Auto-Il2cppDumper

Il2CppDumper without Magisk/Zygisk, dump il2cpp data at runtime, can bypass protection, encryption and obfuscation.

This project is based on BrianGIG Auto-Il2cppDumper which I continue to maintain it

Usage

This is full auto dumper, no need to put unity version anymore since it's based on Zygisk-Il2cppDumper.

You can download pre-compiled libs HERE and follow steps below

In config file jni/Includes/config.h:

Uncomment #define UseFakeLib to use it as root mode

#define Sleep X: Default is 2 seconds. Increase if getting issue with dumper, like if not fully dumped

How to use

Method 1: Fake lib

This is a trick to load our own libunity.so or libmain.so and load game's renamed original lib librealunity.so or librealmain.so. Can't decide which lib? Try libmain.so first as it sometimes work better than libunity.so or vice versa

Root

• Make sure you know the architecture of the game and your device before proceed
• Use any file manager app that can access root. Go to /data/data/(package name)/lib or /data/app/(obfuscated name)/(package name-obfuscated name)/lib
• Rename original libunity.so to librealunity.so or original libmain.so to librealmain.so
• Put our lib file libunity.so or libmain.so to the lib folder

Non-root

Some games may have APK integrity and signature check. You may need to bypass it before adding Il2CppDumper

• Open APK file as ZIP using Winrar. 7zip or other zip utilities
• Rename game's libunity.so to librealunity.so or libmain.so to librealmain.so
• Put our fake lib file libunity.so or libmain.so to the lib folder
• Zipalign and sign the APK file
• Install the APK

Method 2: Lib call

If renaming lib doesn't work, try this method. Some games may have APK integrity and signature check. You may need to bypass it before adding Il2CppDumper

• Decompile the game using Apktool
• Copy libil2cppdumper.so into the lib folder. Make sure only copy same ABIs as the target app, for example if target app has only armeabi-v7a, then you should only copy armeabi-v7a
• Search the main activity in AndroidManifest.xml. Example: com.gameloft.android.XamarinMainActivity

<activity android:configChanges="density|fontScale|keyboard|keyboardHidden|layoutDirection|locale|mcc|mnc|navigation|orientation|screenLayout|screenSize|smallestScreenSize|touchscreen|uiMode" android:label="@string/icon_label" android:launchMode="singleTop" android:multiprocess="false" android:name="com.gameloft.android.XamarinMainActivity" android:resizeableActivity="false" android:screenOrientation="sensorLandscape" android:theme="@style/Theme.acp.notitlebar.fullscreen">
    <intent-filter>
        <action android:name="android.intent.action.MAIN"/>
        <category android:name="android.intent.category.LAUNCHER"/>
    </intent-filter>
</activity>

• Locate the said main activity in the smali folder, can be \smali_classes(number)\com\gameloft\android\XamarinMainActivity.smali if multidex). You must look through all smali classes until you found it

• Insert this lib call into onCreate function below .locals XX

 const-string v0, "il2cppdumper"
 
 invoke-static {v0}, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V

Like

.method protected onCreate(Landroid/os/Bundle;)V
    .locals 2

    const-string v0, "il2cppdumper"
 
    invoke-static {v0}, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V

    whatever code below

• Re-compile, zipalign, sign the APK
• Install the APK

Dumping

• Run the game
• Wait a few seconds. Let the game load into main screen
• Once the dump is complete, it will save the dump.cs in /storage/emulated/0/Android/data/(Package name)/
• If there is no dump.cs, check logcat using Matlog or Android Studio. Game should crash or freeze if dump fails

Obfuscated names

Names can't be deobfuscated. Once they are obfuscated/renamed, it can't be reverted back to original, the APK doesn't even have a brain to memorize all original names. Instead, try find older version without obfuscation, or debug the game using GG, frida, gdb, lldb or others. If you can't do any of these, maybe guess the functions and try one by one :P

Bypass more games?

I'm too noob in Il2Cpp API related, so I can't improve it or bypassing security, and it is not really my thing to bypass. But if you know, feel free to pull request. Issues are still disabled since I forked the project.

Credits

• Perfare Zygisk-Il2CppDumper
• BrianGIG Auto-Il2cppDumper