Tutorial How to dump decrypted DLL files using GameGuardian (NO ROOT / ROOT) (Android 2.3.3-9.0+)

AndnixSH

PMT Elite Modder
Original poster
Staff member
Modding-Team
Jun 27, 2017
4,679
296,824
1,213
Modding World
You can dump memory using GameGuardian to extract encrypted file using get_dll_from_bin tool or Winhex. GameGuardian works on ARM, x64 and x86 devices, including x86 emulators (BlueStacks, Droid4X, Koplayer, Andy, Nox, Memu, Leapdroid, AMIDuOS, Windroye, RemixOS, PhoenixOS, AVD, Genymotion etc.)

Requirements:
  • GameGuardian
  • get_dll_from_bin.exe
  • Rooted device or emulator.
  • Minimum system requirements for Android device: 1 GB RAM, 2 cores CPU. If you have a low-end device, your device may freeze during dumping.
  • Available free space of Internal storage or Sdcard: 2+ GB
  • Requires Android 2.3.3+ (Gingerbread) and up to 9.0 (Pie)

Instructions:
Download GameGuardian app and install it on device or emulator

Download get_dll_from_bin.exe and use it later

Install GameGuardian APK on non-rooted device or rooted device or emulator. It's very easy

Non-rooted devices:
Dumping does work without root but Virtual Space app is required.
Please click the link below and follow tutorial how to use GameGuardian without root.
How to use GameGuardian without root in Virtual space app (with video tutorials) - platinmods.com - Android MODs | iOS MODs | Tutorials & More!

Rooted devices:
GameGuardian works with SuperSU and Magisk. All you need is to grant root permission upon launch

Emulator:
If you are using emulator that supports shared folder and allows you to changed path of shared folder, you can use it to dump files directly to your hard drive

Example in Memu, I changed music path to D:\Shared of my external hard drive.

DgFA1Q8.png
MvUMooI.png


Some emulators do not allow you to change the path. I know 2 emulators that uses hardcoded path:

Bluestacks: /sdcard/windows/BstSharedFolder
Nox: /mnt/shared

For others, find it yourself

------------------------------------------------------------------------------------

Launch GG and press Start to launch GG floating icon.

Launch the game

Open GG and select process of the game

Click on hamburger menu icon (☰) and click on white folder with down arrow

IDqWEAF.png


Change path to shared folder (if supported) and click save. This will allow GG to dump files to your computer directly.

E4FyfzK.png



J6Kj23l.png


Copy get_dll_from_bin.exe to dumped folder and double click to start recovering DLL files.

pq4HN4S.png


You will see recovered dll files

yHr2rc5.png


Find the Assembly-Csharp.dll file yourself using .Net Reflector or dnSpy and move Assembly-Csharp.dll to extracted Managed folder from the game to avoid the save error.

Can't find the Assembly-Csharp.dll file or got PE header error? Dump manually and fix PE header by yourself. Please keep your method secret if you already know it. Thanks

Credits:
AndnixSH# (Tutorial)
Enyby (Developer of GameGuardian)
 
Last edited:

Tiger™

Platinian
Mar 15, 2018
5
236
183
What should I do when there is no Assembly-CSharp.dll at all?
Other dll files are restored except Assembly-CSharp
 

vinicio999

Platinian
Nov 5, 2017
13
13
8
29
I run "get_dll_from_bin" and it recognizes dll files. But when I press any buttom the prompt closes. Is it natural?
 

Vostox

1/3 Games Approved
Jan 19, 2019
13
67
78
24
Indonesia
Hello.
I can't seem to dump thoroughly because the game force closed during the dumping process. As a result, I couldn't retrieve the dll files.
I assume that the game has protection against dumping. (is that even possible?)

How do I get around this problem?
Thank you.

P.S. The game I'm trying to mod is Utopia: Origin.
 

nik2143

Jr. PMT Modder
Staff member
Modding-Team
Jun 30, 2018
512
27,644
1,193
Italy
Hello.
I can't seem to dump thoroughly because the game force closed during the dumping process. As a result, I couldn't retrieve the dll files.
I assume that the game has protection against dumping. (is that even possible?)

How do I get around this problem?
Thank you.

P.S. The game I'm trying to mod is Utopia: Origin.
Yes this is a protection against dumping but I think only PMT Team know how to get around this protection but they can't (or want) explain this
 

DaRealPanDa

Co-Administrator
Staff member
Supporting-Team
Global Moderator
Social Media
Mar 12, 2018
6,665
15,467
2,120
27
Skyrim
Maybe 10% from all Stuff in hacking scenes ( doesn't matter if Phone hacking, PC hacking or real hacking ) is public, 90% is Secret.
When we make all things public, the dev's fix it in a few minutes and we can't mod anymore.
So try to learn more by yourself, become more and more familiar with modding and program languages, deserve it to become advanced knowledge someday and you are on a good way :D
 

Vostox

1/3 Games Approved
Jan 19, 2019
13
67
78
24
Indonesia
I tried to mod another game now. I successfully dumped it, but there seems to be an error when running the script (get_dll_from_bin_modified.exe) and I cant get all the dlls except the Assembly-Csharp. Here is the error that I got:

1548140272109.png


I'm sure that 16.dll is the Assembly-Csharp since it has the biggest size compared to the other dlls. However, an error occurs when making the dll and the script stops there. I googled the error message and found that it is related to the memory limit that the script allows. The script allows approximately 128M of memory while making 16.dll requires about 512M. An answer suggested that we should add this to the script:
1548140637823.png


While being unable to edit the script since it has been compiled to .exe, I don't know any other way to get around this problem. Is there a possible solution to this?
 

AndnixSH

PMT Elite Modder
Original poster
Staff member
Modding-Team
Jun 27, 2017
4,679
296,824
1,213
Modding World
@Vostox that because the DLL is manually corrpted by dev but we can't explain how to recover it unfortunately
 

ak0ztik

Platinian
Sep 28, 2017
25
190
183
and that's because modders also encrypt their .dll for the anti leech, am i right?