Il2CppDumper VS ghidra-scripts

By using IL2CppDumper along with the game's global-metadata.dat file, we can generate headers and structs that we can use with Ghidra, a tool for disassembling code. Once we load Engage and these headers and structs into Ghidra, we can look for a particular function called App.BattleMath$$_IsProbabilityHit. This function is provided a displayed hit (or, as Intelligent Systems calls it, ratio) and is responsible for determining whether or not that attack will actually hit. Ghidra will try to automatically decompile the assembly code into something more readable, and while the results are sometimes mixed, here it's pretty clear what's going on. We can see how, when the displayed hit is less than 51 (or when it's 100), it simply multiplies the displayed hit by 100, and when the displayed hit is 51 or greater, it uses the sin function as described earlier:

So i want to reverse a game which uses Il2cpp, so i used this to dump the files: https://github.com/Perfare/Il2CppDumper

Basically the title; I decompiled a game and intend to mod its behavior, so I used a Il2Cpp dumper that seems pretty popular (https://github.com/Perfare/Il2CppDumper).

There's plenty of resources on decompiling apks. An APK is just a zip basically, and it contains an Ill2cpp.so file & and global-metadata file. You can use Il2cppdumper (https://github.com/Perfare/Il2CppDumper/releases. https://github.com/Perfare/Il2CppDumper ) to restore the Assembly-CSharp. Then you can use IlSpy or just open the assembly or the dump.cs in visual studio that gets produced.

Download and run https://github.com/Perfare/Il2CppDumper/releases. Find and load libil2cpp.so and global-metadata.dat from your combined apk folder when it asks. This will create a bunch of files. The ones we care about right now are the ones in the DummyDll folder.

You'll need: https://github.com/Perfare/AssetStudio and (for the optional part) https://github.com/Perfare/Il2CppDumper

if the game is compiled with IL2CPP you can convert it to a dummy Assembly-CSharp file using IL2Cpp Dumper - https://github.com/Perfare/Il2CppDumper

The tool is https://github.com/Perfare/Il2CppDumper But I'm not sure it uses il2cpp, you have to check by yourself (i think there is a folder/file named il2cpp ?), I guess if you have no assembly it does because it one of the most popular option for Unity games.

I've got no experience with reverse-engineering executables, but I got a bunch of code-like stuff showing up when I fed ULTIMA.EXE to Ghidra and told it to analyze it with all the flags set.

The whole game is written in C++ (game logic intertwined with graphics). Ghidra can help you deconstruct the game binaries, but you need to put in a GREAT great effort to even get a starting point. Cheat Engine has been successful for some purposes, including an AI enabling utility for multiplayer (use with great care!).

Ghidra: https://ghidra-sre.org/, https://github.com/NationalSecurityAgency/ghidra

What I think you’re talking about is reverse engineering. It’s basically taking a program and analysing the compiled code to attempt to find out how it works. It’s a fairly expansive topic, and fairly tricky to do but look at anything to do with Ghidra to get started.

Oh also just as an aside Ghidra is a really cool free tool developed by the NSA which can reverse engineer software by looking at its executable and recreating the C code from the instructions and static data within. It's another way to get familiarized with the relationship between C code and the instructions it compiles to.

There exist decompilers and other tools for helping make sense of assembly and that can automate some of the conversion back to higher level languages. In my brief involvement with Slippi I used Ghidra - a tool developed by the NSA, to do some of that kind of work, which I found a little amusing.

It's likely a binary file that's improperly being interpreted as Unicode by the text editor. If it's an executable file, you can use Ghidra to disassemble and analyze it. There may also be some interesting ASCII strings that would reveal its purpose. My guess is that it's a Windows version of Unix "tee" program which will write stdin to a file and stdout simultaneously.

On the other hand, this slick "Ghidra" webpage looks suspicious. It's probably written in Typescript on Electron!