# Reverse Engineering

Read how a game actually works so a mod can hook it.

- Repository: https://github.com/rehan-remade/universal-modder (9317 stars)
- Category: AI and agents
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add rehan-remade/universal-modder --skill reverse-engineering -g -a claude-code -y`
Codex: `npx skills add rehan-remade/universal-modder --skill reverse-engineering -g -a codex -y`
Cursor: `npx skills add rehan-remade/universal-modder --skill reverse-engineering -g -a cursor -y`
Gemini CLI: `npx skills add rehan-remade/universal-modder --skill reverse-engineering -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add rehan-remade/universal-modder`

## Description

Read how a game actually works so a mod can hook it. Decompile .NET/Mono (ILSpy), IL2CPP (Cpp2IL, Il2CppDumper), Java (Vineflower) and native code (Ghidra, IDA, via MCP servers); dump data and asset formats; reverse-engineer a binary file format and prove it with a round trip; read live memory (Cheat Engine, Frida, x64dbg); find render passes (RenderDoc). Use when a mod needs game internals, e.g. "how does the boss AI work", "find the damage function", "what format is this .sld/.pak/.dat", "where is the player position in memory".

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Reverse engineering for mods

Rule zero: **read the real thing, don't guess.** Decompiled code, the actual data, a live memory view or a
GPU capture is the spec. Write what you learn into `MODLOG.md` (names, IDs, offsets, formats) as you go.

Keep all decompiled output and extracted assets **outside** the mod repo (e.g. `~/<game>-decomp/`) and never
publish them. Single-player, offline or servers the user runs. Never attach debuggers or scanners to games
with anti-cheat (see `skills/mod-any-game/references/safety.md`).

## Pick the tool by what the code is (`um scan` tells you)

If [REA](https://github.com/morluto/rea) (Reverse Engineer Anything, `npx rea-agents setup`) is connected as an MCP
server, start there: one server covers native binaries (through an existing Ghidra, IDA or Hopper install), .NET
assemblies and JavaScript/Electron apps, and its answers come with the evidence behind them. The tools below are
the fallback, and the way to go deeper.

**Managed .NET** (XNA/FNA, Unity Mono, most indie C#)
- `dotnet tool install -g ilspycmd`, then `ilspycmd -p -o ~/<game>-decomp <Game>.exe` (or
  `Assembly-CSharp.dll`). This gives a full C# project you can grep.
- dnSpyEx: step through with a debugger, set breakpoints, edit methods.
- MCP: ILSpy-MCP / dnspy-mcp let an agent query types and methods directly.

**Unity IL2CPP**
- Cpp2IL (or Il2CppDumper) on `GameAssembly.dll` + `global-metadata.dat` gives types, fields, method
  signatures and addresses, plus dummy DLLs for ILSpy.
- Method bodies are native: load `GameAssembly.dll` in Ghidra/IDA and apply the generated script to name
  functions.
- Live: UnityExplorer, or `il2cpp-frida-mcp`.

**Java** (Minecraft, Slay the Spire...)
Vineflower / CFR / Recaf. For Minecraft, use Loom `genSources` with Mojang mappings.

The rest: https://github.com/rehan-remade/universal-modder/blob/HEAD/.agents/skills/reverse-engineering/SKILL.md