Scope of Application
Use this skill first when the task belongs to the following scenarios:
- Game anti-cheat mechanism analysis (EAC, BattlEye, Vanguard, GameGuard)
- Unity game reverse engineering (IL2CPP / Mono)
- Unreal Engine game reverse engineering (UObject, Blueprint)
- Memory scanning and structure reconstruction (Cheat Engine, ReClass.NET)
- Game protection packer analysis (VMProtect, Themida)
- Application of DBI frameworks in games (Frida, DynamoRIO, Pin)
- Game Mod/cheat principle analysis
- Anti-debugging/anti-VM bypass (game scenarios)
Division of Labor with Other Skills
| Scenario | What to Use |
|---|---|
| Game reverse engineering, anti-cheat, Unity/UE analysis | This skill |
| General binary reverse engineering (non-game) | ida-reverse/ or radare2/ |
| APK games (Java layer) | apk-reverse/ → If the core is in so, return to this skill |
| General anti-analysis methodology | reverse-engineering/anti-analysis.md |
| Dynamic Hook (Frida general) | reverse-engineering/tools-dynamic.md |
Debugging Tools
Windows Debuggers
| Tool | Purpose | Suitable Scenarios |
|---|---|---|
| Cheat Engine | Memory scanning, value search, pointer scan | Game value locating, structure discovery |
| x64dbg | General x86/x64 debugging | Breakpoints, tracing, patch |
| WinDbg | Kernel/user-mode debugging | Driver-level anti-cheat analysis |
| ReClass.NET | Memory structure reconstruction | Class/struct reverse engineering |
| HyperDbg | Hypervisor-based debugging | Bypassing kernel-level anti-debugging |
Specialized Debuggers
| Tool | Purpose |
|---|---|
| CE Mono Helper | Unity Mono game debugging |
| dnSpy | .NET assembly debugging/decompilation |
| ILSpy | .NET decompilation (read-only) |
| Frida | Cross-platform dynamic instrumentation |
Disassembly and Decompilation
Multi-platform
| Tool | Positioning |
|---|---|
| IDA Pro | Industry standard, deep analysis → use ida-reverse/ skill |
| Ghidra | Free alternative, strong scripting capabilities |
| Binary Ninja | Modern RE platform, API-friendly |
| Cutter | radare2 GUI frontend |
Game Specialized
| Tool | Purpose |
|---|---|
| IL2CPP Dumper | Unity IL2CPP structure recovery |
| dnSpy | .NET/Unity Mono decompilation |
| Dumper-7 | UE SDK generator |
| Recaf | Java bytecode editing |
Memory Analysis
Scanning Tools
- Cheat Engine: Pattern scanning, value search, pointer chains
- ReClass.NET: Structure reconstruction, class inheritance relationships
- Process Hacker: System-level process analysis
Dump Tools
- KsDumper: Kernel-mode process dump
- PE-bear: PE file analysis
- ImHex: Modern hex editor
Dynamic Binary Instrumentation (DBI)
Framework
| Framework | Features | Suitable scenarios |
|---|---|---|
| Frida | Cross-platform, JS scripting | Fast Hook, API tracing |
| DynamoRIO | Runtime code manipulation | Code coverage, fuzzing |
| Pin | Intel official DBI | Precise instruction-level analysis |
| TinyInst | Lightweight instrumentation | fuzzing harness |
| QBDI | QuarkslaB DBI | Embedded/mobile |
Common uses
- API Hook and tracing
- Code coverage analysis
- Fuzzing harness construction
- Behavior analysis
Anti-analysis bypass (game scenarios)
Common protections
- Anti-debugging detection (IsDebuggerPresent, NtQueryInformationProcess)
- VM/sandbox detection
- Timing attack detection
- PatchGuard (kernel-level)
- Driver-level protection (EAC, BattlEye kernel drivers)
Bypass tools
- TitanHide: Kernel-level anti-debugging hiding
- HyperHide: Hypervisor-based hiding
- ScyllaHide: x64dbg/IDA anti-anti-debugging plugins
Game engine-specific workflows
Unity games (IL2CPP)
1. 定位 GameAssembly.dll
2. 用 IL2CPP Dumper 恢复结构（dump.cs + script.json）
3. 在 IDA/Ghidra 中加载 GameAssembly.dll + dump 信息
4. 定位目标函数（通过类名/方法名搜索）
5. Hook 或 patch
Unity games (Mono)
1. 定位 Assembly-CSharp.dll（通常在 Managed/ 目录）
2. 用 dnSpy 打开，直接看 C# 源码
3. 修改逻辑 → 保存 → 替换原文件
4. 或用 Frida + CE Mono Helper 动态 Hook
Unreal Engine games
1. 识别 UE 版本（从字符串/签名判断）
2. 用 Dumper-7 生成 SDK
3. 分析 UObject/UFunction 系统
4. Hook ProcessEvent 或目标函数
Native games (no engine)
1. 标准 PE 分析（IDA/Ghidra/r2）
2. 导入表/导出表重建
3. 模式扫描定位关键签名
4. 运行时内存分析（CE + ReClass）
VMProtect / Themida analysis
Approach
- Identify protection type and version
- Attempt unpacking (if a known unpacker exists)
- If unpacking is not possible:
- Locate virtualization handlers
- Analyze control flow
- Trace execution paths with DBI
- Runtime dump of key functions
Note
- Do not expect complete unpacking; in many cases you only need to understand the key logic
- Prefer dynamic methods (Hook + trace) over stubbornly pursuing static devirtualization
Recommended analysis order
When encountering game reverse engineering tasks:
1. 确认游戏引擎（Unity/UE/原生）
2. 确认保护机制（反作弊类型、壳）
3. 选择对应工作流
4. 先用轻量工具侦察（CE 扫描、字符串搜索）
5. 再用重量工具深入（IDA 反编译、DBI 追踪）
6. 动态验证发现
Data sources
The tool list of this skill references the awesome-game-security project. If you need to find the GitHub link or latest version of a specific tool, you can get it from that repository.
On-Demand Bootstrap
Automation capability boundaries
| Tool | Can be installed automatically | Installation method | Description |
|---|---|---|---|
| x64dbg | ✗ | Manual download | https://x64dbg.com/ |
| Cheat Engine | ✗ | Manual installation | https://cheatengine.org/ |
| Ghidra | Extensible | GitHub Release ZIP | Can be added to bootstrap-manifest |
| dnSpy | ✗ | Manual download | No longer maintained; use the dnSpyEx fork |
| IL2CPP Dumper | ✗ | Manual download | https://github.com/Perfare/Il2CppDumper |
| Frida | ✓ | pip install frida-tools | Already in bootstrap |
| IDA Pro | ✗ | Commercial software | Use ida-reverse/ skill |
| radare2 | ✓ | GitHub Release ZIP | Already in bootstrap |
Description
Most game security tools are GUI applications or require special environments (such as kernel drivers), and are not suitable for fully automated bootstrap. This skill mainly providesmethodology and workflow guidance, and tool installation is mainly manual.
Tools already in the bootstrap system (Frida, radare2, IDA) can directly reuse the bootstrap capabilities of the corresponding skill.
Routing context
Upstream entry: skills/SKILL.md(master control),routing.md
Trigger conditions: The task involves game reverse engineering, anti-cheat, Unity/UE, memory scanning, and game protection shells
Downstream Export:
- Requires in-depth IDA analysis →
ida-reverse/ - Requires Frida Hook →
reverse-engineering/tools-dynamic.md - APK game Java layer →
apk-reverse/ - General anti-analysis methodology →
reverse-engineering/anti-analysis.md
Peer-related modules: reverse-engineering/(general methodology),ida-reverse/(deep decompilation)