Engine-era PC games

In engine-era PC games much of the logic is outside the native executable. It is in managed assemblies, in C++ generated from them, or in packed asset files. This page has one section per engine or runtime. For these games the tools depend on the engine more than on the hardware. Each section uses the headings of the machine pages that apply. Software engines and middleware describes the engines and how to recognise each one.

.NET and Unity with Mono

How games were made and loaded

.NET assemblies decompile to near-source C# (.NET Framework; Mono).

Tools

The REA tools inspect managed assemblies (re-rea).

For an exact reimplementation

• Read the decompiled C# for the logic. Check its floating-point and integer rules against the runtime the game shipped with.

Unity with IL2CPP

How games were made and loaded

Unity's IL2CPP "converts all managed assemblies into standard C++ code". That code is compiled to an executable or a DLL (IL2CPP overview, Unity Manual).

Media and image formats

On Windows the output is GameAssembly.dll plus global-metadata.dat (not confirmed).

Tools

Il2CppDumper rebuilds names from the metadata (not confirmed) (Il2CppDumper).

For an exact reimplementation

• Rebuild the names first. Then trace the native code as for any PE program (re-trace).

Unreal Engine 4 and 5

How games were made and loaded

Unreal Engine 4 and 5 pack assets in .pak files, which may be AES-encrypted. UObject reflection keeps class names in the binary (not confirmed) (Unreal Engine).

Media and image formats

.pak files, which may be AES-encrypted (not confirmed).

Tools

More on Unreal is in Unreal.

For an exact reimplementation

• Use the class names that reflection keeps to name the functions.

Godot

How games were made and loaded

Godot packs .pck files (not confirmed) (Godot).

Media and image formats

.pck files (not confirmed).

Tools

gdsdecomp recovers projects (not confirmed) (gdsdecomp).

For an exact reimplementation

• Recover the project, then read the game's scripts for the logic.

Anti-cheat

Kernel-level anti-cheat can block debuggers (not confirmed) (Anti-cheat software). Protected or virtualised code is hard to decompile. Unicorn emulation is most useful on the game's own logic (re-emulate).

Linux builds as a second binary

Linux ports came from Loki Software between 1998 and 2002. Most Linux players now use Proton (2018) and the Steam Deck (2022). These facts are (not confirmed) (Loki Entertainment Software; Proton; Steam Deck).

Linux builds sometimes keep more symbols than Windows builds. Use a Linux build as a second binary. Compare its functions with the Windows build to name them.