Il2CppDumper

June 6, 2026 · View on GitHub

中文说明请戳这里

Unity il2cpp reverse engineer

Features

Complete DLL restore (except code), can be used to extract MonoBehaviour and MonoScript
Supports ELF, ELF64, Mach-O, PE, NSO and WASM format
Supports Unity 5.3 - 2022.2
Supports generate IDA, Ghidra and Binary Ninja scripts to help them better analyze il2cpp files
Supports generate structures header file
Supports Android memory dumped libil2cpp.so file to bypass protection
Support bypassing simple PE protection
Native PDB generation for x64 PE (GameAssembly.dll) — see below

Native PDB generation (this fork)

This fork adds il2cpp_pdbgen, a standalone Rust tool that turns Il2CppDumper's output into a real Windows PDB that IDA (and other PDB consumers) load instantly — replacing the slow in-IDA ida_with_struct.py script.

The generated GameAssembly.pdb contains:

Function names + boundaries for every method (publics + globals)
Full struct/union types from il2cpp.h with correct x64 layouts
Typed function prototypes (each function wired to its signature)
A GUID/age matching the binary's debug directory, so IDA auto-loads it

It is written from scratch (MSF container, TPI/DBI/GSI/PSI streams, a C struct layout engine) — no compiler or linker required. Generation takes seconds.

Setup

# Build the tool and place it next to Il2CppDumper's output.
# Add -InstallRust to install Rust automatically if you don't have it.
.\setup.ps1            # or:  .\setup.ps1 -InstallRust

Once built, Il2CppDumper automatically generates <binary>.pdb next to the selected binary whenever the target is an x64 PE (set "GeneratePdb": false in config.json to disable). The selected GameAssembly.dll path is forwarded directly to the generator.

You can also run it manually:

il2cpp_pdbgen <dir>                                   # dir with GameAssembly.dll, il2cpp.h, script.json
il2cpp_pdbgen <dll> <il2cpp.h> <script.json> [out.pdb]

Then open the binary in IDA — the .pdb beside it is picked up automatically.

Usage

Run Il2CppDumper.exe and choose the il2cpp executable file and global-metadata.dat file, then enter the information as prompted

The program will then generate all the output files in current working directory

Command-line

Il2CppDumper.exe <executable-file> <global-metadata> <output-directory>

Outputs

DummyDll

Folder, containing all restored dll files

Use dnSpy, ILSpy or other .Net decompiler tools to view

Can be used to extract Unity MonoBehaviour and MonoScript, for UtinyRipper, UABE

ida.py

For IDA

ida_with_struct.py

For IDA, read il2cpp.h file and apply structure information in IDA

il2cpp.h

structure information header file

ghidra.py

For Ghidra

Il2CppBinaryNinja

For BinaryNinja

ghidra_wasm.py

For Ghidra, work with ghidra-wasm-plugin

script.json

For ida.py, ghidra.py and Il2CppBinaryNinja

stringliteral.json

Contains all stringLiteral information

Configuration

All the configuration options are located in config.json

Available options:

DumpMethod, DumpField, DumpProperty, DumpAttribute, DumpFieldOffset, DumpMethodOffset, DumpTypeDefIndex
- Whether to output these information to dump.cs
GenerateDummyDll, GenerateScript
- Whether to generate these things
DummyDllAddToken
- Whether to add token in DummyDll
RequireAnyKey
- Whether to press any key to exit at the end
ForceIl2CppVersion, ForceVersion
- If ForceIl2CppVersion is true, the program will use the version number specified in ForceVersion to choose parser for il2cpp binaries (does not affect the choice of metadata parser). This may be useful on some older il2cpp version (e.g. the program may need to use v16 parser on il2cpp v20 (Android) binaries in order to work properly)
ForceDump
- Force files to be treated as dumped
NoRedirectedPointer
- Treat pointers in dumped files as unredirected, This option needs to be true for files dumped from some devices

Jumboperson - Il2CppDumper