How to extract C# Code from Unity APK

Antonio Pavlinović — Wed, 06 Nov 2019 13:01:26 +0000

Introduction

Unity games are built using C#, an open language developed by Microsoft and widely used in the game industry. Android and iOS games built with Unity ship with enough meta data to restore a significant portion of the original C# code base, including enumerations, class and method names and strings.

In this guide we'll outline the steps required to extract the C# code using Il2CppDumper and some black magic 🧙.

Prerequisites

Download the latest version of Il2CppDumper and extract it somewhere on your PC.
7-zip or any other ZIP file extractor. Android apps are ZIP archives disguised as APK files. In order to inspect their content, you will need to extract them.

Before you start: Finding Unity version from an APK

In order to use Il2CppDumper, you need to know the exact Unity version used in the APK. You can find the exact Unity version inside the APK:

Extract the APK
Navigate to \assets\bin\Data\Resources and open unity_builtin_extra in a Text Editor of your choice.
Copy the Unity version string!

Unity version used in the game is located in the first line of the unity_builtin_extra file. It's a plain text string that can be copied easily.

Guide

First things first:

Find an APK you want to explore on APK Mirror.
Extract the APK using 7-zip
Launch Il2CppDumper.exe and select the following files:

libil2cpp.so from \lib\arm64-v8a (if using 64-bit APK)
global-metadata.dat from \assets\bin\Data\Managed\Metadata

Once you select the files, Il2CppDumper will ask you for the exact Unity version of your APK. Paste in the string you copied from the unity_builtin_extra file and select an extraction mode.

We recommend using Auto(Plus), but your mileage may vary. Play around with the mode setting until you find a combination that works for your APK. Here's how a successful extraction looks like:

Il2CppDumper extracts Unity C# code

Il2CppDumper will create several files on your hard drive:

dump.cs - raw C# output that contains the whole code base that was extracted. You can use this file to
script.py - a python script that describes how methods and fields should be created from the C# file
DummyDll - a folder that contains DLLs that Il2CppDumper has extracted. These DLLs can be analysed by DnSpy and explored further, but that's a story for another time.

Open up dump.cs with Sublime Text or Notepad++ and enjoy! You are now parsing through the actual Unity C# code that powers your game. This process should be same for iOS IPA packages.

A note on Il2CppDumper dumps

If you've followed along, you're aware that we've used Il2CppDumper as our primary tool for accessing the compiled code base. Unfortunately, in some cases, the C# code inside the dump.cs file is not going to be valid C.

From invalid names to incorrect class and type declaration, consider this to be a relatively correct representation of the code, but not something you can process further.

If you're planning to rewrite and repackage the code, you should use ILSpy and export the project into a Visual Studio solution.

How to extract Assets from Unity APK

Antonio Pavlinović — Wed, 30 Oct 2019 22:01:16 +0000

Introduction

These days, most Android, iOS and event Nintendo Switch games are built with Unity. As one would expect, Unity unified the development platform, allowing developers to (almost) build once and easily deploy at a variety of platforms.

Today, we're gonna show you how to extract icons, sprites, audio files, in-game models, text and other visual elements from a typical Unity application. For today's demonstration we'll be using Pokemon GO, as it's a very popular game written in Unity. The process is similar for every other Unity application, with a few tweaks here and there.

Prerequisites

This guide makes a few assumptions about your knowledge and tools. You will need the following to follow along with the guide:

Microsoft Windows , as most tools we're using are built for Windows. A decent computer is also recommended, as the extraction process can take some time, mostly depending on your hard drive and CPU speed.
An Android device (or a simulator) with X-Plore File Manager installed. This is "somewhat optional", but you will be limited to extracting assets only from APKs.
7-zip or any other ZIP file extractor. Android apps are ZIP archives disguised as APK files. In order to inspect their content, you will need to extract them.

Step 1 - Downloading extraction tools

In order to start extracting, you will need at least one Unity Asset extraction tool. These tools will allow you to dump assets with ease and they don't require any coding skills.

There are two tools which we recommend using:

Recommended: AssetStudio by Prefare, a GUI based tool that allows you to filter which type(s) of assets you want to export. Asset Studio is very straightforward and perfect for beginners.
Unity Asset Bundle Extractor is a lower level tool that can even manipulate Unity bundles. Useful for advanced data miners and readers who want to mess around with loading custom skins and color schemes.

Head over to Asset Studio's Releases section on Github and grab the latest release from there. Asset Studio doesn't require any installation. You can extract the downloaded ZIP file anywhere and start the Studio by opening AssetStudioGUI.exe:

Asset Studio GUI, nothing opened yet.

Step 2 - Getting and extracting the APK

APK files are packages used for distributing Android applications. APK files contain everything needed to start the application and they often contain a ton of visual assets. As mentioned before, we will be using Pokemon GO as a model Unity app in this tutorial

You can get the latest Pokemon GO APK in one of two ways:

Download it from APK Mirror
Extract it from your device by using APK Extractor

The easiest way is to download it from APK mirror. Grab the latest APK from APK Mirror, head over to your Downloads folder and open the APK with 7-Zip. Extract the contents into a sub-folder and navigate into it.

File contents of the Pokemon GO APK include various Android and Unity files. We are mostly interested in the assets folder. Future guides will target classes.dex and other hidden gems.

We could go on and on about the files and folders inside the APK, but let's focus on the task at hand: dumping assets.

Step 3 - Extracting the assets

TLDR

Extract the ZIP somewhere
Open Asset Studio and open the extracted folder
Select types of assets you want to dump (filter them)
Press Export > Filtered assets

We are now ready to explore and dump the assets. Switch over to Asset Studio and follow the instructions below:

Click File > Load Folder
Navigate to the folder where you extracted Pokemon GO
Select assets and click Select Folder
Let Asset Studio do it's magic

Once the process completes, you should see the following screen:

Asset Studio has finished parsing the folder and is now ready to export.

Switch over to the Asset List tab. These are all of the files you can export from the APK. As you can notice, some of them are Texture2D, some are sprites, some are TextAssets etc.

Before exporting select which files you want to dump. The easiest way to do that is to filter the Asset List by using the Filter Type dropdown from the menu bar. Open the Filter Type dropdown and select the following:

AudioClip
Sprite
TextAsset
Texture2D

In order to start the export process, click on the Export dropdown and select Filtered assets. Select a folder where you want to save the exported files. Let Asset Studio chew through your filtered files. The destination folder will automatically open when the process is done.

Here are the results we got, Sprite subfolder used as an example:

Sprites from Pokemon GO were dumped inside the /sprites subfolder. Textures, text assets and sounds were dumped in other subfolders.

Step 4 - Extracting from an Android device (optional, advanced) 🧙

In addition to extracting assets from an APK, you can extract Unity assets from the Android device where the APK was installed. This is especially useful for large games which don't ship with built-in assets, but rather download them on-the-fly. One of those games is Harry Potter: Wizards Unite.

Wizards Unite is built as a lightweight Unity shell that sets up player's account, loads the overworld map and renders some basic UI element. Upon encountering an enemy or opening a menu, the game will download and cache the required Unity assets. These assets are the same assets as you would normally get from the APK, but they are downloaded on demand.

This begs the question, if the assets are not in the APK, where are they?

The answer is simple: on your Android device. In order to find these assets we will use the aforementioned X-Plorer File Manager.

Warning: this part is going to be a little tricky at first, but it's gonna get easier once you get a hang of it. Follow the instructions closely, please. You will need a PC and the Android device for this to work.

Instructions for finding and Extracting Unity files from your Android device

Put both of your devices (PC and your phone) on the same network (same WiFi or local network). They need to be in the same IP range for this to work.
Launch X-Plorer and press "WiFi start". This will start a WiFi server on your phone and provide you with an IP address which can be used to explore your Android device from your PC.
Launch a browser of your choice and navigate to the IP address on your PC. A desktop friendly version of the X-Plorer UI will open up and you can navigate through your device easily.
In order to find app data, you need to navigate go to /sdcard/android/data and find your application's folder inside. For Wizards Unite, it's named com.nianticlabs.hpwu.prod.
Right click on the folder and press Download as Zip. That's it.

Dumping cached Unity Assets from an Android device.

The download process can (and quite often will) fail, so you have to be patient and download the assets in chunks or simply try your luck enough times.

The steps to extract the assets are the same as with the APK:

Extract the ZIP somewhere
Open Asset Studio and open the extracted folder
Select types of assets you want to dump
Press Export > Filtered assets

Parting words

This guide covers the basics of dumping assets from Unity Games and apps. You can use this process for a wide variety of games and apps on mobile and the PC. Be aware that a growing number of Unity games uses Android's hidden partition for storing downloaded assets.

Dumping those assets requires rooting, and we will address those games in a future article, but for now, let's stick with the basics.

Good luck in your asset dumping adventures! 🤠 ⛏️

DEV Community: Antonio Pavlinović

How to extract C# Code from Unity APK

Introduction

Prerequisites

Before you start: Finding Unity version from an APK

Guide

A note on Il2CppDumper dumps

How to extract Assets from Unity APK

Introduction

Prerequisites

Step 1 - Downloading extraction tools

Step 2 - Getting and extracting the APK

Step 3 - Extracting the assets

Step 4 - Extracting from an Android device (optional, advanced) 🧙

Instructions for finding and Extracting Unity files from your Android device

Parting words