What MonoMod is and how Unity developers can detect it

What MonoMod is

• BepInEx or MelonLoader get into the process and load mods.
• The mod or plugin is the actual cheat or feature code.
• HarmonyX is often the friendly patch API the mod calls.
• MonoMod is one of the deeper engines that carries out detours and IL work.

How mod loaders and frameworks use MonoMod

1. The loader boots into the Unity process.
2. It loads plugin DLLs plus support libraries such as MonoMod.RuntimeDetour.
3. A plugin creates a Hook, an ILHook, or goes through HarmonyX.
4. The hook redirects the target method into a detour chain.
5. From that moment, selected game methods run through the hooked path.

How MonoMod works technically

MonoMod vs HarmonyX

A tiny example

using MonoMod.RuntimeDetour;
using System.Reflection;

// Skip SpendCoins completely
var spendCoins = typeof(PlayerWallet).GetMethod(nameof(PlayerWallet.SpendCoins));
var hook = new Hook(spendCoins, (Action<PlayerWallet, int> orig, PlayerWallet self, int amount) =>
{
    // Do not call orig. The wallet never spends.
});

Why Unity developers should care

Traces MonoMod leaves

• Assemblies such as MonoMod.RuntimeDetour, MonoMod.Utils, and often MonoMod.Core
• HookGen helpers named MMHOOK_..., commonly MMHOOK_Assembly-CSharp
• RuntimeDetour types such as Hook, ILHook, and DetourConfig
• HookGen namespaces such as On. and IL. generated against your game types
• MonoMod or MMHOOK_*.dll files on disk that are not part of your shipped build
• Method entry points rewritten by RuntimeDetour after JIT

Detecting MonoMod traces

MonoMod assemblies loaded into the process

void Awake()
{
    bool monoModLoaded = AppDomain.CurrentDomain.GetAssemblies()
        .Any(a =>
        {
            string name = a.GetName().Name;
            return name == "MonoMod.RuntimeDetour"
                || name == "MonoMod.Utils"
                || name == "MonoMod.Core"
                || name == "MonoMod.RuntimeDetour.HookGen";
        });

    if (monoModLoaded)
    {
        Debug.Log("MonoMod assembly detected. Blocking game from starting.");
    }
}

HookGen helpers and RuntimeDetour types

void Awake()
{
    var assemblies = AppDomain.CurrentDomain.GetAssemblies();

    bool mmhookLoaded = assemblies.Any(a => a.GetName().Name.StartsWith("MMHOOK_"));

    string[] markers =
    {
        "MonoMod.RuntimeDetour.Hook",
        "MonoMod.RuntimeDetour.ILHook",
        "MonoMod.RuntimeDetour.DetourConfig"
    };

    var typeNames = assemblies
        .SelectMany(a =>
        {
            try { return a.GetTypes(); }
            catch { return Type.EmptyTypes; }
        })
        .Select(t => t.FullName);

    bool runtimeDetourApi = markers.Any(marker => typeNames.Contains(marker));

    if (mmhookLoaded || runtimeDetourApi)
    {
        Debug.Log("MonoMod HookGen or RuntimeDetour API detected.");
    }
}

MonoMod files on disk

void Awake()
{
    string[] monoModFiles =
    {
        "MonoMod.RuntimeDetour.dll",
        "MonoMod.Utils.dll",
        "MonoMod.Core.dll",
        "MMHOOK_Assembly-CSharp.dll"
    };

    bool found = Directory.EnumerateFiles(".", "*.dll", SearchOption.AllDirectories)
        .Select(Path.GetFileName)
        .Any(name =>
            monoModFiles.Contains(name)
            || name.StartsWith("MMHOOK_", StringComparison.OrdinalIgnoreCase));

    if (found)
    {
        Debug.Log("MonoMod files found on disk.");
    }
}

Method entry points rewritten by RuntimeDetour

using System.Runtime.CompilerServices;

void Awake()
{
    MethodInfo method = typeof(PlayerWallet).GetMethod(nameof(PlayerWallet.SpendCoins));
    RuntimeHelpers.PrepareMethod(method.MethodHandle); // force JIT compile
    IntPtr entry = method.MethodHandle.GetFunctionPointer();

    // Read the first bytes at 'entry' and compare them
    // with a clean baseline taken at startup.
}

There is still one problem

var spendCoins = typeof(PlayerWallet).GetMethod(nameof(PlayerWallet.SpendCoins));
var hook = new Hook(spendCoins, (Action<PlayerWallet, int> orig, PlayerWallet self, int amount) =>
{
    // Do not call orig. The wallet never spends.
});

1. Outsource critical code to an external source

2. Use an obfuscation solution

Your takeaway