Auto-Il2cppDumper

Il2CppDumper without Magisk/Zygisk, dump il2cpp data at runtime, can bypass protection, encryption and obfuscation.

This project is based on BrianGIG Auto-Il2cppDumper which I continue to maintain it

How to use

Download pre-compiled libs HERE and follow steps below

Note: Non-root methods involves modifying APK file, you may need to bypass APK integrity or signature check if it's present. I won't get into the details of bypassing anything because it is simply out of the scope

Method 1: Fake lib

This is a trick to load our own libunity.so or libmain.so and load game's renamed original lib librealunity.so or librealmain.so. Can't decide which lib? Try libmain.so first as it sometimes work better than libunity.so or vice versa

Root

Make sure you know the architecture of the game and your device before proceed
Use any file manager app that can access root. Go to /data/data/(package name)/lib or /data/app/(obfuscated name)/(package name-obfuscated name)/lib
Rename original libunity.so to librealunity.so or original libmain.so to librealmain.so
Put our lib file libunity.so or libmain.so to the lib folder

Non-root

Some games may have APK integrity and signature check. You may need to bypass it before adding Il2CppDumper

Open APK file as ZIP using Winrar. 7zip or other zip utilities
Rename game's libunity.so to librealunity.so or libmain.so to librealmain.so
Put our fake lib file libunity.so or libmain.so to the lib folder
Zipalign and sign the APK file
Install the APK

Method 2: Lib call

If renaming lib doesn't work, try this method.

Decompile the game using Apktool
Copy libil2cppdumper.so into the lib folder. Make sure only copy same ABIs as the target app, for example if target app has only armeabi-v7a, then you should only copy armeabi-v7a
Search the main activity in AndroidManifest.xml. Example: com.gameloft.android.XamarinMainActivity

<activity android:configChanges="density|fontScale|keyboard|keyboardHidden|layoutDirection|locale|mcc|mnc|navigation|orientation|screenLayout|screenSize|smallestScreenSize|touchscreen|uiMode" android:label="@string/icon_label" android:launchMode="singleTop" android:multiprocess="false" android:name="com.gameloft.android.XamarinMainActivity" android:resizeableActivity="false" android:screenOrientation="sensorLandscape" android:theme="@style/Theme.acp.notitlebar.fullscreen">
    <intent-filter>
        <action android:name="android.intent.action.MAIN"/>
        <category android:name="android.intent.category.LAUNCHER"/>
    </intent-filter>
</activity>

Locate the said main activity in the smali folder, can be \smali_classes(number)\com\gameloft\android\XamarinMainActivity.smali if multidex). You must look through all smali classes until you found it
Insert this lib call into onCreate function below .locals XX

 const-string v0, "il2cppdumper"
 
 invoke-static {v0}, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V

.method protected onCreate(Landroid/os/Bundle;)V
    .locals 2

    const-string v0, "il2cppdumper"
 
    invoke-static {v0}, Ljava/lang/System;->loadLibrary(Ljava/lang/String;)V

    whatever code below

Re-compile, zipalign, sign the APK
Install the APK

Dumping

Run the game
Wait a few seconds. Let the game load into main screen
Once the dump is complete, it will save the dump.cs in /storage/emulated/0/Android/data/(Package name)/
If there is no dump.cs, check logcat using Matlog or Android Studio. Game usually crash or freeze if dump fails

Obfuscated names

Names can't be deobfuscated. Once they are obfuscated/renamed, it can't be reverted back to original, the game doesn't even kept any original names which makes obfuscation very useful. Instead, try to find older version without obfuscation, or debug the game using GG, frida, gdb, lldb or others. If you can't do any of these, maybe guess the functions and try one by one? :P

Bypassing protection?

Bypassing is not my thing, but if you know, feel free to make a pull request.

Usage (If you want to complie by yourself)

In config header jni/Includes/config.h:

UseFakeLib is to use it as root mode

Sleep is to delay dumping. Increase if getting issue with dumper, like if not fully dumped

Credits

Perfare Zygisk-Il2CppDumper
BrianGIG Auto-Il2cppDumper

crackercat / auto-il2cppdumper-1 Goto Github PK