Il2Cpp Auto Dumper

Automated Unity IL2CPP runtime dumping for rooted Android emulators

Generate a complete dump.cs, extract IL2CPP artifacts, and create semantic deobfuscation aliases from a three-field Windows GUI.

Overview

Il2Cpp Auto Dumper is a Windows desktop tool for Unity IL2CPP analysis on rooted Android devices and emulators. It is designed for applications where static IL2CPP tools cannot produce a useful dump because global-metadata.dat is encrypted, protected, modified, or initialized only at runtime.

The application requires only three inputs:

1. APK location;
2. Android package name;
3. emulator ADB port.

ADB discovery, Android ABI detection, matching frida-server provisioning, application launch, runtime dump generation, artifact extraction, and semantic alias generation are automated.

What It Delivers

Every successful run creates a versioned output directory containing:

Artifact	Purpose
dump.cs	Faithful IL2CPP runtime class, field, property, method, type, offset, and address dump
dump.annotated.cs	Original symbols preserved with readable semantic aliases and confidence scores
dump.deobfuscated.cs	Human-readable dump with inferred field and nested-type names applied
deobfuscation-map.json	Machine-readable original-to-alias mapping with owner, type, offset, evidence, and confidence
libil2cpp.so	Native IL2CPP binary extracted from the selected APK
global-metadata.dat	Metadata artifact extracted from the selected APK
manifest.json	APK hash, architecture, runtime information, dump statistics, hashes, and output paths

Example semantic recovery:

System.Collections.Generic.Dictionary<
    COW.GamePlay.IHAAMHPPLMG,
    COW.GamePlay.MatchTeam.TeamPlayerInfo
> TeamPlayerInfos; // 0x48 | obfuscated: NEJCMGFAECC

The readable name is derived from matching runtime type information and getter semantics. The original symbol and offset remain available for verification.

Key Features

• one-click Unity IL2CPP Android runtime dump;
• graphical Windows interface with no command-line setup for release users;
• automatic ADB discovery or official Android Platform Tools download;
• automatic x86, x86_64, ARM, and ARM64 Android ABI detection;
• automatic matching Frida client and frida-server deployment;
• root validation before process attachment;
• direct runtime file writer that avoids managed CreateDirectory failures;
• support for protected or non-standard global-metadata.dat files;
• semantic field-name inference from getters, return types, declaration order, and repeated symbols;
• confidence-scored deobfuscation map;
• SHA-256 hashes and reproducible run manifests;
• automatic Windows executable builds through GitHub Actions.

Quick Start

Download Il2CppAutoDumper.exe from the repository's Releases page.

1. Start the rooted Android emulator.
2. Enable its local ADB connection.
3. Open Il2CppAutoDumper.exe.
4. Select the APK.
5. Enter the Android package name, such as com.example.game.
6. Enter the ADB port, such as 5555.
7. Select Generate Dump.

No Python, Node.js, npm, Android SDK, or manual Frida installation is required when using the release executable. Internet access is required during the first run if compatible platform tools or a Frida server are not already cached.

Emulator ADB Setup

The emulator must expose a rooted Android instance through a local TCP ADB port. BlueStacks commonly uses 127.0.0.1:5555, although the actual port may differ between instances and emulator products.

The tool also works with other rooted Android environments when they provide:

• a reachable 127.0.0.1:<port> ADB endpoint;
• functional su -c root access;
• a supported Android ABI;
• permission to attach to the selected application process.

Method

Il2Cpp Auto Dumper uses a runtime-first analysis method. It waits for the target application's IL2CPP runtime to initialize, attaches through an architecture-matched Frida server, enumerates the registered IL2CPP domain, and writes the dump from live runtime structures.

The runtime result is combined with static APK artifact extraction and a separate semantic alias pass. This approach is intended for cases where conventional static IL2CPP Dumper or IL2CPP Inspector workflows are blocked by protected metadata.

Output Layout

Documents/Il2CppAutoDumper/runs/<package>/<timestamp>/
|-- manifest.json
|-- static/
|   |-- global-metadata.dat
|   `-- libil2cpp.so
`-- runtime/
    |-- dump.cs
    |-- dump.annotated.cs
    |-- dump.deobfuscated.cs
    `-- deobfuscation-map.json

Semantic Deobfuscation

The deobfuscation stage does not claim to reconstruct identifiers that were permanently removed by an obfuscator. It produces evidence-backed semantic aliases that make large IL2CPP dumps easier to inspect while preserving every original identifier.

Confidence levels are included because not every inference has equal evidence:

• unique field and readable getter return type: very high confidence;
• repeated exact symbol and exact type: high confidence;
• ordered fields and getters sharing the same type: moderate-to-high confidence;
• nested generic value type inferred from a readable collection property: high confidence.

Use dump.cs when exact runtime fidelity is required, dump.annotated.cs when reviewing evidence, and dump.deobfuscated.cs when navigating the codebase by meaning.

Requirements

Release executable

• Windows 10 or Windows 11 x64;
• rooted Android emulator or rooted Android device;
• TCP ADB enabled;
• internet access during first-time dependency provisioning.

Building from source

• Python 3.11 or newer;
• Node.js 20 or newer;
• PowerShell 5.1 or newer.

Set-ExecutionPolicy -Scope Process Bypass
.\setup.ps1
.\run_gui.bat

Build the standalone Windows executable:

.\build_release.ps1

The result is written to:

dist/Il2CppAutoDumper.exe

Tags matching v* trigger .github/workflows/build-windows.yml, upload the Windows artifact, and attach the executable to the corresponding GitHub Release.

Troubleshooting

unable to access process with pid

Confirm that the emulator grants real UID 0 access through su -c. Current releases validate that frida-server remains running as root before attempting the attach.

abort was called in createDirectoryRecursively

Upgrade to v1.1.1 or newer. Current releases use a direct Frida file writer and do not call the unstable managed directory API.

Application closes during attachment

Some applications intentionally terminate when runtime instrumentation is detected. Use a development build that permits instrumentation or disable the application's anti-tamper layer in an environment you control.

ADB does not connect

Verify the emulator's ADB setting, confirm the port, and test that the instance is listening on 127.0.0.1. Different emulator instances may receive different ports.

License and Use

Distributed under the MIT License.

Use the project only with applications, devices, accounts, and environments you own or are explicitly authorized to inspect. Third-party trademarks belong to their respective owners.