So I have an android game. Its Assembly-CSharp.dll
causes .NET Reflector
to show
File is not a portable executable. DOS header does not contain 'MZ' signature
It's encrypted. The app seems to decrypt that assembly at app launch time.
So I used UltraCompare
to point out what is changed from previous version(It wasn't encrypted).
classes.dex
was identical, so no java code was changed.
libmain.so
and libunity.so
was identical, but libmono.so
had a big change.
There was some new added symbols which seem to be related with encryption such as TEAEncrypt
, TEADecrypt
, TEAEncryptString
, TEADecryptString
, and some
mono library's C# internal call routine like ves_icall_System_Security_SecureString_EncryptInternal
.
If it's the means of the encryption, I wander where are those functions called.
There was some changes to Assembly-CSharp-firstpass.dll
, Assembly-UnityScript.dll
, Assembly-UnityStript-firstpass.dll
with a same change pattern. I can't figure out what does this means.
So where can be the Assembly-CSharp.dll decrypted at runtime? Or is there another way without decrypting that at runtime?