Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/p4nda0s/reverse-skills --skill rev-u3d-dump- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads rev-u3d-dump automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
rev-u3d-dump - Unity IL2CPP Symbol Dumper
Extract C# method names, addresses, and type definitions from Unity IL2CPP builds for IDA/Ghidra analysis.
Overview
Unity IL2CPP compiles C# to native code. The original class/method names are stripped from the binary but preserved in global-metadata.dat. This skill recovers the mapping between native function addresses and their original C# names.
Key Files in Unity Build
| File | Location | Purpose |
|---|---|---|
| Native binary | iOS: Frameworks/UnityFramework.framework/UnityFramework<br>Android: lib/{arch}/libil2cpp.so | Compiled C# code (Mach-O / ELF) |
| Metadata | Data/Managed/Metadata/global-metadata.dat | All type/method/string info |
Tool Selection
Il2CppDumper (recommended for metadata v39+)
Use the v39 fork for Unity 6+ builds:
- Repo:
https://github.com/roytu/Il2CppDumper(branch:v39) - Supports metadata v24–v39
- Outputs
script.jsonwith function addresses — ready for IDA/Ghidra import
The original Il2CppDumper (https://github.com/Perfare/Il2CppDumper) only supports up to v29.
Cpp2IL (alternative)
- Repo:
https://github.com/SamboyCoding/Cpp2IL - Supports metadata v39, but dummy DLLs lack
[Address]attributes - Useful for C# source reconstruction, not ideal for IDA import
Step-by-Step Workflow
Step 1: Locate IL2CPP Files
iOS (IPA):
# Unzip IPA
unzip -o app.ipa -d .
# Binary
BINARY="Payload/<AppName>.app/Frameworks/UnityFramework.framework/UnityFramework"
# Metadata
METADATA="Payload/<AppName>.app/Data/Managed/Metadata/global-metadata.dat"
Android (APK):
# Unzip APK
unzip -o app.apk -d .
# Binary (pick target arch)
BINARY="lib/arm64-v8a/libil2cpp.so"
# Metadata
METADATA="assets/bin/Data/Managed/Metadata/global-metadata.dat"
Step 2: Check Metadata Version
# First 8 bytes: magic (4) + version (4), little-endian
xxd -l 8 "$METADATA"
# Expected: af1b b1fa 2700 0000 → magic OK, version = 0x27 = 39
| Version | Unity | Tool |
|---|---|---|
| ≤ 29 | Unity 2021 and earlier | Original Il2CppDumper |
| 31 | Unity 2022 | Original Il2CppDumper (partial) |
| 39 | Unity 6 (6000.x) | roytu/Il2CppDumper v39 fork |
Step 3: Build & Run Il2CppDumper (v39 fork)
# Clone v39 fork
git clone -b v39 https://github.com/roytu/Il2CppDumper.git
# Build
cd Il2CppDumper
DOTNET_ROLL_FORWARD=LatestMajor dotnet build -c Release
# Run (use net8.0 framework)
DOTNET_ROLL_FORWARD=LatestMajor dotnet run \
--project Il2CppDumper/Il2CppDumper.csproj \
-c Release --framework net8.0 \
-- "$BINARY" "$METADATA" output_dir
Notes:
DOTNET_ROLL_FORWARD=LatestMajorallows running on .NET 9/10 even though the project targets .NET 6/8- Exit code 134 is normal in non-interactive mode (caused by
Console.ReadKey()at the end) - On macOS, if the binary gets SIGKILL'd, ad-hoc sign it:
codesign -s - <binary>
Step 4: Verify Output
Successful run produces these files in the output directory:
| File | Size (typical) | Purpose |
|---|---|---|
script.json | 50–100 MB | Function addresses + names + signatures (IDA/Ghidra import) |
dump.cs | 10–30 MB | C# class dump with RVA/VA addresses |
il2cpp.h | 50–100 MB | C struct definitions for type import |
ida_py3.py | ~2 KB | IDA Python import script |
Check script.json format:
{
"ScriptMethod": [
{
"Address": 40865744,
"Name": "ClassName$$MethodName",
"Signature": "ReturnType ClassName__MethodName (args...);",
"TypeSignature": "viii"
}
]
}
Check dump.cs format:
// RVA: 0x1A2B3C4 Offset: 0x1A2B3C4 VA: 0x1A2B3C4
public void MethodName() { }
Step 5: Import into IDA
- Open the native binary in IDA (UnityFramework / libil2cpp.so)
- Place
script.jsonandida_py3.pyin the same directory File → Script file...→ selectida_py3.py- The script reads
script.jsonand renames all functions automatically - Optional:
File → Load file → Parse C header file...→ selectil2cpp.hfor struct types
Step 5 (alt): Import into Ghidra
- Open the binary in Ghidra
- Use the
ghidra.pyorghidra_with_struct.pyscript from Il2CppDumper Window → Script Manager → Runwithscript.jsonin the same directory
Troubleshooting
| Error | Cause | Fix |
|---|---|---|
not a supported version[39] | Using original Il2CppDumper | Switch to roytu/Il2CppDumper v39 fork |
| Exit code 137 (SIGKILL) | macOS unsigned binary | codesign -s - <binary> |
Cannot read keys (exit 134) | Non-interactive console | Ignore — dump completed successfully |
DOTNET_ROLL_FORWARD error | .NET version mismatch | Set DOTNET_ROLL_FORWARD=LatestMajor |
| Empty output | Wrong binary/metadata pair | Verify both files are from the same build |
Output Usage Tips
dump.csis the quickest reference — search for class/method names with RVA addressesscript.jsonAddress values are decimal — convert to hex for IDA:hex(40865744)→0x26F8FD0- Field offsets in
dump.cs(e.g.,// 0x20) are relative to object base, useful for memory inspection with Frida
FAQ
What does the rev-u3d-dump skill do?
Dump Unity IL2CPP symbols from iOS/Android builds. Extract method names, addresses, and type info from IL2CPP binaries and global-metadata.dat, then generate IDA/Ghidra import scripts.
How do I install rev-u3d-dump?
Run npx skills add https://github.com/p4nda0s/reverse-skills --skill rev-u3d-dump in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/rev-u3d-dump/ (personal) or .claude/skills/rev-u3d-dump/ (project).
Which AI agents can use rev-u3d-dump?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is rev-u3d-dump safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains rev-u3d-dump?
It is published by p4nda0s in p4nda0s/reverse-skills. It has 1,782 recorded installs.
More from p4nda0s/reverse-skills
rev-frida
p4nda0s/reverse-skills
Generate Frida hook scripts using modern Frida API. Activate when the user wants to write Frida scripts, hook functions at runtime, trace calls or arguments or return values, intercept native or ObjC or Java methods, dump memory or exports, or handle native module load timing for Android and other targets.
rev-struct
p4nda0s/reverse-skills
Reconstruct data structures by analyzing memory access patterns across functions
rev-symbol
p4nda0s/reverse-skills
Restore function symbols by analyzing code patterns, strings, constants, and cross-references
rev-idapython
p4nda0s/reverse-skills
IDAPython and IDALib script reference for reverse engineering. Activate when the user needs to write IDAPython scripts in IDA, use IDALib for headless analysis, operate on IDB databases, debug with IDA, manipulate memory/registers, traverse functions/blocks/instructions, work with Hex-Rays decompiler API, handle obfuscation, or batch-process binaries.
rev-dex-dumper
p4nda0s/reverse-skills
Dump DEX files from a running Android app for unpacking/deobfuscation. Activate when the user wants to unpack an Android APK, dump DEX from memory, extract decrypted DEX files, or defeat class-loading packing.
rev-unicorn-debug
p4nda0s/reverse-skills
Debug and emulate specific code fragments or functions using the Unicorn engine. Activate when the user wants to emulate a function with Unicorn, trace binary execution without running the full program, decrypt or decode data by emulating the algorithm, or bypass environment dependencies (JNI, syscalls, libc) during emulation.
Popular mobile skills
design-mobile-apps
designed-by-ai/skills
Design mobile app screens with Sleek, edit Sleek projects, and implement their designs in React Native or HTML.
ios-design
uizze.sh
Design and review iOS UI/UX for iPhone apps in SwiftUI, UIKit, or React Native. Use for mobile app design, screen redesigns, navigation flows, typography, forms, keyboard and safe-area layout, and accessibility checks. Apply Apple Human Interface Guidelines and consult real product references through the optional Uizze connection.
vercel-react-native-skills
vercel-labs/agent-skills
React Native and Expo best practices for building performant mobile apps. Use when building React Native components, optimizing list performance, implementing animations, or working with native modules. Triggers on tasks involving React Native, Expo, mobile performance, or native platform APIs.
animate-expo
emilkowalski/skills
Build animations in React Native and Expo, making the decisions in the order that determines whether they feel right — should it animate, which thread it runs on, which properties, spring or timing, how the gesture hands off, how it degrades. Writes the implementation with Reanimated, Gesture Handler, Expo Router and expo-haptics. Use when animating anything in an Expo app, adding gestures, sheets, screen transitions, press feedback or haptics, or fixing motion that stutters on device. For web animation use animate.
xcode-project-setup
firebase/agent-skills
Safely modifies Xcode projects (.pbxproj) to add Swift Packages and link files. Use this skill whenever an iOS project needs dependencies installed (e.g. Firebase, Alamofire).
firebase-remote-config-basics
firebase/agent-skills
Manages Firebase Remote Config templates, feature flags, loading strategies, and SDKs (Android, iOS). Use when downloading/deploying remoteconfig JSON templates, managing version history/feature flags, setting in-app defaults, fetchAndActivate(), real-time listeners, or SDK setup. Don't use for Firebase Hosting, Auth, Firestore, Data Connect, Crashlytics, or App Hosting.