cpp2il

In IL2CPP, generic methods are specialized into concrete implementations. Because IL2CPP strips implementations that the game does not use, you may need to resolve specific variants.

Find existing variants for a method

Given an Il2CppMethodDefinition, you can find which concrete generic versions exist in the assembly using LibCpp2IlMain.ThePe.ConcreteGenericMethods.

Resolve a method from a raw address

If you have a call to a specific address (e.g., 0x123456789) and it is not a standard method, use LibCpp2IlMain.ThePe.ConcreteGenericImplementationsByAddress to find the base definition.

// Find variants for a specific method
var listType = LibCpp2IlReflection.GetType("List`1", "System");
var addMethod = listType.Methods.First(m => m.Name == "Add");
var variants = LibCpp2IlMain.ThePe.ConcreteGenericMethods[addMethod];

// Resolve base method from a raw address
var genericImplementations = LibCpp2IlMain.ThePe.ConcreteGenericImplementationsByAddress[0x123456789];
Console.WriteLine(genericImplementations[0].BaseMethod.HumanReadableSignature);

Before invoking most APIs, you must initialize the library using Cpp2IlApi.InitializeLibCpp2Il. This method links the core logic to the underlying metadata and binary files via LibCpp2IL.

There are two ways to initialize:

1. From disk: Provide file paths to the binary and metadata files.
2. From memory: Provide byte arrays of the binary and metadata files (useful if you need to decrypt files before processing).

Required Parameters:

• Binary/Metadata: Paths or byte arrays for the files.
• Unity Version: An integer array containing at least three elements [major, minor, patch] (e.g., [2020, 3, 1]). This determines the supported il2cpp metadata version (supports Unity 2018 and up).
• Verbose Logging: A boolean flag to enable detailed logs. It is advised to set this to false during normal runtime.
• Manual Registration Addresses: A boolean flag to allow manual specification of CodeRegistration and MetadataRegistration struct addresses if they cannot be automatically located. It is advised to set this to false during normal runtime.

Unity Version Utility: If you are unsure of the Unity version, use Cpp2IlApi.DetermineUnityVersion. This method takes two paths:

• The path to the Game's main executable (used on Windows to parse the file version).
• The path to the GameName_Data folder (used on non-Windows platforms to read the version from the globalgamemanagers file).

LibCpp2IL can be initialized using two methods. Note that debug logging is enabled by default, which will output extensive timing and loading data to the Console. You must provide the Unity version as an integer array (e.g., new [] {2019, 2, 0}).

From the hard drive

Use LibCpp2IlMain.LoadFromFile by providing the paths to the game assembly and the global metadata.

From a byte array

Use LibCpp2IlMain.Initialize if you have already loaded the file contents into memory.

// From the hard drive
var unityVersion = new [] {2019, 2, 0};
if (!LibCpp2IlMain.LoadFromFile(gameAssemblyPath, globalMetadataPath, unityVersion)) {
    Console.WriteLine("initialization failed!");
    return;
}

// From a byte array
var unityVersion = new [] {2019, 2, 0};
if (!LibCpp2IlMain.Initialize(gameAssemblyBytes, globalMetadataBytes, unityVersion)) {
    Console.WriteLine("initialization failed!");
    return;
}

Use the following properties on an Il2CppTypeDefinition to inspect members:

• Methods: Access .Methods. Each Il2CppMethodDefinition provides .Name, .MethodPointer, .ReturnType (as Il2CppTypeReflectionData), and .Parameters (as Il2CppParameterReflectionData).
• Fields: Access .Fields. Each Il2CppFieldDefinition provides .Name and .FieldType (as Il2CppTypeReflectionData).
• Properties: Access .Properties. Each Il2CppPropertyDefinition provides .Name, .Getter, .Setter, and .PropertyType.
• Events: Access .Events. Each Il2CppEventDefinition provides .Name, .EventType, .Adder, .Remover, and .Invoker.

// Methods
var join = type.Methods[0];
Console.Log(join.Name);
Console.Log($"0x{join.MethodPointer:X}");
Console.Log(join.ReturnType);

// Fields
var lengthField = type.Fields[0];
Console.WriteLine(lengthField.Name);
Console.WriteLine(lengthField.FieldType);

// Properties
var lengthProperty = type.Properties[1];
Console.WriteLine(lengthProperty.Name);
Console.WriteLine(lengthProperty.Getter.Name);

// Events
var appDomain = LibCpp2IlReflection.GetType("AppDomain", "System");
Console.Log(appDomain.Events[0].Name);
Console.Log(appDomain.Events[0].Adder.Name);

IL2CPP stores type, field, string literal, and method references as globals. If you have a virtual address (for example, from an il2cpp_codegen_object_new call), you can resolve it to its corresponding object using the following methods:

• Type References: Use LibCpp2IlMain.GetTypeGlobalByAddress(address) to get an Il2CppTypeReflectionData.
• Method References:
  • For basic details: LibCpp2IlMain.GetMethodDefinitionByGlobalAddress(address) returns an Il2CppMethodDefinition.
  • For complex/generic data: LibCpp2IlMain.GetMethodGlobalByAddress(address) returns a MetadataUsage?. If the usage is a MethodRef, you can use .AsGenericMethodRef() to access generic parameters.
• Field References: Use LibCpp2IlMain.GetFieldGlobalByAddress(address) to get an Il2CppFieldDefinition.
• String Literals: Use LibCpp2IlMain.GetLiteralByAddress(address) to get the string value.

// Type
Il2CppTypeReflectionData type = LibCpp2IlMain.GetTypeGlobalByAddress(0x180623548);

// Method (Basic)
Il2CppMethodDefinition method = LibCpp2IlMain.GetMethodDefinitionByGlobalAddress(0x182938239);

// Method (Generic/Complex)
MetadataUsage? usage = LibCpp2IlMain.GetMethodGlobalByAddress(0x182938239);
if(usage != null && usage.Type == MetadataUsageType.MethodRef) {
    var genericMethodRef = usage.AsGenericMethodRef();
    Console.WriteLine(genericMethodRef.declaringType);
    Console.WriteLine(genericMethodRef.baseMethod);
    Console.WriteLine(genericMethodRef.typeGenericParams);
    Console.WriteLine(genericMethodRef.methodGenericParams);
}

// Field
Il2CppFieldDefinition fieldDef = LibCpp2IlMain.GetFieldGlobalByAddress(0x182933215);

// String
string literal = LibCpp2IlMain.GetLiteralByAddress(0x182197654);

The following attributes are injected into methods by the Call Analyzer. They are located in the Cpp2ILInjected.CallAnalysis namespace.

Method Relationship Attributes

• DeduplicatedMethodAttribute: Indicates the method's instructions were deduplicated by the compiler and it shares an address with other methods.
• CallAnalysisNotSupportedAttribute: Indicates the method has no instructions to analyze (and is not abstract or an interface).
• CalledByAttribute: Indicates this method is called from a specific method. Note: This is not emitted if there are a large number of callers. Contains fields for Type, Member, MemberTypeParameters, MemberParameters, and ReturnType.
• CallsAttribute: Indicates this method calls a specific method. Contains fields for Type, Member, MemberTypeParameters, MemberParameters, and ReturnType.
• CallerCountAttribute: Provides the number of direct calls to this method (similar to Unhollower's implementation). Contains an int Count field.

Instruction Analysis Attributes

• CallsDeduplicatedMethodsAttribute: Indicates the method calls at least one deduplicated method. Contains an int Count field.
• CallsUnknownMethodsAttribute: Indicates the method calls at least one unknown method. Contains an int Count field.
• ContainsInvalidInstructionsAttribute: Indicates the method contains at least one invalid instruction.
• ContainsUnimplementedInstructionsAttribute: Indicates the method contains at least one instruction that is not implemented.

using System;
namespace Cpp2ILInjected.CallAnalysis;

[AttributeUsage(AttributeTargets.Method, AllowMultiple = false)]
public sealed class DeduplicatedMethodAttribute : Attribute {}

[AttributeUsage(AttributeTargets.Method, AllowMultiple = false)]
public sealed class CallAnalysisNotSupportedAttribute : Attribute {}

[AttributeUsage(AttributeTargets.Method, AllowMultiple = true)]
public sealed class CalledByAttribute : Attribute
{
	public object Type;
	public string Member;
	public object[] MemberTypeParameters;
	public object[] MemberParameters;
	public object ReturnType;
}

[AttributeUsage(AttributeTargets.Method, AllowMultiple = true)]
public sealed class CallsAttribute : Attribute
{
	public object Type;
	public string Member;
	public object[] MemberTypeParameters;
	public object[] MemberParameters;
	public object ReturnType;
}

[AttributeUsage(AttributeTargets.Method, AllowMultiple = false)]
public sealed class CallerCountAttribute : Attribute
{
	public int Count;
}

[AttributeUsage(AttributeTargets.Method, AllowMultiple = false)]
public sealed class CallsDeduplicatedMethodsAttribute : Attribute
{
	public int Count;
}

[AttributeUsage(AttributeTargets.Method, AllowMultiple = false)]
public sealed class CallsUnknownMethodsAttribute : Attribute
{
	public int Count;
}

[AttributeUsage(AttributeTargets.Method, AllowMultiple = false)]
public sealed class ContainsInvalidInstructionsAttribute : Attribute {}

[AttributeUsage(AttributeTargets.Method, AllowMultiple = false)]
public sealed class ContainsUnimplementedInstructionsAttribute : Attribute {}