Cave Crawlers / dual 0.7.0 fixed
Unity IL2CPP defaults dumped 2026-09-19 · uploaded by Ꭲ𝒉𝒆𝗭 · Zircon 0.7.0 · report
Dual mode, merge corrected: enum paths no longer shadowed
Runtime and source
- Runtime
- Unity IL2CPP
- Evidence
- object header is 16 bytes, from the runtime rather than assumed
- field iteration is bounded by il2cpp_class_num_fields, so the call that terminates it is never made
- 159102 function entry points in the exception directory, used to check that a slot holds code and not merely an address inside the module
- slot 0x0: 96% in an executable section, 77% at a function entry point, 89% distinct, varies 96% within one argument shape
- slot 0x8: 100% in an executable section, 80% at a function entry point, 91% distinct, varies 96% within one argument shape
- slot 0x10: 100% in an executable section, 73% at a function entry point, 31% distinct, varies 49% within one argument shape
- anchored on 431 methods across 64 classes and 23 argument shapes
- name at 0x18, klass at 0x20, return type at 0x28, token at 0x48, every one by exact match against the pointer the API handed back
- body at 0x0, invoker at 0x10: the invoker repeats 2.9x more across the sample and varies less inside one argument shape, which is what being shared by every method of that shape looks like
- a third code pointer at 0x8; Unity added one in 2021.2 for value-type adjustor thunks, and the method's own code is the first of the three
- metadata: header tiles the file with 2 int32 per entry and 31 spans, 4 bytes of padding and 0 left over
- metadata: span 2 is the identifier blob: 108619 names, 94% identifier bytes
- metadata: span 19 is the type table: 14790 records of 88 bytes, declaring 8 ranges that partition another table exactly
- metadata: type name is slot 0, namespace 1
- metadata: metadata tokens: type slot 21, field slot 2, method slot 6
- metadata: tables named by shape: strings 2, types 19, images 20, fields 11, methods 5, parameters 10, properties 4, events 3, nested types 15
- metadata: read from global-metadata.dat with no process: names, namespaces and tokens are exact, and field types, field offsets and method addresses are absent because they live in the binary rather than in the metadata
- metadata: every type is filed as a class: struct and enum come from a type's parent, which is an index into the binary rather than anything in this file. A dual run takes that from the runtime
- Process
- Cave Crawlers.exe
- Module base
- 0x7ffb1d370000 · image 51.4 MB
- Method
- internal
- Read from
- both the running runtime and global-metadata.dat, merged
- Dumped
- 2026-09-19 05:02 UTC
- Zircon
- 0.7.0 · schema 3
- Index
- 442 MB SQLite from 560 MB JSON · search: fts5
Largest packages
81 in total
mscorlib.dll
Assembly-CSharp.dll
PlayFab.dll
System.dll
UnityEngine.UIElementsModule.dll
UnityEngine.CoreModule.dll
System.Core.dll
Unity.InputSystem.dll
System.Xml.dll
Sirenix.Serialization.dll
Unity.Localization.dll
Unity.RenderPipelines.Core.Runtime.dll
Types per package. The full list is in the browser sidebar.
Runtime addresses
module-relative · click to copyGlobals75
| Name | Address |
|---|---|
| il2cpp_domain_get | |
| il2cpp_domain_get_assemblies | |
| il2cpp_assembly_get_image | |
| il2cpp_image_get_name | |
| il2cpp_image_get_class_count | |
| il2cpp_image_get_class | |
| il2cpp_class_get_name | |
| il2cpp_class_get_namespace | |
| il2cpp_class_get_parent | |
| il2cpp_class_get_fields | |
| il2cpp_class_get_methods | |
| il2cpp_class_get_properties | |
| il2cpp_class_get_events | |
| il2cpp_class_get_nested_types | |
| il2cpp_class_get_interfaces | |
| il2cpp_class_is_valuetype | |
| il2cpp_class_is_enum | |
| il2cpp_class_get_flags | |
| il2cpp_class_get_type | |
| il2cpp_class_get_declaring_type | |
| il2cpp_class_instance_size | |
| il2cpp_field_get_name | |
| il2cpp_field_get_type | |
| il2cpp_field_get_offset | |
| il2cpp_field_get_flags | |
| il2cpp_method_get_name | |
| il2cpp_method_get_return_type | |
| il2cpp_method_get_param_count | |
| il2cpp_method_get_param | |
| il2cpp_method_get_param_name | |
| il2cpp_method_get_flags | |
| il2cpp_property_get_name | |
| il2cpp_property_get_get_method | |
| il2cpp_property_get_set_method | |
| il2cpp_type_get_name | |
| il2cpp_type_get_type | |
| il2cpp_type_get_class_or_element_class | |
| il2cpp_thread_attach | |
| il2cpp_thread_current | |
| il2cpp_object_header_size | |
| il2cpp_class_value_size | |
| il2cpp_class_enum_basetype | |
| il2cpp_class_is_interface | |
| il2cpp_class_is_abstract | |
| il2cpp_class_is_generic | |
| il2cpp_class_is_inflated | |
| il2cpp_class_is_blittable | |
| il2cpp_class_get_image | |
| il2cpp_class_get_type_token | |
| il2cpp_class_get_rank | |
| il2cpp_class_get_element_class | |
| il2cpp_class_get_static_field_data | |
| il2cpp_class_get_data_size | |
| il2cpp_class_num_fields | |
| il2cpp_class_for_each | |
| il2cpp_class_from_type | |
| il2cpp_field_is_literal | |
| il2cpp_field_get_parent | |
| il2cpp_field_static_get_value | |
| il2cpp_method_get_token | |
| il2cpp_method_get_class | |
| il2cpp_method_is_generic | |
| il2cpp_method_is_inflated | |
| il2cpp_method_is_instance | |
| il2cpp_property_get_flags | |
| il2cpp_property_get_parent | |
| il2cpp_type_is_byref | |
| il2cpp_type_is_pointer_type | |
| il2cpp_type_is_static | |
| il2cpp_type_get_attrs | |
| il2cpp_type_get_assembly_qualified_name | |
| il2cpp_image_get_filename | |
| il2cpp_image_get_assembly | |
| il2cpp_thread_detach | |
| il2cpp_free |
Derived runtime offsets8
| Field | Offset |
|---|---|
| Il2CppObject.header | 16 |
| MethodInfo.body | 0 |
| MethodInfo.virtualBody | 8 |
| MethodInfo.invoker | 16 |
| MethodInfo.name | 24 |
| MethodInfo.klass | 32 |
| MethodInfo.returnType | 40 |
| MethodInfo.token | 72 |
Downloads
Generated on the server from this dump. Free for research and modding; see the terms.
Or from the terminal: zircon fetch 42. A .usmap describes Unreal asset serialisation and a Unity build has no equivalent, so neither it nor the C++ SDK is offered here — zircon emit renders this dump into the formats that do apply.
41 downloads so far.