Learn how to Reverse Engineer a Unity Sport


On this tutorial you’ll use ILSpy and AssetStudio to extract code and property from a compiled Unity recreation.

Within the context of software program, reverse engineering is the apply of analyzing a system to extract design and implementation info. That is usually used to raised perceive how software program features. One technique of reverse engineering is decompiling, which performs the alternative operations of a compiler to transform executable applications again into human-readable code.

You’ll be able to decompile Unity video games utilizing specialised instruments to extract the code and most property. Listed here are some frequent use instances the place this may be helpful:

  • Recuperate the misplaced code and property of a recreation you made.
  • Check out the supply code or 3D fashions of a recreation to check and be taught from.
  • Mod a recreation by changing property with your individual.

Word: With nice energy comes nice duty. The reverse engineering strategies described on this tutorial are meant for authorized use instances like recovering initiatives you made your self or for academic use. Stealing code and property and claiming them as your individual is against the law and I’m not liable for any authorized penalties.

On this tutorial, you’ll use ILSpy and AssetStudio to decompile a Unity recreation on Home windows. Alongside the best way, you’ll discover ways to:

  • Use ILSpy to decompile a recreation’s code
  • Save the code to your pc
  • Examine property utilizing AssetStudio
  • Extract audio and 3D fashions from a recreation

Whereas I’ll be protecting Home windows functions on this tutorial, there are options for Linux and macOS on the market with the identical performance like AvaloniaILSpy and UnityPy. I’ve additionally added some extra software program issues on the backside of the tutorial, a few of that are cross-platform.

Getting Began

Click on the Obtain Supplies button on the high or backside of this web page to obtain the pattern recreation, Avoiding Duty. Extract the zip file to a folder to be used in a while. In order for you, you may play the sport on Home windows by working Avoiding Duty.exe. You’ll be able to stop the sport by urgent Escape or Alt + F4.

Screenshot of a game in which a grey cutout of a man moves on a wooden stage while red crystals are shattering into pieces.

Granted, there’s not a lot happening apart from some purple “duty” crystals falling down from above whereas a cheery tune performs within the background. It gained’t be the sport of the 12 months anytime quickly, however that’s not the main focus of this tutorial. Within the following sections, you’ll decide this recreation aside to entry its supply code and property.

Software necessities

On to the instruments! Each ILSpy and AssetStudio want the .NET 6 SDK to work. To test if you have already got this SDK put in, open a Command Immediate by opening the Begin menu, getting into “cmd” and urgent Enter. With the Command Immediate open, enter the next command and press Enter to execute it:

dotnet --list-sdks

If in case you have .NET 6 SDK put in, there needs to be a 6.X.X entry within the listing:

A command line interface showing 6.0.400

If there’s no 6.X.X entry, otherwise you get an “dotnet will not be acknowledged” error, you’ll want to put in the most recent model of the SDK from right here: https://dotnet.microsoft.com/en-us/obtain/dotnet/6.0
Select the installer model that matches your CPU’s structure and obtain it. In most trendy programs, this shall be x64:

Windows x64 is highlighted

Now set up the SDK and re-run the dotnet --list-sdks command in a Command Immediate to confirm it’s put in.

Downloading ILSpy and AssetStudio

With the necessities out of the best way, head over to the releases web page of ILSpy: https://github.com/icsharpcode/ILSpy/releases

Click on on the Belongings button on the backside of the changelog of the most recent launch and click on on the ILSpy_selfcontained_x64 zip to obtain it.


As soon as the obtain finishes, extract the zip to a folder to be used within the subsequent part.

Subsequent up is AssetStudio, the obtain course of right here is much like IlSpy. To begin off, head over to the releases web page: https://github.com/Perfare/AssetStudio/releases

Click on the Belongings button if the property aren’t seen right away and click on on the .net6 hyperlink to obtain the .NET 6 model of AssetStudio.


Extract the contents of the zip to a folder for later use.

Extracting Supply Code

To extract the code from the pattern recreation, you’ll want to make use of ILSpy, which is a an open-source .NET meeting browser and decompiler. Unity video games use C# for his or her scripts, which get compiled to Intermediate Language, or IL for brief. IL is a decrease stage language than C#, however nonetheless greater stage than machine code. Right here’s what IL code appears like:

.technique public hidebysig static void Essential() il managed
    // Code measurement    11 (0xb)
    .maxstack 8
    IL_0000:         ldstr     "Howdy, World"
    IL_0005:    name void [mscorlib]System.Console::WriteLine
                         (class System.String)
} // finish of technique HelloWorld::Essential

By default, Unity compiles all scripts collectively right into a single file named Meeting-CSharp.dll. As a Unity developer, you may select to group scripts in further meeting definitions recordsdata, which is able to generate additional meeting recordsdata when you compile your recreation. ILSpy can learn the IL code in these recordsdata and convert them again to C# courses.

Time to try what IlSpy affords! Open the ILSpy folder and double click on on ILSpy.exe to begin ILSpy. In case your necessities are so as, that is what you’ll see as soon as the appliance masses:

The interface of ILSpy

Exploring ILSpy

The interface is break up up into two foremost sections: a listing of loaded assemblies on the left and the decompiled C# code on the best. ILSpy has some generally used .NET assemblies loaded by default like mscorelib and System.

To load the pattern recreation’s CSharp meeting, click on on the folder icon within the menu bar or press CTRL + O in your keyboard to open a folder browser window.

The open button of ILSpy

Navigate to the Avoiding Duty folder you unzipped earlier, there needs to be a file named Avoiding Duty.exe in there. From there, navigate to the Knowledge folder, named Avoiding Responsibility_Data on this case and open the Managed folder in there. Briefly: Sport folder / Knowledge / Managed.

You need to see a listing of DLL recordsdata in there.

A file named Assembly-CSharp.dll

Double-click Meeting-CSharp.dll to load the meeting in ILSpy. If all went properly, a brand new entry was added within the Assemblies listing on the left named Meeting-CSharp.

To examine the meeting, click on on the little + button on the left of the entry to develop the meeting. This unveils the next gadgets:

  • Metadata: This incorporates info on the meeting, together with its headers and strings.
  • References: A listing of different assemblies this meeting references. ILSpy will mechanically load in these assemblies whenever you’re inspecting code that references them, so don’t be shocked if the Assemblies listing will get crammed up with extra assemblies.
  • A “-” namespace: The pattern recreation doesn’t use namespaces in its code, however different initiatives can have a listing right here of the completely different namespaces used. That is the place the supply code lives.

Develop the - namespace to get your first glimpse of one thing acquainted — a listing of courses! Subsequent, click on on the Rotate class and also you’ll see the supply code being proven on the best.

A Rotate class

You might have to click on the + buttons within the code to develop the strategies, nevertheless it’s all proper there:

Source code of the Rotate class

Exporting Code

It can save you the code by copy-pasting it right into a file, or by right-clicking the category within the Assemblies listing and deciding on Save Code… within the menu. Now you can select a location to save lots of the C# file to. Don’t fear, you’re free to repeat my superb code and use it to your personal. :]

Save Code... entry in a menu

In giant assemblies, having to examine and save the courses individually can get tedious, so I’ll introduce you to a extra environment friendly means of saving the code. Proper-click on Meeting-CSharp and select Save Code… within the menu. This can immediate you to decide on a location to save lots of the C# undertaking file to. It’d appear to be you’re saving a single file right here, however ILSpy will really copy over all courses it might probably discover as C# recordsdata, together with a undertaking file.

CS files in a folder

Usually, ILSpy does a reasonably good job of decompiling the code, however you might run into some bizarre code right here and there if the decompiler wasn’t certain what to do. For example, when you check out the BrokenResponsibility class, it has a DestroySelf technique which differs from the unique code. The decompiled model appears like this:

non-public void DestroySelf()

Whereas the unique code was the next:

non-public void DestroySelf()

Word the Object class and base key phrase that have been added to the tactic name. The decompiled code continues to be legitimate, however you would possibly wish to think about cleansing it up a bit when utilizing it in your individual initiatives.

That concludes using ILSpy! It’s a strong device to remember when it is advisable to extract the supply code from Unity video games and different .NET based mostly merchandise. It has saved me just a few instances already once I misplaced my initiatives as a result of knowledge corruption. Backups are higher in each means, however it is a good backup. Simply bear in mind to be good and use it for good solely.

Now you know the way to examine and save supply code, it’s time to maneuver on to extracting the property.

Extracting Belongings

AssetStudio is an open-source device that may examine and extract the next asset sorts from Unity 3.4 to 2022.1:

  • Textures and sprites
  • Audio
  • Fonts
  • Meshes
  • Textual content
  • Shaders
  • Video recordsdata
  • Animations

It does this by reverse engineering the packed codecs and changing these again into usable codecs. A texture for instance might be transformed into png, tga, jpeg or bmp.

Open AssetStudio by opening the folder you extracted within the Getting Began part and double-click AssetStudioGUI.exe. After a short time, you’ll be greeted by its person interface:

AssetStudio interface

Tour of AssetStudio

Like ILSpy, AssetStudio has two foremost sections: a file browser on the left and a preview on the best. Not like ILSpy nevertheless, there’s nothing to see right here till you open an property file or a folder of a compiled recreation.
Earlier than delving deeper within the utility, disable all error messages as on the time of writing AssetStudio has some points with loading in shaders, leading to a ton of errors being generated. To disregard these, choose Debug within the toolbar and uncheck Present error message.

Debug, Show error message

Now load within the property by deciding on File ▸ Load folder within the toolbar to open a folder browser window.

Load folder menu entry

Navigate to the Avoiding Duty folder, you understand you’re on the proper place when you see the Avoiding Responsibility_Data folder:

The Data and MonoBleedingEdge folders

Choose this folder to load it. AssetStudio will now search all subfolders for any asset recordsdata and skim their contents. This may take fairly some time relying on the quantity of property and their kind. So long as the progress bar on the backside is transferring and the textual content discipline under the preview reads “Learn property…” you need to be good. It took my system about two minutes earlier than the appliance was lastly executed loading.

As soon as the property are loaded, you need to see a listing of scenes and prefabs showing within the Scene Hierarchy tab:

level0 and sharedassets0.assets

You’ll be able to develop these to get a tough concept of what kind of GameObjects make up the scene, however aside from that it’s not that helpful.

A hierachy of objects of a scene

Exporting Belongings

Open the Asset Checklist tab, as that’s the place the enjoyable begins. In right here, you will discover all property supported by AssetStudio which can be a part of the pattern recreation. Most of those are included by Unity, however some have been added by me when creating the sport.

A list of assets

The listing might be filtered by title if you understand what to search for through the use of the textbox under the tabs. For instance, kind in “Entertainer” and wait a short time, the listing will shrink all the way down to a single AudioClip of the background music.

A single asset highlighted named Entertainer

Preview the file by clicking on its title within the Asset Checklist and urgent the Play button within the Preview window on the best.

A button labelled Play

Click on on the Cease button when you’re executed having fun with the tune. It can save you this asset by right-clicking its title and deciding on Export chosen property within the menu. This can immediate you to decide on a folder to put it aside to.

Word: The music is “The Entertainer” by Kevin MacLeod (incompetech.com). It’s licensed below the Artistic Commons: By Attribution 4.0 License.

Export selected assets is highlighted in a menu

AssetStudio will create a folder based mostly on the kind of asset, AudioClip on this case. Inside you’ll discover the audio file in WAV format.

The Entertainer.wav

Filter out the filter by deciding on the textual content you’ve added and hitting Backspace or Delete in your keyboard. There’s one other approach to filter property: by their kind.

Choose Filter Sort ▸ Mesh within the toolbar to solely present 3D fashions within the listing. The fashions used within the pattern recreation all have the identical title: default. You’ll be able to choose them one after the other to get a pleasant preview.

Now choose all default meshes, right-click on any of them and choose Export chosen Belongings within the menu. Choose a folder to save lots of the fashions to within the folder browser window like earlier than.

As soon as the fashions are exported, they’re all in OBJ format. You should utilize an utility like Blender to import these recordsdata, edit them and export to a format of your selecting. You too can use them as-is, as most recreation engines help OBJ meshes.

OBJ files in a folder

Right here’s the default.obj file opened up in Blender for instance:

A 3D model of a stage

That’s it for AssetStudio, one other effective device to have in your arsenal.

The place to Go From Right here?

Congratulations on ending this tutorial! You now know the best way to extract the supply code and property out of a compiled Unity recreation. I sincerely hope these strategies will show as helpful for you as they did for me.

You’ll be able to obtain the pattern recreation utilizing the Obtain Supplies button on the high or backside of this tutorial if you wish to mess around with it some extra.
If you wish to check out another instruments to reverse engineer Unity video games, listed here are my suggestions:

  • dnSpyEx: Just like ILSpy, nevertheless it means that you can debug and even edit assemblies
  • IL2CppDumper: Extracts the supply code from video games that have been constructed with IL2CPP
  • AssetRipper: A substitute for AssetStudio to extract property

Thanks for studying this tutorial to the tip! If in case you have any questions or feedback, be at liberty to hitch the dialogue under.


Leave a Reply