasaR
Link to comment
Share on other sites

51 minutes ago, QuasaR said:

Ok, but code injection mostly assumes it's a mov /add instruction and about R registers, not W or X and not an STR instructionlike in the following example (set_water)

The set_water is called from the following code:

 

Sorry but I'm not familiar with code injection. Please create a new thread to ask question. Thank you

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Unfortunately, your content contains terms that we do not allow. Please edit your content to remove the highlighted words below. For more information, please read our Posting Guidelines.
Reply to this topic... Posting Guidelines

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Our picks

    • Jurassic World Alive v3.5.29 - [ Dino Don't Move & More ]
      Modded/Hacked App: Jurassic World Alive By Ludia
      Bundle ID: com.ludia.jw2
      iTunes Store Link: https://apps.apple.com/us/app/jurassic-world-alive/id1231085864

      Hack Features:
      - Dino Don't Move
      - Inf.Battery
      - VIP Enabled

      This hack works on the latest x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, SE, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.


      Jailbreak required hack(s): https://iosgods.com/topic/103431-jurassic-world-alive-v1829-dino-dont-move-more/?tab=comments#comment-3107135
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,527 replies
    • Jurassic World Alive v3.5.29 - [ Dino Don't Move & More ]
      Modded/Hacked App: Jurassic World Alive By Ludia
      Bundle ID: com.ludia.jw2
      iTunes Store Link: https://apps.apple.com/us/app/jurassic-world-alive/id1231085864


      Hack Features:
      - Dino Don't Move
      - Inf. Battery
      - VIP Enabled

      This hack is an In-Game Mod Menu (iGMM). In order to activate the Mod Menu, tap on the iOSGods button found inside the app. This hack works on the latest x64 or ARM64 iDevices: iPhone 5s, 6, 6 Plus, 6s, 6s Plus, 7, 7 Plus, 8, 8 Plus, X, Xr, Xs, Xs Max, SE, iPod Touch 6G, iPad Air, Air 2, Pro & iPad Mini 2, 3, 4 and later.
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 1,462 replies
    • Idle Cinema Empire: Idle Games v2.13.01 +3 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Idle Cinema Empire: Idle Games By 书涛 刘
      Bundle ID: com.idle.cinema.empire.sim.tycoon
      iTunes Store Link: https://apps.apple.com/us/app/idle-cinema-empire-idle-games/id1660507282?uo=4


      Hack Features:
      - Unlimited Cash -> Earn some.
      - Unlimited Gold Coins -> Earn some.
      - Unlimited Diamonds -> Earn some.


      Jailbreak required hack(s): [Mod Menu Hack] Idle Cinema Empire: Idle Games ( All Versions ) +3 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Haha
        • Thanks
        • Winner
        • Like
      • 42 replies
    • Idle Cinema Empire: Idle Games ( All Versions ) +3 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Idle Cinema Empire: Idle Games By 书涛 刘
      Bundle ID: com.idle.cinema.empire.sim.tycoon
      iTunes Store Link: https://apps.apple.com/us/app/idle-cinema-empire-idle-games/id1660507282?uo=4


      Hack Features:
      - Unlimited Cash -> Earn some.
      - Unlimited Gold Coins -> Earn some.
      - Unlimited Diamonds -> Earn some.


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Idle Cinema Empire: Idle Games v2.11.03 +3 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Thanks
        • Like
      • 12 replies
    • Dark Slayer : AFK RPG v1.1.4 +2 Cheats [ God Mode ]
      Modded/Hacked App: Dark Slayer : AFK RPG By Gamepub CO., LTD
      Bundle ID: com.gamepub.zhteam
      iTunes Store Link: https://apps.apple.com/us/app/dark-slayer-afk-rpg/id6446265751?uo=4


      Mod Requirements:
      - Jailbroken iPhone/iPad/iPod Touch.
      - iGameGod / Filza / iMazing or any other file managers for iOS.
      - Cydia Substrate, Substitute or libhooker depending on your jailbreak.
      - PreferenceLoader (from Cydia, Sileo or Zebra).


      Hack Features:
      - God Mode
      - Attack Speed Multiplier
        • Informative
        • Agree
        • Haha
        • Thanks
        • Winner
        • Like
      • 170 replies
    • Longleaf Valley: Merge & Plant v1.15.58 +1++ Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Longleaf Valley: Merge & Plant By TreesPlease Games Ltd
      Bundle ID: com.treespleasegames.merge1
      iTunes Store Link: https://apps.apple.com/us/app/longleaf-valley-merge-plant/id1573565989?uo=4


      Hack Features:
      - Unlimited Currencies -> Will increase instead of decrease.


      Jailbreak required hack(s): [Mod Menu Hack] Longleaf Valley: Merge & Plant ( All Versions ) +1++ Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Haha
        • Winner
        • Like
      • 15 replies
    • Longleaf Valley: Merge & Plant ( All Versions ) +1++ Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Longleaf Valley: Merge & Plant By TreesPlease Games Ltd
      Bundle ID: com.treespleasegames.merge1
      iTunes Store Link: https://apps.apple.com/us/app/longleaf-valley-merge-plant/id1573565989?uo=4


      Hack Features:
      - Unlimited Currencies -> Will increase instead of decrease.


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Longleaf Valley: Merge & Plant v1.10.48 +1++ Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Winner
        • Like
      • 3 replies
    • Idle Mushroom Hero : AFK RPG v1.02.067 +4 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Idle Mushroom Hero : AFK RPG By Ndolphin Connect
      Bundle ID: com.nextall.mushroomhero.apple
      iTunes Store Link: https://apps.apple.com/us/app/idle-mushroom-hero-afk-rpg/id6475755018?uo=4


      Hack Features:
      - God Mode
      - One-Hit Kill
      - Unlimited Gold -> Will increase instead of decrease.
      - Unlimited Diamonds -> Spend some.


      Jailbreak required hack(s): [Mod Menu Hack] Idle Mushroom Hero : AFK RPG v1.02.066 +5 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Winner
        • Like
      • 17 replies
    • Idle Mushroom Hero : AFK RPG v1.02.067 +5 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Idle Mushroom Hero : AFK RPG By Ndolphin Connect
      Bundle ID: com.nextall.mushroomhero.apple
      iTunes Store Link: https://apps.apple.com/us/app/idle-mushroom-hero-afk-rpg/id6475755018?uo=4


      Hack Features:
      - God Mode
      - One-Hit Kill
      - Unlimited Gold -> Will increase instead of decrease.
      - Unlimited Diamonds -> Spend some.
      - Auto Win


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Idle Mushroom Hero : AFK RPG v1.02.066 +4 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Haha
        • Thanks
        • Winner
        • Like
      • 38 replies
    • Good Pizza, Great Pizza v5.8.1 +2 Jailed Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Pizza, Great Pizza By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.pizzabusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-pizza-great-pizza/id911121200?uo=4


      Hack Features:
      - Unlimited Cash
      - Unlimited Diamonds


      Jailbreak required hack(s): [Mod Menu Hack] Good Pizza, Great Pizza v5.5.6 +2 Cheats [ Unlimited Currencies ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Thanks
        • Winner
        • Like
      • 24 replies
    • Good Pizza, Great Pizza v5.8.1 +2 Cheats [ Unlimited Currencies ]
      Modded/Hacked App: Good Pizza, Great Pizza By TAPBLAZE, LLC
      Bundle ID: com.tapblaze.pizzabusiness
      iTunes Store Link: https://apps.apple.com/us/app/good-pizza-great-pizza/id911121200?uo=4


      Hack Features:
      - Unlimited Cash
      - Unlimited Diamonds


      Non-Jailbroken & No Jailbreak required hack(s): [Non-Jailbroken Hack] Good Pizza, Great Pizza v5.5.6 +2 Jailed Cheats [ Unlimited Currencies ] - Free Non-Jailbroken IPA Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Informative
        • Agree
        • Haha
        • Winner
        • Like
      • 16 replies
    • Merge Lion v2.2.0 +8 Jailed Cheats [ Unlimited Everything ]
      Modded/Hacked App: Merge Lion By GOMBLE GAMES PTE. LTD.
      Bundle ID: com.gomble.ios.mergelion
      iTunes Store Link: https://apps.apple.com/us/app/merge-lion/id6472009816?uo=4


      Hack Features:
      - Unlimited Gold
      - Unlimited Lives
      - Unlimited Boosters
      - Unlimited In-Game Boosters
      - Unlimited Bingo Lions
      - Unlimited Energy
      - Unlimited Pushes
      - Unlimited Capsules


      Jailbreak required hack(s): [Mod Menu Hack] Merge Lion v2.1.9 +9 Cheats [ Unlimited Everything ] - Free Jailbroken Cydia Cheats - iOSGods
      Modded Android APK(s): https://iosgods.com/forum/68-android-section/
      For more fun, check out the Club(s): https://iosgods.com/clubs/
        • Agree
        • Thanks
        • Like
      • 7 replies
×
  • Create New...

Important Information

We would like to place cookies on your device to help make this website better. The website cannot give you the best user experience without cookies. You can accept or decline our cookies. You may also adjust your cookie settings. Privacy Policy - Guidelines