Home/HTB/CubeMadness1 — HTB Challenge
HTB

CubeMadness1 — HTB Challenge

retleave·Apr 21, 2026·6 min read

CubeMadness1 - HTB Challenge

Info

  • Category: GamePwn
  • Difficulty: Easy
  • Key Topics: Unity reverse engineering, IL2CPP, asset extraction, UnityPy, Texture2D/Sprite analysis

Abstract

CubeMadness1 is a GamePwn challenge that provides a compiled Unity game for Windows. Rather than requiring gameplay exploitation or memory manipulation, the flag is embedded within the game's asset bundles as a texture. This writeup covers the methodology for reverse engineering Unity games compiled with IL2CPP, extracting assets programmatically with UnityPy, and understanding the structure of Unity data files. While the solution itself is straightforward, the techniques generalize to more complex game hacking scenarios.

Unity Game Structure

IL2CPP Compilation Model

The game is compiled using Unity's IL2CPP (Intermediate Language To C++) backend, which converts .NET/Mono IL bytecode into C++ source code that is then compiled to native machine code. The resulting binary structure is:
HackTheBox CubeMadness1.exe      # Unity launcher
GameAssembly.dll                  # IL2CPP compiled game logic (native code)
UnityPlayer.dll                   # Unity runtime
UnityCrashHandler64.exe           # Crash reporter
HackTheBox CubeMadness1_Data/     # Game data directory
    sharedassets0.assets           # Primary asset bundle
    sharedassets0.assets.resS      # Resource stream (large binary data)
    globalgamemanagers             # Global settings
    il2cpp_data/                   # IL2CPP metadata
        Metadata/
            global-metadata.dat    # Type/method metadata for IL2CPP

Content Locked

This challenge is still active on HackTheBox. The full writeup will be available after retirement.