
reverse-engineering
Read how a game actually works so a mod can hook it. Decompile .NET/Mono (ILSpy), IL2CPP (Cpp2IL, Il2CppDumper), Java (Vineflower) and native code (Ghidra, IDA, via MCP servers); dump data and asset formats; reverse-engineer a binary file format and prove it with a round trip; read live memory (Cheat Engine, Frida, x64dbg); find render passes (RenderDoc). Use when a mod needs game internals, e.g. "how does the boss AI work", "find the damage function", "what format is this .sld/.pak/.dat", "where is the player position in memory".
- Installs
- 1.6K
- Last 24h
- +23
- Trending rank
- #5163
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/rehan-remade/universal-modder --skill reverse-engineering- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads reverse-engineering automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Reverse engineering for mods
Rule zero: read the real thing, don't guess. Decompiled code, the actual data, a live memory view or a
GPU capture is the spec. Write what you learn into MODLOG.md (names, IDs, offsets, formats) as you go.
Keep all decompiled output and extracted assets outside the mod repo (e.g. ~/<game>-decomp/) and never
publish them. Single-player, offline or servers the user runs. Never attach debuggers or scanners to games
with anti-cheat (see skills/mod-any-game/references/safety.md).
Pick the tool by what the code is (um scan tells you)
Managed .NET (XNA/FNA, Unity Mono, most indie C#)
dotnet tool install -g ilspycmd, thenilspycmd -p -o ~/<game>-decomp <Game>.exe(orAssembly-CSharp.dll). This gives a full C# project you can grep.- dnSpyEx: step through with a debugger, set breakpoints, edit methods.
- MCP: ILSpy-MCP / dnspy-mcp let an agent query types and methods directly.
Unity IL2CPP
- Cpp2IL (or Il2CppDumper) on
GameAssembly.dll+global-metadata.datgives types, fields, method signatures and addresses, plus dummy DLLs for ILSpy. - Method bodies are native: load
GameAssembly.dllin Ghidra/IDA and apply the generated script to name functions. - Live: UnityExplorer, or
il2cpp-frida-mcp.
Java (Minecraft, Slay the Spire...)
Vineflower / CFR / Recaf. For Minecraft, use Loom genSources with Mojang mappings.
Native C/C++ (custom engines, Unreal game code, console recomps)
- Ghidra (free) or IDA, driven through MCP so the agent can decompile, rename, retype and follow
cross-references:
- Ghidra: GhidraMCP (LaurieWired), pyghidra-mcp (headless, with a run-script tool; code-capable tools beat hundreds of tiny ones), ReVa.
- IDA: the official Hex-Rays IDA MCP (IDA 9.4+ Pro/Home; "code mode" runs IDAPython), or ida-pro-mcp.
- Binary Ninja and radare2 have MCP servers too.
- Workflow:
- Strings, then cross-references, then the function.
- Name and type everything you understand. Renames accumulate into a readable program.
- Confirm dynamically (below) before building on a guess. Agents can confidently misidentify things.
- Unreal: dump the reflection data first (UE4SS dumper or Dumper-7); it names most gameplay classes and properties for free.
Dynamic / live
- Cheat Engine: value scans → "find out what writes to this address" → struct → owner. CheatEngine MCP servers exist.
- x64dbg: breakpoints and tracing (x64dbg-mcp; bind it to 127.0.0.1, since some default to 0.0.0.0).
- Frida (frida-mcp, frida-game-hacking-mcp): hook functions from JavaScript, log arguments.
- ReClass.NET rebuilds structs from live memory.
Graphics
- RenderDoc (renderdoc-mcp) captures a frame and shows every draw, the render targets, the constant buffers (view/projection matrices) and the depth buffer.
- That's how you find where to inject geometry or effects (mashup-mods), and which texture holds a sprite atlas.
Data files and asset formats
Use the community tool first:
- Unity: UABEA, AssetRipper
- Unreal: FModel, UAssetGUI
- Fully compressed UE3
.upk(UELib showsExports=0): unpack a copy with Gildor'sdecompress(from UE Viewer), or, for LZO packages, withunpack_upk.py.
- Fully compressed UE3
- Bethesda: xEdit, BSArch
- GameMaker: UndertaleModTool
- Genie: genieutils
- Source: VRF, Crowbar
- FromSoft: WitchyBND, Smithbox
- Godot: GDRE Tools
Before reversing a format yourself, search the community archives. Most game formats from the 2000s and 2010s were worked out there:
- XeNTaX (closed in 2023): the forum, wiki and attachments are on archive.org, with a public backup on GitHub;
- ZenHAX: game file research and QuickBMS scripts (posts up to early 2023);
- The definitive guide to exploring file formats (Mr. Mouse, XeNTaX): the classic tutorial on reading an unknown format.
Use them for format knowledge and tools, whatever its origin (betas, leaked SDKs). Don't download game files, leaked code, SDKs or license keys from them.
For an undocumented format:
- Collect several stock files. Compare sizes, and hex-dump the headers (
xxd | head). Look for magic numbers, counts, offsets and tables of fixed-size records. - Form a hypothesis for the header, then the frame/record layout, then the compression. Check it by parsing every stock file without errors.
- Write a reader that decodes to something viewable (PNGs, JSON) and look at it.
- Write the writer, and prove it with a round trip: decode → encode → decode, compared against the
original. The AoE2 SLD sprite writer was accepted only when it round-tripped the stock knight at
0.9/255 mean error (
examples/aoe2-de-civ/sld.py). - Only then write new files. Test them in game with one asset before batch-converting.
Make it an oracle
- Engine logic you port (for a simulator, a trainer, a reimplementation): record real traces from the
game (positions, velocities per tick) and replay them against your port. In the Terraria Eye of Cthulhu
work, the Eye's velocity matched 99.9% once the port used the action applied on frame t+1. Float32
constants mattered too (
0.2f≠0.2). A leftover mismatch was traced to a hidden buff (Happy!, x1.21 move speed). Replays find what reading the code misses. - For long RE runs:
- a journal file;
- small verified steps;
- cap attempts per problem (about 3 identical failures, then change approach);
- commit every confirmed fact.
FAQ
What does the reverse-engineering skill do?
Read how a game actually works so a mod can hook it. Decompile .NET/Mono (ILSpy), IL2CPP (Cpp2IL, Il2CppDumper), Java (Vineflower) and native code (Ghidra, IDA, via MCP servers); dump data and asset formats; reverse-engineer a binary file format and prove it with a round trip; read live memory (Cheat Engine, Frida, x64dbg); find render passes (RenderDoc). Use when a mod needs game internals, e.g. "how does the boss AI work", "find the damage function", "what format is this .sld/.pak/.dat", "where is the player position in memory".
How do I install reverse-engineering?
Run npx skills add https://github.com/rehan-remade/universal-modder --skill reverse-engineering in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/reverse-engineering/ (personal) or .claude/skills/reverse-engineering/ (project).
Which AI agents can use reverse-engineering?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is reverse-engineering safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains reverse-engineering?
It is published by rehan-remade in rehan-remade/universal-modder. It has 1,597 recorded installs.
More from rehan-remade/universal-modder
mod-any-game
rehan-remade/universal-modder
Mod a PC game the user owns, taking an idea to working in the real game and recorded. It covers new items, weapons, enemies, bosses, units, civilizations, mechanics, art, sound, VR and cross-game mashups. Use when the user wants to mod, extend, hack on, reverse engineer or mash up a game ("add a nuke to Terraria", "make a new civ for Age of Empires", "put Minecraft inside X", "can I mod this game?"). It covers recon (engine, loaders, anti-cheat), choosing the route, a safe lab, a first vertical slice, fal-generated assets, in-game verification and a showcase clip.
game-recon
rehan-remade/universal-modder
Figure out how a specific installed game can be modded, before writing any mod code. Covers where it's installed, the engine and version, managed vs native code, anti-cheat, loaders already present, save and config folders, and the community's modding route. Also whether this machine can run it (a Windows game on macOS or Linux, x64 on ARM). Use when the user asks "can I mod ?", "what engine is ", "how do people mod ", or at the start of any modding task. Produces MODDINGPLAN.md.
game-automation
rehan-remade/universal-modder
Launch, see and drive a real game so an agent can test its own mods. Covers launching via Steam or the exe, windowed mode at a fixed size, screenshots of the game window (GPU-safe capture), clicking and typing into menus, holding keys, relative mouse, crash-reporter cleanup, killing by PID, reading logs, scripted test scenes, and an in-game JSON bridge that lets an agent observe and act. Windows-first (also from WSL), with notes for Linux and macOS. Use when a mod must be verified in game, when navigating menus automatically, or when building a repeatable test or demo scene.
mashup-mods
rehan-remade/universal-modder
Build cross-game mashups and total conversions, the "Minecraft inside Elden Ring" or "skateboarding in MW2" kind. Covers passthrough mods (two games running at once and exchanging state, rendering and collision), porting one game's content or mechanics into another, embedding a decompiled game as a library, and clean reimplementations that read the user's own game files. Use when the user wants to combine two games, bring an enemy, mechanic or world from one game into another, or rebuild a game's runtime, or reimplement the guest's rules headless inside a real host.
asset-pipeline
rehan-remade/universal-modder
Turn generated or hand-made art into exactly what a game engine loads. Covers sprite cutout, trim and nearest-neighbour fitting to frame sizes, pixelation to a palette, sprite sheets and strips, player/team-colour masks, seamless textures, and rendering a 3D model into sprite frames from the game's own camera (isometric/RTS 8 or 16 headings, side view, top-down) with Blender. Use after generating assets, or when the user asks to make sprites, sprite sheets, animation frames, isometric unit sprites or icons for a game.
share-field-notes
rehan-remade/universal-modder
Search and contribute to the shared AI-modding knowledge base, where field notes record how specific games were modded, decompiled or reverse-engineered (exact versions, route, engine facts, verification, gotchas). Use before starting work on a game ("has anyone modded X?"), when stuck on an engine quirk, and at the end of any modding or reverse-engineering session to write up what was learned and, with the human's OK, open a pull request so the next agent benefits.
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.