0

I'm trying to reverse engineer the behavior behind an old iOS app that runs on Unity 4.1.5.

So far what i've done is extracted the ipa file, loaded the main binary into Ghidra, and also attempted to decompile the Assembly-CSharp.dll file present in the Payload/app/Data/Managed/ directory.

The DLL file was sort of a dead-end. While I can see function names, class variables, and interfaces, they're all stub functions with no body. Viewing the relevant file offset of the function leads me to a pattern of repeating 06 2A 00 00 bytes, which is just IL for RET, so I'm assuming all functions have been compiled and stubbed out.

As this was made before Unity introduced their IL2CPP solution, what I've read online suggests that iOS Unity apps used some other method (AOT?) to compile the IL code into bytecode. This, however, means I can't use a tool like Il2cppdumper to extract the function names for use in Ghidra.

So i'm lost on where to go from here. I have the option of using Frida on the device but i'm not sure if there's any effective way to use it for Unity apps.

Thanks in advance

Improve this question
1
  • Yes, it should be Mono AOT. You can read more about it here: mono-project.com/docs/advanced/aot. I would look at the Mono source code to learn about AOT and how it works. – MazeGen Oct 25 '20 at 18:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.