The right way to Reverse Engineer a Unity Recreation

On this tutorial you’ll use ILSpy and AssetStudio to extract code and property from a compiled Unity sport.

Within the context of software program, reverse engineering is the follow of analyzing a system to extract design and implementation data. That is usually used to higher perceive how software program features. One methodology of reverse engineering is decompiling, which performs the other operations of a compiler to transform executable packages again into human-readable code.

You possibly can decompile Unity video games utilizing specialised instruments to extract the code and most property. Listed here are some frequent use circumstances the place this may be helpful:

• Get better the misplaced code and property of a sport you made.
• Check out the supply code or 3D fashions of a sport to review and study from.
• Mod a sport by changing property with your individual.

Observe: With nice energy comes nice accountability. The reverse engineering methods described on this tutorial are supposed for authorized use circumstances like recovering initiatives you made your self or for instructional use. Stealing code and property and claiming them as your individual is against the law and I’m not answerable for any authorized penalties.

On this tutorial, you’ll use ILSpy and AssetStudio to decompile a Unity sport on Home windows. Alongside the way in which, you’ll discover ways to:

• Use ILSpy to decompile a sport’s code
• Save the code to your laptop
• Examine property utilizing AssetStudio
• Extract audio and 3D fashions from a sport

Whereas I’ll be overlaying Home windows functions on this tutorial, there are alternate options for Linux and macOS on the market with the identical performance like AvaloniaILSpy and UnityPy. I’ve additionally added some extra software program issues on the backside of the tutorial, a few of that are cross-platform.

Getting Began

Click on the Obtain Supplies button on the high or backside of this web page to obtain the pattern sport, Avoiding Accountability. Extract the zip file to a folder to be used afterward. In order for you, you’ll be able to play the sport on Home windows by operating Avoiding Accountability.exe. You possibly can stop the sport by urgent Escape or Alt + F4.

Granted, there’s not a lot happening apart from some crimson “accountability” crystals falling down from above whereas a cheery tune performs within the background. It received’t be the sport of the yr anytime quickly, however that’s not the main focus of this tutorial. Within the following sections, you’ll decide this sport aside to entry its supply code and property.

Instrument necessities

On to the instruments! Each ILSpy and AssetStudio want the .NET 6 SDK to work. To examine if you have already got this SDK put in, open a Command Immediate by opening the Begin menu, coming into “cmd” and urgent Enter. With the Command Immediate open, enter the next command and press Enter to execute it:

dotnet --list-sdks

When you’ve got .NET 6 SDK put in, there ought to be a 6.X.X entry within the record:

If there’s no 6.X.X entry, otherwise you get an “dotnet shouldn’t be acknowledged” error, you’ll want to put in the newest model of the SDK from right here: https://dotnet.microsoft.com/en-us/obtain/dotnet/6.0
Select the installer model that matches your CPU’s structure and obtain it. In most trendy methods, this can be x64:

Now set up the SDK and re-run the dotnet --list-sdks command in a Command Immediate to confirm it’s put in.

Downloading ILSpy and AssetStudio

With the necessities out of the way in which, head over to the releases web page of ILSpy: https://github.com/icsharpcode/ILSpy/releases

Click on on the Property button on the backside of the changelog of the newest launch and click on on the ILSpy_selfcontained_x64 zip to obtain it.

As soon as the obtain finishes, extract the zip to a folder to be used within the subsequent part.

Subsequent up is AssetStudio, the obtain course of right here is just like IlSpy. To start out off, head over to the releases web page: https://github.com/Perfare/AssetStudio/releases

Click on the Property button if the property aren’t seen right away and click on on the .net6 hyperlink to obtain the .NET 6 model of AssetStudio.

Extract the contents of the zip to a folder for later use.

Extracting Supply Code

To extract the code from the pattern sport, you’ll want to make use of ILSpy, which is a an open-source .NET meeting browser and decompiler. Unity video games use C# for his or her scripts, which get compiled to Intermediate Language, or IL for brief. IL is a decrease degree language than C#, however nonetheless increased degree than machine code. Right here’s what IL code seems like:

.methodology public hidebysig static void Most important() il managed
{
    .entrypoint
    // Code dimension    11 (0xb)
    .maxstack 8
    IL_0000:         ldstr     "Good day, World"
    IL_0005:    name void [mscorlib]System.Console::WriteLine
                         (class System.String)
} // finish of methodology HelloWorld::Most important

By default, Unity compiles all scripts collectively right into a single file named Meeting-CSharp.dll. As a Unity developer, you’ll be able to select to group scripts in extra meeting definitions recordsdata, which can generate further meeting recordsdata when you compile your sport. ILSpy can learn the IL code in these recordsdata and convert them again to C# courses.

Time to check out what IlSpy provides! Open the ILSpy folder and double click on on ILSpy.exe to start out ILSpy. In case your necessities are so as, that is what you’ll see as soon as the appliance hundreds:

Exploring ILSpy

The interface is break up up into two essential sections: an inventory of loaded assemblies on the left and the decompiled C# code on the suitable. ILSpy has some generally used .NET assemblies loaded by default like mscorelib and System.

To load the pattern sport’s CSharp meeting, click on on the folder icon within the menu bar or press CTRL + O in your keyboard to open a folder browser window.

Navigate to the Avoiding Accountability folder you unzipped earlier, there ought to be a file named Avoiding Accountability.exe in there. From there, navigate to the Knowledge folder, named Avoiding Responsibility_Data on this case and open the Managed folder in there. In brief: Recreation folder / Knowledge / Managed.

You need to see an inventory of DLL recordsdata in there.

Double-click Meeting-CSharp.dll to load the meeting in ILSpy. If all went nicely, a brand new entry was added within the Assemblies record on the left named Meeting-CSharp.

To examine the meeting, click on on the little + button on the left of the entry to increase the meeting. This unveils the next gadgets:

• Metadata: This incorporates data on the meeting, together with its headers and strings.
• References: An inventory of different assemblies this meeting references. ILSpy will mechanically load in these assemblies if you’re inspecting code that references them, so don’t be shocked if the Assemblies record will get crammed up with extra assemblies.
• A “-” namespace: The pattern sport doesn’t use namespaces in its code, however different initiatives can have an inventory right here of the completely different namespaces used. That is the place the supply code lives.

Develop the - namespace to get your first glimpse of one thing acquainted — an inventory of courses! Subsequent, click on on the Rotate class and also you’ll see the supply code being proven on the suitable.

You might have to click on the + buttons within the code to increase the strategies, however it’s all proper there:

Exporting Code

It can save you the code by copy-pasting it right into a file, or by right-clicking the category within the Assemblies record and deciding on Save Code… within the menu. Now you can select a location to save lots of the C# file to. Don’t fear, you’re free to repeat my wonderful code and use it on your personal. :]

In giant assemblies, having to examine and save the courses individually can get tedious, so I’ll introduce you to a extra environment friendly approach of saving the code. Proper-click on Meeting-CSharp and select Save Code… within the menu. It will immediate you to decide on a location to save lots of the C# mission file to. It’d seem to be you’re saving a single file right here, however ILSpy will truly copy over all courses it will possibly discover as C# recordsdata, together with a mission file.

Usually, ILSpy does a fairly good job of decompiling the code, however it’s possible you’ll run into some bizarre code right here and there if the decompiler wasn’t positive what to do. As an example, for those who check out the BrokenResponsibility class, it has a DestroySelf methodology which differs from the unique code. The decompiled model seems like this:

personal void DestroySelf()
{
  Object.Destroy(base.gameObject);
}

Whereas the unique code was the next:

personal void DestroySelf()
{
  Destroy(gameObject);
}

Observe the Object class and base key phrase that had been added to the strategy name. The decompiled code remains to be legitimate, however you would possibly wish to contemplate cleansing it up a bit when utilizing it in your individual initiatives.

That concludes the usage of ILSpy! It’s a robust instrument to remember when it’s good to extract the supply code from Unity video games and different .NET based mostly merchandise. It has saved me just a few instances already after I misplaced my initiatives because of knowledge corruption. Backups are higher in each approach, however this can be a good backup. Simply bear in mind to be good and use it for good solely.

Now you know the way to examine and save supply code, it’s time to maneuver on to extracting the property.

Extracting Property

AssetStudio is an open-source instrument that may examine and extract the next asset varieties from Unity 3.4 to 2022.1:

• Textures and sprites
• Audio
• Fonts
• Meshes
• Textual content
• Shaders
• Video recordsdata
• Animations

It does this by reverse engineering the packed codecs and changing these again into usable codecs. A texture for instance will be transformed into png, tga, jpeg or bmp.

Open AssetStudio by opening the folder you extracted within the Getting Began part and double-click AssetStudioGUI.exe. After a short time, you’ll be greeted by its person interface:

Tour of AssetStudio

Like ILSpy, AssetStudio has two essential sections: a file browser on the left and a preview on the suitable. In contrast to ILSpy nonetheless, there’s nothing to see right here till you open an property file or a folder of a compiled sport.
Earlier than delving deeper within the software, disable all error messages as on the time of writing AssetStudio has some points with loading in shaders, leading to a ton of errors being generated. To disregard these, choose Debug within the toolbar and uncheck Present error message.

Now load within the property by deciding on File ▸ Load folder within the toolbar to open a folder browser window.

Navigate to the Avoiding Accountability folder, you already know you’re on the proper place for those who see the Avoiding Responsibility_Data folder:

Choose this folder to load it. AssetStudio will now search all subfolders for any asset recordsdata and skim their contents. This could take fairly some time relying on the quantity of property and their sort. So long as the progress bar on the backside is shifting and the textual content area under the preview reads “Learn property…” try to be good. It took my system about two minutes earlier than the appliance was lastly completed loading.

As soon as the property are loaded, you need to see an inventory of scenes and prefabs showing within the Scene Hierarchy tab:

You possibly can increase these to get a tough concept of what kind of GameObjects make up the scene, however other than that it’s not that helpful.

Exporting Property

Open the Asset Listing tab, as that’s the place the enjoyable begins. In right here, you’ll find all property supported by AssetStudio which might be a part of the pattern sport. Most of those are included by Unity, however some had been added by me when creating the sport.

The record will be filtered by title if you already know what to search for by utilizing the textbox under the tabs. For instance, sort in “Entertainer” and wait a short time, the record will shrink right down to a single AudioClip of the background music.

Preview the file by clicking on its title within the Asset Listing and urgent the Play button within the Preview window on the suitable.

Click on on the Cease button when you’re completed having fun with the tune. It can save you this asset by right-clicking its title and deciding on Export chosen property within the menu. It will immediate you to decide on a folder to reserve it to.

Observe: The music is “The Entertainer” by Kevin MacLeod (incompetech.com). It’s licensed below the Inventive Commons: By Attribution 4.0 License.

AssetStudio will create a folder based mostly on the kind of asset, AudioClip on this case. Inside you’ll discover the audio file in WAV format.

Filter the filter by deciding on the textual content you’ve added and hitting Backspace or Delete in your keyboard. There’s one other technique to filter property: by their sort.

Choose Filter Sort ▸ Mesh within the toolbar to solely present 3D fashions within the record. The fashions used within the pattern sport all have the identical title: default. You possibly can choose them one after the other to get a pleasant preview.

Now choose all default meshes, right-click on any of them and choose Export chosen Property within the menu. Choose a folder to save lots of the fashions to within the folder browser window like earlier than.

As soon as the fashions are exported, they’re all in OBJ format. You should utilize an software like Blender to import these recordsdata, edit them and export to a format of your selecting. You can even use them as-is, as most sport engines help OBJ meshes.

Right here’s the default.obj file opened up in Blender for instance:

That’s it for AssetStudio, one other nice instrument to have in your arsenal.

The place to Go From Right here?

Congratulations on ending this tutorial! You now know tips on how to extract the supply code and property out of a compiled Unity sport. I sincerely hope these methods will show as helpful for you as they did for me.

You possibly can obtain the pattern sport utilizing the Obtain Supplies button on the high or backside of this tutorial if you wish to mess around with it some extra.
If you wish to check out another instruments to reverse engineer Unity video games, listed here are my suggestions:

• dnSpyEx: Much like ILSpy, however it lets you debug and even edit assemblies
• IL2CppDumper: Extracts the supply code from video games that had been constructed with IL2CPP
• AssetRipper: A substitute for AssetStudio to extract property

Thanks for studying this tutorial to the top! When you’ve got any questions or feedback, be at liberty to hitch the dialogue under.