Modding Unity Games on Android

Today we will be exploring how to modify a basic partially-online Android game that has no encryption, obfuscation, or protection, using only a few tools.

All you need to follow along is a Windows PC, an internet connection, and basic programming knowledge (preferable a basic understanding of C#).

Getting Started

Before we begin, we will need a few pieces of software.

1. dnSpy is a .NET debugger and assembly editor. It can be found here: dnSpy
2. APK Easy Tool is a GUI APK management tool. Among its features are decompiling/recompiling APKs, unzipping/zipping APKs, signing APKs, and ZipAlign. It offers other features but we do not need to worry about them. It can be found here: APK Easy Tool
3. Loot Hunters APK can be downloaded from the Play Store and grabbed from your device. APKs are typically installed to /data/app/<apkname>.apk. You may or may not need root access to view these APKs. I personally use Nox Player.

Grabbing the Code

The next step is to access the code from the APK. We do this by unzipping the APK using APK Easy Tool. First we open APK Easy Tool, then select the APK file.

Next, we click the Extract APK button.

Once the extraction is complete, we browse to the extracted APK. By default, this is Documents\3-Extracted APKs\<apk name>. From the APK root directory, we browse to /assets/bin/Data/Managed/. In here we will find several DLLs. The one we want is called Assembly-CSharp.dll. Open this file in dnSpy. You should see something like this:

Modifying the Code

Now that we have access to the code, we want to modify it. Start by expanding Assembly-CSharp (0.0.0.0), then Assembly-CSharp.dll, then -. You should see something like the following:

Look at the list of classes or search for the relevant search terms you would like to find. In this case, we want to change the loot chests we receive such that we receive only the best chests, even when the reward should be the worst chest. Find the AddRewardChest method in the TreasureRewards class. Although this method does not determine which chest we receive, it is the method that gives us the chest. The method takes one argument, that being an enum of REWARD_TYPE. We will be modifying the chestType variable which contains the type of chest we have been given.

Right-click anywhere in the AddRewardChest method in the code view, and click Edit Method (C#)... from the context menu.

A new window should open. In this window, we can edit the game code and recompile the changes. On the first line of the function, we will change the chestType to CHEST_MYTHRIL, which is the highest level chest available in the game. The one line of code added is chestType = EncounterReward.REWARD_TYPE.CHEST_MYTHRIL;.

Note: Somewhere else in the code checks how many mythril chests have been opened, compares it to gameplay time, and automatically bans the account based on those values, so don't do this.

Next, we will click the Compile button at the bottom right of the window, and the changes should compile successfully.

Now that we have finished modifying the code, we will save our changes. Click File in the toolbar at the top of the window, then click Save Module....

Then just click Okay to override the old DLL.

Finishing Up

The final step is to zip up the APK and install it on the target device.

Move back to APK Easy Manager and click Zip APK. This process might take a few seconds.

Browse to Documents\4-Zipped APKs\ or whichever target folder you specified in APK Easy Manager, copy the APK to the target device, and install it.

Lastly, we test the changes we made by opening the game, completing any encounter that rewards you with a chest upon completion, and checking our loot.

Hurrah! A mythril chest!

There are many other things you can do to practice in this game via this method, such as multiply rewards, skip treasure opening duration, provide unlimited health and mana, remove skill cooldowns, one-hit-kill enemies, etc.

Good luck and have fun!