How to view the source code of a game on Android: from APK decompilation to Unity/C# analysis

Studying the source code of mobile games on Android may be needed for various reasons: from reverse engineering (reverse engineering) for educational purposes to searching for vulnerabilities or creating mods. However, the process of extracting the code is not nearly as simple as opening a text file—games are protected by obfuscation, encryption, and legal restrictions. In this article we will look at access to code, tools for decompilation, as well as the nuances of working with popular engines like legal methods. It is important to understand: most commercial games are protected license agreements prohibiting decompilation. We consider methods exclusively for legal ways code access, decompilation tools APK, as well as the nuances of working with popular engines like Unity And Unreal Engine.

It's important to understand that most commercial games are protected by licensing agreements that prohibit decompilation. We consider methods exclusively for personal non-commercial purposes (for example, training or testing your own projects). If you plan to modify someone else's game for publication, this violates EULA (license agreement) and may entail legal consequences.

Technically, the process depends on what language and engine the game is written in. For example, games on Java/Kotlin (typical for Android SDK) are decompiled differently than projects on C# under Unity. We will look at both cases, as well as ways to extract resources (textures, sounds, 3D models) without diving deeply into the code.

1. Preparation: what you will need to extract the code

Before you start decompiling, make sure you have:

• 📱 APK file of the game —it can be downloaded from your device (via ADB or a file manager) or from sites like APKMirror (official versions only!).
• 💻 Computer s Windows, Linux or macOS —decompilation on the Android device itself is possible, but extremely inconvenient.
• 🛠️ Tools:
  • JADX or Apktool —for decompiling Java/Kotlincode;
  • dnSpy or ILSpy —for analysis Unitygames (C#). data-i="70">Also get ready for the fact that many games use decompilation protection
  • UnityEx or AssetStudio - to extract resources from Unity;
  • Ghidra or IDA Pro — for analyzing native code (C/C++).
• 🔌 ADB (Android Debug Bridge) — to extract APK from the device (if there is no file).

Also be prepared for the fact that many games use decompilation protection:

• 🔒 ProGuard or code obfuscators that replace class names with random characters; R8 — code obfuscators that replace class names with random characters;
• 🛡️ DexGuard a commercial tool for enhanced protection;
• 🔐 Native code —critical parts of the game can be written in C++ and compiled into binary files (.so);
• 🔗 Server validation —some games check the integrity of the code at startup.

⚠️ Attention: Decompilation of protected games (for example, with DexGuard or Unity IL2CPP) requires advanced skills and is often impossible without deep knowledge assembler or reverse engineering. Start with simple projects!

2. Method 1: Decompiling APK using JADX

JADX is one of the most popular tools for decompiling Androidapplications. It converts bytecode DEX (Dalvik Executable) into readable Javacode, and also extracts resources (pictures, XML files, etc.). Suitable for games written in Java/Kotlin or using Android NDK (but not for Unity or Unreal Engine).

Instructions for use:

1. Download JADX from the official repository on GitHub (versions available for Windows, Linux and macOS).
2. Run jadx-gui (graphical version) or use the command line:

   jadx -d output_dir game.apk

3. Wait for the process to complete. In the folder output_dir the following will appear:
   • 📂 resources — graphic files, sounds, XML markup;
   • 📂 sources — decompiled code on Java.

What can be found in the decompiled code:

• 🎮 Logic of game mechanics (for example, click processing, physics, AI);
• 🔑 API keys, server URLs (if not encrypted);
• 📊 Configuration files (levels, balance, character parameters).

⚠️ Attention: If the game uses ProGuard, the names of classes and methods will be replaced on a.b.c, d.e.f etc. It is almost impossible to restore the original names without mapping file (which only developers have).

3. Method 2: Analyzing Unity games using dnSpy

Most mobile games are created on an engine Unitythat uses C# as the main language. A powerful tool for analyzing and editing dnSpy - a powerful tool for analysis and editing .NETassemblies is suitable for decompiling such projects. It allows you not only to view the code, but also to make changes (for example, to create mods).

How to work with dnSpy:

1. Download dnSpy s GitHub (free version).
2. Extract Unity-assemblies from APK:
   • Rename game.apk to game.zip and unpack;
   • Find the folder assets/bin/Data/Managed - there will be files .dll;
   • Copy them to a separate directory.
3. Open dnSpy, drag .dllfiles into the app window.
4. Examine the class tree in the left panel. The main logic is usually located in assemblies like:
   • Assembly-CSharp.dll — custom code;
   • UnityEngine.dll — standard engine functions.

Advantages dnSpy:

• 🔍 Support debugging — you can set breakpoints and analyze execution code;
• ✏️ Editing — changed assemblies can be packaged back into APK;
• 📚 Deobfuscation - copes better with encrypted strings than ILSpy.

Limitations:

• 🚫 Does not work with games compiled through IL2CPP (a popular protection method c Unity);
• 🔒 Some games encrypt .dllfiles - additional analysis will be required.

What is IL2CPP and why does it complicate decompilation?

IL2CPP (Intermediate Language to C++) is a Unity technology that transforms C# code into native C++ before compilation. As a result, instead of readable .DLL files, you get binary code (.so), which is analyzed only through disassemblers like Ghidra or IDA Pro.

4. Method 3: Extracting resources without code (AssetStudio)

If you are not interested in algorithms, and graphics, sounds or 3D models, you can do without decompiling the code. For games on Unity a utility AssetStudio is suitable - it extracts assets (resources) from files assets and sharedassets inside APK.

Step-by-step guide:

1. Extract the APK (rename to .zip and extract the contents).
2. Find the files with extensions:
   • .assets —contain textures, models, audio;
   • .resS —resources for Unity;
   • .bundle —resource packages (used to download content over the network).

Run AssetStudio, drag the found files into the window app.

Select the required resources in the tree and export them (button Export).

What resources can be extracted:

Resource type	Format	Usage example
Textures	.png, .jpg	Character sprites, backgrounds, interface
3D models	.fbx, .obj	Characters, weapons, environments
Audio	.mp3, .ogg	Music, sound effects
Fonts	.ttf, .otf	Menu text, subtitles
Animations	.anim (Unity)	Movements characters, cutscenes

⚠️ Attention: Some games store resources in encrypted form or download them from the server during the game. In this case, AssetStudio will not help - you will need to analyze network traffic (for example, through Fiddler or Charles Proxy).

5. Method 4: Analysis of native code (C/C++) via Ghidra

Many games (especially AAA projects) contain native libraries - files with the extension .so (for example, libil2cpp.so, libunity.so).They are written in C/C++ and compiled into machine code, which complicates the analysis. To study them you will need disassembler for example Ghidra (free tool from NSA).

How to work with Ghidra:

1. Download and install Ghidra from the official website.
2. Extract .sofiles from the APK (they are located in lib/arm64-v8a or lib/armeabi-v7a).
3. Create a new project in Ghidra and import .sofile.
4. Select processor ARM 64-bit (or ARM 32-bit, if the game is for older devices).
5. Wait for the analysis. After this, you can view assembly code and try to restore the logic.

What can be found in the native code:

• 🎯 Anti-cheat systems (for example, checking memory integrity);
• 🔄 Physics engine logic (if the game uses Bullet or PhysX);
• 🔐 Encryption algorithms (for example, to protect saves).

Difficulties:

• 🧩 Code on assembler requires deep knowledge of architecture ARM;
• 🔍 Functions often do not have clear names (only addresses like FUN_00123456);
• 🕒 Analysis takes a lot of time - even for a small game it can take several days.

6. Method 5: Using Frida for dynamic analysis

Frida is a framework for dynamic analysis applications. Unlike decompilation, it allows intercept function calls in real time. timewhich is useful for studying the logic of the game without deep immersion in the code. For example, you can track how purchases are processed in the store or how damage is calculated.

Example of use:

1. Install Frida on your computer:

   pip install frida-tools

2. Connect your Android device via USB and run Frida-server on it:

   adb push frida-server /data/local/tmp/
   adb shell chmod +x /data/local/tmp/frida-server
   adb shell /data/local/tmp/frida-server &

3. Find the name of the game process:

   frida-ps -U

4. Connect to the process and intercept the desired function. For example, to track calls UnityPlayer.UnitySendMessage (used for interaction between C# and Java):

   frida -U -l hook.js -f com.game.package --no-pause

   where hook.js — a script with interception logic.

Examples of tasks for Frida:

• 💰 Tracking purchases in the game (calls IabHelper);
• 🎯 Changing values in memory (for example, the number lives);
• 🔍 Logging network requests (if the game does not use HTTPS).

⚠️ Attention: Many games detect Frida and block launch. To bypass the protection, you will need to patch binary files or use Frida-gadget manually.

7. Legal and Ethics

Before decompiling, please read the game's EULA. Most commercial projects prohibit: license agreement (EULA) games. Most commercial projects prohibit:

• 📜 Decompilation for any purpose other than backward compatibility;
• 🔄 Modification and distribution of modified versions;
• 🔍 Analysis of protected data (for example, anti-cheat algorithms).

What is allowed:

• 🎓 Study of code for personal training (if the developer's rights are not violated);
• 🛠️ Creation of mods for personal use (without distribution);
• 🐛 Search for vulnerabilities with notification to the developer (by rules Responsible Disclosure).

Consequences of violation:

• 🚫 Account blocking in online games;
• ⚖️ Claim for copyright infringement (in some countries);
• 🔒 Device Ban (if the game uses Google Play Protect or SafetyNet).

If you plan to publish the results of the analysis (for example, on GitHub or on a blog), make sure that:

• 📌 You do not disclose confidential information (API keys, protection algorithms);
• 📌 Your project does not violate platform rules (for example, Google Play prohibits modified APK);
• 📌 You indicate that the code is intended for educational purposes only.

8. Alternative methods: what to do if decompilation does not work

If the game is protected DexGuard, IL2CPP or other systems, standard methods may not work. In this case, try:

• 🔍 Analysis of network traffic:
  • Use Fiddler or Charles Proxy to intercept requests;
  • Look for JSON/Protobufmessages with game data.
• 🖥️ Emulation and debugging:
  • Run the game in Android Studio Emulator with a debugger attached;
  • Use ADB logcat to view logs:

  adb logcat | grep com.game.package

• 📦 Search for data leaks:
  • Check if configuration files are stored in /data/data/com.game.package/;
  • Use ADB pull to extract:

  adb pull /data/data/com.game.package/

If all else fails:

• 📚 Study engine documentation (for example, Unity Manual or Unreal Engine Docs);
• 🤝 Refer to the community of reverse engineers (for example, forums XDA Developers or Guided Hacking);
• 💡 Try to find open analogues games with similar mechanics (for example, on GitHub).

FAQ: Frequently asked questions about decompiling Android games

❓ Is it possible to decompile a game without it? root?

Yes, for decompilation APK root is not needed - the file itself is enough, however, to extract data from /data/data/ (for example, saves or cache) will require superuser rights or ADB with unlocked root-access.

❓ How to bypass ProGuard in decompiled code?

Completely restore original class names without mapping file impossible. However, you can:

• Use JADX with the option --deobfuscation;
• Analyze string literals in the code (they often contain hints);
• Compare several versions of the game - sometimes names are repeated.

❓ Is it possible to change the decompiled code and assemble it back?

Technically yes, but:

• For Javagames: after editing you need to recompile the code into .dex (for example, via Apktool), then sign the APK;
• For Unitygames: modified .dll can be packed back into the APK, but the game may refuse to launch due to integrity checks;
• On output will turn out modified APKwhich will not pass verification Google Play Protect.

❓ How to protect your game from decompilation?

If you are a developer, use:

• ProGuard/R8 for obfuscation Javacode;
• IL2CPP in Unity for conversion C# into native code;
• DexGuard or Jeb Decompiler for enhanced protection;
• Checking the integrity of files at startup;
• Encryption of critical resources (for example, through SecurePreferences).

Also regularly update protection - decompilation tools are constantly being improved.

❓ Is it legal to use decompiled code in your projects?

No, even if you change the code, it will be considered copyright infringement. You can:

• Study the code for training only;
• Write similar mechanics from scratch (without copying);
• Use open libraries with similar functionality.

If in doubt, consult a lawyer for IP-law.