Il2CppAnalyzer-IDA

Il2CppAnalyzer-IDA is a Python script designed for IDA Pro, aiming to streamline the analysis and renaming of methods extracted from Il2Cpp binaries using a dump.cs file. This tool automates the process of setting method names, offsets, and argument types within IDA, making reverse engineering Il2Cpp-based applications more efficient.

Features

• Parse and extract method names, classes, and offsets from the dump.cs file.
• Automatically rename methods in IDA to ClassName::MethodName format.
• Adds comments with argument types and other useful information to methods in IDA.
• Designed specifically for Il2Cpp reverse engineering with IDA Pro.

How to Use

1. Use frida-Il2Cpp-bridge to generate the dump.cs file by running the following command within your Frida session:

   Il2Cpp.dump()

   You can find frida-Il2Cpp-bridge and more details about it on its GitHub repository: frida-Il2Cpp-bridge.

2. Clone this repository and load the Python script in IDA Pro.

3. When prompted, select the dump.cs file generated by frida-Il2Cpp-bridge.

4. The script will automatically parse the file and apply the appropriate renaming and comments to the methods in IDA.

Credits

This project relies heavily on the structure provided by frida-Il2Cpp-bridge for generating the dump.cs file. Special thanks to vfsfitvnm for developing such a powerful tool.

Requirements

• IDA Pro (version 7.x or later)
• frida-Il2Cpp-bridge for generating the dump.cs file: GitHub

License

This project is open-source and licensed under the MIT License.