Reverse Engineering VRChat's IL2CPP: When Every Static Dumper Fails

vrchat-il2cpp-re is a deobfuscation pipeline built specifically for VRChat’s IL2CPP binary. It’s archived now, frozen at 2026-07-01. The goal is straightforward: pull the obfuscated code out of GameAssembly.dll (222MB) and rename it. The baseline is Unity 6 (6000.0.60f1), roughly 64,773 classes, 569,859 methods, and 188,384 fields.

The obfuscation is Beebyte’s work: every identifier is rewritten into garbage characters like ÌÍÎÏ, and the struct field layout is reshuffled with each version. Add encrypted metadata and stripped IL2CPP exports, and static dumpers like Il2CppDumper just fall over.

My approach is reverse MethodInfo enumeration: scan every MethodInfo on the heap, resolve their klass, and rebuild the entire type tree. The whole thing self-verifies — ASLR heap segments are auto-detected, offsets are self-validated, and everything is aligned against ground truth, e.g. Vector3 = x/y/z and the method count of Transform.

In the end, 56.9% of classes got semantic names — that’s the ceiling, and it’s a structural one; methods hit 93.5%, fields 85.1%. To be clear, these names are inferred, not recovered — Beebyte destroys the original class names at compile time, so there’s simply no original name to pull back.

The pipeline runs through five stages in run_full_pipeline.py: merge the naming sources into a unified vocabulary, run the 11-stage renaming engine, apply cross-references, produce the deobfuscated dump, name_mapping.json, and a src/ tree of 1,538 C# files, and finally generate an IDA renaming script covering 226K+ functions. One full run takes about 30 seconds.

Along the way I dug up a few more things. The network layer is Photon Realtime + FlatBuffer, with a 4-token auth chain: Steam → VRChat API → Photon → EAC. EAC (EOS anti-cheat) will ban you for online analysis, so this only works against offline VRChat. Beebyte’s custom-XOR metadata decryption routine is documented too. It’s a private research project, no longer distributed — C# 61.6% + Python 37.5%, 188 scripts, paired with IDA Pro / Ghidra / Frida.