dump
一样是很常规的两个路径：
apk\lib\arm64-v8a\libil2cpp.so
.apk\assets\bin\Data\Managed\Metadata\global-metadata.dat 但有加密。
ida 打开 libil2cpp.so 在老地方可以看到老朋友
if ( v9 >= 1 ) { v11 = 0; do { *(_BYTE *)(v10 + v11) ^= byte_3120170[v11 & 0x7F]; ++v11; } while ( v9 != (_DWORD)v11 ); }那还说啥了
.rodata:0000000003120170 ; _BYTE byte_3120170[128].rodata:0000000003120170 D7 EA CE AC 81 0A 43 0D byte_3120170 DCB 0xD7, 0xEA, 0xCE, 0xAC, 0x81, 0xA, 0x43, 0xD, 0x47.rodata:0000000003120170 47 ; DATA XREF: sub_6AC4FB4+12C↓o.rodata:0000000003120179 1D 5A 79 7F C9 45 77 8C… DCB 0x1D, 0x5A, 0x79, 0x7F, 0xC9, 0x45, 0x77, 0x8C, 0x1A.rodata:0000000003120182 D7 51 22 01 95 32 5B 7A… DCB 0xD7, 0x51, 0x22, 1, 0x95, 0x32, 0x5B, 0x7A, 0xE9.rodata:000000000312018B AA 5C 1C E4 29 10 95 13… DCB 0xAA, 0x5C, 0x1C, 0xE4, 0x29, 0x10, 0x95, 0x13, 0xDE.rodata:0000000003120194 E6 B6 69 F1 3C 39 D4 9C… DCB 0xE6, 0xB6, 0x69, 0xF1, 0x3C, 0x39, 0xD4, 0x9C, 0x21.rodata:000000000312019D C0 BE E9 F9 B6 CA 76 70… DCB 0xC0, 0xBE, 0xE9, 0xF9, 0xB6, 0xCA, 0x76, 0x70, 0xAF.rodata:00000000031201A6 88 D5 55 9B 50 06 21 98… DCB 0x88, 0xD5, 0x55, 0x9B, 0x50, 6, 0x21, 0x98, 0xB1.rodata:00000000031201AF 2A 38 30 68 E9 B6 67 91… DCB 0x2A, 0x38, 0x30, 0x68, 0xE9, 0xB6, 0x67, 0x91, 0xD6.rodata:00000000031201B8 B1 E5 14 E8 2D F9 11 9B… DCB 0xB1, 0xE5, 0x14, 0xE8, 0x2D, 0xF9, 0x11, 0x9B, 0xBC.rodata:00000000031201C1 FF B1 A5 52 6E B9 61 0D… DCB 0xFF, 0xB1, 0xA5, 0x52, 0x6E, 0xB9, 0x61, 0xD, 0x3D.rodata:00000000031201CA 88 4A 65 62 D0 A3 88 A9… DCB 0x88, 0x4A, 0x65, 0x62, 0xD0, 0xA3, 0x88, 0xA9, 0x64.rodata:00000000031201D3 F0 57 D4 32 92 25 F3 C5… DCB 0xF0, 0x57, 0xD4, 0x32, 0x92, 0x25, 0xF3, 0xC5, 0x8A.rodata:00000000031201DC 9A A0 A8 5B 89 B5 4A 22… DCB 0x9A, 0xA0, 0xA8, 0x5B, 0x89, 0xB5, 0x4A, 0x22, 0xE7.rodata:00000000031201E5 0B D8 CA 76 07 DC 79 DE… DCB 0xB, 0xD8, 0xCA, 0x76, 7, 0xDC, 0x79, 0xDE, 0x46, 0x71.rodata:00000000031201EF 4E DCB 0x4E手搓秒了