AwesomeREA.org

Tool

Il2CppInspector

Static analysis tool for Unity IL2CPP applications that reads an IL2CPP binary with its global-metadata.dat and outputs the application's type structure and method addresses as C# stub code, .NET assembly shim DLLs for decompilers such as ILSpy and dnSpy, IDA and Ghidra Python scripts that apply symbols and types, C++ type scaffolding and JSON address maps. Three APIs, also published as a NuGet package, and a plugin SDK expose the binary metadata, .NET type model and C++ model for custom analysis. The README states that it is not a decompiler and does not recover method source code.

Requirements and limitations

  • The README announces that development is suspended for the foreseeable future and that the author will not respond to issues or pull requests. The reviewed master commit, which added that notice, dates from 2021-11-23, 16 commits after the last release, 2021.1 (2021-01-31). The README recommends Cpp2IL instead; Cpp2IL and Il2CppDumper, whose entry documents Unity support up to 2022.2, are separate catalog entries. This entry lists Il2CppInspector for its documented outputs and APIs, not as a maintained tool.
  • Its version table marks Unity 5.3.0 through 2020.3.x (IL2CPP 16 to 27.1) as working and 2021.1 (27.2) as partial; later Unity versions are not covered. Documented inputs are ELF, PE, Mach-O, Universal Binary and PS4 FSELF images, 32- and 64-bit, for ARMv7, Thumb-2, ARMv8, x86 and x64, plus APK, AAB, XAPK, Zip and decrypted IPA packages.
  • The analyst supplies the IL2CPP binary and its matching global-metadata.dat; IPA executables must already be decrypted, and the README says packed, encrypted or obfuscated IL2CPP files are not its intended input. It warns that loading a packed PE file runs the DLL's entry point and initialization code, so untrusted DLLs should not be loaded and the tool should never run as administrator.
  • Builds use dotnet publish from a recursive clone and target .NET Core 3.1; the CLI builds for Windows, macOS and Linux, while the WPF GUI is Windows-only, and plugins are fetched separately with the get-plugins scripts. AGPL-3.0; the Bin2Object submodule and libraries such as dnlib and CxxDemangler keep their own licenses. Obfuscation-specific loader plugins and DLL-injection project output are outside this entry's analysis scope. No binary was analyzed, and the reviewed sources establish no REA connection.

About this entry

Type
Tool
Category
Game analysis tools
Relationship
Foundation tool
Targets
App · Binary · Game

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · djkaty/Il2CppInspector · Revision 116c635
  2. README.md#L713-L737 GitHub · djkaty/Il2CppInspector · Revision 116c635
  3. LICENSE GitHub · djkaty/Il2CppInspector · Revision 116c635
  4. Il2CppInspector.Common/Il2CppInspector.csproj GitHub · djkaty/Il2CppInspector · Revision 116c635
  5. Il2CppInspector.GUI/Il2CppInspector.GUI.csproj GitHub · djkaty/Il2CppInspector · Revision 116c635
  6. .gitmodules GitHub · djkaty/Il2CppInspector · Revision 116c635
  7. https://github.com/djkaty/Il2CppInspector/releases/tag/2021.1
  8. https://github.com/djkaty/Il2CppInspector/compare/2021.1...116c6355e7ee3656eab85ca753f913d428abc7a3