Uninomicon

Documenting the dark corners of the Unity Engine.

User Tools

Site Tools


unity_build_information_detection

Inspecting Information from Built Unity Players

It can be useful to inspect information from built Unity players. This can be helpful to check whether a certain DLL is used by the game, or verify that the player built properly.

High Level

  • [Android] .xapk/.apk/.so can be traversed with 7-Zip
  • Unity asset file headers headers can be inspected with any hex editor1)

Unity Version

Find this information in:

  • .unity3d file header
  • resource file headers, for example:
    • unity default resources
    • globalgamemanagers
    • level<number>
    • sharedassets<number>.assets
    • files with 32 characters long names using hexadecimal characters [0-9a-f]
  • [Android]2) lib/<arch>/libunity.so/.note.unity
  • [Windows] <executable>/.rsrc/version.txt
  • [Windows] UnityPlayer.dll - Properties / Details / File version

Used Assemblies

These methods work even with IL2CPP builds.

  • ScriptingAssemblies.json
  • Search for .dll in global-metadata.dat with a hex editor.

Use cases:

  • We can determine URP usage by looking for Unity.RenderPipelines.Universal.*.dll3)

Notes

  • In non-IL2CPP4) builds, all code that made it into a build is also available to the end user and can be viewed with tools 5) relatively easily. Obfuscation can mitigate this, however the most effective obfuscation methods6) are not compatible with IL2CPP so can't be used by developers.
  • global-metadata.dat appears to contain all the method/property/field names in UTF-8 (or at least those that were used and not stripped) from all the assemblies that were used by the build.
1)
Even Notepad works, although only for files <500KB. Notepad may struggle to open bigger files.
2)
since 2017.4
3)
e.g. Unity.RenderPipelines.Universal.Runtime.dll
4)
ie. Mono
5)
dnSpy or ILSpy for .dll files
6)
runtime assembly generation/loading and other methods relying on JIT
unity_build_information_detection.txt · Last modified: 2022/01/28 17:43 by 73.217.35.3