How to extract C# Code from Unity APK

Introduction

Unity games are built using C#, an open language developed by Microsoft and widely used in the game industry. Android and iOS games built with Unity ship with enough meta data to restore a significant portion of the original C# code base, including enumerations, class and method names and strings.

In this guide we'll outline the steps required to extract the C# code using Il2CppDumper and some black magic 🧙.

Prerequisites

• Download the latest version of Il2CppDumper and extract it somewhere on your PC.
• 7-zip or any other ZIP file extractor. Android apps are ZIP archives disguised as APK files. In order to inspect their content, you will need to extract them.

Before you start: Finding Unity version from an APK

In order to use Il2CppDumper, you need to know the exact Unity version used in the APK. You can find the exact Unity version inside the APK:

1. Extract the APK
2. Navigate to \assets\bin\Data\Resources and open unity_builtin_extra in a Text Editor of your choice.
3. Copy the Unity version string!

Guide

First things first:

1. Find an APK you want to explore on APK Mirror.
2. Extract the APK using 7-zip
3. Launch Il2CppDumper.exe and select the following files:

• libil2cpp.so from \lib\arm64-v8a (if using 64-bit APK)
• global-metadata.dat from \assets\bin\Data\Managed\Metadata

Once you select the files, Il2CppDumper will ask you for the exact Unity version of your APK. Paste in the string you copied from the unity_builtin_extra file and select an extraction mode.

We recommend using Auto(Plus), but your mileage may vary. Play around with the mode setting until you find a combination that works for your APK. Here's how a successful extraction looks like:

Il2CppDumper will create several files on your hard drive:

• dump.cs - raw C# output that contains the whole code base that was extracted. You can use this file to
• script.py - a python script that describes how methods and fields should be created from the C# file
• DummyDll - a folder that contains DLLs that Il2CppDumper has extracted. These DLLs can be analysed by DnSpy and explored further, but that's a story for another time.

Open up dump.cs with Sublime Text or Notepad++ and enjoy! You are now parsing through the actual Unity C# code that powers your game. This process should be same for iOS IPA packages.

A note on Il2CppDumper dumps

If you've followed along, you're aware that we've used Il2CppDumper as our primary tool for accessing the compiled code base. Unfortunately, in some cases, the C# code inside the dump.cs file is not going to be valid C.

From invalid names to incorrect class and type declaration, consider this to be a relatively correct representation of the code, but not something you can process further.

If you're planning to rewrite and repackage the code, you should use ILSpy and export the project into a Visual Studio solution.