[Tutorial] How to crack Unity Games

[Eiffel2018]

For beginner, you can refer to
https://gbatemp.net/threads/a-small-tutorial-on-asm-hacks-cheats-for-unity-games.606330/
and crack the games
However, if the il2cppdumper does not work in auto mode, we need to find the codeRegister addresses out manually

Here is a script that handle those il2cppdumper does not work in auto mode


Note:
Always use main.elf instead of main nso for Unity Games
NSO should be extract to ELF first, since there is a bug in il2cppdumper with LZ4

Also, in some Unity Game version, such as v27.1 and v24.2, the il2cppdumper wrongly shift the CodeRegistration address by -0x8 and -0x18 respectively
So when you get an error, you need to try increasing the CodeRegistration address by +8 or +18 etc.


idaPython Script (attachment)

 

[khuong]

For beginner, you can refer to
https://gbatemp.net/threads/a-small-tutorial-on-asm-hacks-cheats-for-unity-games.606330/
and crack the games
However, if the il2cppdumper does not work in auto mode, we need to find the codeRegister addresses out manually

Here is a script that handle those il2cppdumper does not work in auto mode
View attachment 306012

Note:
Always use main.elf instead of main nso for Unity Games
NSO should be extract to ELF first, since there is a bug in il2cppdumper with LZ4

Also, in some Unity Game version, such as v27.1 and v24.2, the il2cppdumper wrongly shift the CodeRegistration address by -0x8 and -0x18 respectively
So when you get an error, you need to try increasing the CodeRegistration address by +8 or +18 etc.

Enviroment:
IDA PRO 7.5+
Python 3.9x

How would you get global metadata file if its not in romfs?

 

[Eiffel2018]

How would you get global metadata file if its not in romfs?

I haven't seen metadata.dat placed outside of romfs

 

[Eiffel2018]

Tested on 《Fire Emblem Engage》

Post automatically merged: Jan 16, 2023

Note: if you got any problems,
you may Press G and goto nnMain, then press P to analyze there first

 

[Eiffel2018]

Added support to version 29

Tested for THEATRHYTHM FINAL BAR LINE

 

[Eiffel2018]

For this game, Have a nice death, https://gbatemp.net/threads/have-a-nice-death-0100125019a14000.629734/
cannot extract the global-metadata.dat , CodeRegistration is disappeared!


So, I've made a similar tool used in idapython GDB
it can extract the field names and functions / method of a class object when you point to there.

With the help of this tool, I find all my pointers in https://gbatemp.net/threads/have-a-nice-death-0100125019a14000.629734/
for details, you may study the cheatgen.py at that post

Post automatically merged: Mar 29, 2023

Here with the GDB python script for Unity

Usage:
1. Open the GDB.i64 template file in IDA PRO, (there are many stuctures define there)
2. Connect GDBstub with IDA PRO
2. ALT+F7 and choose Unity.py and Mark Regions
(may need to right click and edit one of the region and press OK for fixing the invalid order of regions defined)
3. go to an address of a variable (press G and type the address you found by Breeze or EdizonSE)
4. type " closestObject() " at the bottom info / message window (chose python)
5. then the structure will come out after a while



result

and you can copy then message in the output window, and execute these command in another IDA PRO instance that open the main . NSO / ELF.
they are the name of relative functions, just like the script by il2cppdump, but only one object a time. (not the whole file all functions)

For details,
you may also click the [classname_Type] to check the typeinfo,
or click the [classname_Func] to check the methods it used

These are the name of this class's methods .
and you can double click the "second red address" to go into that function

Post automatically merged: Mar 29, 2023

Sometimes, you know a field is another sub class object, such as here


You can just type i() at there


the script will explore 2 more depth sub class from there.

Post automatically merged: Mar 29, 2023

In my case, I believe the pointers in my cheat code file must be correct.
The reason is that, my pointers is found mainly based on the pointers used in the ASM program code, which is not found by the tool pointer searcher.

How do I do it?
I first select the parent class that is closer to the root
Press X to see if there is a referer (ignore the child classes)
When reaching a class instance without referer, the next set up a breakpoint.
Play the game for a while, the breakpoint will be triggered.
I will trace upwards in the program, and check the registers X0, X19, X20, X21, X22, etc.
maybe they are an Instance of a certain CLASS (use i() to explore there), and you can often find some related structures.
Generally speaking, at the end of the function that triggers the breakpoint, check where X30 returns,
look up at the source of x0 there, then you can also find an accurate pointer

 

[Eiffel2018]

After testing several old games, it is found that the offset value has changed a bit.
Another version is now available to support the unity games released in 2020

 

[Squirrel16]

After testing several old games, it is found that the offset value has changed a bit.
Another version is now available to support the unity games released in 2020

Hello, I'm having some trouble with a certain game, when I try to use Il2CppDumper on main.elf it gives me the following errors.




if I try to use just Main it kinda builds the Assembly-CSharp.dll and some other files. How do I go about this? Do I keep just using Main? Is there something I can do to remove protection from Main.elf?

 

[Eiffel2018]

Hello, I'm having some trouble with a certain game, when I try to use Il2CppDumper on main.elf it gives me the following errors.

View attachment 366980


if I try to use just Main it kinda builds the Assembly-CSharp.dll and some other files. How do I go about this? Do I keep just using Main? Is there something I can do to remove protection from Main.elf?

No matter whether it is main or elf. The files generated by il2cppdumper are always the same, if it can extract them correctly

 

[Squirrel16]

No matter whether it is main or elf. The files generated by il2cppdumper are always the same, if it can extract them correctly

Ok, that's good. Then I can extract the main and use them on Main.elf?
I can get the header files alright and the adresses for the functions, I just have issues getting more information on IDA (importing them) at all. IDA crashes using py3 version of the script and complains about erros on the py2 version of the script.

 

[Eiffel2018]

Ok, that's good. Then I can extract the main and use them on Main.elf?
I can get the header files alright and the adresses for the functions, I just have issues getting more information on IDA (importing them) at all. IDA crashes using py3 version of the script and complains about erros on the py2 version of the script.

python 3 + IDA Pro v7.5 is used for me currently

 

[Pj1980]

Anyone tried looking at trinity trigger. It's impossible to edit normal way as values are encrypted. I followed the guide in the link in first post but no luck.

 

[Eiffel2018]

Anyone tried looking at trinity trigger. It's impossible to edit normal way as values are encrypted. I followed the guide in the link in first post but no luck.

Just tested, It seems don't have any issue with decryption

 

[Pj1980]

Just tested, It seems don't have any issue with decryption
View attachment 375074

I meant when you use Edizon or breeze to search for health or experience you can find the visual values but editing them dosen't do anything the real values are encrypted .I was able to port some codes that were already made in end.

 

[Eiffel2018]

I meant when you use Edizon or breeze to search for health or experience you can find the visual values but editing them dosen't do anything the real values are encrypted .I was able to port some codes that were already made in end.

So, you can use the GDB to trace how that address were changed,
and you can also search the correct varible address with the variable name in the decrypt dump.cs

Check here if you want to study how to find the code (think about how to find the hacked asm address)

 

[morarin]

View attachment 347707
Tested on 《Fire Emblem Engage》

Post automatically merged: Jan 16, 2023

Note: if you got any problems,
you may Press G and goto nnMain, then press P to analyze there first

um...the useage is to open the main.elf first and then run il2Address.py, right??
I got an error message by following that


I`m super noob learning making cheat codes so it`s embarrassing but can you help with this?? thx

IDA Pro 7.6
Python 3.9.0
IDAPython 64-bit v7.4.0
Keypatch v2.2
Keystone v0.9.2

I`m doing with DisneyDLV [TID=0100D39012C1A000 BID=14E717418D30DB5C]
https://gbatemp.net/threads/disney-dreamlight-valley-0100d39012c1a000.618607/

I got main.elf by using this tool : https://gbatemp.net/threads/about-the-main-file-in-exefs-folder.533701/post-8554295

---

For this game, Have a nice death, https://gbatemp.net/threads/have-a-nice-death-0100125019a14000.629734/
cannot extract the global-metadata.dat , CodeRegistration is disappeared!
View attachment 362026

So, I've made a similar tool used in idapython GDB
it can extract the field names and functions / method of a class object when you point to there.

With the help of this tool, I find all my pointers in https://gbatemp.net/threads/have-a-nice-death-0100125019a14000.629734/
for details, you may study the cheatgen.py at that post

Post automatically merged: Mar 29, 2023

Here with the GDB python script for Unity

Usage:
1. Open the GDB.i64 template file in IDA PRO, (there are many stuctures define there)
2. Connect GDBstub with IDA PRO
2. ALT+F7 and choose Unity.py and Mark Regions
(may need to right click and edit one of the region and press OK for fixing the invalid order of regions defined)
3. go to an address of a variable (press G and type the address you found by Breeze or EdizonSE)
4. type " closestObject() " at the bottom info / message window (chose python)
5. then the structure will come out after a while

View attachment 362033

result
View attachment 362035
and you can copy then message in the output window, and execute these command in another IDA PRO instance that open the main . NSO / ELF.
they are the name of relative functions, just like the script by il2cppdump, but only one object a time. (not the whole file all functions)

For details,
you may also click the [classname_Type] to check the typeinfo,
or click the [classname_Func] to check the methods it used
View attachment 362038
These are the name of this class's methods . View attachment 362041
and you can double click the "second red address" to go into that function
View attachment 362045

Post automatically merged: Mar 29, 2023

Sometimes, you know a field is another sub class object, such as here
View attachment 362047

You can just type i() at there
View attachment 362048

the script will explore 2 more depth sub class from there.
View attachment 362049

Post automatically merged: Mar 29, 2023

In my case, I believe the pointers in my cheat code file must be correct.
The reason is that, my pointers is found mainly based on the pointers used in the ASM program code, which is not found by the tool pointer searcher.

How do I do it?
I first select the parent class that is closer to the root
Press X to see if there is a referer (ignore the child classes)
When reaching a class instance without referer, the next set up a breakpoint.
Play the game for a while, the breakpoint will be triggered.
I will trace upwards in the program, and check the registers X0, X19, X20, X21, X22, etc.
maybe they are an Instance of a certain CLASS (use i() to explore there), and you can often find some related structures.
Generally speaking, at the end of the function that triggers the breakpoint, check where X30 returns,
look up at the source of x0 there, then you can also find an accurate pointer

I got almost same error with DisneyDLV


so I tried to follow the step but can`t understand step 2 well ...
2. Connect GDBstub with IDA PRO means to connect IDA Pro with Switch Game (Application) running??


um ... I`m completely lost, sorry
uh ... I typo the IP address so made it correct and this

 

[Eiffel2018]

um...the useage is to open the main.elf first and then run il2Address.py, right??
I got an error message by following that
View attachment 380964

I`m super noob learning making cheat codes so it`s embarrassing but can you help with this?? thx

For your reference,
I put my files as these structure




The share library path is hard-coding with ../__python__/
You may follow or change them by yourself

 

[morarin]

For your reference,
I put my files as these structure

View attachment 381062


The share library path is hard-coding with ../__python__/
You may follow or change them by yourself

I changed the file structure as yours and got same result
um...I`ll try on other games or try to find these two registrations in another way somehow??

thx for your tutorial and reply!!

 

[Eiffel2018]

for exploring the il2cppdump

1. open the elf with IDA PRO v7.5 or above
2. wait for a while
3. ALT+F7 and select the ida_with_struct_py3.py
4. choose the script.json and then il2cpp.h

Then the functions name will be appeared

Post automatically merged: Jul 1, 2023

for using the GDBstub (without il2cpp / without metadata / without main.nso)
1. just open unity_gdb.i64 with IDA PRO
2. connect to switch console
3. Shift+F2 and run the initialize script (1)

4. move to the location of any variable you found and then run the class analyzing script (2)

for more details, check #6

Post automatically merged: Jul 1, 2023

For generating the cheat file

1. open the elf with IDA PRO v7.5 or above
2. wait for a while
3. ALT+F7 and select the cheatgen.py written by yourself

here(first attachment) is an example of a cheatgen.py

Post automatically merged: Jul 1, 2023

Unity.7z (second attachment) contains the files inside ../__python__

 

[morarin]

for exploring the il2cppdump

1. open the elf with IDA PRO v7.5 or above
2. wait for a while
3. ALT+F7 and select the ida_with_struct_py3.py
4. choose the script.json and then il2cpp.h

Then the functions name will be appeared

Post automatically merged: Jul 1, 2023

for using the GDBstub (without il2cpp / without metadata / without main.nso)
1. just open unity_gdb.i64 with IDA PRO
2. connect to switch console
3. Shift+F2 and run the initialize script (1)
View attachment 381158
4. move to the location of any variable you found and then run the class analyzing script (2)

for more details, check #6

Post automatically merged: Jul 1, 2023

For generating the cheat file

1. open the elf with IDA PRO v7.5 or above
2. wait for a while
3. ALT+F7 and select the cheatgen.py written by yourself

here(first attachment) is an example of a cheatgen.py

Post automatically merged: Jul 1, 2023

Unity.7z (second attachment) contains the files inside ../__python__

step 2 in this worked for me even ig!!

btw I finally got what ..\ means