frida-il2cpp-bridge

Unity Versions

Supports Unity versions in the range 5.3.0 to 6000.3.x.

Supported Platforms

• Android (Tested)
• Linux (Tested)
• Windows
• iOS
• macOS

Note: Only Android and Linux are officially tested; using other platforms may result in breakage.

Starting from version 0.10.0, a Python executable is included with the NPM package. This executable wraps the frida command and adds IL2CPP-specific features. You can invoke it using npx or npm exec.

npx frida-il2cpp-bridge --help
# or
npm exec frida-il2cpp-bridge -- --help

Use the dump subcommand to extract application metadata (classes, methods, etc.) without needing the metadata file. You can specify the output directory and the C# output style.

npm exec frida-il2cpp-bridge -- -f com.example.application dump --out-dir dumps

For contributors wanting to test changes locally on Linux (x86_64), you can build specific IL2CPP assemblies and run tests.

Prerequisites:

• Linux (x86_64)
• clang and make installed.

# Build IL2CPP assembly (GameAssembly.so) for a specific Unity version
make assembly UNITY_VERSION=6000.3.10f1

# Run test on each assembly
make test

To test on non-Linux or different architectures, use the provided Dockerfile. This allows creating a container with the necessary Unity editor artifacts.

Prerequisites:

• Docker
• Emulator/virtualization (optional)

Build Docker image

Specify the Unity version via UNITY_VERSION.

Run tests

Use make testd to run tests on each Docker image.

# Build Docker image for a specific Unity version
make image UNITY_VERSION=2023.2.20f1

# Run tests on each Docker image
make testd

The base property on an Il2Cpp.Object allows you to access members of the parent class. This is useful when a subclass has shadowed or overridden a member (field or method) and you need to interact with the original implementation in the base class. It behaves similarly to the C# base keyword.

Example

If Bar inherits from Foo and both have a method foo():

const Bar: Il2Cpp.Class = ...;
const bar = Bar.new();

console.log(bar.foo()); // Returns the implementation in Bar
console.log(bar.base.foo()); // Returns the implementation in Foo

const Bar: Il2Cpp.Class = ...;
const bar = Bar.new();

console.log(bar.foo()); // 2
console.log(bar.base.foo()); // 1

When working with instance methods, you can use .bind(instance) to create an Il2Cpp.BoundMethod. A bound method is a proxy that automatically passes the assigned instance as the this pointer, allowing you to call .invoke() without manually providing the object every time.

const object: Il2Cpp.Object = Il2Cpp.string("Hello, world!").object;
const GetLength: Il2Cpp.BoundMethod<number> = object.method<number>("GetLength");

// No need to pass the object when invoking!
const length = GetLength.invoke(); // 13

You can use multi-stage Docker builds to extract only the Unity editor components (Data and GameAssembly.so) without the full image. Use the --target unity-editor flag.

docker build \
  --platform linux/amd64 \
  --build-arg UNITY_VERSION=2023.2.20f1 \
  --target unity-editor \
  -t unity:2023.2.20f1 \
  test

The Application class provides utility methods for interacting with the console and managing the user interface during command execution:

• print(*args, **kwargs): Standard printing to the console.
• update_status(message): Updates the current status line in the console.
• next_status(): Clears the current status line if the console is in ConsoleState.STATUS mode, allowing for a clean transition to the next output.