Why most obfuscators for Unity fail

What is an obfuscator?

Takeaway: The goal is not to make a game unmodifiable or even unhackable. The goal is to remove the easy map: clear type names, clear method names, and searchable strings. If that map is gone, most attackers stop quickly.

What is the Unity engine?

The two scripting backends: Mono and IL2CPP

Takeaway: Mono and IL2CPP change the file format. They do not change the fact that Unity still needs your type names at runtime. Those are resolved at runtime using reflection.

One engine, many platforms, the same repeating structures

1. A native player. On Windows that is an .exe plus UnityPlayer.dll. On Android that is libmain.so and libunity.so.
2. A data folder. Scenes, shared assets, boot files, and settings live here in the same family of files on almost every platform.
3. A scripting layer. Either Mono assemblies, or IL2CPP native code plus global-metadata.dat.
4. Extra folders for plugins, streaming assets, and (on some builds) Addressables.

Typical Unity build files

Windows

MyGame/                                         
|
├── MyGame.exe                                  native player, launches the game
├── UnityPlayer.dll                             the Unity engine
├── ...
|
└── MyGame_Data/                                
    ├── globalgamemanagers                      global managers (tags, layers, ...)
    ├── globalgamemanagers.assets               assets those managers reference
    ├── level0                                  first scene in Build Settings
    ├── resources.assets                        contents of Resources folders
    ├── sharedassets0.assets                    assets used by level0
    ├── ...
    |
    ├── Managed/ —————>                         compiled C#, the easy dump target
    |   ├── Assembly-CSharp.dll                 your game scripts
    |   ├── Assembly-CSharp-firstpass.dll       plugins compiled first
    |   ├── UnityEngine.CoreModule.dll          Unity engine module
    |   └── ...                                 other Unity and plugin DLLs
    |
    └── MonoBleedingEdge/                       embedded Mono runtime
        └── EmbedRuntime/
            └── mono-2.0-bdwgc.dll              the Mono virtual machine

MyGame/                                                 
|
├── MyGame.exe                                          native player, launches the game
├── GameAssembly.dll                                    compiled game code (native)
├── UnityPlayer.dll                                     the Unity engine
├── UnityCrashHandler64.exe                             crash reporter
├── baselib.dll                                         IL2CPP base library
├── SymbolMap                                           native symbol map
|
├── MyGame_Data/                                        
|   ├── globalgamemanagers                              global managers (tags, layers, ...)
|   ├── globalgamemanagers.assets                       assets those managers reference
|   ├── level0                                          first scene in Build Settings
|   ├── resources.assets                                contents of Resources folders
|   ├── ...
|   |
|   └── il2cpp_data/                                    IL2CPP runtime data
|       ├── Metadata/
|       |   └── global-metadata.dat                     type, method, and field names
|       └── Resources/
|
└── MyGame_BackUpThisFolder_ButDontShipItWithYourGame/  generated C++ / debug. Keep, do not ship.

Android

MyGame.apk/                                         
|
├── AndroidManifest.xml                             Android wrapper, launches Unity
├── classes.dex                                     Java/Kotlin wrapper code
├── resources.arsc                                  Android resource table
├── res/                                            Android resources
├── META-INF/                                       signing and package metadata
|
├── assets/                                         
|   └── bin/
|       └── Data/                                   
|           ├── globalgamemanagers                  global managers (tags, layers, ...)
|           ├── globalgamemanagers.assets           assets those managers reference
|           ├── level0                              first scene in Build Settings
|           ├── resources.assets                    contents of Resources folders
|           ├── sharedassets0.assets                assets used by level0
|           ├── data.unity3d                        sometimes, instead of loose asset files
|           ├── Managed/                            Mono DLLs, or IL2CPP metadata on many versions
|           └── StreamingAssets/                    files copied into the build as-is
|
└── lib/                                            
    ├── arm64-v8a/                                  64-bit ARM, the usual target
    |   ├── libmain.so                              starts the player
    |   ├── libunity.so                             the Unity engine
    |   └── ...                                     other native plugins
    └── armeabi-v7a/                                older or dual-ABI builds
        └── ...

MyGame.apk/                                 
|
├── assets/bin/Data/Managed/                
|   ├── Assembly-CSharp.dll                 your game scripts
|   └── UnityEngine.*.dll                   Unity engine modules
|
└── lib/arm64-v8a/                          
    ├── libmonobdwgc-2.0.so                 the Mono virtual machine
    └── ...

MyGame.apk/                                     
|
├── lib/arm64-v8a/
|   ├── libil2cpp.so                            compiled game code (native)
|   └── libbaselib.so                           IL2CPP base library
|
└── assets/bin/Data/Managed/Metadata/
    └── global-metadata.dat                     type, method, and field names

What obfuscation changes, and where those names go

• namespaces
• classes and structs
• methods
• fields and properties
• events
• parameters and other leftover metadata

// Before obfuscation. Easy to find in a DLL or in global-metadata.dat.
public class PlayerHealth : MonoBehaviour
{
    [SerializeField]
    private int maxHealth = 100;

    public void TakeDamage(int amount)
    {
        maxHealth -= amount;
    }
}

// After renaming. The code can still run, if every other copy of the name is updated too.
public class a : MonoBehaviour
{
    [SerializeField]
    private int b = 100;

    public void c(int d)
    {
        b -= d;
    }
}

The problem: Unity leans on reflection

• Do I have a type called PlayerHealth?
• Does it have a field called maxHealth?
• Does it have a method called TakeDamage?

using System;
using System.Reflection;
using UnityEngine;

public class FakeUnityLoader : MonoBehaviour
{
    void Start()
    {
        // Unity does a more complete version of this when a scene or prefab loads.
        Type type = Type.GetType("PlayerHealth");
        Component component = gameObject.AddComponent(type);

        FieldInfo field = type.GetField(
            "maxHealth",
            BindingFlags.Instance | BindingFlags.NonPublic
        );
        field.SetValue(component, 100);

        MethodInfo method = type.GetMethod("TakeDamage");
        method.Invoke(component, new object[] { 10 });
    }
}

Those names also live in assets, serialized data, and bundles

• scenes and prefabs
• ScriptableObject assets
• serialized fields on components
• UnityEvents on buttons, sliders, and custom inspectors
• animation events
• Timeline and Playable assets
• UI Toolkit bindings
• Addressable catalogs (JSON or binary)
• AssetBundles and other packed content
• some plugin and networking configs that look up types by string

Why most obfuscators have to skip most of your code

Takeaway: The failure is not "Unity cannot be obfuscated." The failure is "the tool never updated the other copies of the name." This is why most obfuscators for Unity fail.

GuardingPearSoftware Obfuscator patches those resources

A practical mindset