Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

How to analyze a Function in a Dumped DLL in Ghidra #768

Closed
PastClear opened this issue Dec 25, 2023 · 2 comments
Closed

How to analyze a Function in a Dumped DLL in Ghidra #768

PastClear opened this issue Dec 25, 2023 · 2 comments

Comments

@PastClear
Copy link

PastClear commented Dec 25, 2023

Hello Community,

i have an understanding problem with the following situation:

I need to analyze the source code of a Function in a dumped DLL from a IL2CPP Unity Android Game.

From my unterstanding Il2CPPDumper is only extracting the header of an function like what i see in DnSpy.

When i try to disassemble the DLL File in Ghidra its not showing any Code of the Function, its like the same in DnSpy.

So how im able to analyze the Code of an Function in an Dumped DLL?

Im quite confused because from my unterstanding the dumped DLL only has the Header of an Function and not the Code at all?

Is anyone out here to point me into the right direction?

@masagrator
Copy link
Contributor

masagrator commented Dec 25, 2023

So how im able to analyze the Code of an Function in an Dumped DLL?

That's the neat part, you don't.

This tool doesn't dump functions. It dumps only signatures from global-metadata.dat, for example to be applied to executable in disassembler or AssetStudio.

@PastClear
Copy link
Author

Thanks for the quick answer. its clarifying alot.
So my main question is out of the scope in this repo right?

Any tips for this like dumping the memory at runtime?
Thanks for helping me out otherwise can be closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants