====== Inspecting Information from Built Unity Players ======

It can be useful to inspect information from built Unity players. This can be helpful to check whether a certain DLL is used by the game, or verify that the player built properly.

===== High Level =====

  * [Android] .xapk/.apk/.so can be traversed with [[https://www.7-zip.org/|7-Zip]]
  * Unity asset file headers can be inspected with any hex editor((Even Notepad works, although only for files <500KB. Notepad may struggle to open bigger files.))

===== Unity Version =====

Find this information in:
  * ''.unity3d'' file header
  * resource file headers, for example:
    * ''unity default resources''
    * ''globalgamemanagers''
    * ''level<number>''
    * ''sharedassets<number>.assets''
    * files with 32 characters long names using hexadecimal characters [0-9a-f]
  * [Android]((since 2017.4)) ''lib/<arch>/libunity.so/.note.unity''
  * [Windows] ''<executable>/.rsrc/version.txt''
  * [Windows] ''UnityPlayer.dll'' - Properties / Details / File version

===== Used Assemblies ====
These methods work even with IL2CPP builds.

  * ''ScriptingAssemblies.json''
  * Search for ''.dll'' in ''global-metadata.dat'' with a hex editor.

Use cases:

  * We can determine URP usage by looking for ''Unity.RenderPipelines.Universal.*.dll''((e.g. ''Unity.RenderPipelines.Universal.Runtime.dll''))

===== Notes =====

  * In non-IL2CPP((ie. Mono)) builds, all code that made it into a build is also available to the end user and can be viewed with tools ((dnSpy or ILSpy for .dll files)) relatively easily. Obfuscation can mitigate this, however the most effective obfuscation methods((runtime assembly generation/loading and other methods relying on JIT)) are not compatible with IL2CPP so can't be used by developers.
  * ''global-metadata.dat'' appears to contain all the method/property/field names in UTF-8 (or at least those that were used and not stripped) from all the assemblies that were used by the build.