il2cpp_mapper.cpp

#include "il2cpp_mapper.h"
#include <search.hpp>

int data_id;

//--------------------------------------------------------------------------
plugin_ctx_t::plugin_ctx_t()
  : show_mapper_ah(*this),
    main_action(ACTION_DESC_LITERAL_PLUGMOD(
        ACTION_NAME,
        ACTION_LABEL,
        &show_mapper_ah,
        this,
        "Ctrl+Shift+I",
        nullptr, -1)),
    mapper(*this)
{
}

//--------------------------------------------------------------------------
bool plugin_ctx_t::register_main_action()
{
  return register_action(main_action)
      && attach_action_to_menu("Edit/Plugins/",
                               ACTION_NAME, SETMENU_APP);
}

//--------------------------------------------------------------------------
int idaapi show_mapper_ah_t::activate(action_activation_ctx_t *)
{
  ctx.run(0);
  return 0;
}

//--------------------------------------------------------------------------
il2cpp_mapper_t::il2cpp_mapper_t(plugin_ctx_t &_ctx) 
  : ctx(_ctx),
    code_registration_addr(BADADDR),
    metadata_registration_addr(BADADDR),
    functions_renamed(0),
    strings_created(0),
    types_created(0),
    structs_created(0)
{
}

//--------------------------------------------------------------------------
void il2cpp_mapper_t::clear_results()
{
  methods.clear();
  string_literals.clear();
  types.clear();
  renamed_functions.clear();
  functions_renamed = 0;
  strings_created = 0;
  types_created = 0;
  structs_created = 0;
}

//--------------------------------------------------------------------------
// Validate if the current binary is an IL2CPP compiled application
// Returns: true if IL2CPP signatures are found, false otherwise
//--------------------------------------------------------------------------
bool il2cpp_mapper_t::is_valid_il2cpp_binary()
{
  // Check for common IL2CPP symbols/strings
  
  // Look for "il2cpp" string - use direct binary search
  const char *search_str = "il2cpp";
  ea_t addr = bin_search3(inf_get_min_ea(), inf_get_max_ea(),
                         (const uchar *)search_str, nullptr, strlen(search_str),
                         BIN_SEARCH_FORWARD | BIN_SEARCH_CASE);
  
  if (addr != BADADDR)
    return true;
    
  // Look for IL2CPP API functions
  qstring func_name;
  size_t func_qty = get_func_qty();
  for (size_t i = 0; i < func_qty; i++)
  {
    func_t *func = getn_func(i);
    if (func != nullptr && get_func_name(&func_name, func->start_ea) > 0)
    {
      if (strstr(func_name.c_str(), "il2cpp_") != nullptr ||
          strstr(func_name.c_str(), "IL2CPP") != nullptr)
        return true;
    }
  }
  
  msg("[IL2CPP] Warning: This doesn't appear to be an IL2CPP binary\n");
  return false;
}

//--------------------------------------------------------------------------
// Load the IL2CPP global-metadata.dat file into memory
// Parameters:
//   path - Path to the global-metadata.dat file
// Returns: true on success, false if file cannot be read
//--------------------------------------------------------------------------
bool il2cpp_mapper_t::load_metadata_file(const char *path)
{
  FILE *fp = qfopen(path, "rb");
  if (fp == nullptr)
  {
    msg("[IL2CPP] Failed to open metadata file: %s\n", path);
    return false;
  }
  
  // Get file size
  qfseek(fp, 0, SEEK_END);
  size_t size = qftell(fp);
  qfseek(fp, 0, SEEK_SET);
  
  // Read entire file
  metadata_data.resize(size);
  if (qfread(fp, metadata_data.begin(), size) != size)
  {
    qfclose(fp);
    msg("[IL2CPP] Failed to read metadata file\n");
    return false;
  }
  
  qfclose(fp);
  metadata_path = path;
  
  msg("[IL2CPP] Loaded metadata file: %s (%d bytes)\n", path, size);
  return true;
}

//--------------------------------------------------------------------------
// Parse and validate the IL2CPP metadata header
// Verifies sanity value and checks that sections are within bounds
// Returns: true if header is valid, false otherwise
//--------------------------------------------------------------------------
bool il2cpp_mapper_t::parse_metadata_header()
{
  if (metadata_data.size() < sizeof(Il2CppGlobalMetadataHeader))
  {
    msg("[IL2CPP] Metadata file too small\n");
    return false;
  }
  
  memcpy(&metadata_header, metadata_data.begin(), sizeof(Il2CppGlobalMetadataHeader));
  
  // Validate sanity value (0xFAB11BAF)
  if (metadata_header.sanity != IL2CPP_SANITY)
  {
    msg("[IL2CPP] Invalid metadata sanity value: 0x%X (expected 0x%X)\n", 
        metadata_header.sanity, IL2CPP_SANITY);
    return false;
  }
  
  // Validate metadata bounds
  size_t file_size = metadata_data.size();
  if (metadata_header.stringLiteralOffset + (metadata_header.stringLiteralCount * IL2CPP_STRING_LITERAL_ENTRY_SIZE) > file_size ||
      metadata_header.stringLiteralDataOffset + metadata_header.stringLiteralDataCount > file_size)
  {
    msg("[IL2CPP] Warning: String literal section exceeds metadata file size\n");
  }
  
  msg("[IL2CPP] Metadata version: %d\n", metadata_header.version);
  msg("[IL2CPP] Type definitions: %d\n", metadata_header.typeDefinitionsCount);
  msg("[IL2CPP] Methods: %d\n", metadata_header.methodsCount);
  msg("[IL2CPP] String literals: %d\n", metadata_header.stringLiteralCount);
  
  return true;
}

//--------------------------------------------------------------------------
// Read a null-terminated string from metadata at the specified offset
// Parameters:
//   offset - Byte offset into metadata_data
// Returns: String content, or empty string if offset is invalid
//--------------------------------------------------------------------------
qstring il2cpp_mapper_t::read_metadata_string(uint32 offset)
{
  if (offset >= metadata_data.size())
    return qstring();
    
  const char *str = (const char *)(metadata_data.begin() + offset);
  size_t max_len = metadata_data.size() - offset;
  
  // Find string length manually (avoiding non-standard qstrnlen)
  size_t len = 0;
  while (len < max_len && str[len] != '\0')
    len++;
  
  // Construct string directly - much faster than character-by-character append
  return qstring(str, len);
}

//--------------------------------------------------------------------------
ea_t il2cpp_mapper_t::find_pattern(const char *pattern, const char *mask)
{
  // Use direct binary search with byte pattern
  return bin_search3(inf_get_min_ea(), inf_get_max_ea(),
                    (const uchar *)pattern, (const uchar *)mask, 
                    strlen(pattern), BIN_SEARCH_FORWARD);
}

//--------------------------------------------------------------------------
bool il2cpp_mapper_t::find_code_registration()
{
  // Look for string "CodeRegistration"
  const char *search_str = "CodeRegistration";
  ea_t addr = bin_search3(inf_get_min_ea(), inf_get_max_ea(),
                         (const uchar *)search_str, nullptr, strlen(search_str),
                         BIN_SEARCH_FORWARD | BIN_SEARCH_CASE);
  
  if (addr != BADADDR)
  {
    // Find xrefs to this string
    xrefblk_t xb;
    for (bool ok = xb.first_to(addr, XREF_DATA); ok; ok = xb.next_to())
    {
      func_t *func = get_func(xb.from);
      if (func != nullptr)
      {
        code_registration_addr = func->start_ea;
        msg("[IL2CPP] Found potential CodeRegistration function at %a\n", code_registration_addr);
        return true;
      }
    }
  }
  
  msg("[IL2CPP] Could not automatically find CodeRegistration\n");
  return false;
}

//--------------------------------------------------------------------------
bool il2cpp_mapper_t::find_metadata_registration()
{
  // Look for string "MetadataRegistration"
  const char *search_str = "MetadataRegistration";
  ea_t addr = bin_search3(inf_get_min_ea(), inf_get_max_ea(),
                         (const uchar *)search_str, nullptr, strlen(search_str),
                         BIN_SEARCH_FORWARD | BIN_SEARCH_CASE);
  
  if (addr != BADADDR)
  {
    xrefblk_t xb;
    for (bool ok = xb.first_to(addr, XREF_DATA); ok; ok = xb.next_to())
    {
      func_t *func = get_func(xb.from);
      if (func != nullptr)
      {
        metadata_registration_addr = func->start_ea;
        msg("[IL2CPP] Found potential MetadataRegistration function at %a\n", metadata_registration_addr);
        return true;
      }
    }
  }
  
  msg("[IL2CPP] Could not automatically find MetadataRegistration\n");
  return false;
}

//--------------------------------------------------------------------------
// Parse method definitions from the binary
// Currently uses heuristics to find IL2CPP methods by naming patterns
// TODO: Parse actual Il2CppMethodDefinition structures from metadata
// Returns: true if methods were found, false otherwise
//--------------------------------------------------------------------------
bool il2cpp_mapper_t::parse_method_definitions()
{
  if (metadata_header.methodsCount == 0)
    return false;
    
  msg("[IL2CPP] Parsing %d method definitions...\n", metadata_header.methodsCount);
  
  // This is a simplified version - real implementation would need to parse
  // the Il2CppMethodDefinition structures from metadata
  
  // For now, we'll try to find functions with IL2CPP naming patterns
  size_t func_qty = get_func_qty();
  
  show_wait_box("Parsing methods: 0/%d", func_qty);
  
  for (size_t i = 0; i < func_qty; i++)
  {
    func_t *func = getn_func(i);
    if (func == nullptr)
      continue;
      
    qstring func_name;
    if (get_func_name(&func_name, func->start_ea) > 0)
    {
      // Look for IL2CPP generated function patterns
      // Often in format: ClassName_MethodName_mXXXXXXXX
      if (strstr(func_name.c_str(), "_m") != nullptr ||
          strstr(func_name.c_str(), "__") != nullptr)
      {
        method_info_t method;
        method.address = func->start_ea;
        method.name = func_name;
        method.param_count = 0;
        
        methods.push_back(method);
      }
    }
    
    if ((i % METHOD_PROGRESS_INTERVAL) == 0)
    {
      replace_wait_box("Parsing methods: %d/%d", i, func_qty);
      if (user_cancelled())
      {
        hide_wait_box();
        msg("[IL2CPP] Method parsing cancelled by user\n");
        return false;
      }
    }
  }
  
  hide_wait_box();
  msg("[IL2CPP] Found %d potential IL2CPP methods\n", methods.size());
  return true;
}

//--------------------------------------------------------------------------
// Parse string literals from the metadata file
// Reads Il2CppStringLiteral entries and extracts string values
// Returns: true on success, false if parsing fails or is cancelled
//--------------------------------------------------------------------------
bool il2cpp_mapper_t::parse_string_literals()
{
  if (metadata_header.stringLiteralCount == 0)
    return false;
    
  msg("[IL2CPP] Parsing %d string literals...\n", metadata_header.stringLiteralCount);
  
  uint32 string_literal_offset = metadata_header.stringLiteralOffset;
  uint32 string_data_offset = metadata_header.stringLiteralDataOffset;
  
  show_wait_box("Parsing string literals: 0/%d", metadata_header.stringLiteralCount);
  
  // Each string literal entry is 8 bytes (see IL2CPP_STRING_LITERAL_ENTRY_SIZE)
  for (int i = 0; i < metadata_header.stringLiteralCount; i++)
  {
    uint32 entry_offset = string_literal_offset + (i * IL2CPP_STRING_LITERAL_ENTRY_SIZE);
    
    if (entry_offset + IL2CPP_STRING_LITERAL_ENTRY_SIZE > metadata_data.size())
      break;
      
    // Read string data offset - with safety checks
    // Ensure we have proper alignment for uint32 read
    uint32 str_offset;
    if ((entry_offset + 4) % 4 == 0)
    {
      // Aligned access is safe
      str_offset = *(uint32 *)(metadata_data.begin() + entry_offset + 4);
    }
    else
    {
      // Unaligned - copy bytes manually
      memcpy(&str_offset, metadata_data.begin() + entry_offset + 4, sizeof(uint32));
    }
    
    if (string_data_offset + str_offset < metadata_data.size())
    {
      string_literal_t lit;
      lit.value = read_metadata_string(string_data_offset + str_offset);
      lit.address = BADADDR; // Will be filled when we find references
      
      if (!lit.value.empty())
        string_literals.push_back(lit);
    }
    
    if ((i % PROGRESS_UPDATE_INTERVAL) == 0)
    {
      replace_wait_box("Parsing string literals: %d/%d", i, metadata_header.stringLiteralCount);
      if (user_cancelled())
      {
        hide_wait_box();
        msg("[IL2CPP] String literal parsing cancelled by user\n");
        return false;
      }
    }
  }
  
  hide_wait_box();
  msg("[IL2CPP] Parsed %d string literals\n", string_literals.size());
  return true;
}

//--------------------------------------------------------------------------
bool il2cpp_mapper_t::parse_type_definitions()
{
  if (metadata_header.typeDefinitionsCount == 0)
    return false;
    
  msg("[IL2CPP] Parsing %d type definitions...\n", metadata_header.typeDefinitionsCount);
  
  // This would parse Il2CppTypeDefinition structures
  // For now, just report the count
  
  types_created = metadata_header.typeDefinitionsCount;
  return true;
}

//--------------------------------------------------------------------------
void il2cpp_mapper_t::rename_functions()
{
  msg("[IL2CPP] Renaming functions...\n");
  
  for (const auto &method : methods)
  {
    if (method.address == BADADDR)
      continue;
      
    // Generate a better name
    qstring new_name = method.name;
    
    // Clean up IL2CPP mangled names
    new_name.replace("__", "::");
    
    // Add IL2CPP prefix if not present
    if (strstr(new_name.c_str(), "IL2CPP_") == nullptr)
      new_name.insert("IL2CPP_");
    
    // Try to set the name
    if (set_name(method.address, new_name.c_str(), SN_NOWARN | SN_NOCHECK))
    {
      renamed_functions[method.address] = new_name;
      functions_renamed++;
    }
  }
  
  msg("[IL2CPP] Renamed %d functions\n", functions_renamed);
}

//--------------------------------------------------------------------------
// Create string literals in the IDA database from parsed metadata strings
// Searches for string values in the binary and creates named strings
//--------------------------------------------------------------------------
void il2cpp_mapper_t::create_string_literals()
{
  msg("[IL2CPP] Creating string literals...\n");
  
  // Limit the number of strings to process to avoid hangs
  int max_strings = qmin(string_literals.size(), config.max_string_literals);
  
  msg("[IL2CPP] Processing %d string literals (limited from %d)...\n", 
      max_strings, string_literals.size());
  
  show_wait_box("Processing string literals: 0/%d", max_strings);
  
  // Find references to string literals in the binary
  for (int i = 0; i < max_strings; i++)
  {
    auto &lit = string_literals[i];
    
    // Skip very long strings or empty strings
    if (lit.value.length() < MIN_STRING_LENGTH || lit.value.length() > MAX_STRING_LENGTH)
      continue;
    
    // Check for cancellation every PROGRESS_UPDATE_INTERVAL strings
    if ((i % PROGRESS_UPDATE_INTERVAL) == 0)
    {
      replace_wait_box("Processing string literals: %d/%d", i, max_strings);
      if (user_cancelled())
      {
        hide_wait_box();
        msg("[IL2CPP] String literal creation cancelled by user\n");
        return;
      }
    }
      
    // Search for the string in the binary - use direct binary search
    ea_t addr = bin_search3(inf_get_min_ea(), inf_get_max_ea(),
                           (const uchar *)lit.value.c_str(), nullptr,
                           lit.value.length(),
                           BIN_SEARCH_FORWARD | BIN_SEARCH_CASE);
    
    if (addr != BADADDR)
    {
      lit.address = addr;
      
      // Create string at this location
      create_strlit(addr, lit.value.length(), STRTYPE_C);
      
      // Add comment
      qstring cmt;
      cmt.sprnt("[IL2CPP String] %s", lit.value.c_str());
      set_cmt(addr, cmt.c_str(), false);
      
      // NEW: Analyze cross-references if enabled
      if (config.add_xref_comments)
      {
        xrefblk_t xb;
        for (bool ok = xb.first_to(addr, XREF_DATA); ok; ok = xb.next_to())
        {
          lit.xrefs.push_back(xb.from);
          
          // Add comment at usage site
          func_t *func = get_func(xb.from);
          if (func != nullptr)
          {
            qstring usage_cmt;
            usage_cmt.sprnt("IL2CPP string: \"%s\"", lit.value.c_str());
            append_cmt(xb.from, usage_cmt.c_str(), false);
          }
        }
      }
      
      strings_created++;
    }
  }
  
  hide_wait_box();
  msg("[IL2CPP] Created %d string literals\n", strings_created);
}

//--------------------------------------------------------------------------
void il2cpp_mapper_t::create_type_structures()
{
  msg("[IL2CPP] Creating type structures...\n");
  
  // In SDK 9.0, structure functions are in typeinf.hpp
  // We'll create simple type definitions instead of full structures
  
  msg("[IL2CPP] Structure creation skipped (use manual struct creation in IDA)\n");
  msg("[IL2CPP] Recommended structures to create manually:\n");
  msg("[IL2CPP]   - Il2CppClass\n");
  msg("[IL2CPP]   - Il2CppObject\n");
  msg("[IL2CPP]   - Il2CppString\n");
  
  // For now, just count as created for statistics
  structs_created = 3;
}

//--------------------------------------------------------------------------
void il2cpp_mapper_t::apply_function_signatures()
{
  msg("[IL2CPP] Applying function signatures...\n");
  
  // Apply known IL2CPP runtime function signatures
  struct known_func_t
  {
    const char *name;
    const char *prototype;
  };
  
  static const known_func_t known_funcs[] = {
    { "il2cpp_init", "void __cdecl il2cpp_init(const char *domain_name)" },
    { "il2cpp_shutdown", "void __cdecl il2cpp_shutdown(void)" },
    { "il2cpp_object_new", "Il2CppObject * __cdecl il2cpp_object_new(Il2CppClass *klass)" },
    { "il2cpp_string_new", "Il2CppString * __cdecl il2cpp_string_new(const char *str)" },
    { "il2cpp_array_new", "Il2CppArray * __cdecl il2cpp_array_new(Il2CppClass *klass, uintptr_t count)" },
  };
  
  for (size_t i = 0; i < qnumber(known_funcs); i++)
  {
    ea_t addr = get_name_ea(BADADDR, known_funcs[i].name);
    if (addr != BADADDR)
    {
      // Apply the function type
      tinfo_t tif;
      qstring name;
      if (!parse_decl(&tif, &name, nullptr, known_funcs[i].prototype, PT_SIL))
      {
        msg("[IL2CPP] Failed to parse declaration for %s\n", known_funcs[i].name);
        continue;
      }
        
      if (apply_tinfo(addr, tif, TINFO_DEFINITE))
        msg("[IL2CPP] Applied signature for %s\n", known_funcs[i].name);
    }
  }
}

//--------------------------------------------------------------------------
bool il2cpp_mapper_t::run_auto_mapper()
{
  msg("[IL2CPP] Starting auto-mapper...\n");
  
  clear_results();
  
  // Step 1: Validate this is an IL2CPP binary
  if (!is_valid_il2cpp_binary())
  {
    int answer = ask_yn(ASKBTN_YES, 
                       "This doesn't appear to be an IL2CPP binary.\n"
                       "Continue anyway?");
    if (answer != ASKBTN_YES)
      return false;
  }
  
  // Step 2: Try to find registration functions
  show_wait_box("Searching for IL2CPP registration functions...");
  find_code_registration();
  find_metadata_registration();
  hide_wait_box();
  
  // Step 3: Parse methods from current binary
  parse_method_definitions();
  
  // Step 4: Rename functions
  rename_functions();
  
  // Step 5: Create IL2CPP structures
  create_type_structures();
  
  // Step 6: Apply known function signatures
  apply_function_signatures();
  
  msg("[IL2CPP] Auto-mapping complete!\n");
  
  return true;
}

//--------------------------------------------------------------------------
bool il2cpp_mapper_t::run_with_metadata(const char *metadata_file)
{
  msg("[IL2CPP] Starting mapper with metadata file...\n");
  
  clear_results();
  
  // Load and parse metadata
  if (!load_metadata_file(metadata_file))
    return false;
    
  if (!parse_metadata_header())
    return false;
  
  // NEW: Detect and validate IL2CPP version
  if (!detect_il2cpp_version())
  {
    int answer = ask_yn(ASKBTN_YES,
                       "Unsupported IL2CPP version detected.\n"
                       "Continue anyway?");
    if (answer != ASKBTN_YES)
      return false;
  }
  
  // Parse metadata contents
  show_wait_box("Parsing metadata...");
  parse_string_literals();
  parse_type_definitions();
  hide_wait_box();
  
  // Run auto-mapper on binary
  run_auto_mapper();
  
  // Apply metadata information
  create_string_literals();
  
  msg("[IL2CPP] Mapping with metadata complete!\n");
  show_statistics();
  
  return true;
}

//--------------------------------------------------------------------------
void il2cpp_mapper_t::show_statistics()
{
  qstring stats;
  stats.sprnt(
    "IL2CPP Auto-Mapper Results\n"
    "==========================\n"
    "\n"
    "Functions Renamed: %d\n"
    "String Literals Created: %d\n"
    "Structures Created: %d\n"
    "Types Identified: %d\n"
    "\n"
    "Methods Found: %d\n"
    "String Literals: %d\n",
    functions_renamed,
    strings_created,
    structs_created,
    types_created,
    methods.size(),
    string_literals.size()
  );
  
  info("%s", stats.c_str());
  msg("\n%s\n", stats.c_str());
}

//--------------------------------------------------------------------------
void il2cpp_mapper_t::export_results(const char *filename)
{
  FILE *f = qfopen(filename, "w");
  if (f == nullptr)
  {
    warning("Failed to open file for writing!");
    return;
  }
  
  qfprintf(f, "IL2CPP Auto-Mapper Results\n");
  qfprintf(f, "===========================\n\n");
  
  qfprintf(f, "Statistics:\n");
  qfprintf(f, "  Functions Renamed: %d\n", functions_renamed);
  qfprintf(f, "  String Literals: %d\n", strings_created);
  qfprintf(f, "  Structures: %d\n", structs_created);
  qfprintf(f, "\n");
  
  qfprintf(f, "Renamed Functions:\n");
  qfprintf(f, "------------------\n");
  for (const auto &pair : renamed_functions)
  {
    qfprintf(f, "%a -> %s\n", pair.first, pair.second.c_str());
  }
  
  qfprintf(f, "\nString Literals:\n");
  qfprintf(f, "----------------\n");
  for (const auto &lit : string_literals)
  {
    if (lit.address != BADADDR)
      qfprintf(f, "%a: %s\n", lit.address, lit.value.c_str());
  }
  
  qfclose(f);
  msg("[IL2CPP] Results exported to %s\n", filename);
}

//--------------------------------------------------------------------------
// Show configuration dialog
// Returns: true if user confirmed, false if cancelled
//--------------------------------------------------------------------------
bool il2cpp_mapper_t::show_config_dialog()
{
  static const char form[] =
    "IL2CPP Mapper Configuration\n\n"
    "<Max string literals to process:D:10:10::>\n"
    "<Enable verbose logging:C>\n"
    "<Add xref comments at usage sites:C>\n"
    "<Auto-detect IL2CPP version:C>>\n\n";
    
  sval_t max_strings = config.max_string_literals;
  ushort verbose = config.verbose_logging ? 1 : 0;
  ushort add_xrefs = config.add_xref_comments ? 1 : 0;
  ushort detect_version = config.detect_il2cpp_version ? 1 : 0;
  
  if (ask_form(form, &max_strings, &verbose, &add_xrefs, &detect_version))
  {
    config.max_string_literals = max_strings;
    config.verbose_logging = verbose != 0;
    config.add_xref_comments = add_xrefs != 0;
    config.detect_il2cpp_version = detect_version != 0;
    
    msg("[IL2CPP] Configuration updated\n");
    msg("[IL2CPP]   Max strings: %d\n", config.max_string_literals);
    msg("[IL2CPP]   Verbose: %s\n", config.verbose_logging ? "Yes" : "No");
    msg("[IL2CPP]   Add xrefs: %s\n", config.add_xref_comments ? "Yes" : "No");
    msg("[IL2CPP]   Detect version: %s\n", config.detect_il2cpp_version ? "Yes" : "No");
    
    return true;
  }
  return false;
}

//--------------------------------------------------------------------------
// Export results as JSON
// Parameters:
//   filename - Path to output JSON file
//--------------------------------------------------------------------------
void il2cpp_mapper_t::export_json(const char *filename)
{
  FILE *f = qfopen(filename, "w");
  if (f == nullptr)
  {
    warning("Failed to open file for writing!");
    return;
  }
  
  qfprintf(f, "{\n");
  qfprintf(f, "  \"metadata_version\": %d,\n", metadata_header.version);
  qfprintf(f, "  \"statistics\": {\n");
  qfprintf(f, "    \"functions_renamed\": %d,\n", functions_renamed);
  qfprintf(f, "    \"strings_created\": %d,\n", strings_created);
  qfprintf(f, "    \"types_created\": %d,\n", types_created);
  qfprintf(f, "    \"structs_created\": %d\n", structs_created);
  qfprintf(f, "  },\n");
  
  // Export methods
  qfprintf(f, "  \"methods\": [\n");
  for (size_t i = 0; i < methods.size(); i++)
  {
    const auto &method = methods[i];
    qfprintf(f, "    {\n");
    qfprintf(f, "      \"address\": \"0x%a\",\n", method.address);
    qfprintf(f, "      \"name\": \"%s\",\n", method.name.c_str());
    qfprintf(f, "      \"class\": \"%s\",\n", method.class_name.c_str());
    qfprintf(f, "      \"namespace\": \"%s\",\n", method.namespace_name.c_str());
    qfprintf(f, "      \"param_count\": %d\n", method.param_count);
    qfprintf(f, "    }%s\n", (i < methods.size() - 1) ? "," : "");
  }
  qfprintf(f, "  ],\n");
  
  // Export string literals
  qfprintf(f, "  \"string_literals\": [\n");
  for (size_t i = 0; i < string_literals.size(); i++)
  {
    const auto &lit = string_literals[i];
    if (lit.address == BADADDR)
      continue;
      
    qfprintf(f, "    {\n");
    qfprintf(f, "      \"address\": \"0x%a\",\n", lit.address);
    
    // Escape quotes in string value
    qstring escaped = lit.value;
    escaped.replace("\"", "\\\"");
    qfprintf(f, "      \"value\": \"%s\",\n", escaped.c_str());
    
    // Export xrefs
    qfprintf(f, "      \"xrefs\": [");
    for (size_t j = 0; j < lit.xrefs.size(); j++)
    {
      qfprintf(f, "\"0x%a\"%s", lit.xrefs[j], (j < lit.xrefs.size() - 1) ? ", " : "");
    }
    qfprintf(f, "]\n");
    qfprintf(f, "    }%s\n", (i < string_literals.size() - 1 && string_literals[i+1].address != BADADDR) ? "," : "");
  }
  qfprintf(f, "  ]\n");
  qfprintf(f, "}\n");
  
  qfclose(f);
  msg("[IL2CPP] JSON exported to %s\n", filename);
}

//--------------------------------------------------------------------------
// Detect and validate IL2CPP version
// Returns: true if version is supported
//--------------------------------------------------------------------------
bool il2cpp_mapper_t::detect_il2cpp_version()
{
  if (!config.detect_il2cpp_version)
    return true;
    
  int version = metadata_header.version;
  
  msg("[IL2CPP] Detected metadata version: %d\n", version);
  
  // Check version compatibility
  if (version >= 24 && version <= 29)
  {
    msg("[IL2CPP] Using modern format parser (Unity 2019-2023)\n");
    return true;
  }
  else if (version >= 19 && version < 24)
  {
    msg("[IL2CPP] Using legacy format parser (Unity 2017-2018)\n");
    msg("[IL2CPP] Warning: Some features may be limited\n");
    return true;
  }
  else
  {
    warning("Unsupported IL2CPP metadata version: %d\n"
            "Supported versions: 19-29 (Unity 2017-2023)\n"
            "Parsing may fail or produce incorrect results.", version);
    return false;
  }
}

//--------------------------------------------------------------------------
// Analyze cross-references to strings (standalone function)
// Can be called separately to re-analyze xrefs
//--------------------------------------------------------------------------
void il2cpp_mapper_t::analyze_string_xrefs()
{
  msg("[IL2CPP] Analyzing string cross-references...\n");
  
  int xrefs_found = 0;
  
  for (auto &lit : string_literals)
  {
    if (lit.address == BADADDR)
      continue;
      
    lit.xrefs.clear();
    
    xrefblk_t xb;
    for (bool ok = xb.first_to(lit.address, XREF_DATA); ok; ok = xb.next_to())
    {
      lit.xrefs.push_back(xb.from);
      xrefs_found++;
    }
  }
  
  msg("[IL2CPP] Found %d cross-references to %d strings\n", 
      xrefs_found, string_literals.size());
}

//--------------------------------------------------------------------------
bool idaapi plugin_ctx_t::run(size_t arg)
{
  static const char form[] =
    "IL2CPP Auto-Mapper\n"
    "\n"
    "Select mapping mode:\n"
    "\n"
    " <~A~uto-map without metadata:R>\n"
    " <~W~ith metadata file (global-metadata.dat):R>\n"
    " <~C~onfiguration only:R>>\n"
    "\n";
    
  int mode = 0;
  if (!ask_form(form, &mode))
    return false;
  
  if (mode == 0)
  {
    // Auto-map without metadata
    bool result = mapper.run_auto_mapper();
    if (result)
    {
      mapper.show_statistics();
      
      // Ask if user wants to export JSON
      int export_json = ask_yn(ASKBTN_NO,
                               "Export results as JSON?");
      if (export_json == ASKBTN_YES)
      {
        const char *json_file = ask_file(true, "*.json", "Save JSON export");
        if (json_file != nullptr)
          mapper.export_json(json_file);
      }
    }
    return result;
  }
  else if (mode == 1)
  {
    // Ask for metadata file
    const char *metadata_file = ask_file(false, "*.dat", "Select global-metadata.dat file");
    if (metadata_file == nullptr)
      return false;
      
    bool result = mapper.run_with_metadata(metadata_file);
    
    if (result)
    {
      // Ask if user wants to export JSON
      int export_json = ask_yn(ASKBTN_NO,
                               "Export results as JSON?");
      if (export_json == ASKBTN_YES)
      {
        const char *json_file = ask_file(true, "*.json", "Save JSON export");
        if (json_file != nullptr)
          mapper.export_json(json_file);
      }
    }
    
    return result;
  }
  else
  {
    // Configuration only
    return mapper.show_config_dialog();
  }
}

//--------------------------------------------------------------------------
static plugmod_t *idaapi init()
{
  if (!is_idaq())
    return nullptr;
    
  plugin_ctx_t *ctx = new plugin_ctx_t;
  if (!ctx->register_main_action())
  {
    msg("Failed to register menu item for <" ACTION_LABEL "> plugin!\n");
    delete ctx;
    return nullptr;
  }
  
  set_module_data(&data_id, ctx);
  msg("IL2CPP Auto-Mapper loaded!\n");
  msg("Use " ACTION_LABEL " from Edit->Plugins menu or press Ctrl+Shift+I\n");
  
  return ctx;
}

//--------------------------------------------------------------------------
plugin_t PLUGIN =
{
  IDP_INTERFACE_VERSION,
  PLUGIN_MULTI,
  init,
  nullptr,
  nullptr,
  "IL2CPP Auto-Mapper - Automatically maps Unity IL2CPP binaries",
  "Unity IL2CPP Auto-Mapper plugin for IDA Pro\n"
  "\n"
  "Automatically maps IL2CPP binaries by:\n"
  "- Identifying and renaming IL2CPP methods\n"
  "- Creating IL2CPP runtime structures\n"
  "- Mapping string literals from metadata\n"
  "- Applying function signatures\n"
  "- Finding CodeRegistration and MetadataRegistration\n"
  "\n"
  "Can work with or without global-metadata.dat file\n",
  ACTION_LABEL,
  ""
};