Reverse-engineering of an Unity dll

Question

I'm working on a project which requires me to extract, edit, and reproduce part of a proprietary hash algorithm.. which is contained inside a dll.

The dll is used by an Unity game, and includes Unity between its references too.

This dll invokes some external functions contained in another dll (which I suppose has been written in c++, considering the DllImport etc present in the source code) with all the real hash logic and methods... and here comes the problem.

I've not been able to find and locate that dll: no trace in the folder at all.

So I suppose that Unity (or whatever tool) managed somehow to embed it inside the dll code itself... but after further decompilation, disassemblation etc, the dll does not present any code to eventually extract it!

The fact is that ILSpy is able to show this external dll in the "parent" dll references, marking it as a "module", but I have no idea about how to proceed to extract it (if it's relly there!).

I also tried to bypass the problem, including the entire dll into a C# project, and invoking its public functions at runtime (like the Unity game does)... but it seems that somehow, this idea is not working at all (read something about the fact that unity can run c# code, but I cannot init Unity via C#... or something like that).

So... After struggling for days, I decided to ask here to some experts.

Anyone can help me?

Answer 1

This dll invokes some external functions contained in another dll (which I suppose has been written in c++, considering the DllImport etc present in the source code) with all the real hash logic and methods... and here comes the problem.
I've not been able to find and locate that dll: no trace in the folder at all.

Use Process Explorer or Process Hacker to find which modules are loaded in the address space of the process. When you find the required dll, check whether there exists a valid path for that module in disk. If there is one then you may simple copy over the dll for further analysis. Otherwise the dll may have been loaded from memory. In such case you have to dump that dll from memory.

Next using a PE detection tool such as ExeInfo PE , Detect It Easy scan the dll. If it is a managed DLL (aka .net) check if a .net decompiler such as dotPeek or reflector can decompile it readily. If it is obfuscated, try using de4dot before decompiling.

If it is a native dll IDA Pro is your best option for analyzing the dll.

---

There are quite a few ways to package a dll inside an executable.

• For native dlls to be embedded inside native executables, you can simply store them as resources, which will be written to disk at runtime and loaded subsequently. Another way is to load it completely from memory as said previously.
• For native dlls to be embedded inside managed executables, you may use the resource method.
• For managed dlls to be embedded inside managed executables, you may use the resource method, but writing it to disk is not needed.

See this article on loading a dll from embedded resource for more info.