efonte

Decompiling IL2CPP Games with Il2CppDumper and Ghidra

This guide will walk through how to decompile/reverse engineer IL2CPP games for modding usage.

Note: expect this entire process to take upwards of an hour. Have something ready to do on the side while waiting for processing to finish.

Prerequisites

Download Il2CppDumper

Unity IL2CPP Reverse Engineering

Unity games are fun.

Modding them is more fun.

Most unity games ship as "Mono". This means .NET IL code is right there for your viewing pleasure and makes for one of the easiest modding experience you can have (outside of official mod support).

Recently, many Unity games have been shipping with "IL2CPP" which optimizes out the "just in time" compilation with actual compilation. This process makes the game perform better for the player, but it also obfuscates game code meaning we have less information to work with when attempting to reverse engineer. This document describes the process of reverse engineering a Unity game built with IL2CPP despite the limitations. Keep in mind the best process for reverse engineering will change as Unity Engine evolves and the tools available change, and so this may become outdated.

Install VirtualBox guest additions onto Ubuntu server guests

Note

The following steps have been successfully tested with Ubuntu guests of:

24.04LTS
22.04LTS
18.04LTS
16.04LTS

`docker-machine` import/export

Script to import and export docker-machine configurations to sync between hosts/collaborators

Export (on host A)

$ docker-machine ls
NAME       ACTIVE   DRIVER         STATE     URL                            SWARM   DOCKER    ERRORS
dev        -        digitalocean   Running   tcp://example.com:2376                 v1.10.1

	using namespace System.Management.Automation
	using namespace System.Management.Automation.Language

	if ($host.Name -eq 'ConsoleHost')
	{
	Import-Module PSReadLine
	}
	#Import-Module PSColors
	#Import-Module posh-git
	Import-Module -Name Terminal-Icons

	// ==UserScript==
	// @name EmuParadise Download Workaround
	// @version 1.2.3
	// @description Replaces the download button link with a working one
	// @author infval (Eptun)
	// @match https://www.emuparadise.me///*
	// @grant none
	// ==/UserScript==

	// https://www.reddit.com/r/Piracy/comments/968sm6/a_script_for_easy_downloading_of_emuparadise_roms/

	###############################################
	# TX SX OS unpacker - by hexkyz and naehrwert #
	###############################################

	from Crypto.Cipher import AES
	from Crypto.Util import Counter
	import os
	import struct

	"""

	###############################
	# Action Replay #
	# Code Types supported by #
	# CTRPluginFramework #
	# v0.5.0 #
	###############################

	==============
	INFO
	==============

	@startuml
	' uncomment the line below if you're using computer with a retina display
	' skinparam dpi 300
	!define Table(name,desc) class name as "desc" << (T,#FFAAAA) >>
	' we use bold for primary key
	' green color for unique
	' and underscore for not_null
	!define primary_key(x) <b>x</b>
	!define unique(x) <color:green>x</color>
	!define not_null(x) <u>x</u>