How to dump decrypted DLL files using GameGuardian (NO ROOT & ROOT)
You can dump memory using GameGuardian to extract encrypted file using get_dll_from_bin tool or Winhex.
Requirements:
- GameGuardian
- get_dll_from_bin.exe
- dnSpyEx
- Rooted device or Virtual space for non-rooted devices
- Available free space of Internal storage or Sdcard: 5+ GB
- Requires Android 4.x and above. May not work on new devices
Instructions:
Download GameGuardian app and install it on rooted device or emulator
Download get_dll_from_bin.exe. We wil need it later
Install GameGuardian APK on non-rooted device or rooted device or emulator. It’s very easy
Non-rooted devices:
You can use Virtual Space. See the tutorial
https://www.andnixsh.com/2018/04/how-to-use-gameguardian-without-root-in.html
Or use Virtual machine with root support: https://www.andnixsh.com/2023/06/list-of-android-virtual-machine-apps.html
Rooted devices:
GameGuardian works with SuperSU and Magisk. All you need is to grant root permission upon launch
Emulator:
If you are using emulator that supports shared folder and allows you to changed path of shared folder, you can use it to dump files directly to your hard drive
Example in Memu, I changed music path to D:\Shared of my external hard drive.
Some emulators do not allow you to change the path. I know 2 emulators that uses hardcoded path:
Bluestacks: /sdcard/windows/BstSharedFolder
Nox: /mnt/shared
For other emulator, figure out yourself
Launch GG and press Start to launch GG floating icon.
Launch the game
Open GG and select process of the game
Click on hamburger menu icon (☰) and click on white folder with down arrow
Change path if you want and click Save. This will dump whole memory into the disk
If you use a phone, copy all the dump files to your computer.
Copy get_dll_from_bin.exe to the location of the dumped folder and double click to start extracting DLL files.
After that, you will get dll files
Open them on dnSpy and enjoy
Can’t find the Assembly-Csharp.dll file or can’t open some dll files? You may need to decrypt some remaining parts or fix some header by yourself. I can’t help with DLL protections related
Credits:
AndnixSH (Tutorial)
Enyby (GameGuardian and get_dll_from_bin.exe)
