search

Perfare / Il2CppDumper

Unity il2cpp reverse engineer
MIT License
6.67k stars 1.29k forks source link

How to analyze a Function in a Dumped DLL in Ghidra #768

Closed PastClear closed 5 months ago

PastClear commented 6 months ago

Hello Community,

i have an understanding problem with the following situation:

I need to analyze the source code of a Function in a dumped DLL from a IL2CPP Unity Android Game.

From my unterstanding Il2CPPDumper is only extracting the header of an function like what i see in DnSpy.

When i try to disassemble the DLL File in Ghidra its not showing any Code of the Function, its like the same in DnSpy.

So how im able to analyze the Code of an Function in an Dumped DLL?

Im quite confused because from my unterstanding the dumped DLL only has the Header of an Function and not the Code at all?

Is anyone out here to point me into the right direction?

masagrator commented 6 months ago

So how im able to analyze the Code of an Function in an Dumped DLL?

That's the neat part, you don't.

This tool doesn't dump functions. It dumps only signatures from global-metadata.dat, for example to be applied to executable in disassembler or AssetStudio.

PastClear commented 6 months ago

Thanks for the quick answer. its clarifying alot. So my main question is out of the scope in this repo right?

Any tips for this like dumping the memory at runtime? Thanks for helping me out otherwise can be closed.