Il2CppInspector 2020.1
So djkaty
wanted me to post about it. Here you go =D
Il2CppInspector
2020.1 delivers dozens of improvements including several major new features:
- IDA functionality enhancements: Il2CppInspector now outputs
type declarations for all IL2CPP internal types and types used by the
application, including all generic instances, plus address mapping for
every type definition and method argument types. Boxed types are generated
as required. Memory-mapped vtables are generated for every type. Function
boundary mapping has also been improved.
- C++ scaffolding output module: You can now output C++
headers with type declarations for all IL2CPP internal types and types
used by the application, including all generic instances and inferred
usages from metadata, plus all vtables and applicable boxed types. You can
select which C++ compiler to target for the output (MSVC or GCC). Perfect
for use with x64dbg among others!
- Native APK and (decrypted) IPA
support: You
can now specify an APK or IPA file on the command-line or via the GUI -
Il2CppInspector will automatically unzip the package into memory and
locate the IL2CPP component files for analysis - no need to find the
binary and metadata files first!
- Generic types overhaul: This is a complete overhaul
to the management of .NET generic types, improving the completeness and
accuracy of all outputs (C#, IDA, C++). All closed generic types including
those not defined directly but referenced by types or methods in the
application are now accounted for. Nested and inherited open and closed
generic types are handled correctly. New APIs are available for
inspecting generic types.
- Battle-hardened: Il2CppInspector is now
compatible with all 205 releases of IL2CPP from Unity 5.3.0 to 2019.4.2+.
For IDA and C++ outputs, Il2CppInspector will attempt to auto-detect both
the Unity version and C++ compiler used to generate the IL2CPP application
and generate a complete set of type definitions for the corresponding
Unity version with the corresponding compiler-defined memory layout. You
can override these options if you wish. Il2CppInspector will also perform
automatic name conflict resolution to avoid the use of pre-defined symbols
and keywords in C++, and to handle re-definition of same-named symbols in
the application.
- Many new API calls for the
package (Il2CppInspector) and .NET type model (Il2CppModel) for automated
analysis of IL2CPP applications (see the source code for details; these
are primarily for the handling of generic types and C++ declarations; you
can now also use MethodBase.GetMethodBody() to retrieve the
executable machine code for any method)
- Many bug fixes for IL2CPP
processing
- Minor improvements to C#
prototypes output
- Minor improvements to ELF
handling and de-obfuscation
- Using the generate-binaries.ps1 script
now allows you to examine the generated C++, not just the final IL2CPP
binary
- Output paths now work correctly
for Linux and other POSIX filesystems
We're
already working on some exciting new features for the next version, and hope
you enjoy this update!
IDA C++
decompilation example:
C++
scaffolding example:
