diff --git a/dumper/README.md b/dumper/README.md index fd9698f7c..85448afe7 100644 --- a/dumper/README.md +++ b/dumper/README.md @@ -20,4 +20,24 @@ After the dump folder has been moved to the `Pictures` folder simply click the f -Now that we have the dump files we are going to need to cut the desired shared object file out of the `.bin` memory range that contains our shared object. \ No newline at end of file +Now that we have the dump files we are going to need to cut the desired shared object file out of the `.bin` memory range that contains our shared object. + +As you can see the dump generates a text file that gives you all of the memory ranges + lib names. + + + +Now find the `.bin` that contains your ENTIRE `.so` memory range. Not just one of them. For this dump the range is: `92154000` - `98495000`. In the dump folder we can see a `.bin` that contains +this memory range. + + + +Open the .bin in hxd and search for "ELF" if you scroll down to the bottom you will see an ELF header! This is the header for the il2cpp.so! now calculate the size of the .so by taking the end address +and subtracting it with the start address. (`0x98495000` - `0x92154000` = `0x6341000`). + + + +Now that we have the memory selected, click file->new then paste, save as `il2cpp.so`. + +# using il2cppdumper + +Take the dumped `il2cpp.so` and `global-metadata.dat` file, put together in a new folder + make a folder inside of that new folder called `output`. \ No newline at end of file