ree-pdb

A tool to create a fake pdb from reframework's il2cpp dump.

This makes it alot easier to get symbol information in whatever debugger/dissassembler you use (I've tested it on x64dbg, cheat engine 7.6, ghidra 12.0.2 (might be borked on ghidra), IDA Pro 9.2). It's also blazingly fast 🚀 (kinda not really at all).

I plan on adding better debug info, right now it's very rudamentary, it just generates function names and structs. Expect the naming format of functions to change

Usage

To run it you need two things, an il2cpp_dump.json from reframework, and the game exe (non-dumped (sometimes dumped maybe)).

The first time you load a PDB it will probably take a while to load (on my slow laptop that's running out of ram, might take 15-30min). To make the loading faster, use the filter and flags to skip things if you want.

Note

If you are looking at a lot of native stuff, you can try adding the --resolve-native-thunks so that ree-pdb analyzes native functions that look like thunks and names the callee native functions. It doesn't work perfectly for everything, but from some things I've looked at, it can be very useful.

Usage: ree-pdb [OPTIONS] --exe <EXE>

Options:
  -i, --il2cpp <IL2CPP>        path to il2cpp dump generated by reframework [default: il2cpp_dump.json]
  -e, --exe <EXE>              path to the game exe, e.g 'C:\Program Files (x86)\Steam\steamapps\common\MonsterHunterWilds\MonsterHunterWilds.exe'
  -o, --output <OUTPUT>        path to the output directory, e.g 'C:\Program Files (x86)\Steam\steamapps\common\MonsterHunterWilds'. If unspecified, it will be written to the directory of the exe
  -n, --name <NAME>            name of the pdb file (file will be written as "<name>.pdb", default uses the name of the exe)
  -a, --age <AGE>              override for the age that will be written to the pdb file
  -s, --signature <SIGNATURE>  override for the signature that will be written to the pdb file (default=0)
  -g, --guid <GUID>            override for the guid that will be written to the pdb file
  -f, --filter <FILTER>        regex filter for types to add
      --enums <ENUMS>          path to Enums_Internal.hpp generated by REFramework. If omitted, ree-pdb looks beside the il2cpp dump
      --ida-safe-enums         prefix enum member names with the enum type name to avoid IDA enumerator-name collisions
  -v, --verbose
      --address <ADDRESS>      fallback base address for symbols that cannot be mapped through the PE section table [default: 5368713216]
      --skip-methods           Skip methods
      --skip-types             Skip types (also skips enums)
      --skip-enums             Skip enums
      --skip-statics           Skip static field symbols
  -r, --resolve-native-thunks  Attempts to find thunked native functions and name add symbols for them (experimental, function args might be incorrect))
  -h, --help                   Print help
  -V, --version                Print version

Generating the PDB (this will create it in the same directory as the exe you gave):

ree-pdb.exe --exe <path to game exe> --il2cpp <path to il2cpp_dump.json>
# or If you're building from source.
cargo run --release -- --exe <path to game exe> --il2cpp <path to il2cpp_dump.json>
# or
./target/release/ree-pdb.exe --exe <path to game exe> --il2cpp <path to il2cpp_dump.json>

For example (this generates the pdb file at C:\Program Files (x86)\Steam\steamapps\common\MonsterHunterWilds\MonsterHunterWilds.pdb):

ree-pdb.exe --exe 'C:\Program Files (x86)\Steam\steamapps\common\MonsterHunterWilds\MonsterHunterWilds.exe' --il2cpp ..\il2cpp_dump.json

Building

You will need llvm to build since it relies on it for generating the pdb streams. I've been using 22.1.5, make sure to get the clang+llvm-22.1.5... so you have the right cmake files installed on your system (winget or chocolatey installs don't work, vcpkg takes forever). Here are the prebuilt binaries I downloaded clang+llvm-22.1.5-x86_64-pc-windows-msvc.tar.xz

I just moved the extracted files to C:\Program Files\LLVM\.

I developed this on windows but the llvm tools are cross platform so I'll release a linux build at some point.

Then just git clone and build. If you don't build in release it will be really really slow because rust 🚀. Other than that it's blazingly fast.

Note

I recommend building with RUSTFLAGS="-C target-cpu=native", it should hopefully speed things up.

git clone https://github.com/kvasszn/ree-pdb.git
cargo build --release --bin ree-pdb
or
RUSTFLAGS="-C target-cpu=native" cargo build --release --bin re-pdb

TODO

• topological dependancy checking
  • this should make leaner pdbs and potentially be faster
• types
• symbols/functions
• vtables (might be weird at times idk)
• enums
• global singletons
• static fields symbols
  • static fields can be done with the same method as managed singletons
• static field literals (similar way as enums)
  • this would be nice since it wouldn't require parsing Enums_Internal.hpp anymore if done right
  • could probably convert some code for adding enums for this
• find native thunked functions
• check if native thunked functions have a this passed in through a singleton
• reflection methods and properties
• it would be nice to try and statically analyze the binary to fill in types using simple getters/setters for native types without reflected fields
  • static fields are easy, non-static fields are harder
• proper value type handling (kinda done maybe)
• flags as additional info
• verifiying that things actually work in different things. I wrote this 10 min ago but wtf does this even mean, probably different tools/games
• rewrite with microsoft's ms_pdb as a backend instead of llvm + pdb_wrapper
  • structs can mostly be done with this, but I've looked into it and some things like public symbols don't have great support
• system to add additional custom struct definitions (i.e you reverse something yourself and want to add it to the pdb)
• comments on things in the pdb? maybe for functions that people can add similar to the above thing
• script to fixup the IAT in dumped exes using the non-dumped exe

Credits