I'm trying to reverse engineer the behavior behind an old iOS app that runs on Unity 4.1.5.
So far what i've done is extracted the ipa file, loaded the main binary into Ghidra, and also attempted to decompile the Assembly-CSharp.dll file present in the Payload/app/Data/Managed/ directory.
The DLL file was sort of a dead-end. While I can see function names, class variables, and interfaces, they're all stub functions with no body. Viewing the relevant file offset of the function leads me to a pattern of repeating 06 2A 00 00 bytes, which is just IL for RET, so I'm assuming all functions have been compiled and stubbed out.
As this was made before Unity introduced their IL2CPP solution, what I've read online suggests that iOS Unity apps used some other method (AOT?) to compile the IL code into bytecode. This, however, means I can't use a tool like Il2cppdumper to extract the function names for use in Ghidra.
So i'm lost on where to go from here. I have the option of using Frida on the device but i'm not sure if there's any effective way to use it for Unity apps.
Thanks in advance
