How to dump decrypted DLL files using GameGuardian (NO ROOT / ROOT) (Android 2.3.3-9.0+)

You can dump memory using GameGuardian to extract encrypted file using get_dll_from_bin tool or Winhex. GameGuardian works on ARM, x64 and x86 devices, including x86 emulators (BlueStacks, Droid4X, Koplayer, Andy, Nox, Memu, Leapdroid, AMIDuOS, Windroye, RemixOS, PhoenixOS, AVD, Genymotion etc.)

Requirements:

- GameGuardian

- get_dll_from_bin.exe

- Rooted device or emulator.

- Minimum system requirements for Android device: 1 GB RAM, 2 cores CPU. If you have a low-end device, your device may freeze during dumping.

- Available free space of Internal storage or Sdcard: 2+ GB

- Requires Android 2.3.3+ (Gingerbread) and up to 9.0 (Pie)

Instructions:

Download GameGuardian app and install it on device or emulator

Download get_dll_from_bin.exe and use it later

Install GameGuardian APK on non-rooted device or rooted device or emulator. It's very easy

Non-rooted devices:
Dumping does work without root but Virtual Space app is required.
Please click the link below and follow tutorial how to use GameGuardian without root.
How to use GameGuardian without root in Virtual space app (with video tutorials) - platinmods.com - Android MODs | iOS MODs | Tutorials & More!

Rooted devices:
GameGuardian works with SuperSU and Magisk. All you need is to grant root permission upon launch

Emulator:

If you are using emulator that supports shared folder and allows you to changed path of shared folder, you can use it to dump files directly to your hard drive

Example in Memu, I changed music path to D:\Shared of my external hard drive.

    

Some emulators do not allow you to change the path. I know 2 emulators that uses hardcoded path:

Bluestacks: /sdcard/windows/BstSharedFolder

Nox: /mnt/shared

For others, find it yourself

------------------------------------------------------------------------------------

Launch GG and press Start to launch GG floating icon.

launch the game

Open GG and select process of the game

Click on hamburger menu icon (☰) and click on white folder with down arrow

 

Change path to shared folder (if supported) and click save. This will allow GG to dump files to your computer directly.

On your computer, navigate to the directory where you have dumped the memory and start recover files using Winhex or other programs

If you are recovering DLL files, copy get_dll_from_bin.exe to dumped folder and double click to start recovering DLL files.

You will see recovered dll files

Find the Assembly-Csharp.dll file yourself using .Net Reflector or dnSpy and move Assembly-Csharp.dll to extracted Managed folder from the game to avoid the save error.

Can't find the Assembly-Csharp.dll file or got PE header error? Dump manually and fix PE header by yourself. Please keep your method secret if you already know it. Thanks

Credits:

AndnixSH# (Tutorial)

Enyby (Developer of GameGuardian)