📖 Tutorial How to hack Unity Android Games when there's no Assembly-Csharp.dll (libil2cpp.so method)

[Gourov]

Sorry, due to broken metadata I can't get the dump.cs file?

You can get using riru ... I never used that , @DDeveloper can help probably.

 

[Akasanvas95]

Hello there, and thanks for the Tuto.

Trying to understand what's going on inside some file... and so... tryin to understand Opcode too =)

Tried with your example , but in my case, almost every function I found is translated to something like

str x21, [sp, #-0x30]!
stp x20, x19, [sp, #0x10]

Wich, if i'm correct, can't be turned back to something completely different, but still can't figure exactly how i can mod this.

Do you guy got some documentation about "other" code somewhere? found a lot on google etc...but not sure wich one would be best / Relevant ?

Thanks for all

 

[steve9112]

Hello there,
I keep receiving this message whenever I try to dump the libil2cpp.so :


Initializing metadata...
Metadata Version: 24.1
Initializing il2cpp file...
Applying relocations...
WARNING: find SHT_LOUSER section
ERROR: This file may be protected.
Il2Cpp Version: 24.1
Searching...
CodeRegistration : 0
MetadataRegistration : 0
ERROR: No symbol is detected
ERROR: Can't use auto mode to process file, try manual mode.
Input CodeRegistration:

the game I'm trying to dump is Captain Tsubasa Dream team (Android) but there's no luck

 

[Gourov]

Hello there,
I keep receiving this message whenever I try to dump the libil2cpp.so :


Initializing metadata...
Metadata Version: 24.1
Initializing il2cpp file...
Applying relocations...
WARNING: find SHT_LOUSER section
ERROR: This file may be protected.
Il2Cpp Version: 24.1
Searching...
CodeRegistration : 0
MetadataRegistration : 0
ERROR: No symbol is detected
ERROR: Can't use auto mode to process file, try manual mode.
Input CodeRegistration:

the game I'm trying to dump is Captain Tsubasa Dream team (Android) but there's no luck

Obfuscated Meta or Lib.

 

[steve9112]

Obfuscated Meta or Lib.

is there a way then to decrypt it ?
I have searched a lot and couldn't find a good way for that , of course without using a rooted android

 

[Gourov]

is there a way then to decrypt it ?
I have searched a lot and couldn't find a good way for that , of course without using a rooted android

That depends on games . You can try using Riru or Auto Dumper.

 

[BooMeRaN1]

OK. Esto sirve para decompilar y al hacerlo me sale un archivo dump.cs y una carpeta llamada MetaDll o algo asi, que contiene unas DLLs que entiendo son las que estan encapsuladas en el archivo so

Si quiero modificar alguna de esas DLLs es posible ...... y como compilaria el archivo a libil2cpp.so???

------------------

OKAY. This is used to decompile and when doing it I get a dump.cs file and a folder called MetaDll or something like that, which contains some DLLs that I understand are the ones that are encapsulated in the so file

If I want to modify any of those DLLs it is possible ...... and how would I compile the file to libil2cpp.so ???

 

[Amokkhan]

Hi, thanks for the tutorial.

I have a question for about the backingfield, how can mod it in this tutorial?

In this tutorial " https://forum.sbenny.com/thread/a-complete-moding-tutorial-for-unity-games-using-dnspy.16650/?amp=1 " at step 6 can we modify the backingfield, but how we can do it here?

Thanks

 

[Sbenny]

Hi, thanks for the tutorial.

I have a question for about the backingfield, how can mod it in this tutorial?

In this tutorial " https://forum.sbenny.com/thread/a-complete-moding-tutorial-for-unity-games-using-dnspy.16650/?amp=1 " at step 6 can we modify the backingfield, but how we can do it here?

Thanks

You have two ways. The first is using hooks (very advanced) and the second is scrolling inside IDA's function to find out the backingField ID.

For example, if you have something like this:

backingField _gold; 0x14 (in dump.cs)

And in the IDA function you're trying to hack you find something like this:

LDR R0, [R0, #0x14]

then you should be able to hack it with by replacing that line with:

MOV R0, 0xFFFFFF

which would end up replacing the variable "gold" with 0xFFFFFF which is 16777215.

 

[Amokkhan]

Thank you for the answer.

I have one more question, how can i remove a line in IDA and add a new for this example i tried to remove the ldr line and try to add a mov line, but i dont get it can you explain how i do can change it in IDA? This would be nice or already exists a tutorial for it here?

Thank you

 

[Sbenny]

You can't do it with IDA, you need to use softwares like HxD for this.