Il2cpp Frida MCP

🚀 IL2CPP Frida MCP Server

An IL2CPP reverse engineering tool based on Model Context Protocol (MCP), which allows AI assistants (such as Claude, Kiro) to directly analyze and manipulate Unity IL2CPP applications.

🚀 Quick Start

The IL2CPP Frida MCP Server is a powerful tool for reverse - engineering Unity IL2CPP applications. Below are the steps to get started:

Installation

Option 1: pip install (Recommended)

# Install from source
pip install .

# Or install in development mode
pip install -e .

Option 2: Manual dependency installation

pip install -r requirements.txt

Compile Frida Agent

npm install
npm run build

Usage

Start MCP Server

# If installed via pip
il2cpp-frida-mcp                        # Interactive selection
il2cpp-frida-mcp --stdio                # stdio mode
il2cpp-frida-mcp --sse                  # SSE mode
il2cpp-frida-mcp --http                 # HTTP mode

# Or run script directly
python mcp_server.py --stdio

# Custom host and port
il2cpp-frida-mcp --sse --host 0.0.0.0 --port 9000

Configure MCP Client

Claude Desktop / Kiro

Add to your MCP configuration file:

{
  "mcpServers": {
    "il2cpp-frida": {
      "command": "il2cpp-frida-mcp",
      "args": ["--stdio"]
    }
  }
}

Or run using Python module:

{
  "mcpServers": {
    "il2cpp-frida": {
      "command": "python",
      "args": ["-m", "mcp_server", "--stdio"]
    }
  }
}

✨ Features

• 🔌 Frida Integration - Support for USB, remote, and local device connections
• 📦 IL2CPP Analysis - List images, classes, methods with fuzzy search support
• 🔍 Disassembly - Method disassembly based on Frida Instruction API
• 🧠 GC Heap Analysis - Find runtime object instances
• 📤 Import/Export - Find module import and export functions
• 🛠️ JS Execution - Execute arbitrary JavaScript code to manipulate Frida API

📦 Project Structure

.
├── mcp_server.py           # Entry point
├── mcp_server/             # MCP Server module
│   ├── __init__.py
│   ├── server.py           # MCP Server core
│   ├── state.py            # Frida state management
│   ├── tools.py            # MCP tool definitions
│   ├── transport.py        # Transport layer (stdio/sse/http)
│   ├── cli.py              # Command line interface
│   ├── agent_loader.py     # Agent loader
│   └── handlers/           # Tool handlers
│       ├── __init__.py
│       ├── frida_handlers.py
│       └── il2cpp_handlers.py
├── agent/                  # Frida Agent (TypeScript)
│   ├── index.ts            # Agent entry point
│   ├── core/               # Core modules
│   │   ├── il2cpp-helper.ts
│   │   ├── method-utils.ts
│   │   └── class-finder.ts
│   └── services/           # Service modules
│       ├── image-service.ts
│       ├── class-service.ts
│       ├── method-service.ts
│       ├── disasm-service.ts
│       ├── module-service.ts
│       ├── gc-service.ts
│       └── exec-service.ts
├── _agent.js               # Compiled Agent
├── package.json
├── tsconfig.json
└── requirements.txt

💻 Usage Examples

1. Connect to Device

Use frida_connect to connect to the frontmost app on USB device

2. Analyze IL2CPP

List all images, then find classes containing "Player"

3. View Method Details

List all methods of PlayerController class, then view Update method details

📚 Documentation

MCP Tools

Frida Basic Tools

IL2CPP Analysis Tools

🔧 Technical Details

Development

Compile Agent

npm run build     # Single build
npm run watch     # Watch mode

Dependencies

• Python 3.10+
• Node.js 16+
• Frida 17+
• frida-il2cpp-bridge

📄 License

MIT

Acknowledgements

• frida-il2cpp-bridge - IL2CPP runtime bridge
• Il2CppHookScripts - Reference implementation