Unity Game Hacking with dnSpy

Key Takeaways

this is a continuation of the previous video where we had done some introduction to game hacking with the Defcon 32 game in the labs and challenges that they had put together we had used the cheat engine utility which you could fire up here and then attach to any game or process you would like it's a very cool Dynamic debugger but in this video we will not end up using cheat engine we will instead use a tool called DN spy and that will act as our net debugger and assembly editor this is for C working behind it but the original DN spy if you track it down online on GitHub is actually discontinued you'll want to be sure to use DN spy X that is the continuation of the DN spy project and that has this available with their Fork repository where you can download the releases and get this up in action if you'd like if you'd like to follow along I do recommend you download from the releases and all it is is just a zip file with the static binary included so we can go ahead and get that ready for us I've got that in my downloads folder just going to extract the zip archive and then create a shortcut so we can easily access it now with DN spy on my desktop we can fire up the game and remember this is a unity game so we'll be working with C some of the managed assemblies behind it but where we left off in the previous video we just wrapped up levels 1 2 and three in this video we will want to go tackle levels four five and six so we'll go to the level select option here and then get back to level four this will spawn us here on this map with our usual unicorn raft here and he says fine you can have it with the goal and objective to be this flag we'll want to go walk and grab that but the floor falls out from underneath us and all the barrels fall on us and hey it says have fun down here good luck you're never going to be able to get out you won't be able to do anything you can't jump out here and get to the end of the level we can climb these stairs but it's not going to be able to get us back to the end where we want to be able to reach that checkered goal over there so our objective with level four is to try and figure out how we would be able to get past that falling floor in which case we can open up the folder the directory with all of the contents for the game itself and we do have this game hacking Gore data directory now this has a lot of stuff in it but what we want to start looking at is the managed folder and that'll include an assembly C.D this is one of the critical game files that defines a lot of the logic hey a lot of the different classes a lot of the code behind it and maybe just maybe we could actually manipulate it sort of patch the game contents and make it do whatever we really want it to do instead all it takes is rebuild building and modifying that dll so what I'm going to do is actually make a copy of this I'll right click to copy and then I'll simply paste because I want to have a modified rendition so I'm just going to rename this to hyphen modified and we'll have another copy that we can just simply call the original so we have a save backup and we can make changes to whatever will end up kind of swapping in place for the actual assembly C dll then we'll go ahead and open up DN spy and with DN spy started we can actually go open and assembly here CR o to open navigate back into that folder for game hacking the game hacking data and we'll modify the modified dll that we kind of reserve for ourselves let's open that and you'll see it gets added down here on the left side navigation to see it in the assembly Explorer now we can expand this if we click into the arrows here pull these down and you might have seen DN spy in plenty of other videos on this channel ultimately we want to go explore what might be in the sort of hyphen rendition here with the curly brace say to denote hey here are a lot of the different classes behind the logic and game functionality you can see things here like anti-che you can see things like Health text like laser turret main menu and down here you might even be able to see Pitfall so if I click into that it'll start to decompile it and the text will be visible over on this right side this is the C behind what will be used in the unity engine to run the game so take a look at some of the logic here we've got a function that runs as it starts we also see one called ont trigger enter that takes in a parameter and you can see that included in the parenthesis here for a collider type object name being called other and the logic here is checking if the other property your game object that's passed into it if it can compare the tag being the player well then all of this code block will follow apparently the floor will be set active to false meaning okay it's no longer going to be functioning presumably floor two done the very same and then an array of object objects from this pit objects probably things that it's just trying to carry or hold on to it goes through in a loop to actually set each of those to active enabling gravity and having them just fall down like we saw and then it will destroy the flag which is peculiar we don't want that to happen so what if we just kind of remove that you can see down below all the other properties sort of hey private or public class fields that are included again being it's copy of a floor floor two pit objects and the flag but what if we could just sort of modify this inative code if we rightclick we can actually edit an entire class or this method hotkey there is control shift e so let's do that and then this will start to decompile and get to that function for us and allow us to actually interact with it and make changes like now we can type here we can do whatever we would want but all we really want to do is remove this logic so that if the player were to collide with it it won't just disappear or go away so what I'm going to do is have this all selected and then backspace to delete it so that this function basically does nothing not adding a collision Logic for the player walking onto this Pitfall I shrink this window down on the bottom right you can see this compile button and that's all that we really need it will now basically knp out or remove the functionality of that function with that we can go ahead and save this module click that and file it can use the same path that it's already in using our assembly C modified let's click okay and once that's done we'll go back to our folder that we had open knowing that okay this modified one is what we want to put in place of what the game will load the assembly C dll file so I'll delete this old one make a copy of this crl c contrl v on my keyboard and now let me rename this let's remove the modified suffix so that just has the original name assembly C with that in action let's go try the game again and see what level four does level select level four and now that we're dropped in I can start to walk with WD but the floor is not going to go away from us that's pretty awesome we've patched that functionality out of the game now when I try to go grab the flag though it doesn't do anything uh maybe that wasn't active either so that doesn't really help we can keep shooting our unicorn raft friend but that's not going to do anything for us so let's go take another look in the code and see what we might be missing you might have seen it when we had DN spy open but there is a whole another object or class definition here called pit complete and presumably this is when okay it lands on the ground and it's done working through the action of hey falling and having the floor just fall beneath you but if you actually read the function here it ends up checking if the player collides with it and this is not completed that exclamation point in the two ampersands to FL The Logical and it says the completion feedback will probably play a sound the global Unity engine will instantiate a new object being a pit flag and then it sets its own completion variable to true so it creates a new flag rather than the one that's just dis displayed in the middle of the field is this something that we'll actually end up walking into let's get back to the game and just see what happens if we keep walking around and maybe this sort of checkered finale or goal here is maybe just an invisible wall to note and Trigger oh yep okay the flag shows up and then the kind of latch hole opens so we can complete that level once we grab this flag I can press I to open my inventory and we'll see there is our pit flag with the text being you should play basketball okay cutesy let's get back to this and go complete level four excellent now we can move on to level five unicorn W says okay bud I'm done with this game you aren't getting out of here alive for this one and this is weird you can see like this red force field surrounding it and uh turret back over there uh I'm going to assume trying to get the flag that's probably just going to kill me isn't it yep okay that killed me so back in DN spy let's see what we can do here looking at the other classes that we have available to us do we see anything that sounds like oh the turret yep okay laser turret laser turret race maybe that one is interesting let's take a look at the logic we see this on enable and on disable function to do some things with an event stop or start listening uh we also see a fire laser okay that sounds about right and what's the info here player health will grab the player actually getting the object and retrieving their health property it instantiates a new object of a laser and then he plays the sound and checks if it does kill and if it does it kills the player H okay so once again pretty simple we could just go ahead and remove all this logic this is the function just for fire laser though if we keep scrolling down we can see that's actually called on another event collider another trigger enter when there is a collision with the player being the other object it's up against so maybe this is what we could patch out either of these two will work this is kind of the fun flexibility here let me see if we can decompile and then remove this logic done and done we'll hit compile down on the bottom right we'll go ahead and save this we'll hot swap remove the old actual thing that it's loaded and then make a copy to rename it to the proper assembly C file that it loads now I actually want to stop and restart the game because honestly we want to have it load this new dll let's start it up once again let's get to our level select choose level five and now we've removed the Collision for us hitting that sort of red force field and the laser turret won't be able to do anything so can I just jump into this pit and yes I can with that I can grab the flag and I'll H eye on my keyboard you can see there's the next flag okay now you have god mode with that we can ow the Unicorn raft hurt me let's jump out of here and then complete level five and move on to level six okay now we have all right cheater let's see if you can get past the ancient guard without a fish he won't budge and I ate all the fish okay thank you unicorn raft uh we have an apple in the middle of the map here can I get that yep okay now that's probably added to my inventory there it is Apple notably not a fish thanks for that so this giant statue of a cat it looks like this ancient guard I'm assuming this sort of uh yellow pad here whoa okay acting like a trampoline just like pushing me away as I interact with it we need to actually get a fish in our inventory it sounds like so let's go back to the code once again at this point I'm sure you get the gist right and this is pretty simple hey small stuff small tweaks within our DN spy so do you see this class has fish that sounds like what we want to drill down into we've got another Collision check here if it's the player that's going to walk up against it it checks if you have an inventory available and if that doesn't go down that condition if were to continue onward and not return out of dys function it'll end up checking fish items being set as a property and variable getting that from your inventory if it contains fish if the fish items count as greater than zero then it will walk through all of this in which case we get the feedback it will instantiate the fish flag builds out some completion objects and then checks something for anti-che warnings just as well hm we'll see the anti-che in action in the next video I think but what we can do pretty simple is just hey manipulate this logic change this condition to be something greater than or equal to zero since we don't have a fish and there's presumably no way to get one or again we could just kind of remove this block and keep all this code and functionality intact so let's edit this once again remember you could do a couple different things here you could just change this condition to greater than or equal to zero and keep that logic Branch or if we wanted to we could totally just remove the if statement and hey clean up that block of code you want to make sure to remove the return statement because that would end up finishing the function granted that's fine because we don't really need this debug log anymore so it's totally cool being the end of the function since there's nothing else really there so you could keep that functionality or again manipulate this however else you would like let's compile that save the module and this is all pretty simple and easy right we're just manipulating code that we can see basically in plain text because it is C assemblies and that's the benefit of this Unity rendition here let's click okay to compile that hot swap these files as usual and let's restart our game now back in level six we do not have a fish in our inventory but if we go walk against this sort of gold pedestal platform spot there let's see if we can kind of get by the ancient guard and the big cat here fingers crossed all right yeah there we go it just turns into the flag removes and puts up all these other notes here and then we get oh no cheating allowed Beyond this point okay uh we could move on to what would be level seven and we'll save that for the next video but now we can says no more cheating cheat again and you're out of here so we might need to go play with that anti-che class but we've got another objective for level seven for the moment though we're done we did levels four five and six and it was just some simple patching a couple modified and manipulated he logic within the code but that's something that we could easily do thanks to the way this game was written it being a game built in the unity Engine with some C managed assemblies we could totally crank through it and do what we want within DN spy with that we're all done quick video thanks so much for watching everybody hope you do all those YouTube algorithm things like comment subscribe and I'll see you in the next video