The Unity engine provides a number of PlayerPrefs.SetXxx functions that can be used to save user data. However, it will automatically append a hash to the name of what you saved. For example, a call of
PlayerPrefs.SetString("justTesting", "TEST!");
will add a registry value of
on Windows platform.
I know it's actually djb2-xor, but I am still curious about how the hash function is implemented. By using dnSpy I found PlayerPrefs.SetString, which is implemented in UnityEngine.CoreModule.dll, finally calls a native method declared as

private static extern bool TrySetSetString(string key, string value);

And I'm stuck here. There's indeed a string UnityEngine.PlayerPrefs::TrySetSetString in .rdata section of UnityPlayer.dll, but I don't know where to find the actual code for it. What should I do next?


OK after some bold attempts I finally found it quite simple, at least on this Unity version. First, find the method name string and where it's referenced: enter image description here

It is referenced at 11376594. But what's at this address? Here we go: enter image description here

It's a string table. The next thing to do is to find out the table's start address, and then what references to this address. This guided me here: enter image description here And here: enter image description here This is a loop, which binds each function name to items in another table at 11371C40. This new table is a function table so I renamed it: enter image description here Now it's reasonable to suspect this function table contains how each native method is implemented. By adding the string offset to the function table address, I got the bool TrySetSetString(string key, string value) address. Diving deeper and here is the hash algorithm: enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.