My friend and I am trying to decrypt the Assembly-CSharp.dll file from an Android game which was written in Unity3D. Normally these files are readable when using something like JustDecompile, but this one is encrypted.
We managed to modify the APK so that it is debuggable and also managed to get the stuff running so that we can debug the APK in IDA Pro. This runs fine so far and we can also set breakpoints and all that stuff.
But when debugging the APK in IDA Pro we are not able to find the points where the client is decrypting the Assembly-CSharp.dll file as this seems to happen in libmono.so. Here is an example what the encrypted DLL looks like right now:
After making some adjustments of how the files are loaded from the APK, we were able to load libmono.so and also libunity.so into IDA, but we can not debug these files.
Whenever we want to debug them the IDA system tells us that these files can not run by themselves. Now we have 3 possible ways how to get to the point we want to:
- Finding the correct entry for libmono.so over debugging the classes.dex file
- Loading libmono.so or libunity.so to jump step by step to the point where the Assembly-CSharp.dll gets decrypted and extract the DLL (not sure how to do this yet ^^)
- Finding a way to load the libmono.so into IDA and debug it with another tool (I found a tool here which is called native-shim, this could probably help us).