#Synalyze it documentation how to
#Synalyze it documentation full version
#Synalyze it documentation apk
#Synalyze it documentation full

So I did some Googling and while I didn’t find any open source code that could modify Unity assets, I did find code that could read them.

#Synalyze it documentation how to

We needed to figure out how to patch Unity assets ourselves. So we knew how to patch in custom songs, the problem was we only knew how to do it with closed-source Windows GUI applications like DevX, which wasn’t going to help us deliver custom songs to lots of people, and as a macOS user it wasn’t going to help me.

#Synalyze it documentation full

Elliot Tate used DevX and this knowledge to perform the first successful patch of the full game.

However people on Windows were able to use tools like Il2CppDumper to get symbols, and emulamer found the signature check and figured out an ARM machine code patch to replace the call to the verify signature function with a constant true.

#Synalyze it documentation full version

We still needed to patch the signature check in the full version though, so I tried poking around in Binary Ninja but couldn’t get anywhere because the library with all the code didn’t have symbols for the function names in it. However, we had noticed that levels contained a signature field so we suspected this wouldn’t work on its own and it didn’t, but it turned out the demo version didn’t check the signature and this lead to the first successful test.

#Synalyze it documentation apk

This could then be patched into an APK using a Unity modding tool like DevX. With this information emulamer could convert PC beatmaps (maps of the patterns of blocks to slash along with the song) to the format that went inside the Unity asset. Some people who had Unity modding tools installed that could read and modify Unity asset files looked at the assets and found the levels but the beat maps looked like indecipherable compressed or encrypted data, then through some digging in disassembly and deduction emulamer figured out that it was the same data types the PC version used for levels, just encoded with C#’s BinaryFormatter and then run through a DeflateStream. Over a couple days we figured out that Beat Saber was compiled with IL2CPP so modding the C# code would be tricky, but while the levels were stored in a different format than the PC game, they were stored in the Unity asset bundles present in the APK. I didn’t have anything to poke at myself yet but I could still chime in with ideas, and I created a Google Doc where I collated and documented other people’s discoveries, which I encouraged other people to edit and write things in as they experimented. I started off by joining the Beat Saber Modding Group Discord chat while my Quest was still shipping, and chatting with the other modders who were eager to figure out how to add custom songs to Beat Saber on the Quest like they have with the PC version. I figured out how to read and modify the Unity asset file format used by Beat Saber, learned C#, and wrote a patcher that could read in the game’s assets, modify them to add custom songs, and modify the APK in-place with the replaced asset files.

As expected I really enjoyed playing Beat Saber and practicing to play more difficult songs, but I also ended up getting wrapped up in the Beat Saber modding community and developing a patcher for adding custom songs which has been downloaded 80,000 times. Writing a Beat Saber Patcher for the Oculus QuestĪfter trying out VR and Beat Saber at Ctrl-V and really enoying it, I decided to pre-order an Oculus Quest, the first standalone VR headset with 6 DOF head and hand tracking.