Cocos Decompiler Online

What to Upload

Upload the game's .apk, or its .xapk if that is what you have. A normal APK decompiler shows you the Java that starts the Cocos engine — a few dozen classes of glue. The game itself is JavaScript or Lua under assets/, and in a shipped title it is almost always encrypted. This decompiler keeps the Java, resources and smali output intact and adds a cocos/ folder containing the scripts.

Prefer the XAPK. Modern store listings split a game across a base APK and per-architecture config splits. The scripts live in the base and the native library that holds their key lives in config.arm64_v8a.apk, so a base APK on its own has nothing to recover the key from. An XAPK contains both, and each split is searched.

What You Get Back

• cocos/js/ — every .jsc decrypted to the JavaScript the developer shipped.
• cocos/lua/ — Lua source: decrypted directly where the game shipped source, decompiled where it shipped compiled chunks.
• cocos/bytecode/ — decrypted Lua chunks that the decompiler could not convert, kept rather than discarded.
• cocos/README.txt — the key that worked, its signature prefix, and which library it came out of.
• resources/, sources/, smali/ — the normal Android output, untouched.

How the Key Is Recovered

Cocos protects scripts with XXTEA, a small block cipher, and the developer picks the key at build time. That key is handed to setXXTEAKey() as the engine starts, which means it is an ordinary string constant sitting in libcocos2djs.so, libcocos2dlua.so, or whatever the studio renamed that library to.

So the key is recovered by reading, not by running: every NUL-terminated printable string in the library becomes a candidate, and each one is used to decrypt the smallest script in the package. XXTEA's encoder appends the plaintext length as an extra word, so a wrong key produces a length that does not fit the file — which is what makes sweeping tens of thousands of candidates practical. The survivor is checked once more against its content, then applied to the whole tree.

Cocos2d-x also writes a signature string in front of the ciphertext, XXTEA by default and renamed as freely as the key. It is detected from the file itself rather than assumed.

Limits

• No key, no scripts. If the library was not in the upload, or the key is assembled at runtime or fetched from a server, the result explains what was tried instead of failing silently.
• JavaScript comes back as build output. Cocos Creator bundles and minifies before encrypting, so you get the shipped bundle, not the original project tree.
• Compiled Lua loses comments. Names and structure survive in the chunk; comments and original formatting were never stored.
• Hot updates are absent. Scripts downloaded after installation were never part of the APK.
• Custom engine forks. A game that replaced XXTEA with its own cipher cannot be decrypted here.

Frequently Asked Questions