⚠ Caution ⚠

This should be used only for debugging or educational purposes.
Application to commercial software or online games may violate the Terms of Use and carry legal risks.

UnityCryptoHook

This is a plugin that utilizes BepInEx and HarmonyX to hook calls to the CreateEncryptor and CreateDecryptor methods during encryption and decryption in Unity's game execution environment.

It can log information such as Key, IV, BlockSize, CallStack, etc. used in the encryption process.

This plugin requires MonoMod.Backports and MonoMod.ILHelpers to work.

Features

• Applies hooks to CreateEncryptor/CreateDecryptor methods in all concrete classes of SymmetricAlgorithm (e.g. AesManaged, RijndaelManaged, DES, RC2, ARC4Managed, etc).

• Show call stack.

Config

[General]

## Show call stack trace on CreateEncryptor/CreateDecryptor call
# Setting type: Boolean
# Default value: true
ShowCallStack = true

Sample

[Info   : Unity Log] Start loading save data.
[Info   :CryptoHook] --------------------------------------------------------
[Info   :CryptoHook] Method: RijndaelManaged.CreateDecryptor called
[Info   :CryptoHook] BlockSize: 128
[Info   :CryptoHook] Mode: CBC
[Info   :CryptoHook] Padding: PKCS7
[Info   :CryptoHook] FeedbackSize: 128
[Info   :CryptoHook] Key (hex): 30-31-32-33-34-35-36-37-38-39-30-62-63-64-65-66
[Info   :CryptoHook] Key (UTF-8): 01234567890bcdef
[Info   :CryptoHook] IV (hex): 30-31-32-33-34-35-36-37-38-39-30-62-63-64-65-66
[Info   :CryptoHook] IV (UTF-8): 01234567890bcdef
[Info   :CryptoHook] Call Stack Trace:
[Info   :CryptoHook]    at System.Security.Cryptography.RijndaelManaged.DMD<System.Security.Cryptography.RijndaelManaged::CreateDecryptor> (Address: 0x1BA95F53D00) Args: (RijndaelManaged , Byte[] , Byte[] )
[Info   :CryptoHook]    at System.Security.Cryptography.SymmetricAlgorithm.CreateDecryptor (Address: 0x1BB8B716840) Args: ()
[Info   :CryptoHook]    at System.Security.Cryptography.AesManaged.CreateDecryptor (Address: 0x1BB8B716800) Args: ()
[Info   :CryptoHook]    at TheGame.Crypto.AESCryption.Decrypt (Address: 0x1BB8B714BF0) Args: (String text)
[Info   :CryptoHook]    at TheGame.Data.LoadSaveData (Address: 0x1BB8B713B80) Args: ()
[Info   :CryptoHook]    at UnityEngine.SetupCoroutine.InvokeMoveNext (Address: 0x1BB04C89D80) Args: (IEnumerator enumerator, IntPtr returnValueAddress)
[Info   :CryptoHook] --------------------------------------------------------
[Info   : Unity Log] Save data loading is completed.