How to use Auto-Il2CppDumper to dump protected Il2Cpp games (NO magisk-zygisk)

Il2CppDumper without Magisk/Zygisk, dump il2cpp data at runtime, can bypass protection, encryption and obfuscation.

This project is based on BrianGIG Auto-Il2cppDumper which I continue to maintain it

Big thanks to @BryanGIG

**This may not work with some games with higher protections. Some games can detect tampered lib file, detect tampered APK file, and detect hooking. It is always a matter of time the game developer will improve the protection without notice!

How to use:**
Download pre-compiled libs HERE and follow steps below

Note: Non-root methods involves modifying APK file, you may need to bypass APK integrity or signature check if it’s present. I won’t get into the details of bypassing anything because it is simply out of the scope

Method 1: Fake lib
This is a trick to load our own libunity.so or libmain.so and load game’s renamed original lib librealunity.so or librealmain.so. Can’t decide which lib? Try libmain.so first as it sometimes work better than libunity.so or vice versa

Root

• Make sure you know the architecture of the game and your device before proceed
• Use any file manager app that can access root. Go to /data/data/(package name)/lib or /data/app/(obfuscated name)/(package name-obfuscated name)/lib
• Rename original libunity.so to librealunity.so or original libmain.so to librealmain.so
• Put our lib file libunity.so or libmain.so to the lib folder
• 

Non-root
Some games may have APK integrity and signature check. You may need to bypass it before adding Il2CppDumper

• Open APK file as ZIP using Winrar. 7zip or other zip utilities

• Rename game’s libunity.so to librealunity.so or libmain.so to librealmain.so

• Put our fake lib file libunity.so or libmain.so to the lib folder

• 

• Zipalign and sign the APK file

• Install the APK

Method 2: Lib call
If renaming lib doesn’t work, try this method. Some games may have APK integrity and signature check. You may need to bypass it before adding Il2CppDumper

• Decompile the game using Apktool
• Copy libil2cppdumper.so into the lib folder. Make sure only copy same ABIs as the target app, for example if target app has only armeabi-v7a, then you should only copy armeabi-v7a
• Search the main activity in AndroidManifest.xml. Example: com.gameloft.android.XamarinMainActivity

XML:

<activity android:configChanges="density|fontScale|keyboard|keyboardHidden|layoutDirection|locale|mcc|mnc|navigation|orientation|screenLayout|screenSize|smallestScreenSize|touchscreen|uiMode" android:label="@string/icon_label" android:launchMode="singleTop" android:multiprocess="false" android:name="com.gameloft.android.XamarinMainActivity" android:resizeableActivity="false" android:screenOrientation="sensorLandscape" android:theme="@style/Theme.acp.notitlebar.fullscreen">
    <intent-filter>
        <action android:name="android.intent.action.MAIN"/>
        <category android:name="android.intent.category.LAUNCHER"/>
    </intent-filter>
</activity>

• Locate the said main activity in the smali folder, can be \smali_classes(number)\com\gameloft\android\XamarinMainActivity.smali if multidex). You must look through all smali classes until you found it

• Insert this lib call into onCreate function below .locals XX

  Code:

  const-string v0, "il2cppdumper"
  
  invoke-static {v0}, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V
  

  Like

  Code:

  .method protected onCreate(Landroid/os/Bundle;)V
  
  .locals 2
  
  const-string v0, "il2cppdumper"
  
  invoke-static {v0}, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V
  
  whatever code below
  

• Re-compile, zipalign, sign the APK

• Install the APK

Dumping

• Run the game

• Wait a few seconds. Let the game load into main screen

• Once the dump is complete, it will save the dump.cs in /storage/emulated/0/Android/data/(Package name)/

  

• If there is no dump.cs, check logcat using Matlog or Android Studio. Game should crash or freeze if dump fails

Deobfuscate il2cpp?
Names can’t be deobfuscated. Once they are obfuscated/renamed, it can’t be reverted back to original, the game doesn’t even kept any original names which makes obfuscation very useful. Instead, try to find older version without obfuscation, or debug the game using GG, frida, gdb, lldb or others. If you can’t do any of these, maybe guess the functions and try one by one? :P

Bypassing protection?
Bypassing is not my thing, but if you know, feel free to make a pull request.

Credits

• Perfare Zygisk-Il2CppDumper
• BrianGIG Auto-Il2cppDumper