So I have an android game. Its
.NET Reflector to show
File is not a portable executable. DOS header does not contain 'MZ' signature
It's encrypted. The app seems to decrypt that assembly at app launch time.
So I used
UltraCompare to point out what is changed from previous version(It wasn't encrypted).
classes.dex was identical, so no java code was changed.
libunity.so was identical, but
libmono.so had a big change.
There was some new added symbols which seem to be related with encryption such as
TEADecryptString, and some
mono library's C# internal call routine like
If it's the means of the encryption, I wander where are those functions called.
There was some changes to
Assembly-UnityStript-firstpass.dll with a same change pattern. I can't figure out what does this means.
So where can be the Assembly-CSharp.dll decrypted at runtime? Or is there another way without decrypting that at runtime?