Tutorial [Beginner Friendly] Guide to Easily Hacking Your First Unity Game

Farag1212 · December 19, 2020

Good luck 👍🍀

LeePham · December 20, 2020

On 6/9/2020 at 1:54 PM, D red said:

Hello,

What is the different of fmov and mov ?

Thanks

fmov is FLOAT

and MOV is INT

LeePham · December 20, 2020

they updated und change Binary to -> Unityframework

Alihackali · February 18, 2021

Hello sir, thanks for helping I hope you will help me.. I want to know how I can hack this game. I have now dnspy and ida pro. I extracted offset, but I do not know what to do anymore. I want to hack coins from the game (( Sugar Blast )) and extracted Offset. This is Huh 0x15938BC But I don't know what to do anymore Can you help me please I want to make it as Tweak to hack this game For Jailbreak users I know how to make Tweak I just want the way how to write the code what I can put it in Tweak.xm

Offset. This is 0x15938BC

DreamBlast.Inventory$$GetCoins

or can you show me what I have to use hex on tool iOSGods Live Offset

Updated February 20, 2021 by Apps96

Alihackali · February 20, 2021

.

Updated February 20, 2021 by Apps96

ꪫꪑꪖꪚ · June 11, 2021

It gave me this message while dumping il2cpp,

----- [Dumping ARM64] -----
Read config...
Initializing metadata...
System.IndexOutOfRangeException: Index was outside the bounds of the array.
at Il2CppDumper.Metadata.ProcessingMetadataUsage()
at Il2CppDumper.Metadata..ctor(Stream stream)
at Il2CppDumper.FormGUI.Init(String il2cppPath, String metadataPath, Metadata& metadata, Il2Cpp& il2Cpp)
at Il2CppDumper.FormGUI.Dumper(String file, String metadataPath, String outputPath)

Copied ida_with_struct.py
Copied ida_with_struct_py3.py

Updated June 16, 2021 by CrazyBloo

ic0 · July 10, 2021

qss

Noela87 · August 30, 2021

Can this also be used for non Unity games?

cybergeisha · November 3, 2021

.

Updated November 9, 2021 by cybergeisha

xrayactual · January 20, 2022

Solution:

Spoiler

Unity games place their executable/binary within the Frameworks folder of the app

~/this.app/Frameworks/UnityFramework.framework/UnityFramework

I was able to decrypt the UnityFramework executable using flexdecrypt, because CrackerXl+ does not allow you to target any binary other than the one in the app's main directory, making it useless for cracking unity games.

Using the much larger decrypted UnityFramework along with the aforementioned global-metadata spits out the necessary archive

~/this.app/Data/Managed/Metadata/global-metadata.dat

Original post:

@Enoch Is it not possible to decrypt unity games using Il2cpp Dumper anymore?
CC: @Ted2 @Rook
I'm getting errors on the two online tools, (IOSGods & JumboPerson), even though I have the executable/binary from CrackdXl, and the metadata from the file path "/this.app/Data/Managed/Metadata", but nothing is working.
One of the games I was testing this with has already has mod menus (jailed & jailbroken)

Spoiler

Screen Shot

There are so many tutorials on IOSGods (regarding mobile hacking basics/tools) and they are all so spread out (in time), some of which are extremely outdated or have requirements that are no longer available/reliable, it's difficult to piece together the process together as it stands today. At this point it's honestly easier to troubleshoot the issues I or others encounter, as they occu, until someone redoes/properly updates the tutorials.

Some other issues that don't seem to have an explanation:

~~Using the attach command on an active process through LLDB will crash LLDB, returning you to the previous file path~~
GNU Debugger is completely broken, using the gdb command (literally the first step) spits out the following error, attempts to fix/circumvent caused a cascade of headaches in sources, tweaks/names, duplicate files (during/after install), and their prerequisites
- Spoiler
```
/usr/bin/gdb: line 355: /usr/libexec/gdb/gdb-arm-apple-darwin: Bad CPU type in executable
/usr/bin/gdb: line 355: /usr/libexec/gdb/gdb-arm-apple-darwin: Undefined error: 0
```
Syscall, ptrace, etc. not found in disassembled executable
I'll add more as they present themselves

Solutions:

Spoiler

Anti-debugging detection?
1. So far no bypass has worked for me
2. Haven't found any known debug checkers, functions are clean too
Possibly deprecated?
1. Given up on GDB

Updated January 21, 2022 by xrayactual
Additional details