Il2CppInspector icon indicating copy to clipboard operation
Il2CppInspector copied to clipboard

Support encrypted Mach-O executeable from installed device

Open AndnixSH opened this issue 3 years ago • 0 comments

This might sounds like a dumb question, i know you need to decrypt binary first from memory. As i got an Apple M1 computer which can run iOS apps, i just tried to dump il2cpp using Perfare's Il2CppDumper to see what happens. Surprisingly, it dumps successfully even it warned the binary is encrypted and cannot be processed

image

I tried to do the same with the files from my iPad, it can dump too. But it can't dump binary from downloaded IPA file, because the binary is full encrypted and larger. So it seems it only works with the '99% decrypted with 1% encrypted block' binary that has been installed on the iOS and macOS device. Yes, i compared the binary with 010 editor

Maybe you can make some changes to support it? Not a big deal but it can save me some time from having to decrypt the binary

Files: https://drive.google.com/file/d/1YmzqP3KuuWUYcVQIkBg13f7byO-p239h/view

AndnixSH avatar Jun 12 '21 11:06 AndnixSH