https://github.com/stackdoubleflow/xref_apply
https://github.com/stackdoubleflow/xref_apply
Last synced: 11 months ago
JSON representation
- Host: GitHub
- URL: https://github.com/stackdoubleflow/xref_apply
- Owner: StackDoubleFlow
- Created: 2022-09-03T14:29:43.000Z (almost 4 years ago)
- Default Branch: il2cpp_v31
- Last Pushed: 2025-01-02T02:27:59.000Z (over 1 year ago)
- Last Synced: 2025-02-01T12:27:07.885Z (over 1 year ago)
- Language: Rust
- Size: 35.2 KB
- Stars: 0
- Watchers: 2
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# xref_apply
A command line tool to find symbol addresses in Unity IL2CPP AArch64 applications using xref traces.
## Usage
Firstly, you'll have to gather the following things:
- The traces that correspond to the specific Unity version and platform (`xref_gen.json`). You can generate the data with [xref_gen](https://github.com/StackDoubleFlow/xref_gen).
- The application's il2cpp shared object file (`libil2cpp.so`) and global metadata file (`global-metadata.dat`).
With those placed inside the `./data` directory, you can run the following command to generate a JSON file containing the addresses of any symbols it can find:
```
cargo run --release -- data/libil2cpp.so data/global-metadata.dat data/xref_gen.json
```
The output will be placed in `./data/xref_apply.json`. You may see several errors, but it is normal not to be able to sucessfully trace all symbols. These can be safely ignored.
## Importing into Ghidra
The ghidra script at `./data/xref_apply.py` will look for the output file `xref_apply.json` in the same directory. The script can only be ran once Auto Analysis on the binary has been completed. Once run, labels will be created for the symbols `xref_apply` had sucessfully found.