Summary

The article outlines the process of reverse engineering Unity3D games for Android, particularly since August 1, 2019, when Google mandated 64-bit architecture support, leading to the use of IL2CPP Scripting Backend, which simplifies the extraction of game source codes in C# from APK files.

Abstract

The article titled "How to reverse engineer Unity3D Games?" challenges the perception that Unity games are secure due to their binary format within APK files, as opposed to JavaScript-based browser games. The author, after conducting experiments, discovered that reverse engineering Unity games is feasible, especially with the IL2CPP backend, which is now commonly used due to Google's requirement for 64-bit architecture support in games published on the Google Play Store. The tutorial explains the steps involved in reversing a Unity-based game, from decompiling the APK file using apktool to extracting game codes and class names using Il2CppDumper and viewing the exposed source codes with dnSpy. The author emphasizes the ease of this process and concludes by directing readers to resources on protecting Unity games from hacking.

Opinions

The author initially believed that Unity games were more secure than JavaScript browser games due to their binary format, indicating a common misconception about the safety of Unity games.
The author's opinion shifted after experiments revealed the relative ease of reverse engineering Unity games, highlighting a potential security oversight in game development practices.
The requirement from Google for 64-bit architecture support has inadvertently increased the risk of game code exposure, according to the author's view.
The article suggests that the use of IL2CPP as the Scripting Backend, while necessary for compliance with Google's requirements, has a significant drawback in that it simplifies the reverse engineering process.
The author provides a tutorial with the opinion that it is crucial for developers to understand the vulnerabilities in their games, implying that awareness is the first step towards better security.
By pointing readers to further resources on game protection, the author opines that while reverse engineering is straightforward, there are methods available to mitigate these risks.

How to reverse engineer Unity3D Games?

Before writing this article, I thought Unity’s games were much safer than some browser games built using JavaScript. Since games are built as binary and embedded in an apk file, which should be very challenging to reverse engineer games when compared to some games built by plaintext JavaScript codes.

However, after doing some experiments, I realized my theory is wrong and decided to write this tutorial.

With the Scripting Backend: IL2CPP to build your game, it is easy to reverse your game from apk file to source codes in C#, which gives malicious hackers the ability to see what kind of classes, methods, functions, properties, and even logic you implemented in your games.

In this tutorial, you will know how easy it is to reverse engineer a Unity-based game on Andoird.

When did this happen?

Since August 1, 2019, Google has required all games to support 64-bit architecture, the Unity developers needed to enable the Scripting Backend: IL2CPP feature when building and publishing games to the Google Play Store.

This may pose the risk that the public could easily discover game codes.