Il2CppDumper tutorial finding CodeRegistration and MetadataRegistratio…
Il2CppDumper Tutorial
Due the lack of information about how find CodeRegistration and MetadataRegistration, i'm doing this tutorial for those how didn't figure out yet how to do that, if you know how to or is Ida pro, this isn't for you.
I will use rust for this tutorial, but this may work for other unity games.
Requeriments:
1.IDA pro
2.SigMaker plugin for IDA: SigMaker
3.Unity (same version of your game, in this case 2019.2.0f1)
4.Il2CppDumper:Il2CppDumper
Steps:
1. Check the unity version of your game
2. Compile empty unity project using il2cpp method to get its .pdb
3. Open GameAssembly.dll of compiled game in IDA
4. Find il2cpp_codegen_register() function and made a Signature of it, and check in dumper.
5. Open rust GameAssembly.dll and wait IDA process it (until get idle,in left down corner)
6. Use signature from local compiled project to find CodeRegistration and MetadataRegistration.
Step 1:
Find "unity_builtin_extra" file from your game path and open as text.
https://imgur.com/a/17naBoH
This image has been resized. Click this bar to view the full image. The original image is sized 850x474. |
In this case unity version is: 2019.2.0f1
Step 2:
Open unity 2019.2.0f1, go to File>Build Settings>Player Settings>Other Settings>Configuration:
Scripting Backend: IL2CPP
Api Compatibility Level: .NET 4.x
C++ Compiler Configuration: Release
https://imgur.com/a/5cWfPTc
This image has been resized. Click this bar to view the full image. The original image is sized 958x679. |
Make sure pdb checkbox is checked:
https://imgur.com/IF3pc0p
This image has been resized. Click this bar to view the full image. The original image is sized 630x611. |
Step 3:
Compiled GameAssembly.dll should come with .pdb file this will allow us to find il2cpp_codegen_register() function in ida.
Step 4:
In ida press (Alt+t) and look for: Il2CppCodegenRegistration()
You will find something like this>
https://imgur.com/5NstHdA
This image has been resized. Click this bar to view the full image. The original image is sized 1159x300. |
Click on Il2CppCodegenRegistration() and press (Ctrl+Alt+S) to make a signature for this function:
- adding references
- sig: 4C 8D 05 ? ? ? ? 48 8D 15 ? ? ? ? 48 8D 0D ? ? ? ? E9 ? ? ? ?
Press (f5) on "Il2CppCodegenRegistration()" name, it will show you pointers of CodeRegistration and MetadataRegistration, first and second parameter of function>
https://imgur.com/cy3BTdM
This image has been resized. Click this bar to view the full image. The original image is sized 742x148. |
Double click on them to show the address that u need for il2cppdumper.
https://imgur.com/7Md3m7T
This image has been resized. Click this bar to view the full image. The original image is sized 925x64. |
Now make sure its all fine, use il2cppDumper option 1 with 2 values founded, if failed, use 3(auto), it will show you the right values, back to ida and try again.
This image has been resized. Click this bar to view the full image. The original image is sized 979x512. |
Step 5:
Wait ida process rust GameAssembly.dll this could that some time (hours):
This image has been resized. Click this bar to view the full image. The original image is sized 1274x964. |
Step 6:
Press (Ctrl+Alt+S) go to find ida signature option and use this signature gotten from local GameAssembly.dll:
- adding references
- sig: 4C 8D 05 ? ? ? ? 48 8D 15 ? ? ? ? 48 8D 0D ? ? ? ? E9 ? ? ? ?
Get CodeRegistration and MetadataRegistration address and use it in il2cppDumper!!!
Finally:
1. Run IL2CPPDumper application, and navigate to where your game install is and select GameAssembly.dll
2. For the metadata location, navigate to RustClient_Data\il2cpp_data\Metadata, and select the file there
3. After this, enter the unity version (2019.2.0f1), and press 1
4. Insert both values (CodeRegistration and MetadataRegistration) found with method above.