Editing Openai/6952a1d0-7e3c-8003-a3f6-55806826a464 (section)

=== Assistant: Yeah — but quick reality check: with Unity IL2CPP you’re not going to “open the C game code.” You’re dealing with a nat… ===
Yeah — but quick reality check: with Unity IL2CPP you’re not going to “open the C# game code.” You’re dealing with a native binary (GameAssembly.dll) + metadata (global-metadata.dat). So the “actual code” you’ll see is decompiled C++-ish pseudocode, plus recovered class/method names via metadata.

Good news: there are MCP servers that plug AI into real reverse-engineering tools, which is exactly the vibe you want.

==== MCPs that help you inspect IL2CPP “game code” ====

===== 1) Ghidra MCP servers =====
* GhidraMCP (plugin + MCP server) lets an AI client drive Ghidra: decompile functions, list symbols, rename stuff, follow xrefs, etc. GitHub<ref>{{cite web|title=GitHub|url=https://github.com/LaurieWired/GhidraMCP|publisher=github.com|access-date=2025-12-29}}</ref>
* There’s also pyghidra-mcp (headless) aimed at project-wide, multi-binary analysis. clearbluejar<ref>{{cite web|title=clearbluejar|url=https://clearbluejar.github.io/posts/pyghidra-mcp-headless-ghidra-mcp-server-for-project-wide-multi-binary-analysis/|publisher=clearbluejar.github.io|access-date=2025-12-29}}</ref>
* Another Ghidra MCP option: GhidrAssistMCP. GitHub<ref>{{cite web|title=GitHub|url=https://github.com/jtang613/GhidrAssistMCP|publisher=github.com|access-date=2025-12-29}}</ref>

Why it’s good for IL2CPP: Ghidra is great at “what does this function do” and “where is this called from,” and AI can speed-run the boring parts (renaming, grouping, call-chain tracing).

===== 2) IDA Pro MCP servers =====
* ida-pro-mcp bridges IDA with MCP so an AI can query and automate analysis. GitHub<ref>{{cite web|title=GitHub|url=https://github.com/mrexodia/ida-pro-mcp|publisher=github.com|access-date=2025-12-29}}</ref>
* If you want automation at scale, ida-headless-mcp exists and explicitly mentions Il2CppDumper metadata import support (very relevant for Unity IL2CPP). GitHub<ref>{{cite web|title=GitHub|url=https://github.com/zboralski/ida-headless-mcp|publisher=github.com|access-date=2025-12-29}}</ref>
* Hex-Rays plugin site also lists an “ida-mcp-server” flavor. plugins.hex-rays.com<ref>{{cite web|title=plugins.hex-rays.com|url=https://plugins.hex-rays.com/mxiris-reverse-engineering/ida-mcp-server|publisher=plugins.hex-rays.com|access-date=2025-12-29}}</ref>

Why it’s good: IDA’s ecosystem for IL2CPP workflows is strong, and MCP automation can turn “find the player controller” from a day into an hour.

===== 3) Binary Ninja MCP =====
* binary_ninja_mcp exposes Binary Ninja analysis through MCP. GitHub<ref>{{cite web|title=GitHub|url=https://github.com/fosdickio/binary_ninja_mcp|publisher=github.com|access-date=2025-12-29}}</ref>

Why it’s good: Binary Ninja is super scriptable and fast for iterating; MCP makes it easy to ask “show me all xrefs to this string/symbol” and get structured answers.

==== The Unity IL2CPP piece you still need: metadata dumping ====

Before any of those tools are truly useful, you usually run something like Il2CppDumper to extract type/method info from GameAssembly.dll + global-metadata.dat. GitHub<ref>{{cite web|title=GitHub|url=https://github.com/Perfare/Il2CppDumper|publisher=github.com|access-date=2025-12-29}}</ref>

Then your AI can:
* search the dump for likely classes (Player, Controller, Inventory, etc.)
* jump to those functions in Ghidra/IDA/Binja via MCP
* build you a “hook shortlist” for BepInEx patches

If you don’t want to build a full RE MCP setup yet, the low-effort move is: Filesystem MCP + give the AI the dump outputs (type lists, method signatures). That alone gets you 70% of the value.

==== What MCP “helps with” in practice (the stuff that saves your sanity) ====

With one of the RE MCPs above, you can do things like:
* “List functions that touch health / damage”
* “Find the update loop for the player motor”
* “Show call chain from input → movement”
* “Auto-rename methods based on behavior”
* “Identify structs used for transforms / vectors” …and then translate that into BepInEx hook points.

==== Very important anti-footgun note ====

If the game is competitive online or has anti-cheat, poking the binary can get accounts banned. For offline/single-player/private co-op, you’re usually fine. Also: I can help with legit modding + analysis, but not with bypassing anti-cheat/security.

If you tell me which tool you’d rather use (Ghidra / IDA / Binary Ninja) and whether this is offline/coop/online, I’ll suggest the tightest setup + the exact “first questions” to ask the MCP so you find player movement/health fast.

TL;DR: For IL2CPP, “game code” means decompiled native code + metadata. Best MCP options are GhidraMCP/pyghidra-mcp, IDA Pro MCP (and ida-headless-mcp with Il2CppDumper import), or Binary Ninja MCP. Pair one of those with an IL2CPP dump workflow (e.g., Il2CppDumper) and Filesystem MCP, and you’ll be able to locate real hook points for BepInEx way faster.