Reverse Engineering
Read how a game actually works so a mod can hook it.
Install
npx skills add rehan-remade/universal-modder --skill reverse-engineering -g -a claude-code -y- Repository
- rehan-remade/universal-modder9.3k
- Category
- AI and agents
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 1,620 tokens
- Runs scripts
- Yes, review before use
What it does
Read how a game actually works so a mod can hook it. Decompile .NET/Mono (ILSpy), IL2CPP (Cpp2IL, Il2CppDumper), Java (Vineflower) and native code (Ghidra, IDA, via MCP servers); dump data and asset formats; reverse-engineer a binary file format and prove it with a round trip; read live memory (Cheat Engine, Frida, x64dbg); find render passes (RenderDoc). Use when a mod needs game internals, e.g. "how does the boss AI work", "find the damage function", "what format is this .sld/.pak/.dat", "where is the player position in memory".
Reverse engineering for mods
Rule zero: read the real thing, don't guess. Decompiled code, the actual data, a live memory view or a
GPU capture is the spec. Write what you learn into MODLOG.md (names, IDs, offsets, formats) as you go.
Keep all decompiled output and extracted assets outside the mod repo (e.g. ~/<game>-decomp/) and never
publish them. Single-player, offline or servers the user runs. Never attach debuggers or scanners to games
with anti-cheat (see skills/mod-any-game/references/safety.md).
Pick the tool by what the code is (um scan tells you)
If REA (Reverse Engineer Anything, npx rea-agents setup) is connected as an MCP
server, start there: one server covers native binaries (through an existing Ghidra, IDA or Hopper install), .NET
assemblies and JavaScript/Electron apps, and its answers come with the evidence behind them. The tools below are
the fallback, and the way to go deeper.
Managed .NET (XNA/FNA, Unity Mono, most indie C#)
dotnet tool install -g ilspycmd, thenilspycmd -p -o ~/<game>-decomp <Game>.exe(orAssembly-CSharp.dll). This gives a full C# project you can grep.- dnSpyEx: step through with a debugger, set breakpoints, edit methods.
- MCP: ILSpy-MCP / dnspy-mcp let an agent query types and methods directly.
Unity IL2CPP
- Cpp2IL (or Il2CppDumper) on
GameAssembly.dll+global-metadata.datgives types, fields, method signatures and addresses, plus dummy DLLs for ILSpy. - Method bodies are native: load
GameAssembly.dllin Ghidra/IDA and apply the generated script to name functions. - Live: UnityExplorer, or
il2cpp-frida-mcp.
Java (Minecraft, Slay the Spire...)
Vineflower / CFR / Recaf. For Minecraft, use Loom genSources with Mojang mappings.
