Dump Il2Cpp unprotected executable ELF from process memory
- Pure shell implementation
- Supports detection of ELF file headers
- Supports guessing which is the correct ELF based on memory location
- Supports automatic memory region merging
- Supports dumping
global-metadata.dat
from memory - Supports ELF file headers analysis
- Android Shell (root):
Il2CppMemoryDumper.sh <package> [output=/sdcard/dump]
- Output will be:
[output]/[startOffset]_[package]_[memoryName].[so/dump/dat]
[output]/[package]_maps.txt
- Nothing to do
- Fix dumped ELF using SoFixer
- Dump Method and StringLiteral using Il2CppDumper, you can download standalone execueable for Linux (x64, arm, arm64), MacOS (x64, arm64), WoA (arm, arm64) in Il2CppDumper-Standalone