reversing-unity-il2cpp

reversing-unity-il2cpp is a skill for Claude Code from trilwu/secskills. It costs 85 tokens per session (1,845 once invoked), scanned A, original, MIT.

A method for examining Unity games and apps built with Mono or IL2CPP. IL2CPP compiles C# code into native code, so its metadata must be combined with the binary before the program logic becomes readable.

In plain words
What is it for?
Examining Android APKs, iOS IPAs, game logic, anti-cheat behavior, and API layers using Unity-specific files and analysis tools.
Why use it?
It helps identify the Unity build type and recover logic when tools such as jadx show mostly Unity plumbing. It also prevents using the wrong analysis approach for Flutter, React Native, or non-Unity apps.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Not installable on its own: it runs a file from its repository that does not travel with it. Clone the repository, or install whatever ships that file. The line is ilspycmd ./out/Assembly-CSharp.dll -o ./decompiled.

Part of the secskills-core plugin — 30 skills shipped together

Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add trilwu/secskills
Claude Code
/plugin install secskills-core

Made for: Claude Code.

Or install secskills-core, the plugin that ships this one along with the rest of its 30 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for reversing-unity-il2cpp

README.md
[![agentmods](https://agentmods.dev/badge/skills/trilwu/secskills/reversing-unity-il2cpp.svg)](https://agentmods.dev/skills/trilwu/secskills/reversing-unity-il2cpp)
Your own site
<a href="https://agentmods.dev/skills/trilwu/secskills/reversing-unity-il2cpp"><img src="https://agentmods.dev/badge/skills/trilwu/secskills/reversing-unity-il2cpp.svg" alt="Measured on agentmods" height="20"></a>
Per session 85 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,845 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00085 $0.01845
Opus 5 $0.00043 $0.00923
Sonnet 5 $0.00017 $0.00369
Haiku 4.5 $0.00009 $0.00185

Measured 6d ago against content hash 08fc0b7d1e2d, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

reversing-unity-il2cpp scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

secskills-core/skills/reversing-unity-il2cpp/SKILL.md · 164 lines

How it starts

The opening of the file, as written. The whole thing — 164 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Reversing Unity IL2CPP

Unity ships in two very different shapes, and identifying which one you have is the entire first decision. A Mono build hands you decompilable .NET assemblies. An IL2CPP build compiles C# to C++ to native code, and the C# metadata lives in a separate file that you must recombine with the binary before anything is readable.

When to Use

  • The APK contains assets/bin/Data/Managed/Metadata/global-metadata.dat and lib/arm64-v8a/libil2cpp.so
  • The APK contains assets/bin/Data/Managed/Assembly-CSharp.dll (Mono build)
  • The IPA contains Frameworks/UnityFramework.framework
  • jadx shows only UnityPlayerActivity and Unity plumbing
  • You need to recover game or app logic, anti-cheat behaviour, or the API layer

When NOT to Use

  • Flutter or React Native — use reversing-flutter-apps or reversing-react-native-apps
  • Ordinary native apps — use testing-mobile-applications
  • Desktop game binaries with no Unity markers — use analyzing-binaries
  • Building cheats or bypassing anti-cheat in live multiplayer services — out of scope; that is service abuse, not assessment

Identify the Build

unzip -l target.apk | rg 'global-metadata|libil2cpp|Assembly-CSharp|libmono'
Present Build Difficulty
Assembly-CSharp.dll, libmono*.so Mono Easy — decompile the DLL directly
global-metadata.dat + libil2cpp.so IL2CPP The main path below
Neither, but UnityFramework iOS IL2CPP Same as IL2CPP; extract from the decrypted IPA

Mono builds are a short job. Pull the assembly and open it:

unzip -j target.apk 'assets/bin/Data/Managed/Assembly-CSharp.dll' -d ./out
# dnSpy / dnSpyEx / ILSpy / dotPeek — full C# source recovery, and dnSpy can edit
ilspycmd ./out/Assembly-CSharp.dll -o ./decompiled

Everything below is for IL2CPP.

Recombining Metadata with the Binary

IL2CPP splits the information: libil2cpp.so holds the compiled code, global-metadata.dat holds the C# type system — class names, method names, field names, string literals. Neither is useful alone. The tools' job is to match them and produce symbols.

Read the full file on GitHub · 164 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 164 lines · 85 tokens per session scan A 08fc0b7d1e2d

Subscribe to this mod's changes

reversing-unity-il2cpp is a skill published in the GitHub repository trilwu/secskills (134 stars, last pushed yesterday), licensed MIT. It adds 85 tokens to every session and 1,845 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

hz-unity-meta-mixed-reality-utility-kit

Meta XR Mixed Reality Utility Kit (MRUK) (com.meta.xr.mrutilitykit) for Unity XR development. Use when working with Scene API data (rooms, walls, floors, furniture), spawning prefabs on scene anchors, placing virtual objects in the real world, world locking to prevent anchor drift, raycasting against room geometry…

meta-quest/agentic-tools · 136 tokens

hz-unity-meta-movement-sdk-retargeting

Set up and tweak Meta Movement SDK (MSDK) retargeting for a character model. Use this whenever the user wants to retarget a humanoid FBX/prefab for Meta Quest body tracking, generate a retargeting config, or hand-edit the resulting .json (fix known-joint mappings, exclude joints from auto-mapping, rename target…

meta-quest/agentic-tools · 182 tokens

hz-vr-debug

Debugs Meta Quest and Horizon OS VR/MR applications using the metavr CLI — view logs, capture screenshots, diagnose common issues. Use when troubleshooting crashes, errors, or unexpected behavior on Quest devices.

meta-quest/agentic-tools · 46 tokens

hz-unity-placement

Ensures accurate object placement in Unity projects targeting Meta Quest and Horizon OS by using Renderer and Collider bounds when objects are added, moved, or positioned relative to other objects.

meta-quest/agentic-tools · 39 tokens

hz-new-project-creation

Scaffolds new Meta Quest and Horizon OS projects with recommended settings for Unity, Unreal, Android/Spatial SDK, or WebXR. Use when creating a new Quest app from scratch.

meta-quest/agentic-tools · 43 tokens

hz-perfetto-debug

Analyzes Meta Quest and Horizon OS VR performance using Perfetto traces — frame timing, CPU/GPU bottlenecks, render pass analysis. Use when profiling frame drops, jank, or thermal issues on Quest devices.

meta-quest/agentic-tools · 50 tokens