Deep deobfuscation of VRChat's GameAssembly.dll — 289,734 semantic methods, 100% class and field coverage. Beebyte ÌÍÎÏ obfuscation defeated via M1-M16 pipeline + 7 data sources + LLM predictions + Hex-Rays clustering.
Every identifier in VRChat's IL2CPP binary has been named. 97.9% have meaningful semantic names derived from 7 data sources + VA propagation; the remaining 2.1% use stable hash-based names (m_XXX, f_XXX) consistent across sessions.
4-strategy pipeline processes 10,462 obfuscated fields through increasingly sophisticated analysis.
| Strategy | Count | Method |
|---|---|---|
| Backing Field | 1,168 | <X>k__BackingField → _x |
| Accessor Match | 16 | get_/set_ 1:1 correlation |
| Type Inference | 5,846 | Frida runtime types → semantic names |
| Hash Fallback | 4,397 | Stable f_XXX hash |
75,279 obfuscated methods processed with VA propagation, call graph analysis, IDA string refs, and LLM predictions.
| Strategy | Count | Method |
|---|---|---|
| VA Propagation v2 | 7,252 | Address propagation + call graph analysis |
| Call Graph | 5,738 | Caller/callee relationship inference |
| IDA String Refs | 7,623 | String cross-reference naming |
| String-API | 425 | API string pattern matching |
| LLM Predictions | 11,190 | Hex-Rays decompiled → LLM inference + structural clustering |
| Hash Fallback | 6,355 | Stable m_XXX hash |
extract_field_types_v2.pyThis is a structural dump — signatures, types, and RVA addresses only. Actual method logic lives as machine code in GameAssembly.dll (206.8 MB). 10,670 functions have been decompiled via Hex-Rays, yielding 11,190 LLM-predicted names. Load the IDA rename script (133K+ entries) into IDA Pro for full analysis, or use Ghidra.
M1-M16 strategies + 7 external data sources + 2-pass rename → method & field renaming → output generation. 11,190 LLM predictions applied from 10,670 Hex-Rays decompiled functions.
Runtime-verified analysis of VRChat's core subsystems via Frida instrumentation.
Per-frame Update + LateUpdate monitoring with three-tier sibling redundancy verification. Primary anti-cheat system — detects IL2CPP struct modifications, memory patches, and hook tampering.
Dual-precision FlatBuffer serialization. PoseEvent encodes full body pose: head/body/hip transforms + hand gestures + finger curl values + eye tracking. Interpolation/extrapolation for smooth networked movement.
Network tick at 1,420 calls/sec — polls Photon transport buffer for incoming RPCs, events, and state updates. Heartbeat at 200/s keeps connection alive.
Factory-pattern virtual machine. UdonHeap bounds-checked memory with whitelist/blacklist + signature verification sandbox. Executes world creator scripts in isolation.
31 methods execute every frame per avatar. Dependency graph rebuilt each frame for bone chain simulation — hair, clothing, ears, tails. Major performance cost for crowded instances.
Largest namespace. 928 async state machines are network-related (API calls, asset downloads, world loading). 930 hookable MoveNext RVAs identified for runtime analysis.
| Method | Calls/sec | Function |
|---|---|---|
PhotonConnectionHandler.m_FC8 | 1,420/s | Photon network tick (message pump) |
*.m_ACA | 410/s | Async task dispatcher |
*.m_DEE | 200/s | Heartbeat / keep-alive |
| Offline mode: 6/155 hooks fired (room/udon/network/impostor all silent) | ||
run_full_pipeline.pyOrchestrator (5 stages)deobfuscate.py8-phase + smart renameextract_field_types_v2.pyFrida field type extractionbuild_va_propagation_v2.py+7,252 methods via call graphida_hexrays_export.py10,670 functions decompiledgenerate_source_tree.py1,126 organized .cs filesextract_precise_dump.pyIL2CPP struct scannerdeep_probe.py/jsRuntime hook frameworkNames encoded as 23-character strings using U+00CC (Ì), U+00CD (Í), U+00CE (Î), U+00CF (Ï). Regex: ^[\u00CC-\u00CF]{3,}$
Struct layout altered: FieldInfo at +0xA0 (not +0x88), field_count at +0x124 (not +0x122). 264 IL2CPP exports renamed, only 3 left unobfuscated.