Il2CppInspector: C++ Scaffold Guide

## Overview This guide gathers practical examples for working with the Il2CppInspector C++ scaffold and the IL2CPP API when reverse engineering Unity games. Each section focuses on a discrete workflow, combining explanations, code snippets, and screenshots that demonstrate the expected output. > **Legal notice:** This repository is intended for educational purposes only. Always respect the license agreements and terms of service of any software you analyze. ## Quick Reference - **Installation:** Download the latest Il2CppInspectorPro release from the [official repository](https://github.com/jadis0x/Il2CppInspectorPro/releases). - **Requirements:** Familiarity with C++ and C#, plus a working understanding of the Unity engine. - **Getting started:** The examples assume you have already generated a C++ scaffold using **Il2CppInspectorPro 2025.6**. - **Prerequisites:** - Windows with **Visual Studio 2019** (or newer). - A local copy of the target Unity game. - The helper utilities provided in the [`lib`](https://github.com/jadis0x/il2cpp-reverse-engineering-guide/raw/main/lib) directory of this repository. - **Video tutorial:** [Watch on YouTube](https://www.youtube.com/watch?v=L7s2ttcNEh0). - **Contact:** Discord & Steam — **Jadis0x**. #### Prerequisites - Windows with **Visual Studio 2019** or newer installed - **Il2CppInspectorPro** (see the Installation section above) - Basic knowledge of C++/C# and the Unity game engine - A local copy of the target Unity game #### Navigation

Get the assemblies

This code snippet retrieves a raw list of all assemblies loaded in the active domain using the IL2CPP API. The il2cpp_domain_get_assemblies function serves a purpose similar to AppDomain.CurrentDomain.GetAssemblies() in managed C#, but it operates at a lower level and provides direct access to Il2CppAssembly structures.
```cpp // Get the active domain const Il2CppDomain* domain = il2cpp_domain_get(); // Define variables to hold the assembly list const Il2CppAssembly** assemblies; size_t size; // Use the il2cpp_domain_get_assemblies function to retrieve all assemblies assemblies = il2cpp_domain_get_assemblies(domain, &size); // Iterate through each assembly in the list for (size_t i = 0; i < size; ++i) { const Il2CppAssembly* assembly = assemblies[i]; if (assembly) { // Get the assembly name using il2cpp_image_get_name function const char* assemblyName = il2cpp_image_get_name(assembly->image); // Print the name of the assembly to the console std::cout << assemblyName << "\n"; } } ```

Summary of Get the assemblies

Get the Active Domain:
- Function: il2cpp_domain_get
- Description: Retrieves the active domain (Il2CppDomain) where the program is currently running.
Retrieve Assemblies:
- Function: il2cpp_domain_get_assemblies
- Description: Retrieves a list of all assemblies (Il2CppAssembly) within the specified domain (Il2CppDomain). The function returns an array of Il2CppAssembly pointers (assemblies) and updates the size variable with the number of assemblies found.
Iterate Through Assemblies:
- Using a for loop, iterate through each assembly in the assemblies array.
Get Assembly Name:
- Function: il2cpp_image_get_name
- Description: Retrieves the name of the assembly associated with the given image (Il2CppImage) within the assembly structure (Il2CppAssembly). It returns a const char* containing the assembly name.
Print Assembly Names:
- Print each assembly name retrieved from il2cpp_image_get_name to the console (std::cout).

Output:

Converting an Il2CppObject* to Type* and Understanding Its Usage

To obtain the type information here, we will use the GetTypeFromClass function inside my Il2cppHelper class. ```cpp Il2CppObject* Il2CppHelper::GetTypeFromClass(const Il2CppImage* image, const char* namespaze, const char* className) { if (!image) { return nullptr; } // Retrieve the Il2CppClass pointer Il2CppClass* targetClass = il2cpp_class_from_name(image, namespaze, className); if (!targetClass) { return nullptr; } // Retrieve the Il2CppType pointer const Il2CppType* targetType = il2cpp_class_get_type(targetClass); if (!targetType) { return nullptr; } // Retrieve the Il2CppObject pointer return il2cpp_type_get_object(targetType); // If it fails, nullptr will be returned. } ``` First, load the CoreModule from Unity, which contains many fundamental classes such as GameObject. ```cpp const Il2CppImage* _CoreModule = _helper->GetImage("UnityEngine.CoreModule.dll"); ``` If the module is successfully loaded, use the GetTypeFromClass function to get the type information for the GameObject class. ```cpp if (_CoreModule) { // Get the type information for the GameObject class in the UnityEngine namespace Il2CppObject* objectType = _helper->GetTypeFromClass(_CoreModule, "UnityEngine", "GameObject"); // Ensure the type information is retrieved successfully if (!objectType) { std::cout << "Failed to retrieve GameObject type.\n"; return; } // Cast Il2CppObject to Type Type* gameObjectType = reinterpret_cast(objectType); if (!gameObjectType) { std::cout << "Failed to cast to Type.\n"; return; } // Find all GameObject instances Object_1__Array* allGameObjects = Object_1_FindObjectsOfType(gameObjectType, nullptr); if (!allGameObjects) { std::cout << "No GameObjects found.\n"; return; } // Print the count of GameObject instances std::cout << "GameObject count: " << allGameObjects->max_length << "\n"; // Iterate through each GameObject instance for (int i = 0; i < allGameObjects->max_length; i++) { Object_1* currentGameObject = allGameObjects->vector[i]; if (!currentGameObject) { continue; // Skip null objects } // Check if the GameObject is active in the hierarchy GameObject* gameObject = reinterpret_cast(currentGameObject); if (gameObject && GameObject_get_activeInHierarchy(gameObject, nullptr)) { // Print the name of the active GameObject std::cout << "GameObject Name: " << il2cppi_to_string(Object_1_GetName(currentGameObject, nullptr)) << "\n"; } } } ``` In this example, we are passing the type of the object to be found (GameObject) as a parameter to the Object_1_FindObjectsOfType function. This actually allows us to achieve the following: ```cpp GameObject[] allGameObjects = FindObjectsOfType(); ``` > This function is quite slow. Using this function every frame is not recommended.

Summary of the Steps and il2cpp API Functions Used

Loading the Image:
- Function: GetImage
- Description: Loads the CoreModule image from Unity, which contains fundamental classes like GameObject.
Retrieving Class Information:
- Function: il2cpp_class_from_name
- Description: Retrieves class information using the image, namespace, and class name.
Getting Type Information from Class:
- Function: il2cpp_class_get_type
- Description: Obtains the type information from the class.
Getting Il2CppObject from Type:
- Function: il2cpp_type_get_object
- Description: Converts type information into an Il2CppObject.
Casting Il2CppObject to Type:
- Operation: reinterpret_cast<Type*>
- Description: Casts the retrieved Il2CppObject to Type.
Finding Objects of a Specific Type:
- Function: Object_1_FindObjectsOfType
- Description: Finds all objects of the specified type (GameObject in this case).
Checking if GameObject is Active:
- Function: GameObject_get_activeInHierarchy
- Description: Checks if the GameObject is active in the hierarchy.
Getting GameObject Name:
- Function: Object_1_GetName
- Description: Retrieves the name of the GameObject.

Output:

Getting class names and types from a specific assembly

This code snippet demonstrates how to retrieve and print the names and namespaces of classes within a specified assembly using il2cpp API functions.

```cpp void Il2CppHelper::GetClassesAndNamesFromAssembly(const Il2CppImage* _image) { if (_image) { size_t classCount = il2cpp_image_get_class_count(_image); std::cout << "{\n"; for (size_t i = 0; i < classCount; ++i) { const Il2CppClass* _klass = il2cpp_image_get_class(_image, i); if (_klass) { char* _name = const_cast(il2cpp_class_get_name(const_cast(_klass))); char* _namespace = const_cast(il2cpp_class_get_namespace(const_cast(_klass))); std::cout << " [\n"; std::cout << "\tName: " << _name << "\n"; std::cout << "\tNamespace: " << _namespace << "\n"; std::cout << " ],\n"; } } std::cout << "\n}\n"; } } ``` ```cpp const Il2CppImage* _BoltDll = _helper->GetImage("bolt.dll"); if (_BoltDll) { _helper->GetClassesAndNamesFromAssembly(_BoltDll); } ``` or ```cpp const Il2CppImage* _assemblyCSHARP = _helper->GetImage("Assembly-CSharp.dll"); if (_assemblyCSHARP) { _helper->GetClassesAndNamesFromAssembly(_assemblyCSHARP); } ```

Outputs:

Getting information about any method

* It allows you to print the name, return type, and parameter information of the target method. ```cpp void Il2CppHelper::GetMethodInfo(const Il2CppImage* _image, const char* _funcName, int argLength, const char* _class_name, const char* _class_namespace) { Il2CppClass* _class = il2cpp_class_from_name(_image, _class_namespace, _class_name); if (_class == nullptr) return; const MethodInfo* methodInfo = il2cpp_class_get_method_from_name(_class, _funcName, argLength); if (methodInfo == nullptr) return; Il2CppReflectionMethod* reflectionMethod = il2cpp_method_get_object(methodInfo, _class); // Check if the reflectionMethod is not null if (reflectionMethod == nullptr) return; std::cout << "{\n"; // Get the method's name from the reflectionMethod object const char* methodName = il2cpp_method_get_name(methodInfo); std::cout << "\tMethod Name: " << methodName << std::endl; const Il2CppType* returnType = il2cpp_method_get_return_type(methodInfo); std::cout << "\tReturn Type: " << il2cpp_type_get_name(returnType) << std::endl; // Get the parameter count of the method using il2cpp_method_get_param_count int parameterCount = il2cpp_method_get_param_count(methodInfo); std::cout << "\tParameter Count: " << parameterCount << std::endl; std::cout << "\t[\n"; // Get the parameter types of the method for (int i = 0; i < parameterCount; i++) { // Get the parameter type at index i using il2cpp_method_get_param const Il2CppType* parameterType = il2cpp_method_get_param(methodInfo, i); // Get the type name of the parameter type using il2cpp_type_get_name const char* parameterTypeName = il2cpp_type_get_name(parameterType); // Print the parameter type name to the console std::cout << "\t\tParameter " << i << " Type: " << parameterTypeName << std::endl; } std::cout << "\t]\n"; std::cout << "}\n"; } ``` ```cpp const Il2CppImage* _AssemblyCSharp = _helper->GetImage("Assembly-CSharp.dll"); _helper->GetMethodInfo(_AssemblyCSharp, "SetFOV", 1, "NolanBehaviour", ""); ```

Output:

Calling a function with "il2cpp_runtime_invoke"

```cpp if (GetAsyncKeyState(VK_F1) & 0x8000) { const Il2CppImage* assemblyCSharp = _helper->GetImage("Assembly-CSharp.dll"); if (!assemblyCSharp) { std::cout << "Failed to get Assembly-CSharp.dll image.\n"; return; } _helper->GetMethodInfo(assemblyCSharp, "SetRank", 1, "NolanRankController", ""); } if (GetAsyncKeyState(VK_F2) & 0x8000) { const Il2CppImage* csharpImage = _helper->GetImage("Assembly-CSharp.dll"); if (!csharpImage) { std::cout << "Failed to get Assembly-CSharp.dll image.\n"; return; } // Get the NolanRankController type Il2CppObject* nolanObj = _helper->GetTypeFromClass(csharpImage, "", "NolanRankController"); if (!nolanObj) { std::cout << "Failed to get NolanRankController type.\n"; return; } Type* TNolan = reinterpret_cast(nolanObj); auto isTypeValid = Object_1_FindObjectOfType(TNolan, nullptr); if (!isTypeValid) { std::cout << "NolanRankController instance not found.\n"; return; } // Cast to NolanBehaviour NolanBehaviour* nolanBehaviour = reinterpret_cast(isTypeValid); if (!nolanBehaviour) { std::cout << "Failed to cast to NolanBehaviour.\n"; return; } // Get class information Il2CppClass* nolanClass = il2cpp_class_from_name(csharpImage, "", "NolanRankController"); if (!nolanClass) { std::cout << "Failed to retrieve NolanRankController class.\n"; return; } // Get method information const MethodInfo* methodInfo = il2cpp_class_get_method_from_name(nolanClass, "SetRank", 1); if (!methodInfo) { std::cout << "Failed to get SetRank method.\n"; return; } int newRankValue = 666; void* params[] = { &newRankValue }; std::cout << "Calling SetRank function...\n"; il2cpp_runtime_invoke(methodInfo, nolanBehaviour, params, nullptr); } ```

Output:

Getting a List of All Functions in the Target Class

* This function, serves the purpose of obtaining and displaying a list of all methods within a given class (specified by the klass parameter). It iterates through each method in the class using a loop, retrieving information such as the method name and its return type. Subsequently, it prints out the method name along with its return type, providing a clear representation of the methods contained within the class ```cpp void Il2CppHelper::PrintMethods(Il2CppClass* klass) { const MethodInfo* methodIter = nullptr; void* iter = nullptr; // Retrieve all methods of the class while ((methodIter = il2cpp_class_get_methods(klass, &iter)) != nullptr) { // Get the name of the method const char* methodName = il2cpp_method_get_name(methodIter); // Get the return type of the method const Il2CppType* methodReturnType = il2cpp_method_get_return_type(methodIter); char* returnTypeName = il2cpp_type_get_name(methodReturnType); // Print the method name and its return type std::cout << "Method Name: " << methodName; std::cout << " (" << returnTypeName << ")\n------------------------------------\n"; // Perform necessary memory operations il2cpp_free(returnTypeName); } } ``` ## Example: ```cpp const Il2CppImage* _image = _helper->GetImage("Assembly-CSharp.dll"); if (_image) { Il2CppClass* nolanRankControllerClass = il2cpp_class_from_name(_timage, "", "NolanRankController"); if (nolanRankControllerClass != nullptr) { _helper->PrintMethods(nolanRankControllerClass); } } ```

Output:

Getting Information about Class Fields (FieldInfo)

* It allows us to get information about the fields of a class ```cpp void Il2CppHelper::GetFieldsInformation(Il2CppClass* klass) { void* iter = nullptr; FieldInfo* field = nullptr; // Iterate through the fields of the class while ((field = il2cpp_class_get_fields(klass, &iter)) != nullptr) { // Get the name of the field const char* fieldName = il2cpp_field_get_name(field); // Get the type of the field const Il2CppType* fieldType = il2cpp_field_get_type(field); char* fieldTypeStr = il2cpp_type_get_name(fieldType); // Print the information about the field std::cout << "Field Name: " << fieldName << std::endl; std::cout << "Type: " << fieldTypeStr << std::endl; std::cout << "-----------\n"; } } ``` ```cpp const Il2CppImage* _assemblyCSHARP = _helper->GetImage("Assembly-CSharp.dll"); if (_assemblyCSHARP) { Il2CppClass* _nolanBehaviourClass = il2cpp_class_from_name(_assemblyCSHARP, "", "NolanBehaviour"); _helper->GetFieldsInformation(_nolanBehaviourClass); } ```

Output:

Modifiying the Value of a Field

```cpp if (GetAsyncKeyState(VK_F1) & 0x8000) { // Get the Il2CppImage for "Assembly-CSharp.dll" const Il2CppImage* assemblyCSharp = _helper->GetImage("Assembly-CSharp.dll"); if (!assemblyCSharp) { std::cout << "Failed to get Assembly-CSharp.dll image.\n"; return; } // Get the object for the "Menu" class within the "Horror" namespace Il2CppObject* horrorMenuClassObject = _helper->GetTypeFromClass(assemblyCSharp, "Horror", "Menu"); if (!horrorMenuClassObject) { std::cout << "Failed to get Horror::Menu class.\n"; return; } // Find the object instance of the "Menu" class auto menuType = app::Object_1_FindObjectOfType_1(reinterpret_cast(horrorMenuClassObject), true, nullptr); if (!menuType) { std::cout << "Failed to find an instance of Horror::Menu.\n"; return; } // Get the Il2CppClass for the "Menu" class Il2CppClass* menuClass = il2cpp_class_from_name(assemblyCSharp, "Horror", "Menu"); if (!menuClass) { std::cout << "Failed to get Il2CppClass for Horror::Menu.\n"; return; } // Get the FieldInfo for the "steamName" field FieldInfo* steamNameField = il2cpp_class_get_field_from_name(menuClass, "steamName"); if (!steamNameField) { std::cout << "Field 'steamName' does not exist in Horror::Menu.\n"; return; } std::cout << "Field 'steamName' exists!\n"; // Define a new value for the field const char* newSteamNameValue = "il2cpp-field"; // Create a new Il2CppString from the new value Il2CppString* newSteamNameString = il2cpp_string_new(newSteamNameValue); if (!newSteamNameString) { std::cout << "Failed to create Il2CppString for new steam name.\n"; return; } // Set the field's value to the new value il2cpp_field_set_value(menuType, steamNameField, newSteamNameString); std::cout << "Successfully updated 'steamName' field!\n"; } ```

Creating a Helper Function to Find Objects of a Specific Type ("FindObjectOfType")

**FindObjectOfType** function is used to search for an object of a specific class (type). Our goal is to write our own function that will simplify this process in the IL2CPP environment. This way, we can obtain a more flexible and customized solution for direct access to Unity's objects. **Basic Logic of the Function:** - **Load the Assembly:** We open the specified assembly file to access its classes. - **Find the Class:** We locate the class in the assembly using the className parameter. - **Get the Type of the Class:** We access the type (Type) of the class we found. - **Search for the Unity Object:** We perform an object search using Unity's internal functions (e.g., app::Object_1_FindObjectOfType) -> defined in the *il2cpp-functions.h* header file. - **Result**: Once the object is found, we return it by casting to the appropriate type (T)."
**Here is the function we will write according to the logic explained above:** ```cpp template T* FindObjectOfType(const char* className, const char* classNamespace = "", const char* assemblyName = "Assembly-CSharp.dll") { // Getting the IL2CPP domain - the domain represents the runtime environment where all objects are loaded Il2CppDomain* domain = il2cpp_domain_get(); if (!domain) { std::cout << "Error: Failed to get IL2CPP domain!" << std::endl; return nullptr; } // Loading the assembly - loading the specific assembly (like Assembly-CSharp.dll) in which the class is defined const Il2CppAssembly* assembly = il2cpp_domain_assembly_open(domain, assemblyName); if (!assembly) { std::cout << "Error: Failed to load assembly (" << assemblyName << ")" << std::endl; return nullptr; } // Loading the class by name - locating the class inside the assembly using classNamespace and className Il2CppClass* klass = il2cpp_class_from_name(assembly->image, classNamespace, className); if (!klass) { std::cout << "Error: Class not found (" << classNamespace << "::" << className << ")" << std::endl; return nullptr; } // Getting the class type - retrieving the type information of the class (Il2CppType) const Il2CppType* type = il2cpp_class_get_type(klass); if (!type) { std::cout << "Error: Failed to get class type (" << className << ")" << std::endl; return nullptr; } // Getting the type object - using the class type to get the corresponding type object in Unity Il2CppObject* typeObject = il2cpp_type_get_object(type); if (!typeObject) { std::cout << "Error: Failed to get type object!" << std::endl; return nullptr; } // Calling Unity's FindObjectOfType method - this function finds the first object of the given type in the scene app::Object_1* foundObject = app::Object_1_FindObjectOfType(reinterpret_cast(typeObject), nullptr); if (!foundObject) { std::cout << "Warning: Object not found (" << className << ")" << std::endl; return nullptr; } // Returning the found object cast to the specified type return reinterpret_cast(foundObject); } ```
Now, let me show an example from the macro below using our FindObjectOfType function. The following function simulates the click of the 'Start' button in the lobby menu. ```cpp DO_APP_FUNC(0x006AC8A0, void, Menu_OnLobbyStartButtonClick, (Menu * __this, MethodInfo * method)); ```
```cpp #include "pch-il2cpp.h" #define WIN32_LEAN_AND_MEAN #include #include #include "il2cpp-appdata.h" #include "helpers.h" #include #include extern const LPCWSTR LOG_FILE = L"il2cpp-log.txt"; // Template function to find an object of a specified class type in the Unity scene // This function is used to search for the first instance of a class in the scene by class name template T* FindObjectOfType(const char* className, const char* classNamespace = "", const char* assemblyName = "Assembly-CSharp.dll") { // Getting the IL2CPP domain - the domain represents the runtime environment where all objects are loaded Il2CppDomain* domain = il2cpp_domain_get(); if (!domain) { std::cout << "Error: Failed to get IL2CPP domain!" << std::endl; return nullptr; } // Loading the assembly - loading the specific assembly (like Assembly-CSharp.dll) in which the class is defined const Il2CppAssembly* assembly = il2cpp_domain_assembly_open(domain, assemblyName); if (!assembly) { std::cout << "Error: Failed to load assembly (" << assemblyName << ")" << std::endl; return nullptr; } // Loading the class by name - locating the class inside the assembly using classNamespace and className Il2CppClass* klass = il2cpp_class_from_name(assembly->image, classNamespace, className); if (!klass) { std::cerr << "Error: Class not found (" << classNamespace << "::" << className << ")" << std::endl; return nullptr; } // Getting the class type - retrieving the type information of the class (Il2CppType) const Il2CppType* type = il2cpp_class_get_type(klass); if (!type) { std::cerr << "Error: Failed to get class type (" << className << ")" << std::endl; return nullptr; } // Getting the type object - using the class type to get the corresponding type object in Unity Il2CppObject* typeObject = il2cpp_type_get_object(type); if (!typeObject) { std::cout << "Error: Failed to get type object!" << std::endl; return nullptr; } // Calling Unity's FindObjectOfType method - this function finds the first object of the given type in the scene app::Object_1* foundObject = app::Object_1_FindObjectOfType(reinterpret_cast(typeObject), nullptr); if (!foundObject) { std::cerr << "Warning: Object not found (" << className << ")" << std::endl; return nullptr; } // Returning the found object cast to the specified type return reinterpret_cast(foundObject); } void Run() { // Initialize thread data - DO NOT REMOVE Il2CppDomain* domain = il2cpp_domain_get(); il2cpp_thread_attach(domain); il2cppi_new_console(); while (true) { // Check if the F1 key is pressed - GetAsyncKeyState returns the state of a specific key if (GetAsyncKeyState(VK_F1) & 0x8000) { // Try to find the "Menu" object in the "Horror" namespace app::Menu* _menu = FindObjectOfType("Menu", "Horror"); // If the menu is found, attempt to invoke the 'OnLobbyStartButtonClick' function if (_menu) { // Ensure that the function pointer is valid before calling it if (app::Menu_OnLobbyStartButtonClick != nullptr) { app::Menu_OnLobbyStartButtonClick(_menu, nullptr); // Simulates the click of the "Start" button in the lobby menu } } } std::this_thread::sleep_for(std::chrono::seconds(1)); } } ```

Reading and Managing Static and Instance Properties

A guide to accessing and managing static and instance properties. Explains how to create a custom PropertyAccessor class ```cpp // The `PropertyAccessor` class provides an interface to interact with Il2Cpp objects, // enabling access to classes, static properties, and instance properties in a given assembly. class PropertyAccessor { private: /** * @brief Finds an Il2Cpp class by its namespace and class name within the current image. * * This method is used to locate and retrieve a class definition from the Il2Cpp image. * It performs checks to ensure the image, assembly, and class exist. * * @param namespaceName The namespace where the target class resides. * @param className The name of the class to find. * @return A pointer to the `Il2CppClass` if found; otherwise, nullptr. */ Il2CppClass* FindClass(const std::string& namespaceName, const std::string& className) { if (!currentImage) { std::cout << "[Error] Current image is null." << std::endl; return nullptr; } const Il2CppAssembly* assembly = currentImage->assembly; if (!assembly) { std::cout << "[Error] Assembly is null." << std::endl; return nullptr; } const Il2CppImage* image = il2cpp_assembly_get_image(assembly); if (!image) { std::cout << "[Error] Image is null." << std::endl; return nullptr; } Il2CppClass* klass = il2cpp_class_from_name(image, namespaceName.c_str(), className.c_str()); if (!klass) { std::cout << "[Error] Class not found: " << namespaceName << "." << className << std::endl; return nullptr; } return klass; } public: /** * @brief Constructs the `PropertyAccessor` object, initializing the image for the specified assembly. * * This constructor initializes the current Il2Cpp image by opening the specified assembly * in the current domain. The image is required for accessing classes and properties. * * @param assemblyName The name of the assembly to load (e.g., "UnityEngine.CoreModule.dll"). */ PropertyAccessor(const char* assemblyName) { // Retrieve the Il2Cpp domain Il2CppDomain* domain = il2cpp_domain_get(); if (!domain) { std::cout << "[ERROR] Il2Cpp domain not available."; } // Open the specified assembly and retrieve its image if (assemblyName && *assemblyName) { currentImage = il2cpp_domain_assembly_open(domain, assemblyName)->image; if (!currentImage) { std::cout << "[ERROR] Assembly not found: " + std::string(assemblyName); } } } /** * @brief Retrieves the value of a static property from a given class. * * This method finds the class by its namespace and name, locates the getter method * for the specified property, and invokes the method to retrieve the property value. * * @tparam T The expected type of the property value. * @param classNamespace The namespace of the target class. * @param className The name of the class containing the static property. * @param propertyName The name of the property to retrieve. * @return The value of the property as type `T`. */ template T getStaticProperty(const std::string& classNamespace, const std::string& className, const std::string& propertyName) { Il2CppClass* klass = FindClass(classNamespace, className); if (!klass) { std::cout << "[Error] Class not found: " + classNamespace + "." + className; } std::string getterName = "get_" + propertyName; const MethodInfo* getterMethod = il2cpp_class_get_method_from_name(klass, getterName.c_str(), 0); if (!getterMethod) { std::cout << "[Error] Getter method not found: " + propertyName; } // Invoke the getter method to retrieve the property value Il2CppObject* result = il2cpp_runtime_invoke(getterMethod, nullptr, nullptr, nullptr); return convertResult(result); } /** * @brief Retrieves the value of an instance property from a given object. * * This method checks the validity of the provided instance, locates the getter * method for the specified property, and invokes it to retrieve the property value. * * @tparam T The expected type of the property value. * @param instance A pointer to the Il2CppObject instance. * @param propertyName The name of the property to retrieve. * @return The value of the property as type `T`. */ template T getInstanceProperty(Il2CppObject* instance, const std::string& propertyName) { if (!instance) { std::cout << "[Error] Instance is null."; } Il2CppClass* klass = il2cpp_object_get_class(instance); if (!klass) { std::cout << "[Error] Class not found."; } std::string getterName = "get_" + propertyName; const MethodInfo* getterMethod = il2cpp_class_get_method_from_name(klass, getterName.c_str(), 0); if (!getterMethod) { std::cout << "[Error] Getter method not found: " + propertyName; } // Invoke the getter method to retrieve the property value Il2CppObject* result = il2cpp_runtime_invoke(getterMethod, instance, nullptr, nullptr); return convertResult(result); } /** * @brief Converts the Il2CppObject result to the desired type `T`. * * This method supports basic data types (e.g., strings, numerics, enums) and * directly returns pointers for complex object types. * * @tparam T The expected type of the result. * @param result The `Il2CppObject` to be converted. * @return The converted result as type `T`. */ template T convertResult(Il2CppObject* result) { if (!result) { std::cout << "[Error] Null result."; } if constexpr (std::is_same_v) { // Convert Il2CppString to std::string Il2CppString* il2cppString = reinterpret_cast(result); return il2cppi_to_string(il2cppString); } else if constexpr (std::is_arithmetic_v || std::is_enum_v) { // Unbox primitive types or enums return *(T*)il2cpp_object_unbox(result); } else { // Return the result as a raw pointer for other types return reinterpret_cast(result); } } private: const Il2CppImage* currentImage; // The Il2CppImage associated with the target assembly. }; ``` Now that we have written our PropertyAccessor class, let's create some examples and test it. We will use the PropertyAccessor class to read static properties like Application.version and Application.dataPath, and to retrieve the main camera instance ```cpp void Run() { // Initialize thread data - DO NOT REMOVE il2cpp_thread_attach(il2cpp_domain_get()); il2cppi_new_console(); PropertyAccessor appProperty("UnityEngine.CoreModule.dll"); //UnityEngine.Application.version std::cout << appProperty.getStaticProperty("UnityEngine", "Application", "version") << "\n"; //UnityEngine.Application.dataPath std::cout << appProperty.getStaticProperty("UnityEngine", "Application", "dataPath") << "\n"; //UnityEngine.Application.productName std::cout << appProperty.getStaticProperty("UnityEngine", "Application", "productName") << "\n"; //UnityEngine.Application.unityVersion std::cout << appProperty.getStaticProperty("UnityEngine", "Application", "unityVersion") << "\n"; PropertyAccessor cameraProperty("UnityEngine.CoreModule.dll"); //UnityEngine.Camera.main app::Camera* mainCamera = cameraProperty.getStaticProperty("UnityEngine", "Camera", "main"); if (mainCamera) { std::cout << "main camera retrieved!!\n"; } else { std::cout << "main camera is nullptr.\n"; } } ``` Output:

Now, let's move on to further enhancing our class. I will create a UGameObject class that will inherit from PropertyAccessor. This class will serve as a dedicated helper for operations related to GameObject. It will encapsulate all the functionality required for interacting with GameObject instances, such as retrieving objects by tag, accessing their properties, and performing related tasks in a structured manner. ```cpp class UGameObject : public PropertyAccessor { public: UGameObject() : PropertyAccessor("UnityEngine.CoreModule.dll") {} // Finds a GameObject by tag app::GameObject* FindWithTag(const char* tag) { // Find GameObject class Il2CppClass* klass = FindClass("UnityEngine", "GameObject"); if (!klass) { std::cout << "[Error] GameObject class not found.\n"; return nullptr; } // Find the FindWithTag method const MethodInfo* method = il2cpp_class_get_method_from_name(klass, "FindWithTag", 1); if (!method) { std::cout << "[Error] GameObject.FindWithTag method not found.\n"; return nullptr; } // Create Il2CppString for the tag Il2CppString* il2cppTag = il2cpp_string_new(tag); // Invoke the method Il2CppException* exception = nullptr; Il2CppObject* result = il2cpp_runtime_invoke(method, nullptr, reinterpret_cast(&il2cppTag), &exception); if (exception) { char exceptionMessage[1024]; il2cpp_format_exception(exception, exceptionMessage, sizeof(exceptionMessage)); std::cout << "[Error] Exception occurred during FindWithTag call: " << exceptionMessage << "\n"; return nullptr; } if (result) { return reinterpret_cast(result); } return nullptr; } // Retrieves the activeInHierarchy property bool GetActiveInHierarchy(app::GameObject* gameObject) { return getInstanceProperty(reinterpret_cast(gameObject), "activeInHierarchy"); } // Retrieves the activeSelf property bool GetActiveSelf(app::GameObject* gameObject) { return getInstanceProperty(reinterpret_cast(gameObject), "activeSelf"); } // Retrieves the layer property int GetLayer(app::GameObject* gameObject) { return getInstanceProperty(reinterpret_cast(gameObject), "layer"); } // Retrieves the tag property std::string GetTag(app::GameObject* gameObject) { return getInstanceProperty(reinterpret_cast(gameObject), "tag"); } // Retrieves the transform property app::Transform* GetTransform(app::GameObject* gameObject) { return getInstanceProperty(reinterpret_cast(gameObject), "transform"); } }; ``` Now, let's move on to creating an example ```cpp void Run() { // Initialize thread data - DO NOT REMOVE il2cpp_thread_attach(il2cpp_domain_get()); il2cppi_new_console(); // Create an instance of UGameObject UGameObject gameObjectHelper; while (true) { // Check if the F1 key is pressed - GetAsyncKeyState returns the state of a specific key if (GetAsyncKeyState(VK_F1) & 0x8000) { // Example usage: Find a GameObject by tag app::GameObject* myObject = gameObjectHelper.FindWithTag("Player"); if (myObject) { std::cout << "GameObject found with tag 'Player'.\n"; std::cout << "Active in Hierarchy: " << gameObjectHelper.GetActiveInHierarchy(myObject) << "\n"; std::cout << "Active Self: " << gameObjectHelper.GetActiveSelf(myObject) << "\n"; std::cout << "Layer: " << gameObjectHelper.GetLayer(myObject) << "\n"; std::cout << "Tag: " << gameObjectHelper.GetTag(myObject) << "\n"; app::Transform* transform = gameObjectHelper.GetTransform(myObject); if (transform) { std::cout << "Transform component retrieved.\n"; } else { std::cout << "[Error] Transform component not found.\n"; } } else { std::cout << "[Error] GameObject with tag 'Player' not found. -> you're probably on the menu, so it's normal\n"; } } Sleep(1000); } } ``` Output:

Finally, just like with the GameObject logic, let's create a UTransform class and demonstrate it with an example ```cpp class UTransform : public PropertyAccessor { public: UTransform(app::Transform* transform) : PropertyAccessor("UnityEngine.CoreModule.dll") { this->transform = transform; } private: app::Transform* transform; public: app::Vector3 GetPosition() { auto obj = getInstanceProperty(reinterpret_cast(transform), "position"); return *(reinterpret_cast(il2cpp_object_unbox(obj))); } app::Vector3 GetRotation() { auto obj = getInstanceProperty(reinterpret_cast(transform), "rotation"); return *(reinterpret_cast(il2cpp_object_unbox(obj))); } app::Vector3 GetScale() { auto obj = getInstanceProperty(reinterpret_cast(transform), "localScale"); return *(reinterpret_cast(il2cpp_object_unbox(obj))); } }; ``` ```cpp void Run() { // Initialize thread data - DO NOT REMOVE il2cpp_thread_attach(il2cpp_domain_get()); il2cppi_new_console(); // Create an instance of UGameObject UGameObject gameObjectHelper; while (true) { // Check if the F1 key is pressed - GetAsyncKeyState returns the state of a specific key if (GetAsyncKeyState(VK_F1) & 0x8000) { // Example usage: Find a GameObject by tag app::GameObject* myObject = gameObjectHelper.FindWithTag("Player"); if (myObject) { std::cout << "GameObject found with tag 'Player'.\n"; app::Transform* playerTransform = gameObjectHelper.GetTransform(myObject); if (playerTransform) { std::cout << "Transform component retrieved.\n"; UTransform transformHelper(playerTransform); std::cout << "Position: [x,y,z]" << transformHelper.GetPosition().x << "," << transformHelper.GetPosition().y << "," << transformHelper.GetPosition().z << "\n"; std::cout << "Rotation: [x,y,z]" << transformHelper.GetRotation().x << "," << transformHelper.GetRotation().y << "," << transformHelper.GetRotation().z << "\n"; std::cout << "Scale: [x,y,z]" << transformHelper.GetScale().x << "," << transformHelper.GetScale().y << "," << transformHelper.GetScale().z << "\n"; } else { std::cout << "[Error] Transform component not found.\n"; } } else { std::cout << "[Error] GameObject with tag 'Player' not found. -> you're probably on the menu, so it's normal\n"; } } Sleep(1000); } } ``` Output:

Il2CppInspector C++ Scaffold Mod Example

As a reference, you can check out my open-source IL2CPP mod project built using Il2CppInspectorPro C++ scaffold: [DevourX](https://github.com/jadis0x/DevourX)