Reverse Engineering Notes

How every piece of game data in this repo was extracted, which tools were used, every pitfall we hit, and how to redo it when the game updates. Written July 2026 against Steam build 20244830 (Chaos Update era), Unity 2022.3.10f1, Mono scripting backend.

---

1. The Three Data Sources (and which to trust)

The compile-time-default trap (the #1 lesson of this project)

public float CritDamagePerDex = 4f; in decompiled code is a default, not the value the game uses. Unity serializes the real value in the asset/scene that instantiates the class, overriding the initializer. We shipped months of wrong formulas by reading initializers. Values that burned us: AbilityPwrPerMight (2→1), CritDamagePerDex (4→1.5), WeaponDamagePerLevel (0.20→0.23), HealthBase (30→100), maxArmorReductionPercent (80→90), PartyCountRollModifiers ([0,1,2,2,3,3] → [-2,-2,-1,-1,0,0]), and a dozen more.

Rule: any constant you cite must come from a serialized asset/scene instance, never from a .cs initializer. ScriptableObject values live in .asset files (e.g. Resources/global settings/GS 1.asset); MonoBehaviour values live in scene files (e.g. DiceRollingManager in level1).

---

2. Toolchain

Game paths (adjust per machine):

• Game: C:\Program Files (x86)\Steam\steamapps\common\Stolen Realm\Stolen Realm_Data
• DLLs: …\Stolen Realm_Data\Managed (needs Assembly-CSharp.dll, Sirenix.Serialization.dll, UnityEngine.CoreModule.dll, …)

> Scripts in scripts/ contain absolute paths from the original workstation — fix the > path constants at the top of each script before running.

---

3. AssetRipper export — failure modes we hit

1. Classes with [SerializeReference] fields export as empty stubs. 668/669 actions/*.asset and 340/340 enemies/*.asset were 14-line husks (m_Script: {fileID: 0}, no data) because ActionInfo.AITargetChoices and CharacterInfo.SkillsAndAI[].AIOverrideInfo use [SerializeReference]. Detection: an exported MonoBehaviour asset with ≤15 lines is a stub. Fix: read those classes from resources.assets with UnityPy (§4).
2. Some arrays are garbled in scene YAML. PartyCountRollModifiers exported as feffff/ffeffff/… (invalid hex with slashes). Read scene MonoBehaviours with UnityPy instead (§6).
3. Filename sanitization. [Dusk King] Brain Freeze → _Dusk King_ Brain Freeze, Ymir Rune, Courage → Ymir Rune_ Courage. When matching exported filenames to runtime m_Names, normalize [/]/, → _.
4. PyYAML octal trap (our bug, but export-format-induced): Unity writes enum-array scalars as packed hex (itemTypes: 04000000). YAML 1.1 parses leading-zero numbers as octal ints, destroying them. Quote them first: re.sub(r'^(\s+\w+:) ([0-9a-fA-F]{8,})\s*$', r"\1 '\2'", text, flags=re.M) then decode as little-endian uint32s per 8 hex chars.

---

4. Reading resources.assets directly (UnityPy pipeline)

scripts/extract_runtime_assets.py is the workhorse. Flow:

1. UnityPy.load(<game>\resources.assets)
2. TypeTreeGenerator(unity_version).load_local_dll_folder(<game>\Managed)
3. Fast header scan of every MonoBehaviour: first bytes are m_GameObject PPtr (12B) | m_Enabled (u8+3 pad) | m_Script PPtr (12B) | m_Name (len-prefixed) — group objects by script, resolve MonoScript → class name once per script.
4. Per target class: gen.get_nodes_up("Assembly-CSharp.dll", fullName) → patch the tree (below) → obj.read_typetree(nodes, check_read=False) per object.

Required tree patches (both bugs, or parses fail/corrupt)

• managedReference nodes: rename m_Type to anything neutral. On disk each managed reference is just an SInt64 rid; the reader special-cases the type name and errors ("Failed to get ref type node"). Drop the trailing references (ManagedReferencesRegistry) top-level field — it's always last.
• TypeTreeGeneratorAPI bug — string[] / List<string> emitted as single string: desyncs the parse wherever the array is non-empty, and the misparse fabricates giant lengths (multi-GB allocations, looks like a hang). Scan the decompiled sources for public string[] X / public List<string> X declarations per class and wrap those string nodes into proper vector → Array → (size, string data) subtrees. See string_array_fields() + patch_string_arrays() in the script.

Odin-serialized fields

Classes extending SerializedScriptableObject keep Unity-unserializable fields (interface arrays like IEffectInfo[] Effects, ITargetInfo[] Targets) in serializationData.SerializedBytes (binary Odin blob) with external refs in ReferencedUnityObjects. Everything else is normal typetree data. Notes:

• The game ships the open-source OdinSerializer (ProductName "OdinSerializer" v1.0.0.0) as Sirenix.Serialization.dll — the public GitHub format docs apply.
• Many blobs are trivial: PartyEvent/Shopkeeper/CraftingRecipe blobs contain only the object's Guid — no logic. Don't assume a blob hides secrets.
• The ones that matter: ActionInfo (Targets + Effects with damage expressions), ActionStatusInfo (Effects for ground/DoT statuses).

Decoding blobs — scripts/odt/ (C#)

odt --batch <dump.json> <_names.json> <TypeFullName> <fields> <out.json> deserializes every record's blob using the game's own DLLs. Hard-won requirements:

All 714 action + 397 status blobs decoded with zero failures. Every Effects entry in the game is a GeneralEffect { string Action } expression, e.g. TargetStored["FireDamage"] = Source.SpellPower("Fire") * 1.1f.

---

5. Pipeline run order (full refresh after a game update)

# 0. AssetRipper: export the game to full/ExportedProject (YAML + decompiled C# + icons)
# 1. runtime dumps (resources.assets → md/odin_extracted/raw/)
python extract_runtime_assets.py            # ActionInfo, CharacterInfo by default
python extract_runtime_assets.py PartyEvent Burst2Flame.ActionStatusInfo ItemInfo WeaponInfo EventStatus
python scan_names.py                        # path_id -> name map
# 2. plain-YAML settings (from the export)
python extract_globalsettings.py            # GS 1.asset -> global_settings.json
python extract_settings_assets.py           # difficulty/endgame/misc settings
python extract_shops.py                     # shopkeepers -> shops.json
python extract_crafting.py                  # crafting recipes
# 3. Odin blob decode (C#; build once with: dotnet build scripts/odt)
odt --batch raw/ActionInfo.json raw/_names.json Burst2Flame.ActionInfo "Targets,Effects,UseConditions" raw/ActionInfo_odin.json
odt --batch raw/ActionStatusInfo.json raw/_names.json Burst2Flame.ActionStatusInfo "Effects,TickTargets,EffectOverrides" raw/ActionStatusInfo_odin.json
# 4. merge/derive website data
python build_action_data.py                 # action_data.json + skill_actions.json
python build_loot_tables.py                 # personal + group loot
python build_enemies.py                     # enemies.json + Enemies.md
python build_status_data.py                 # enrich status_effects.json
python build_skills_enriched.py             # merge AP/range/damage into skills.json
python build_skill_statuses_md.py           # human-readable skill->status doc
python fix_items_meta.py                    # items.json scaling constants (runtime values)
# 5. legacy YAML extractors still valid for their domains:
#    extract_fortunes / extract_skills(+resolve_deps/rebuild_skills_md) / extract_items
#    extract_statuses / extract_enemy_mods / map_bosses / roll_checks

MonoBehaviour scene values (not in resources.assets): load level files — UnityPy.load(level0, level1, level2, globalgamemanagers.assets, resources.assets) so m_Script PPtrs resolve across files, then read the class as usual (that's how DiceRollingManager.PartyCountRollModifiers was recovered from level1).

---

6. Validation anchors (rerun these after any refresh)

---

7. Selected findings that took real digging (don't re-derive)

• Event deck: recency-weighted, not exhaust-based — newest ~33% of the eligible pool excluded, next ~33% reduced weight (DeckRandomizer.cs); profile save (GlobalSaveData.LastVisitedEvents, rolling 100) pre-suppresses across runs.
• Ymir Trials: sequential (battleOverrideInfo.VictoryEvent chains Strength→Honor→Courage), finale forced before the island boss by the quest status's ForcedEventBeforeBoss. Event blobs hold no conditions — event gating is all plain YAML (requiredStatusesToSpawn, option requiredStatuses, EventStatus.Forced*).
• Jack in the Box: forced by the Wrath of the Righteous fortune status.
• World loot never rolls Epic (whitelists in Character.GetLootDrop); gambling is the only random-drop Epic source (25/50/15/8/2 rarity %).
• Enemy skill tuning: CharacterInfo.Overrides = per-skill cooldown/mana/damage multipliers; merged into enemies.json.
• Cut content: 91 equipment crafting recipes (only prefix/suffix + consumable recipes are reachable via CraftingManager), Mythic rarity, 3 fortunes (Avenging Ancestors, Everlasting Sacrifice, Master of the Blade), The Spell Council Returns event, Ymir Honor/Strength "- Victory" events.
• MinLevel gates enemy spawns; MaxLevel is ignored (IsInLevelRange).

Full changelog of corrections: docs/CHANGES.md. Working notes: docs/DEV_NOTES.md.