Deobfuscating IOS dll file (I think arm64)

Question

I am just starting out my journey with modding IAP files. I use dnSPY to find the offsets of the methods I want to change and then use an arm64 to hex converter to then apply these changes.

I have been stumped with this code shown in the picture. I have not found any useful methods for the past couple days of searching which leads me to believe they lie within the gibberish labels of methods. Some quick reasearch leads me to believe these methods have been obfuscated.

So far I have tried using de4dot to deobfuscate the code but it showed no difference after completing. Has anyone seen this style of obfuscation or know/have a tool that can tackle this.

The game in question is Survivor.io and I am happy to provide the decrypted dll files if it would help.

Many thanks,

A noob trying to learn modding

Obfuscated code

Answer 1

If you have really dll files in an iOS app then most likely it is a Xamarin based app.

But the dll file you have does not contain .Net byte code: Because code interpreters were (or are?) not allowed on iOS all .Net code is compiled what Xamarin calls "Ahead of Time Compilation" (AOT) into native code (most likely arm64-v8a).

This is the reason all the functions you see don't have any code in their function body. AFAIK they are just there as place-holder used to get the function names (may be for reflection?). Any code in those assemblies is ignored. So trying to modify any .Net code is to my knowledge, a waste of time.

The native code is stored in "aotdata" files next to the dll files (file extension .aotdata.arm64 for armv8a platform). Not sure if Ghidra, IDA or a similar tool can now open these files, last time I tried they could not.

The best way to modify Xamarin iOS apps is on a jailbroken device using Frida. Mono/Xamarin is not yet directly supported by Frida, but the necessary functions by the Mono framework work on the same level like other native libraries, so that hooking and modifying arguments/return values as well as calling Mono/Xamarin functions is possible.

See e.g.

• https://withinrafael.com/2019/07/09/notes-from-reverse-engineering-a-mono-aot-compiled-app-on-ios/
• https://www.hypn.za.net/blog/2020/04/19/hacking-unity-games-part-2-manipulating/