How eysap/il2bridge works
IL2Bridge injects a native loader into a Unity IL2CPP process and uses a separate broker CLI to discover targets, inspect metadata, resolve methods, manage hooks, and read hook events. The README documents the loader, reversible trampoline and breakpoint hooks, and bounded resumable event streaming. Source excerpts confirm parts of broker session handling, metadata decoding, loader dispatch, and trampoline installation; links for unsampled subsystems follow documented behavior and are limited accordingly.
Main entry points: ipc_server.c IPC server · main.cpp Broker commands · target_session.cpp Target session · init.c Loader initialization
Components 19
Broker CLI
- Broker commands
src/broker/cli/main.cpp - Method selectors
src/broker/client/client_models.cpp - Metadata parser
src/broker/metadata/metadata_file.cpp
Target Discovery
- Unity discovery
src/broker/metadata/unity_discovery.cpp - Target discovery
src/broker/client/target_discovery.cpp - Target session
src/broker/client/target_session.cpp - IPC transport
src/broker/client/ipc_transport.cpp
Loader Runtime
- Loader initialization
src/loader/init.c - Runtime discovery
src/loader/discovery.c - IL2CPP bridge
src/loader/bridge.c - IPC server
src/loader/ipc_server.c
Hooks and Events
- Hook registry
src/loader/hooks/registry.c - Trampoline hooks
src/loader/hooks/trampoline.c - Breakpoint hooks
src/loader/hooks/breakpoint.c - Hook handlers
src/loader/handlers/registry.c - Event ring
src/loader/events.c
Other components
- Engineer
- Unity target process
- IL2CPP runtime
Connections 22
- Engineer → Broker commands: runs commands
- Broker commands → Target discovery: discovers targets
- Broker commands → Metadata parser: inspects metadata
- Broker commands → Method selectors: parses selectors
- Broker commands → Target session: manages hooks
- Unity discovery → Metadata parser: locates metadata
- Target discovery → Target session: selects target
- Target session → IPC transport: sends requests
- IPC transport → IPC server: exchanges socket data
- Unity target process → Loader initialization: loads via LD_PRELOAD
- Loader initialization → Runtime discovery: starts discovery
- Runtime discovery → IL2CPP runtime: waits for mapping
- Loader initialization → IL2CPP bridge: initializes API
- IL2CPP bridge → IL2CPP runtime: resolves IL2CPP API
- IPC server → IL2CPP bridge: resolves methods
- IPC server → Hook registry: installs or removes
- IPC server → Hook handlers: looks up handler
- Hook registry → Trampoline hooks: installs transport
- Hook registry → Breakpoint hooks: installs transport
- Trampoline hooks → Event ring: publishes hook hits
- IPC server → Event ring: streams events
- Target session → IPC server: requests hook and event data