Guide for game-engine internals, source trees, plugins, and engine-specific security research. Use this skill when researching Unreal, Unity, Source, Godot, custom engines, engine detectors, engine explorers, or engine protection patterns relevant to modding, reverse engineering, and anti-cheat.
Guide for game-engine internals, source trees, plugins, and engine-specific security research. Use this skill when researching Unreal, Unity, Source, Godot, custom engines, engine detectors, engine explorers, or engine protection patterns relevant to modding, reverse engineering, and anti-cheat.
Game Engine Development Resources
Overview
This skill covers game engine development resources from the awesome-game-security collection, including both commercial (Unreal, Unity) and open-source engines.
Engine globals, object layouts, metadata formats, and helper APIs vary by engine
branch, build configuration, platform, and game modifications. Verify the exact
version and binary artifacts; use
research-rigor before generalizing signatures or
offsets.
README Coverage
Game Engine > Guide
Game Engine > Source
Game Engine Plugins:Unreal
Game Engine Plugins:Unity
Game Engine Plugins:Godot
Game Engine Plugins:Lumix
Game Engine Detector
Cheat > SDK CodeGen
Cheat > Game Engine Explorer:Unreal
Cheat > Game Engine Explorer:Unity
Cheat > Game Engine Explorer:Source
Anti Cheat > Game Engine Protection:Unreal
Anti Cheat > Game Engine Protection:Unity
Anti Cheat > Game Engine Protection:Source
Game Develop > MCP server
Major Engine Categories
Unreal Engine
Official documentation and forums
Source code access (requires Epic Games account)
Community guides and tutorials
Plugin development references
Unity Engine
C# reference source code
Asset store resources
Unity-specific design patterns
VR/AR development guides
Open Source Engines
Godot: Free and open-source, supports GDScript and C#
Cocos2d-x: Cross-platform 2D game framework
CRYENGINE: High-fidelity graphics engine
Source Engine: Valve's game engine (various versions)
Custom/Educational Engines
Hazel Engine (TheCherno's educational series)
Bevy (Rust-based data-driven engine)
Fyrox (Rust game engine)
Key Technical Areas
Rendering
Software renderers for learning
Ray tracing implementations
Shader development tutorials
Post-processing effects
Mathematics
Linear algebra libraries (GLM, DirectXMath)
Physics simulation (PhysX, Bullet)
Collision detection algorithms
Networking
Client-server architectures
KCP reliable UDP protocol
Steam networking integration
MMORPG server implementations
Resource Categories
Documentation & Guides
- Learning resources and tutorials
- Architecture documentation
- Best practices and style guides
1. Identify UE version from binary signatures
2. Inject Dumper-7 into running game process
3. SDK output: C++ headers with UObject hierarchy
4. Key structures: UObject, FName, UClass, UFunction, UProperty
5. Generated SDK enables: property access, function calls, blueprint hooks
6. Alternative tools: UnrealDumper, UE4SS (live scripting + SDK dump)
Unity (IL2CPPDumper)
1. Locate global-metadata.dat + GameAssembly.dll (or libil2cpp.so)
2. Run IL2CPPDumper → outputs: dump.cs, il2cpp.h, script.json
3. Load generated headers into IDA/Ghidra for symbol recovery
4. Key structures: Il2CppClass, MethodInfo, FieldInfo, Il2CppType
5. For Mono builds: directly decompile Assembly-CSharp.dll with dnSpy
Source Engine (NetVar Parsing)
1. Walk ClientClass linked list from CHLClient
2. For each class, enumerate RecvTable → RecvProp entries
3. Build offset map: class name → property name → offset
4. Example: CCSPlayer → m_iHealth → 0x100
5. Tools: hazedumper, source2gen (Source 2)
Engine Object Models
Unreal Engine
Core hierarchy:
UObject → UField → UStruct → UClass
UObject → AActor → APawn → ACharacter → APlayerCharacter
Key globals:
GUObjectArray / GObjects: registered UObject slots; lifecycle and reachability
filtering are still required
GNames / FNamePool: name storage; symbol and structure names vary by UE version
GWorld (UWorld*): current world context
GEngine (UEngine*): engine singleton
Memory layout:
Common UObject fields include VTable, flags, internal index, class, name, and
outer pointers; order, packing, and presence are build-specific
Reflected property offsets come from the version-specific class metadata
Unity (IL2CPP)
Core structures:
Il2CppDomain → Il2CppAssembly → Il2CppImage → Il2CppClass
Il2CppClass: fields, methods, vtable, static_fields pointer
Key patterns:
il2cpp_domain_get() → domain singleton
il2cpp_class_from_name() → class lookup by namespace + name
il2cpp_runtime_invoke() → call managed methods from native
Metadata:
global-metadata.dat contains string pool, type definitions, method signatures
Encrypted metadata in some protected games (requires custom decryptor)
The README's > MCP server subcategory includes servers relevant
to game engine workflows:
- Unreal Engine MCP: AI agent controls UE editor (spawn actors, modify properties, blueprints)
- Unity MCP: AI agent interacts with Unity editor and C# scripting
- Godot MCP: AI agent controls Godot editor and GDScript
These complement the RE-focused MCP tools (see reverse-engineering skill)
by enabling AI-assisted game development and rapid prototyping.
Security Research Focus
For game security research, understanding engine internals helps with:
Memory layout and object structures
Rendering pipeline hooks
Network protocol analysis
Anti-cheat integration points
Data Source
Important: This skill provides conceptual guidance and overview information. For detailed information use the following sources:
1. Project Overview & Resource Index
Fetch the main README for the full curated list of repositories, tools, and descriptions:
The main README contains thousands of curated links organized by category. When users ask for specific tools, projects, or implementations, retrieve and reference the appropriate sections from this source.
2. Repository Code Details (Archive)
For detailed repository information (file structure, source code, implementation details), the project maintains a local archive. If a repository has been archived, always prefer fetching from the archive over cloning or browsing GitHub directly.
Identify the GitHub repository the user is asking about (owner and repo name from the URL).
Construct the description URL: replace {owner} with the GitHub username/org and {repo} with the repository name.
Fetch the description file — it contains a short, human-readable summary of the repository's purpose and contents.
If the fetch returns a 404, the description has not been generated yet; fall back to the README entry or the archive.
Priority order when answering questions about a specific repository:
Description (quick summary) — fetch first for concise context
Archive (full code snapshot) — fetch when deeper implementation details are needed
README entry — fallback when neither description nor archive is available
Compiled wiki
Prefer the compiled domain overview at wiki/overviews/game-engine.md (see wiki/index.md and wiki/AGENTS.md) before re-deriving synthesis from raw README/archive material.
