Tutorial Unity How to edit/decrypt EasySave 3(.es3) Save Files

[Henry1887]

Hello, in this thread i will guide you through the steps on how to obtain the decryption password for your es3 save file and how to edit it.

Info about the ES3 Save Format:

You must be registered to see the links

is a tool/plugin in Unity to save and load data easily and is used in many games.
Most of the time these save files are encrypted(AES) so you cannot directly tamper with these save files.

Before we begin, i am only sharing what i know here so if u notice any mistakes in my tutorial please do let me know!

First you gotta locate the save files (in a .es3 format), they are somewhere in your Appdata folder on windows or the game folder. Now you should probably make a backup of these save files before doing stuff with them.

CHECK IF THE SAVE FILE IS ACTUALLY ENCRYPTED! (If the contents of the file is not garbled nonsense)
If not then you can skip everything and just edit your save file with notepad. The Save File is in a

You must be registered to see the links

-ish Format.

Now we need to find out the password to decrypt this save file.

Spoiler: Obtaining the Decryption Password

You don't have permission to view the spoiler content. Log in or register now.

Good now you should have your Decryption password and you can follow the next step.

Spoiler: Decrypt and edit the Save

You don't have permission to view the spoiler content. Log in or register now.

Give this man some love for making the

You must be registered to see the links

!

Spoiler: Extra plugin to completely disable encryption

You don't have permission to view the spoiler content. Log in or register now.

 

[Hasix1]

Thank you for your post. Looking forward to your IL2CPP tutorial.

 

[Henry1887]

Thank you for your post. Looking forward to your IL2CPP tutorial.

i have added the steps for il2cpp. Please try it and lemme know if it works.

 

[Henry1887]

Also the Password for the Game Virtual Succubus is "VSPassword1"

 

[gary12450]

I am testing the games "Self Defense Dojo Secret NTR Lesson" and "和 巨人の秘宝 -The Giant's Treasure-". Both games use IL2CPP and require BepInEx to be opened properly. To use BepInEx, I need to use BepInEx-BepInExPack_IL2CPP-6.0.667 (

You must be registered to see the links

). BepInEx 6.0.0-pre.1 opens the game successfully for the first time, but afterwards, the game crashes. Additionally, I tried using UnityExplorer 4.9.0, both UnityExplorer.BepInEx.IL2CPP.CoreCLR.zip and UnityExplorer.BepInEx.IL2CPP.zip, but pressing F7 in the game doesn't have any response. I'm not sure what the reason for this issue is.


Additional after using BepInEx, a decompiled DLL file is generated in the interop folder. I tried reading the EasySave3.dll file using DnSpy, but when I added Console.WriteLine("--- " + password + "---"); and then compiled it, I encountered an error such as "Error CS0246 The type or namespace name 'Il2CppInterop' could not be found (are you missing a using directive or an assembly reference?) main.cs". Therefore, I cannot use this method either.

 

[Henry1887]

I am testing the games "Self Defense Dojo Secret NTR Lesson" and "和 巨人の秘宝 -The Giant's Treasure-". Both games use IL2CPP and require BepInEx to be opened properly. To use BepInEx, I need to use BepInEx-BepInExPack_IL2CPP-6.0.667 (

You must be registered to see the links

). BepInEx 6.0.0-pre.1 opens the game successfully for the first time, but afterwards, the game crashes. Additionally, I tried using UnityExplorer 4.9.0, both UnityExplorer.BepInEx.IL2CPP.CoreCLR.zip and UnityExplorer.BepInEx.IL2CPP.zip, but pressing F7 in the game doesn't have any response. I'm not sure what the reason for this issue is.


Additional after using BepInEx, a decompiled DLL file is generated in the interop folder. I tried reading the EasySave3.dll file using DnSpy, but when I added Console.WriteLine("--- " + password + "---"); and then compiled it, I encountered an error such as "Error CS0246 The type or namespace name 'Il2CppInterop' could not be found (are you missing a using directive or an assembly reference?) main.cs". Therefore, I cannot use this method either.
View attachment 2741449

The Games Code is inside GameAssembly.dll for IL2CPP Games, the file you tried to edit has been generated by BepInEx. Editing that has no effect on the Game. Also you cannot edit the GameAssembly.dll with DnSpy if youre wondering. Imma take a look into this game and find out which BepInEx Version can be used with UnityExplorer.

 

[Henry1887]

The latest BepInEx Bleeding Edge Build works for the game. Though UnityExplorer does not. Imma try writing my own BepInEx Plugin for it.

 

[gary12450]

The latest BepInEx Bleeding Edge Build works for the game. Though UnityExplorer does not. Imma try writing my own BepInEx Plugin for it.

I found the BepInEx Bleeding Edge Build you mentioned on this website (

You must be registered to see the links

). I opened the compressed file and examined its contents. It seems to be the same as the BepInEx-BepInExPack_IL2CPP-6.0.667 version I mentioned earlier.

Additionally, I tried using DnSpy's Debug mode to read the Method Decrypt, but encountered an error as shown in the image below.

 

[Henry1887]

I found the BepInEx Bleeding Edge Build you mentioned on this website (

You must be registered to see the links

). I opened the compressed file and examined its contents. It seems to be the same as the BepInEx-BepInExPack_IL2CPP-6.0.667 version I mentioned earlier.

Additionally, I tried using DnSpy's Debug mode to read the Method Decrypt, but encountered an error as shown in the image below.
View attachment 2741967

"the Games Code is inside GameAssembly.dll for IL2CPP Games"
you cannot use dnspy for il2cpp games. The file you are viewing only contains the class names and method names not the code.

 

[Henry1887]

my il2cpp method doesnt involve editing any dll files because you cant.

 

[Henry1887]

I found the BepInEx Bleeding Edge Build you mentioned on this website (

You must be registered to see the links

). I opened the compressed file and examined its contents. It seems to be the same as the BepInEx-BepInExPack_IL2CPP-6.0.667 version I mentioned earlier.

Additionally, I tried using DnSpy's Debug mode to read the Method Decrypt, but encountered an error as shown in the image below.
View attachment 2741967

Also one thing i forgot to say. Check if the save file is actually encrypted. Just open it with notepad and if its encrypted it should just be some gibberish.

 

[gary12450]

Also one thing i forgot to say. Check if the save file is actually encrypted. Just open it with notepad and if its encrypted it should just be some gibberish.

The save file is encrypted, and I found a key shared in the forum (https://f95zone.to/threads/translat...-lesson-nontrressun-rj01053661.164549/page-13) in post #254. I wanted to learn how to find it, and coincidentally, I came across your method, so I wanted to give it a try. Thank you for your assistance!

 

[gary12450]

I have also been learning to use Il2CppDumper-win-v6.7.40 to decompile the GameAssembly.dll using the global-metadata.dat file. However, the resulting DLL files I obtained only contain event names without any content, as shown in the image below.

 

[Henry1887]

I have also been learning to use Il2CppDumper-win-v6.7.40 to decompile the GameAssembly.dll using the global-metadata.dat file. However, the resulting DLL files I obtained only contain event names without any content, as shown in the image below.
View attachment 2742153

Imma look into how to do it with il2cppdumper and ida.
Though i think i will not recommend this method cuz it probably requires some knowledge of Assembly.

 

[Henry1887]

Indeed i have found the Password "wanzg!1f**k" inside the GameAssembly.dll using ghidra and il2cppdumper
The one thing i still have to figure out is how he found where the password is in the assembly code without knowing what to search for.

 

[Henry1887]

I think i found a method. For both of the games that you have mentioned the password is the same.
Do Note u need to have a bit of knowledge about assembly(probably)

Firstly you need to run IL2CPPDumper on your Game
Then open up Ghidra and load the GameAssembly in there. Skip the Auto Analysis if it asks you for now.
Hit the green play button in the top to open up the Script Manager. And inside it hit the list button to the left of the red cross button to open up the script directories. And in there add the IL2CPPDumper directory as a script directory by hitting the green cross button.
Close the Script Directories Manager and find "ghidra_with_struct.py" in the list. Highlight it and hit the green play button in the top to run this script.
The Script will ask you to find the script.json. It is inside your IL2CPPDumper Directory.
Let the Script do its thing and wait for it to finish.
Now in the Symbol Tree on the right open up "Functions->S->Save->SaveData$$.cctor"(it can varie but u just need to end up at SaveData$$.cctor) Now after u have clicked it the middle window will show the assembly for this address of the function.
There will not be much readable, because we need to run the Auto Analyzer now. At the top hit "Analysis" and Auto Analyze GameAssembly.dll. Let the Auto analyzer run until the function you have just opened has readable Assembly Code.

now it should look like this(excluding the comments i added in the right side). Well only look at the lines that have "RCX,[{Address}]". The way i did it was i copied the address and went to that adress to look what text that address had and added a EOL Comment to the right.
Now we need to analyze these comments ourselfs. We can already cross out the first and last comment and we can cross out the comments representing a file path. Now in my case there are only "wanzg!1" and "f**k" left. If there are multiple comments left then u need to piece them together until the SaveEditor Website says that the password is correct. in my case the last one is the first and the first last.


I have only tried this on 2 games of the same developer(i think, because the password is the same). You will have to do a lot of thinking yourself. I have no idea if this is even a efficient method or if it even works on other games but it has worked so far. Im gonna test it out on more games.
On another game i have tested, the SaveData function was missing so i guess i need to find another way

 

[CrimsonWatcher]

I don't understand much about this, but this is the password I get to edit the savegames for (the Self Defense Dojo Secret NTR Lesson game)

 

[Henry1887]

I don't understand much about this, but this is the password I get to edit the savegames for (the Self Defense Dojo Secret NTR Lesson game)
View attachment 2760508

yep thats the password for the save file.

 

[gary12450]

I don't understand much about this, but this is the password I get to edit the savegames for (the Self Defense Dojo Secret NTR Lesson game)
View attachment 2760508

According to the picture, I can see that you are using UnityExplorer version 4.9.4. Where did you download it from? I only see version 4.9.0 on GitHub, and I couldn't find UnityExplorer 4.9.4 through a direct search.

 

[CrimsonWatcher]

According to the picture, I can see that you are using UnityExplorer version 4.9.4. Where did you download it from? I only see version 4.9.0 on GitHub, and I couldn't find UnityExplorer 4.9.4 through a direct search.

Here is the link

You must be registered to see the links

as I couldn't use BepInEx I used MelonLoader