elecgnosis / Unity-game-hacking

A guide for hacking unity games

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

This is a small guide for extracting and modifying assets or code from games made with the Unity engine. Feel free to contribute.

  1. Unity game folder structure
  2. Extracting and editing code
  3. Extracting assets
  4. Hacking memory

Unity game folder structure

│   *.exe
└───*_Data
    │   globalgamemanagers
    │   globalgamemanagers.assets
    │   level0
    │   level0.resS
        ...
    |   levelN
    |   levelN.resS
    │   sharedassets0.assets
    │   sharedassets0.assets.resS
        ...
    |   sharedassetsN.assets
    |   sharedassetsN.assets.resS
    |   resources.assets
    ├───Managed
    │       Assembly-CSharp.dll
    │       Assembly-UnityScript.dll
    │       Mono.Security.dll
    │       mscorlib.dll
    │       System.Core.dll
    │       System.dll
    │       UnityEngine.dll
    │       UnityEngine.dll.mdb
    │       UnityEngine.Networking.dll
    │       UnityEngine.UI.dll
    ├───Mono
    │   │   mono.dll
    │   └───etc
    │       └───mono
    │           │   browscap.ini
    │           │   config
    │           ├───1.0
    │           │       DefaultWsdlHelpGenerator.aspx
    │           │       machine.config
    │           ├───2.0
    │           │   │   DefaultWsdlHelpGenerator.aspx
    │           │   │   machine.config
    │           │   │   settings.map
    │           │   │   web.config
    │           │   └───Browsers
    │           │           Compat.browser
    │           └───mconfig
    │                   config.xml
    └───Resources
            unity default resources
            unity_builtin_extra

* : Name chosen during building

File/Directory Description
*.exe Executable file of the game
*_Data Data folder containing the game resources
level0-levelN Files containing game scenes data, each scene has its own file
sharedassets0-sharedassetsN Game assets are split into sharedassets and .resS files (sharedassets.assets.split0 - ..splitN on platforms like Android/iOS)
resources.assets Raw Assets found in the project resources folders and their dependencies are stored in this file (as well as raw audio files, even if outside of Resources folder in Unity, AudioClips with references to .resource and info such as audio size/offset still stored inside .assets)
Managed Folder containing unity DLLs
Assembly-CSharp.dll DLL file containing compiled C# files
Assembly-UnityScript.dll DLL file containing compiled UnityScript files

Extracting and editing code

C# and UnityScript files are compiled into the Assembly-CSharp.dll and Assembly-UnityScript.dll DLLs respectively, which can be found inside the Managed folder.

DLLs can be decompiled using ILSpy or dnSpy which allow modifying and recompiling assembly files.

If DLLs are missing from the managed directory, try dumping them using this tool MegaDumper

Extracting assets

Assets are stored in the .assets and .resS files. Content of these files can be unpacked with one of these tools :

Tool Description
UtinyRipper uTinyRipper is a tool for extracting assets from serialized files (CAB-*, *.assets, .sharedAssets, etc.) and assets bundles (.unity3d, *.assetbundle, etc.) and conveting them into native Engine format.
Unity Studio A tool for exploring, extracting and exporting assets from Unity games and apps.
Unity Assets Bundle Extractor UABE is a tool that allow modification of assets file and extraction of assets in usable formats (png/tga for textures, obj for meshes).
Unity Assets Explorer Can extract textures to .DDS format, meshes to .43 format.
QuickBMS with this script or this one for webplayer
DevXUnityUnpacker A (paid) tool with a friendly GUI meant for restoring unity projects by inputting the built game/app including a previewer for individual files as image, hex, text etc.
UnityEX Tool for extracting/converting files from .assets bundles and replacing files (Mostly used for replacing textures).

DDS files :

The DDS files can be opened/converted/edited with this gimp plugin or this photoshop plugin.

Another way of extracting meshes and textures :

Use 3D Ripper DX (doesn't support 64 bits binaries) or Ninja Ripper.

Alternatives:

Tool Tutorial
RenderDoc Tutorial on how to use RenderDoc.
Intel® Graphics Performance Analyzers Tutorial on how to use the Intel Graphics Analyzers to extract graphics.

Hacking memory

Cheat engine have a feature called Dissect mono that can help hacking game's memory. This video series about using cheat engine is really useful.

About

A guide for hacking unity games