So we get APK sample based on the uploaded aab and found out that these files are stored compressed (using HEX-editor on APK). Our app loads these files directly as byte sequence assuming that they are stored uncompressed inside APK. Then we noticed the problem that some StreamingAssets files are not loaded during runtime. Finding a way to load the libmono.so into IDA and debug it with another tool (I found a tool here which is called native-shim, this could probably help us).We uploaded Android App Bundle (aab) to Google Play which was build with "Build App Bundle (Google Play)" option enabled in Unity (2019.2).Loading libmono.so or libunity.so to jump step by step to the point where the Assembly-CSharp.dll gets decrypted and extract the DLL (not sure how to do this yet ^^).Finding the correct entry for libmono.so over debugging the x file.Now we have 3 possible ways how to get to the point we want to:
Whenever we want to debug them the IDA system tells us that these files can not run by themselves. Here is an example what the encrypted DLL looks like right now:Īnd what it should look like (from a game, made by me with unity):Īfter making some adjustments of how the files are loaded from the APK, we were able to load libmono.so and also libunity.so into IDA, but we can not debug these files. This runs fine so far and we can also set breakpoints and all that stuff.īut when debugging the APK in IDA Pro we are not able to find the points where the client is decrypting the Assembly-CSharp.dll file as this seems to happen in libmono.so. We managed to modify the APK so that it is debuggable and also managed to get the stuff running so that we can debug the APK in IDA Pro. Normally these files are readable when using something like JustDecompile, but this one is encrypted. My friend and I am trying to decrypt the Assembly-CSharp.dll file from an Android game which was written in Unit圓D.
0 kommentar(er)
