← Contact

iOS Unity reverse engineering guide

Overview

Unity iOS apps that use IL2CPP compile C# code into native code inside UnityFramework. Static analysis usually starts with the IPA, global-metadata.dat, and the Unity framework binary. Dynamic analysis then maps IL2CPP metadata back to runtime addresses so functions can be inspected while the app runs.

This workflow covers:

  1. Extracting the IPA and required IL2CPP files.
  2. Processing IL2CPP metadata to recover method names and signatures.
  3. Using Radare2 for static analysis of Unity logic.
  4. Using r2frida for runtime inspection on a jailbroken device.

The goal is to map compiled code back to useful C# context, identify functions of interest, and inspect runtime state without losing track of the binary’s loaded base address.

Process

Use this high-level process before moving into the detailed steps:

  1. Initial setup
    • Acquire the IPA from the device.
    • Extract the files required by Il2CppDumper.
    • Process the metadata and generate script.json.
  2. Function selection
    • Review script.json for security-relevant or behaviorally important functions.
    • Use method names, signatures, and addresses to choose analysis targets.
    • Examine candidate functions statically before attaching to the live process.
  3. Code review
    • Compare disassembly, decompiler output, metadata names, and nearby string references.
    • Identify the function’s purpose, inputs, return value, and side effects.
    • Record assumptions before testing them dynamically.
  4. Dynamic analysis
    • Set breakpoints on selected functions.
    • Use :dr. to read register values during execution.
    • Treat register writes and memory patches as explicit experiments that should be documented.
  5. Runtime experiments
    • Patch memory when a controlled test requires a behavior change.
    • Use :dxc to call functions with specific parameters.
    • Use Frida scripts to create objects, call methods, and observe runtime behavior.

Requirements

Hardware requirements

Software requirements

IL2CPP analysis workflow

Step 1: IPA extraction

Step 2: extract required files

  1. Extract Data/Managed/Metadata/global-metadata.dat from the IPA.
  2. Extract the Unity framework from Frameworks/UnityFramework.framework/UnityFramework.

Note: UnityFramework contains the compiled Unity logic. Use UnityFramework and global-metadata.dat together to recover function addresses, names, and signatures. The metadata file provides the mapping between IL2CPP functions and their original C# context.

Step 3: IL2CPP processing

Step 4: Radare2 analysis

  1. Load UnityFramework in Radare2. 
    $ r2 UnityFramework
[0x100000000]>
  2. Run the aae command. 
    [0x100000000]> aae
[x] Analyze all flags starting with sym. and entry0 (aa)
[x] Analyze function calls (aac)
[x] Analyze len bytes of instructions for references (aar)
[x] Check for objc references
[x] Check for vtables
[x] Type matching analysis for all functions (aaft)
[x] Propagate noreturn information
[x] Use -AA or aaaa to perform a complete analysis
  3. Execute . ./il2cpp.r2.js to symbolicate the binary. 
    [0x100000000]> . ./il2cpp.r2.js
[*] Loading IL2CPP metadata...
[*] Symbolicated 1234 functions
[0x100000000]>

Step 5: function analysis

  1. Review script.json to identify functions of interest. 
    {
  "functions": [
    {
      "name": "GameManager.Update",
      "address": "0x100123456",
      "signature": "void GameManager.Update()"
    }
  ]
}
  2. Navigate to the function with s <address>. 
    [0x100000000]> s 0x100123456
[0x100123456]>
  3. Run pd to view symbolicated disassembly. 
    [0x100123456]> pd
;-- GameManager.Update:
0x100123456      55             push rbp
0x100123457      4889e5         mov rbp, rsp
0x10012345a      4883ec20       sub rsp, 0x20
0x10012345e      488b05f3ffffff mov rax, qword [0x100123458]
0x100123464      488b00         mov rax, qword [rax]

Step 6: dynamic analysis setup

Note: : switches to the Frida command context.

Step 7: calculate runtime address

Step 8: dynamic analysis operations

Credits