# Rev U3d Dump

Dump Unity IL2CPP symbols from iOS/Android builds.

- Repository: https://github.com/P4nda0s/reverse-skills (2339 stars)
- Category: Mobile
- License: see repository
- Last updated: 2026-05-06
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add P4nda0s/reverse-skills --skill rev-u3d-dump -g -a claude-code -y`
Codex: `npx skills add P4nda0s/reverse-skills --skill rev-u3d-dump -g -a codex -y`
Cursor: `npx skills add P4nda0s/reverse-skills --skill rev-u3d-dump -g -a cursor -y`
Gemini CLI: `npx skills add P4nda0s/reverse-skills --skill rev-u3d-dump -g -a gemini-cli -y`

## Description

Dump Unity IL2CPP symbols from iOS/Android builds. Extract method names, addresses, and type info from IL2CPP binaries and global-metadata.dat, then generate IDA/Ghidra import scripts.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# rev-u3d-dump - Unity IL2CPP Symbol Dumper

Extract C# method names, addresses, and type definitions from Unity IL2CPP builds for IDA/Ghidra analysis.

---

## Overview

Unity IL2CPP compiles C# to native code. The original class/method names are stripped from the binary but preserved in `global-metadata.dat`. This skill recovers the mapping between native function addresses and their original C# names.

### Key Files in Unity Build

| File | Location | Purpose |
|------|----------|---------|
| Native binary | iOS: `Frameworks/UnityFramework.framework/UnityFramework`<br>Android: `lib/{arch}/libil2cpp.so` | Compiled C# code (Mach-O / ELF) |
| Metadata | `Data/Managed/Metadata/global-metadata.dat` | All type/method/string info |

---

## Tool Selection

### Il2CppDumper (recommended for metadata v39+)

Use the **v39 fork** for Unity 6+ builds:

- Repo: `https://github.com/roytu/Il2CppDumper` (branch: `v39`)
- Supports metadata v24, v39
- Outputs `script.json` with function addresses, ready for IDA/Ghidra import

The original Il2CppDumper (`https://github.com/Perfare/Il2CppDumper`) only supports up to v29.

### Cpp2IL (alternative)

- Repo: `https://github.com/SamboyCoding/Cpp2IL`
- Supports metadata v39, but dummy DLLs lack `[Address]` attributes
- Useful for C# source reconstruction, not ideal for IDA import

---

## Step-by-Step Workflow

### Step 1: Locate IL2CPP Files

**iOS (IPA):**
```bash
# Unzip IPA
unzip -o app.ipa -d .

# Binary
BINARY="Payload/<AppName>.app/Frameworks/UnityFramework.framework/UnityFramework"

# Metadata
METADATA="Payload/<AppName>.app/Data/Managed/Metadata/global-metadata.dat"
```

**Android (APK):**
```bash
# Unzip APK
unzip -o app.apk -d .

# Binary (pick target arch)
BINARY="lib/arm64-v8a/libil2cpp.so"

# Metadata
METADATA="assets/bin/Data/Managed/Metadata/global-metadata.dat"
```

### Step 2: Check Metadata Version

The rest: https://github.com/P4nda0s/reverse-skills/blob/HEAD/skills/rev-u3d-dump/SKILL.md