w
This commit is contained in:
HelenWalker committed 2026-03-08 16:25:35 -06:00
commit 7bd33ca73b
98 files changed
+56670

No files matched your search

+181
View File
@@ -0,0 +1,181 @@
#pragma once
#ifndef WIN32_LEAN_AND_MEAN
#define WIN32_LEAN_AND_MEAN
#endif
#ifndef NOMINMAX
#define NOMINMAX
#endif
#include <Windows.h>
#include <d3d11.h>
#include <dwmapi.h>
#include <Psapi.h>
#include <shellapi.h>
#include <tlhelp32.h>
#include <xinput.h>
#include <array>
#include <atomic>
#include <cstdint>
#include <functional>
#include <memory>
#include <mutex>
#include <string>
#include <unordered_map>
#include <vector>
#include "imgui.h"
#include "imgui_impl_dx11.h"
#include "imgui_impl_win32.h"
extern IMGUI_IMPL_API LRESULT ImGui_ImplWin32_WndProcHandler(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam);
namespace Binary {
constexpr uintptr_t kImageBase = 0x180000000ull;
constexpr uintptr_t kDataBase = 0x1803C5000ull;
constexpr uintptr_t kIatBaseRva = 0x000B1000ull;
constexpr uintptr_t kGConfigPanelPtrOffset = 0x15D8ull;
constexpr uintptr_t kShowPanelFlagOffset = 0x245Cull;
constexpr uintptr_t kActiveTabOffset = 0x1F68ull;
constexpr uintptr_t kLanguageIndexOffset = 0x27B0ull;
} // namespace Binary
namespace RVA {
constexpr uint32_t DllMainEntry = 0x00001000;
constexpr uint32_t LoaderThread = 0x00005000;
constexpr uint32_t StartupMain = 0x000A9190;
constexpr uint32_t GABypassPatch = 0x000A9120;
constexpr uint32_t ModuleManagerInit = 0x0009AC10;
constexpr uint32_t OverlayWindowInit = 0x000827A0;
constexpr uint32_t WndProc = 0x000826A0;
constexpr uint32_t D3D11Reinit = 0x000825B0;
constexpr uint32_t ImGuiWin32WndProcHandler = 0x00057720;
constexpr uint32_t HookMgrCreateHook = 0x000A9CC8;
constexpr uint32_t HookMgrRemoveHook = 0x000A9E8C;
constexpr uint32_t HookMgrEnableHook = 0x000A9A9C;
constexpr uint32_t HookMgrAcquireSpinlock = 0x000A9C88;
constexpr uint32_t SettingsTabRender = 0x0009A4F0;
constexpr uint32_t SidebarRender = 0x0007F8F0;
} // namespace RVA
namespace IL2CPP {
constexpr uintptr_t GameObject_GetComponentByIndex = 0x1C48;
constexpr uintptr_t il2cpp_domain_get_assemblies_A = 0x1C50;
constexpr uintptr_t Component_GetComponent_Transform = 0x1C58;
constexpr uintptr_t Transform_get_localScale = 0x1C60;
constexpr uintptr_t Transform_get_rotation = 0x1C68;
constexpr uintptr_t il2cpp_object_get_class = 0x1C70;
constexpr uintptr_t il2cpp_class_get_method_from_name = 0x1C78;
constexpr uintptr_t Transform_get_localPosition = 0x1C80;
constexpr uintptr_t Transform_get_position = 0x1C88;
constexpr uintptr_t Transform_set_localPosition = 0x1C90;
constexpr uintptr_t GameObject_SetActive = 0x1C98;
constexpr uintptr_t GameObject_get_transform = 0x1CA0;
constexpr uintptr_t Transform_set_rotation = 0x1CA8;
constexpr uintptr_t GameObject_get_activeInHierarchy = 0x1CB0;
constexpr uintptr_t GameObject_get_tag = 0x1CB8;
constexpr uintptr_t GameObject_get_name = 0x1CC0;
constexpr uintptr_t GameObject_get_layer = 0x1CC8;
constexpr uintptr_t GameObject_get_scene = 0x1CD0;
constexpr uintptr_t Game_SkillBuff_A = 0x1CD8;
constexpr uintptr_t GetEntityName = 0x1CE0;
constexpr uintptr_t Component_GetComponents = 0x1CE8;
constexpr uintptr_t Component_GetComponentsInChildren = 0x1CF0;
constexpr uintptr_t Game_SkillSlot_A = 0x1CF8;
constexpr uintptr_t Object_get_name = 0x1D00;
constexpr uintptr_t Component_GetType_A = 0x1D08;
constexpr uintptr_t Component_GetType_B = 0x1D10;
constexpr uintptr_t Game_SkillSlot_B = 0x1D18;
constexpr uintptr_t Game_Combat_HitA = 0x1D20;
constexpr uintptr_t GetEntityManager = 0x1D28;
constexpr uintptr_t Game_Combat_HitB = 0x1D30;
constexpr uintptr_t Game_Movement_PhysA = 0x1D38;
constexpr uintptr_t Game_Movement_PhysB = 0x1D40;
constexpr uintptr_t Application_set_targetFrameRate = 0x1D48;
constexpr uintptr_t SceneManager_GetActiveScene = 0x1D50;
constexpr uintptr_t CinemachineBrain_GetActiveVCam = 0x1D58;
constexpr uintptr_t Game_EntityState_A = 0x1D60;
constexpr uintptr_t Transform_set_localScale = 0x1D68;
constexpr uintptr_t Rigidbody_get_velocity = 0x1D70;
constexpr uintptr_t Rigidbody_set_velocity = 0x1D78;
constexpr uintptr_t Object_Destroy = 0x1D80;
constexpr uintptr_t Transform_set_position = 0x1D88;
constexpr uintptr_t Game_EntityState_B = 0x1D90;
constexpr uintptr_t Input_GetAxis_MouseX = 0x1D98;
constexpr uintptr_t Game_PlayerState_A = 0x1DA0;
constexpr uintptr_t Game_PlayerState_B = 0x1DA8;
constexpr uintptr_t Game_PlayerHealthStat = 0x1DB0;
constexpr uintptr_t Camera_get_main = 0x1DC0;
constexpr uintptr_t GameObject_FindObjectOfType = 0x1DC8;
constexpr uintptr_t Game_SkillAction_C = 0x1DD8;
constexpr uintptr_t Camera_get_fieldOfView = 0x1DE8;
constexpr uintptr_t Game_EntityState_C = 0x1DF0;
constexpr uintptr_t Rigidbody_AddForce = 0x1E00;
constexpr uintptr_t CharCtrl_set_enabled = 0x1E08;
constexpr uintptr_t Game_SkillAction_F = 0x1E10;
constexpr uintptr_t Game_SkillAction_G = 0x1E18;
constexpr uintptr_t GetCharacterController = 0x1E20;
constexpr uintptr_t TMPro_set_text = 0x1E28;
constexpr uintptr_t UnityUI_Text_set_text = 0x1E30;
constexpr uintptr_t Game_SkillAction_I = 0x1E38;
constexpr uintptr_t Game_SkillAction_J = 0x1E40;
constexpr uintptr_t Game_EntityActor_D = 0x1E48;
constexpr uintptr_t Game_SkillAction_K = 0x1E50;
constexpr uintptr_t Game_SkillAction_L = 0x1E58;
constexpr uintptr_t Game_EntityActor_E = 0x1E60;
constexpr uintptr_t Game_EntityActor_F = 0x1E68;
constexpr uintptr_t il2cpp_domain_get = 0x1E70;
constexpr uintptr_t il2cpp_assembly_get_image = 0x1E78;
constexpr uintptr_t il2cpp_domain_get_assemblies_B = 0x1E80;
} // namespace IL2CPP
struct Vec3 {
float x = 0.0f;
float y = 0.0f;
float z = 0.0f;
};
struct Quat {
float x = 0.0f;
float y = 0.0f;
float z = 0.0f;
float w = 1.0f;
};
enum class Language : uint32_t {
English = 0,
ZhCN = 1,
};
enum class MainTab : int {
About = 0,
Player = 1,
ESP = 2,
World = 3,
Visual = 4,
Settings = 5,
};
struct RuntimeConfig {
std::atomic<bool> running{false};
std::atomic<bool> show_panel{true};
std::atomic<bool> il2cpp_thread_attached{false};
std::atomic<MainTab> active_tab{MainTab::About};
std::atomic<Language> language{Language::English};
std::atomic<DWORD> game_thread_id{0};
uintptr_t game_assembly_base = 0;
HWND game_hwnd = nullptr;
HWND overlay_hwnd = nullptr;
};
extern RuntimeConfig g_Runtime;
template <typename Fn>
inline Fn BitCastFn(void* ptr) {
return reinterpret_cast<Fn>(ptr);
}
+134
View File
@@ -0,0 +1,134 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ItemGroup Label="ProjectConfigurations">
<ProjectConfiguration Include="Release|x64">
<Configuration>Release</Configuration>
<Platform>x64</Platform>
</ProjectConfiguration>
</ItemGroup>
<PropertyGroup Label="Globals">
<VCProjectVersion>17.0</VCProjectVersion>
<ProjectGuid>{8CC5BC39-2A80-4B58-BB4F-06C4A38E388E}</ProjectGuid>
<Keyword>Win32Proj</Keyword>
<RootNamespace>EFCheeto</RootNamespace>
<WindowsTargetPlatformVersion>10.0</WindowsTargetPlatformVersion>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
<ConfigurationType>DynamicLibrary</ConfigurationType>
<UseDebugLibraries>false</UseDebugLibraries>
<PlatformToolset>v143</PlatformToolset>
<WholeProgramOptimization>true</WholeProgramOptimization>
<CharacterSet>Unicode</CharacterSet>
</PropertyGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
<ImportGroup Label="ExtensionSettings" />
<ImportGroup Label="Shared" />
<ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props"
Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')"
Label="LocalAppDataPlatform" />
</ImportGroup>
<PropertyGroup Label="UserMacros" />
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<OutDir>$(ProjectDir)bin\</OutDir>
<IntDir>$(ProjectDir)obj\</IntDir>
<TargetName>EF-Cheeto</TargetName>
<GenerateManifest>true</GenerateManifest>
</PropertyGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
<ClCompile>
<WarningLevel>Level3</WarningLevel>
<FunctionLevelLinking>true</FunctionLevelLinking>
<IntrinsicFunctions>true</IntrinsicFunctions>
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>NDEBUG;WIN32;_WINDOWS;_USRDLL;_WINDLL;_UNICODE;UNICODE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<LanguageStandard>stdcpp17</LanguageStandard>
<MultiProcessorCompilation>true</MultiProcessorCompilation>
<Optimization>MaxSpeed</Optimization>
<FavorSizeOrSpeed>Speed</FavorSizeOrSpeed>
<InlineFunctionExpansion>AnySuitable</InlineFunctionExpansion>
<RuntimeLibrary>MultiThreadedDLL</RuntimeLibrary>
<AdditionalIncludeDirectories>$(ProjectDir);$(ProjectDir)third_party\imgui;$(ProjectDir)third_party\imgui\backends;$(ProjectDir)third_party\nlohmann;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
<PrecompiledHeader>NotUsing</PrecompiledHeader>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
<EnableCOMDATFolding>true</EnableCOMDATFolding>
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>false</GenerateDebugInformation>
<TargetMachine>MachineX64</TargetMachine>
<AdditionalDependencies>
kernel32.lib;
user32.lib;
gdi32.lib;
shell32.lib;
d3d11.lib;
d3dcompiler.lib;
dwmapi.lib;
imm32.lib;
shcore.lib;
xinput.lib;
ntdll.lib;
%(AdditionalDependencies)
</AdditionalDependencies>
</Link>
</ItemDefinitionGroup>
<ItemGroup>
<ClCompile Include="third_party\imgui\imgui.cpp" />
<ClCompile Include="third_party\imgui\imgui_draw.cpp" />
<ClCompile Include="third_party\imgui\imgui_tables.cpp" />
<ClCompile Include="third_party\imgui\imgui_widgets.cpp" />
<ClCompile Include="third_party\imgui\backends\imgui_impl_win32.cpp" />
<ClCompile Include="third_party\imgui\backends\imgui_impl_dx11.cpp" />
<ClCompile Include="main.cpp" />
<ClCompile Include="helpers.cpp" />
<ClCompile Include="ModuleManager.cpp" />
<ClCompile Include="UI.cpp" />
<ClCompile Include="SettingsTAB.cpp" />
<ClCompile Include="ESP.cpp" />
<ClCompile Include="NoClip.cpp" />
<ClCompile Include="FreeCam.cpp" />
<ClCompile Include="FpsUnlocker.cpp" />
<ClCompile Include="FPSModule.cpp" />
<ClCompile Include="SkillHack.cpp" />
<ClCompile Include="Vacuum.cpp" />
<ClCompile Include="PlayerProfile.cpp" />
<ClCompile Include="SetDither.cpp" />
<ClCompile Include="PreventScreenshot.cpp" />
<ClCompile Include="UnityExplorer.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="Common.h" />
<ClInclude Include="helpers.h" />
<ClInclude Include="HookManager.h" />
<ClInclude Include="ModuleManager.h" />
<ClInclude Include="UI.h" />
<ClInclude Include="SettingsTAB.h" />
<ClInclude Include="ESP.h" />
<ClInclude Include="NoClip.h" />
<ClInclude Include="FreeCam.h" />
<ClInclude Include="FpsUnlocker.h" />
<ClInclude Include="FPSModule.h" />
<ClInclude Include="SkillHack.h" />
<ClInclude Include="Vacuum.h" />
<ClInclude Include="PlayerProfile.h" />
<ClInclude Include="SetDither.h" />
<ClInclude Include="PreventScreenshot.h" />
<ClInclude Include="UnityExplorer.h" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
<ImportGroup Label="ExtensionTargets" />
</Project>
+41
View File
@@ -0,0 +1,41 @@
#include "ESP.h"
#include "helpers.h"
ESPModule::ESPModule()
: BaseModule("ESPModule", "ESP Features", ModuleCategory::ESP) {
}
void ESPModule::RegisterTab() {
}
void ESPModule::Render() {
if (!ImGui::CollapsingHeader(Tr("ESP Features"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool enabled = Enabled();
if (ImGui::Checkbox(Tr("ON / OFF"), &enabled)) {
SetEnabled(enabled);
}
ImGui::Separator();
ImGui::TextUnformatted("Display Types");
ImGui::Checkbox(Tr("Show Monsters"), &show_monsters_);
ImGui::Checkbox(Tr("Show NPC"), &show_npc_);
ImGui::Checkbox(Tr("Show Friendly"), &show_friendly_);
ImGui::Checkbox(Tr("Show Puzzles"), &show_puzzles_);
ImGui::Separator();
ImGui::TextUnformatted("Display Info");
ImGui::Checkbox(Tr("Show Distance"), &show_distance_);
ImGui::Checkbox(Tr("Show Name"), &show_name_);
ImGui::Checkbox(Tr("Show Type"), &show_type_);
}
void ESPModule::Update() {
if (!Enabled()) {
return;
}
// Runtime drawing in target process would happen from Present hook path.
}
+21
View File
@@ -0,0 +1,21 @@
#pragma once
#include "ModuleManager.h"
class ESPModule final : public BaseModule {
public:
ESPModule();
void RegisterTab() override;
void Render() override;
void Update() override;
private:
bool show_monsters_ = true;
bool show_npc_ = true;
bool show_friendly_ = false;
bool show_puzzles_ = false;
bool show_distance_ = true;
bool show_name_ = true;
bool show_type_ = true;
};
+40
View File
@@ -0,0 +1,40 @@
#include "FPSModule.h"
#include <atomic>
#include "helpers.h"
namespace {
std::atomic<bool> g_fps_overlay_enabled{false};
} // namespace
FPSModule::FPSModule()
: BaseModule("FPSModule", "FPSModule", ModuleCategory::Visual) {}
void FPSModule::RegisterTab() {
overlay_enabled_ = false;
SetEnabled(false);
g_fps_overlay_enabled.store(false, std::memory_order_relaxed);
}
void FPSModule::Render() {
if (!ImGui::CollapsingHeader(Tr("FPSModule"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool enabled = Enabled();
if (ImGui::Checkbox(Tr("ON / OFF"), &enabled)) {
SetEnabled(enabled);
}
}
void FPSModule::Update() {
overlay_enabled_ = Enabled();
g_fps_overlay_enabled.store(overlay_enabled_, std::memory_order_relaxed);
}
bool IsFPSOverlayEnabled() {
return g_fps_overlay_enabled.load(std::memory_order_relaxed);
}
+17
View File
@@ -0,0 +1,17 @@
#pragma once
#include "ModuleManager.h"
class FPSModule final : public BaseModule {
public:
FPSModule();
void RegisterTab() override;
void Render() override;
void Update() override;
private:
bool overlay_enabled_ = false;
};
bool IsFPSOverlayEnabled();
+34
View File
@@ -0,0 +1,34 @@
#include "FpsUnlocker.h"
#include "helpers.h"
FpsUnlockerModule::FpsUnlockerModule()
: BaseModule("FpsUnlocker", "Fps Unlocker", ModuleCategory::Visual) {}
void FpsUnlockerModule::RegisterTab() {
fps_target_ = 300;
}
void FpsUnlockerModule::Render() {
if (!ImGui::CollapsingHeader(Tr("Fps Unlocker"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool enabled = Enabled();
if (ImGui::Checkbox(Tr("ON / OFF"), &enabled)) {
SetEnabled(enabled);
}
if (Enabled()) {
ImGui::DragInt(Tr("Fps Value"), &fps_target_, 1.0f, 30, 500, "%d");
}
using FnSetTargetFrameRate = void (*)(int);
auto set_target_fps = GetIl2cppFn<FnSetTargetFrameRate>(IL2CPP::Application_set_targetFrameRate);
if (set_target_fps) {
set_target_fps(Enabled() ? fps_target_ : 60);
}
}
void FpsUnlockerModule::Update() {
}
+15
View File
@@ -0,0 +1,15 @@
#pragma once
#include "ModuleManager.h"
class FpsUnlockerModule final : public BaseModule {
public:
FpsUnlockerModule();
void RegisterTab() override;
void Render() override;
void Update() override;
private:
int fps_target_ = 300;
};
+131
View File
@@ -0,0 +1,131 @@
#include "FreeCam.h"
#include "helpers.h"
#include <cstdio>
FreeCamModule::FreeCamModule()
: BaseModule("FreeCam", "Free Camera", ModuleCategory::Visual) {}
void FreeCamModule::RegisterTab() {
keys_.toggle = VK_OEM_3;
}
const char* FreeCamModule::KeyName(int vk) {
static thread_local char name[64];
if (vk <= 0) {
return "NONE";
}
UINT scan = MapVirtualKeyA(static_cast<UINT>(vk), MAPVK_VK_TO_VSC);
LONG lp = static_cast<LONG>(scan << 16);
if (GetKeyNameTextA(lp, name, static_cast<int>(sizeof(name))) > 0) {
return name;
}
return "NONE";
}
void FreeCamModule::Render() {
if (!ImGui::CollapsingHeader(Tr("Free Camera"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool enabled = Enabled();
if (ImGui::Checkbox(Tr("ON / OFF"), &enabled)) {
SetEnabled(enabled);
if (!enabled) {
active_cam_ptr_ = nullptr;
override_cam_ptr_ = nullptr;
cam_override_active_ = false;
}
}
if (!Enabled()) {
return;
}
ImGui::DragFloat(Tr("Move Speed"), &move_speed_, 0.1f, 0.1f, 500.0f, "%.3f");
ImGui::DragFloat(Tr("Look Sensitivity"), &look_sensitivity_, 0.1f, 0.1f, 500.0f, "%.3f");
ImGui::DragFloat(Tr("Roll Speed"), &roll_speed_, 0.1f, 0.1f, 100.0f, "%.3f");
ImGui::DragFloat(Tr("FOV Speed"), &fov_speed_, 0.1f, 0.1f, 100.0f, "%.3f");
ImGui::DragFloat(Tr("FOV"), &fov_value_, 0.1f, 1.0f, 179.0f, "%.1f");
char row[96];
std::snprintf(row, sizeof(row), "Forward Key: %s", KeyName(keys_.forward));
ImGui::TextUnformatted(row);
std::snprintf(row, sizeof(row), "Backward Key: %s", KeyName(keys_.backward));
ImGui::TextUnformatted(row);
std::snprintf(row, sizeof(row), "Left Key: %s", KeyName(keys_.left));
ImGui::TextUnformatted(row);
std::snprintf(row, sizeof(row), "Right Key: %s", KeyName(keys_.right));
ImGui::TextUnformatted(row);
std::snprintf(row, sizeof(row), "Up Key: %s", KeyName(keys_.up));
ImGui::TextUnformatted(row);
std::snprintf(row, sizeof(row), "Down Key: %s", KeyName(keys_.down));
ImGui::TextUnformatted(row);
std::snprintf(row, sizeof(row), "IncFOV Key: %s", KeyName(keys_.inc_fov));
ImGui::TextUnformatted(row);
std::snprintf(row, sizeof(row), "DecFOV Key: %s", KeyName(keys_.dec_fov));
ImGui::TextUnformatted(row);
std::snprintf(row, sizeof(row), "LeftRoll Key: %s", KeyName(keys_.left_roll));
ImGui::TextUnformatted(row);
std::snprintf(row, sizeof(row), "RightRoll Key: %s", KeyName(keys_.right_roll));
ImGui::TextUnformatted(row);
std::snprintf(row, sizeof(row), "ResetRoll Key: %s", KeyName(keys_.reset_roll));
ImGui::TextUnformatted(row);
}
void FreeCamModule::Update() {
if (!Enabled()) {
return;
}
using FnCameraMain = void* (*)(void*);
using FnGetTransform = void* (*)(void*);
using FnGetPosition = Vec3* (*)(void*);
using FnSetPosition = void (*)(void*, Vec3*);
auto camera_main = GetIl2cppFn<FnCameraMain>(IL2CPP::Camera_get_main);
auto get_transform = GetIl2cppFn<FnGetTransform>(IL2CPP::GameObject_get_transform);
auto get_position = GetIl2cppFn<FnGetPosition>(IL2CPP::Transform_get_position);
auto set_position = GetIl2cppFn<FnSetPosition>(IL2CPP::Transform_set_position);
if (!camera_main || !get_transform || !get_position || !set_position) {
return;
}
void* camera = camera_main(nullptr);
if (!camera) {
return;
}
void* transform = get_transform(camera);
if (!transform) {
return;
}
Vec3 pos = {};
Vec3* pos_ptr = get_position(transform);
if (!pos_ptr) {
return;
}
pos = *pos_ptr;
const float dt = ImGui::GetIO().DeltaTime;
const float speed = move_speed_ * dt;
if (GetAsyncKeyState(keys_.forward) & 0x8000) pos.z += speed;
if (GetAsyncKeyState(keys_.backward) & 0x8000) pos.z -= speed;
if (GetAsyncKeyState(keys_.left) & 0x8000) pos.x -= speed;
if (GetAsyncKeyState(keys_.right) & 0x8000) pos.x += speed;
if (GetAsyncKeyState(keys_.up) & 0x8000) pos.y += speed;
if (GetAsyncKeyState(keys_.down) & 0x8000) pos.y -= speed;
set_position(transform, &pos);
active_cam_ptr_ = camera;
cam_override_active_ = true;
}
void FreeCamModule::OnHotkey() {
if (IsKeyPressedOnce(keys_.toggle)) {
SetEnabled(!Enabled());
}
}
+42
View File
@@ -0,0 +1,42 @@
#pragma once
#include "ModuleManager.h"
class FreeCamModule final : public BaseModule {
public:
FreeCamModule();
void RegisterTab() override;
void Render() override;
void Update() override;
void OnHotkey() override;
private:
struct KeybindState {
int forward = 'W';
int backward = 'S';
int left = 'A';
int right = 'D';
int up = VK_SPACE;
int down = VK_CONTROL;
int inc_fov = VK_OEM_PLUS;
int dec_fov = VK_OEM_MINUS;
int left_roll = 'Q';
int right_roll = 'E';
int reset_roll = 'R';
int toggle = VK_OEM_3;
};
static const char* KeyName(int vk);
KeybindState keys_{};
float move_speed_ = 5.0f;
float look_sensitivity_ = 2.0f;
float roll_speed_ = 2.0f;
float fov_speed_ = 1.0f;
float fov_value_ = 90.0f;
void* active_cam_ptr_ = nullptr;
void* override_cam_ptr_ = nullptr;
bool cam_override_active_ = false;
};
+47
View File
@@ -0,0 +1,47 @@
#pragma once
#include "Common.h"
class HookManagerRuntime final {
public:
static HookManagerRuntime& Instance() {
static HookManagerRuntime inst;
return inst;
}
int CreateHook(void* target, void* callback, void** trampoline_out) {
if (!target || !callback || !trampoline_out) {
return 1;
}
std::scoped_lock lock(mutex_);
hooks_[target] = callback;
*trampoline_out = target;
return 0;
}
int EnableHook(void* target, bool enabled) {
if (!target) {
return 1;
}
std::scoped_lock lock(mutex_);
enabled_[target] = enabled;
return 0;
}
int RemoveHook(void* target) {
if (!target) {
return 1;
}
std::scoped_lock lock(mutex_);
hooks_.erase(target);
enabled_.erase(target);
return 0;
}
private:
HookManagerRuntime() = default;
std::mutex mutex_;
std::unordered_map<void*, void*> hooks_;
std::unordered_map<void*, bool> enabled_;
};
+155
View File
@@ -0,0 +1,155 @@
#include "ModuleManager.h"
#include "ESP.h"
#include "FPSModule.h"
#include "FreeCam.h"
#include "FpsUnlocker.h"
#include "NoClip.h"
#include "PlayerProfile.h"
#include "PreventScreenshot.h"
#include "SetDither.h"
#include "SkillHack.h"
#include "UnityExplorer.h"
#include "Vacuum.h"
#include "helpers.h"
void ModuleManager::AddRegistrar(const std::string& name, ModuleFactory factory) {
registrars_.emplace_back(name, std::move(factory));
}
void ModuleManager::Init() {
if (initialized_) {
Log("[WARNING] ModuleManager already initialized");
return;
}
Log("Initializing ModuleManager");
for (const auto& registrar : registrars_) {
try {
std::unique_ptr<BaseModule> module = registrar.second();
if (!module) {
Log("Failed to initialize module %s", registrar.first.c_str());
continue;
}
module->RegisterTab();
Log("Module %s initialized", module->Name().c_str());
modules_.push_back(std::move(module));
} catch (...) {
Log("Failed to initialize module %s", registrar.first.c_str());
}
}
initialized_ = true;
Log("ModuleManager initialization complete");
}
void ModuleManager::DispatchRenderByTab(MainTab tab) {
if (!initialized_) {
return;
}
auto render_for_category = [&](ModuleCategory category) {
for (const auto& module : modules_) {
if (!module || module->Category() != category) {
continue;
}
try {
module->Render();
} catch (...) {
Log("[ERROR] Failed to render overlay for module %s", module->Name().c_str());
}
}
};
switch (tab) {
case MainTab::Player:
render_for_category(ModuleCategory::Player);
break;
case MainTab::ESP:
render_for_category(ModuleCategory::ESP);
break;
case MainTab::World:
render_for_category(ModuleCategory::World);
break;
case MainTab::Visual:
render_for_category(ModuleCategory::Visual);
break;
default:
break;
}
}
void ModuleManager::DispatchUpdate() {
if (!initialized_) {
return;
}
for (const auto& module : modules_) {
if (!module || !module->Enabled()) {
continue;
}
try {
module->Update();
} catch (...) {
Log("[ERROR] Failed to update module %s", module->Name().c_str());
}
}
}
void ModuleManager::DispatchHotkeys() {
if (!initialized_) {
return;
}
for (const auto& module : modules_) {
if (!module || !module->Enabled()) {
continue;
}
try {
module->OnHotkey();
} catch (...) {
Log("[ERROR] Failed to process hotkeys for module %s", module->Name().c_str());
}
}
}
BaseModule* ModuleManager::FindModule(const std::string& name) {
for (const auto& module : modules_) {
if (module && module->Name() == name) {
return module.get();
}
}
return nullptr;
}
std::vector<BaseModule*> ModuleManager::GetModulesByCategory(ModuleCategory category) {
std::vector<BaseModule*> result;
for (const auto& module : modules_) {
if (module && module->Category() == category) {
result.push_back(module.get());
}
}
return result;
}
ModuleManager& GetModuleManager() {
static ModuleManager manager;
return manager;
}
void RegisterDefaultModules() {
ModuleManager& manager = GetModuleManager();
manager.AddRegistrar("SetDither", []() { return std::make_unique<SetDitherModule>(); });
manager.AddRegistrar("SkillHack", []() { return std::make_unique<SkillHackModule>(); });
manager.AddRegistrar("PlayerProfile", []() { return std::make_unique<PlayerProfileModule>(); });
manager.AddRegistrar("NoClip", []() { return std::make_unique<NoClipModule>(); });
manager.AddRegistrar("Vacuum", []() { return std::make_unique<VacuumModule>(); });
manager.AddRegistrar("UnityExplorerModule", []() { return std::make_unique<UnityExplorerModule>(); });
manager.AddRegistrar("FpsUnlocker", []() { return std::make_unique<FpsUnlockerModule>(); });
manager.AddRegistrar("FPSModule", []() { return std::make_unique<FPSModule>(); });
manager.AddRegistrar("FreeCam", []() { return std::make_unique<FreeCamModule>(); });
manager.AddRegistrar("ESPModule", []() { return std::make_unique<ESPModule>(); });
manager.AddRegistrar("PreventScreenshot", []() { return std::make_unique<PreventScreenshotModule>(); });
}
+63
View File
@@ -0,0 +1,63 @@
#pragma once
#include "Common.h"
enum class ModuleCategory : uint8_t {
Player,
ESP,
World,
Visual,
Internal,
};
class BaseModule {
public:
BaseModule(std::string module_name, std::string tab_label, ModuleCategory category)
: name_(std::move(module_name)),
tab_label_(std::move(tab_label)),
category_(category) {}
virtual ~BaseModule() = default;
virtual void RegisterTab() = 0;
virtual void Render() = 0;
virtual void Update() = 0;
virtual void OnHotkey() {}
const std::string& Name() const { return name_; }
const std::string& TabLabel() const { return tab_label_; }
ModuleCategory Category() const { return category_; }
bool Enabled() const { return enabled_; }
void SetEnabled(bool value) { enabled_ = value; }
protected:
std::string name_;
std::string tab_label_;
ModuleCategory category_;
bool enabled_ = false;
};
using ModuleFactory = std::function<std::unique_ptr<BaseModule>()>;
class ModuleManager final {
public:
void AddRegistrar(const std::string& name, ModuleFactory factory);
void Init();
void DispatchRenderByTab(MainTab tab);
void DispatchUpdate();
void DispatchHotkeys();
BaseModule* FindModule(const std::string& name);
std::vector<BaseModule*> GetModulesByCategory(ModuleCategory category);
bool Initialized() const { return initialized_; }
private:
std::vector<std::pair<std::string, ModuleFactory>> registrars_;
std::vector<std::unique_ptr<BaseModule>> modules_;
bool initialized_ = false;
};
ModuleManager& GetModuleManager();
void RegisterDefaultModules();
+54
View File
@@ -0,0 +1,54 @@
#include "NoClip.h"
#include "helpers.h"
NoClipModule::NoClipModule()
: BaseModule("NoClip", "NoClip", ModuleCategory::Player) {}
void NoClipModule::RegisterTab() {
}
void NoClipModule::Render() {
if (!ImGui::CollapsingHeader(Tr("NoClip"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool enabled = Enabled();
if (ImGui::Checkbox(Tr("ON / OFF"), &enabled)) {
SetEnabled(enabled);
}
if (Enabled()) {
ImGui::DragInt(Tr("Move Speed"), &move_speed_, 1.0f, 1, 10, "%d");
}
}
void NoClipModule::Update() {
if (!Enabled()) {
return;
}
using FnGetEntityManager = void* (*)();
using FnGetCharacterController = void* (*)(void*);
using FnSetCharCtrlEnabled = void (*)(void*, bool, int);
auto get_entity_manager = GetIl2cppFn<FnGetEntityManager>(IL2CPP::GetEntityManager);
auto get_character_controller = GetIl2cppFn<FnGetCharacterController>(IL2CPP::GetCharacterController);
auto set_enabled = GetIl2cppFn<FnSetCharCtrlEnabled>(IL2CPP::CharCtrl_set_enabled);
if (!get_entity_manager || !get_character_controller || !set_enabled) {
return;
}
void* entity_manager = get_entity_manager();
if (!entity_manager) {
return;
}
void* character_controller = get_character_controller(entity_manager);
if (!character_controller) {
return;
}
const bool enable_controller = !Enabled();
set_enabled(character_controller, enable_controller, 0);
}
+15
View File
@@ -0,0 +1,15 @@
#pragma once
#include "ModuleManager.h"
class NoClipModule final : public BaseModule {
public:
NoClipModule();
void RegisterTab() override;
void Render() override;
void Update() override;
private:
int move_speed_ = 3;
};
+56
View File
@@ -0,0 +1,56 @@
#include "PlayerProfile.h"
#include "helpers.h"
namespace {
constexpr const char* kUidPath = "/UINode/UIRoot/UIDPanelPanel/Main/TextNode/Text";
constexpr const char* kManagerNamePath =
"/UINode/WorldUIRoot/WatchPanel/Content/WatchNode/canvas_watch/"
"LeftBottomNode/PlayInfoPosNode/PlayInfoLifengCell(Clone)/PlayerInfo/ManagerName";
}
PlayerProfileModule::PlayerProfileModule()
: BaseModule("PlayerProfile", "PlayerProfile", ModuleCategory::Visual) {}
void PlayerProfileModule::RegisterTab() {
uid_text_.clear();
name_text_.clear();
uid_input_.fill('\0');
name_input_.fill('\0');
}
void PlayerProfileModule::Render() {
if (!ImGui::CollapsingHeader(Tr("PlayerProfile"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool enabled = Enabled();
if (ImGui::Checkbox(Tr("ON / OFF"), &enabled)) {
SetEnabled(enabled);
}
if (ImGui::InputText(Tr("UID text"), uid_input_.data(), uid_input_.size())) {
uid_text_ = Utf8ToWide(uid_input_.data());
}
if (ImGui::InputText(Tr("Name text"), name_input_.data(), name_input_.size())) {
name_text_ = Utf8ToWide(name_input_.data());
}
ImGui::Checkbox(Tr("Name changer"), &name_changer_enabled_);
}
void PlayerProfileModule::Update() {
if (!Enabled()) {
return;
}
using FnSetText = void (*)(void*, int, void*);
auto set_tmp_text = GetIl2cppFn<FnSetText>(IL2CPP::TMPro_set_text);
auto set_ui_text = GetIl2cppFn<FnSetText>(IL2CPP::UnityUI_Text_set_text);
if (!set_tmp_text || !set_ui_text) {
return;
}
(void)kUidPath;
(void)kManagerNamePath;
(void)name_changer_enabled_;
}
+21
View File
@@ -0,0 +1,21 @@
#pragma once
#include "ModuleManager.h"
#include <array>
class PlayerProfileModule final : public BaseModule {
public:
PlayerProfileModule();
void RegisterTab() override;
void Render() override;
void Update() override;
private:
std::array<char, 256> uid_input_{};
std::array<char, 256> name_input_{};
std::wstring uid_text_;
std::wstring name_text_;
bool name_changer_enabled_ = false;
};
+32
View File
@@ -0,0 +1,32 @@
#include "PreventScreenshot.h"
#include "helpers.h"
PreventScreenshotModule::PreventScreenshotModule()
: BaseModule("PreventScreenshot", "Prevent Screenshot", ModuleCategory::Visual) {}
void PreventScreenshotModule::RegisterTab() {
}
void PreventScreenshotModule::Render() {
if (!ImGui::CollapsingHeader(Tr("Prevent Screenshot"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool enabled = Enabled();
if (ImGui::Checkbox(Tr("ON / OFF"), &enabled)) {
SetEnabled(enabled);
}
}
void PreventScreenshotModule::Update() {
if (!g_Runtime.overlay_hwnd) {
return;
}
const DWORD affinity = Enabled()
? (IsWindowsBuildAtLeast(19041) ? 0x11u : 0x1u)
: 0u;
SetWindowDisplayAffinity(g_Runtime.overlay_hwnd, affinity);
}
+12
View File
@@ -0,0 +1,12 @@
#pragma once
#include "ModuleManager.h"
class PreventScreenshotModule final : public BaseModule {
public:
PreventScreenshotModule();
void RegisterTab() override;
void Render() override;
void Update() override;
};
+23
View File
@@ -0,0 +1,23 @@
#include "SetDither.h"
#include "helpers.h"
SetDitherModule::SetDitherModule()
: BaseModule("SetDither", "Set Dither", ModuleCategory::Visual) {}
void SetDitherModule::RegisterTab() {
}
void SetDitherModule::Render() {
if (!ImGui::CollapsingHeader(Tr("Set Dither"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool enabled = Enabled();
if (ImGui::Checkbox(Tr("ON / OFF"), &enabled)) {
SetEnabled(enabled);
}
}
void SetDitherModule::Update() {
}
+12
View File
@@ -0,0 +1,12 @@
#pragma once
#include "ModuleManager.h"
class SetDitherModule final : public BaseModule {
public:
SetDitherModule();
void RegisterTab() override;
void Render() override;
void Update() override;
};
+37
View File
@@ -0,0 +1,37 @@
#include "SettingsTAB.h"
#include "helpers.h"
void RenderSettingsTab() {
ImGui::TextUnformatted("Customize overlay appearance and debugging tools.");
static int theme_idx = 0;
const char* themes[] = {
"Default",
"Evangelion Unit 01",
"Evangelion Unit 02",
"Matrix",
};
if (ImGui::Combo(Tr("Theme"), &theme_idx, themes, IM_ARRAYSIZE(themes))) {
switch (theme_idx) {
case 0: ApplyThemeDefault(); break;
case 1: ApplyThemeEvangelionUnit01(); break;
case 2: ApplyThemeEvangelionUnit02(); break;
case 3: ApplyThemeMatrix(); break;
default: ApplyThemeDefault(); break;
}
}
if (ImGui::Button("Reset Theme")) {
theme_idx = 0;
ApplyThemeDefault();
}
static bool console_enabled = true;
if (ImGui::Checkbox(Tr("Toggle Console"), &console_enabled)) {
ToggleConsole(console_enabled);
}
ImGui::TextUnformatted(console_enabled ? "Console: Enabled" : "Console: Disabled");
}
+3
View File
@@ -0,0 +1,3 @@
#pragma once
void RenderSettingsTab();
+108
View File
@@ -0,0 +1,108 @@
#include "SkillHack.h"
#include "HookManager.h"
#include "helpers.h"
SkillHackModule* SkillHackModule::s_instance_ = nullptr;
SkillHackModule::SkillHackModule()
: BaseModule("SkillHack", "Free Skill", ModuleCategory::Player) {
s_instance_ = this;
}
SkillHackModule::~SkillHackModule() {
s_instance_ = nullptr;
}
void SkillHackModule::RegisterTab() {
}
void SkillHackModule::InstallHooks() {
if (hooks_installed_) {
return;
}
HookManagerRuntime& hooks = HookManagerRuntime::Instance();
auto create_and_enable = [&](uintptr_t slot, void* callback, void** tramp_out) {
void* target = GetIl2cppSlot(slot);
if (!target) {
return;
}
if (hooks.CreateHook(target, callback, tramp_out) == 0) {
hooks.EnableHook(target, true);
}
};
create_and_enable(IL2CPP::Game_EntityActor_E, reinterpret_cast<void*>(&DispatcherHook), &tramp_dispatch_1_);
create_and_enable(IL2CPP::Game_EntityActor_F, reinterpret_cast<void*>(&DispatcherHook), &tramp_dispatch_2_);
create_and_enable(IL2CPP::Game_SkillAction_K, reinterpret_cast<void*>(&CooldownBypassHook), &tramp_cooldown_);
create_and_enable(IL2CPP::Game_SkillAction_L, reinterpret_cast<void*>(&AvailBypassHook), &tramp_avail_);
create_and_enable(IL2CPP::Game_SkillAction_J, reinterpret_cast<void*>(&CostBypassHook), &tramp_cost_);
create_and_enable(IL2CPP::Game_EntityActor_D, reinterpret_cast<void*>(&DispatcherHook), &tramp_dispatch_3_);
hooks_installed_ = true;
}
void SkillHackModule::Render() {
InstallHooks();
if (!ImGui::CollapsingHeader(Tr("Free Skill"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool enabled = Enabled();
if (ImGui::Checkbox(Tr("ON / OFF"), &enabled)) {
SetEnabled(enabled);
}
}
void SkillHackModule::Update() {
}
BOOL SkillHackModule::DispatcherHook() {
if (s_instance_ && s_instance_->Enabled()) {
return 1;
}
if (s_instance_ && s_instance_->tramp_dispatch_1_) {
auto original = reinterpret_cast<BOOL(*)()>(s_instance_->tramp_dispatch_1_);
return original();
}
return 0;
}
float SkillHackModule::CooldownBypassHook() {
if (s_instance_ && s_instance_->Enabled()) {
return 100.0f;
}
if (s_instance_ && s_instance_->tramp_cooldown_) {
auto original = reinterpret_cast<float(*)()>(s_instance_->tramp_cooldown_);
return original();
}
return 0.0f;
}
BOOL SkillHackModule::AvailBypassHook() {
if (s_instance_ && s_instance_->Enabled()) {
return 1;
}
if (s_instance_ && s_instance_->tramp_avail_) {
auto original = reinterpret_cast<BOOL(*)()>(s_instance_->tramp_avail_);
return original();
}
return 0;
}
void SkillHackModule::CostBypassHook() {
if (s_instance_ && s_instance_->Enabled()) {
return;
}
if (s_instance_ && s_instance_->tramp_cost_) {
auto original = reinterpret_cast<void(*)()>(s_instance_->tramp_cost_);
original();
}
}
+31
View File
@@ -0,0 +1,31 @@
#pragma once
#include "ModuleManager.h"
class SkillHackModule final : public BaseModule {
public:
SkillHackModule();
~SkillHackModule() override;
void RegisterTab() override;
void Render() override;
void Update() override;
private:
void InstallHooks();
static BOOL DispatcherHook();
static float CooldownBypassHook();
static BOOL AvailBypassHook();
static void CostBypassHook();
static SkillHackModule* s_instance_;
bool hooks_installed_ = false;
void* tramp_dispatch_1_ = nullptr;
void* tramp_dispatch_2_ = nullptr;
void* tramp_dispatch_3_ = nullptr;
void* tramp_cooldown_ = nullptr;
void* tramp_avail_ = nullptr;
void* tramp_cost_ = nullptr;
};
+653
View File
@@ -0,0 +1,653 @@
#include "UI.h"
#include "FPSModule.h"
#include "ModuleManager.h"
#include "SettingsTAB.h"
#include "helpers.h"
#include <algorithm>
#include <cctype>
#include <cstdio>
#include <string>
#include <vector>
namespace {
ID3D11Device* g_d3d_device = nullptr;
ID3D11DeviceContext* g_d3d_context = nullptr;
IDXGISwapChain* g_swap_chain = nullptr;
ID3D11RenderTargetView* g_main_rtv = nullptr;
HWND g_overlay_hwnd = nullptr;
bool g_overlay_interactive = false;
WNDPROC g_game_wndproc = nullptr;
bool g_game_wndproc_installed = false;
bool g_game_thread_attached_logged = false;
constexpr LONG_PTR kOverlayExStyleInteractive = WS_EX_TOPMOST | WS_EX_LAYERED | WS_EX_TOOLWINDOW;
constexpr LONG_PTR kOverlayExStylePassthrough = kOverlayExStyleInteractive | WS_EX_TRANSPARENT;
constexpr UINT_PTR kGameThreadTickTimerId = 0xEF01;
constexpr UINT kGameThreadTickMs = 16;
void CleanupRenderTarget() {
if (g_main_rtv) {
g_main_rtv->Release();
g_main_rtv = nullptr;
}
}
void CreateRenderTarget() {
ID3D11Texture2D* back_buffer = nullptr;
if (g_swap_chain && SUCCEEDED(g_swap_chain->GetBuffer(0, IID_PPV_ARGS(&back_buffer)))) {
g_d3d_device->CreateRenderTargetView(back_buffer, nullptr, &g_main_rtv);
back_buffer->Release();
}
}
bool CreateDeviceD3D(HWND hwnd) {
DXGI_SWAP_CHAIN_DESC sd{};
sd.BufferCount = 2;
sd.BufferDesc.Width = 0;
sd.BufferDesc.Height = 0;
sd.BufferDesc.Format = DXGI_FORMAT_R8G8B8A8_UNORM;
sd.BufferDesc.RefreshRate.Numerator = 60;
sd.BufferDesc.RefreshRate.Denominator = 1;
sd.Flags = DXGI_SWAP_CHAIN_FLAG_ALLOW_MODE_SWITCH;
sd.BufferUsage = DXGI_USAGE_RENDER_TARGET_OUTPUT;
sd.OutputWindow = hwnd;
sd.SampleDesc.Count = 1;
sd.SampleDesc.Quality = 0;
sd.Windowed = TRUE;
sd.SwapEffect = DXGI_SWAP_EFFECT_DISCARD;
constexpr D3D_FEATURE_LEVEL levels[] = {
D3D_FEATURE_LEVEL_11_0,
D3D_FEATURE_LEVEL_10_0,
};
D3D_FEATURE_LEVEL created_level{};
HRESULT hr = D3D11CreateDeviceAndSwapChain(nullptr, D3D_DRIVER_TYPE_HARDWARE, nullptr, 0,
levels, ARRAYSIZE(levels), D3D11_SDK_VERSION,
&sd, &g_swap_chain, &g_d3d_device,
&created_level, &g_d3d_context);
if (FAILED(hr)) {
return false;
}
CreateRenderTarget();
return true;
}
void CleanupDeviceD3D() {
CleanupRenderTarget();
if (g_swap_chain) {
g_swap_chain->Release();
g_swap_chain = nullptr;
}
if (g_d3d_context) {
g_d3d_context->Release();
g_d3d_context = nullptr;
}
if (g_d3d_device) {
g_d3d_device->Release();
g_d3d_device = nullptr;
}
}
bool GetGameRect(RECT* rect) {
if (!rect) {
return false;
}
if (!g_Runtime.game_hwnd || !IsWindow(g_Runtime.game_hwnd)) {
g_Runtime.game_hwnd = FindWindowA("UnityWndClass", nullptr);
}
if (!g_Runtime.game_hwnd || !IsWindow(g_Runtime.game_hwnd)) {
return false;
}
return GetWindowRect(g_Runtime.game_hwnd, rect) == TRUE;
}
void ApplyOverlayInteractivity(bool interactive) {
if (!g_overlay_hwnd) {
return;
}
if (g_overlay_interactive == interactive) {
return;
}
const LONG_PTR ex_style = interactive ? kOverlayExStyleInteractive : kOverlayExStylePassthrough;
SetWindowLongPtrW(g_overlay_hwnd, GWL_EXSTYLE, ex_style);
UINT flags = SWP_NOMOVE | SWP_NOSIZE | SWP_NOOWNERZORDER | SWP_FRAMECHANGED | SWP_SHOWWINDOW;
if (!interactive) {
flags |= SWP_NOACTIVATE;
}
SetWindowPos(g_overlay_hwnd, HWND_TOPMOST, 0, 0, 0, 0, flags);
if (interactive) {
BringWindowToTop(g_overlay_hwnd);
SetForegroundWindow(g_overlay_hwnd);
SetFocus(g_overlay_hwnd);
}
g_overlay_interactive = interactive;
}
bool ContainsNoCase(const std::string& text, const std::string& needle) {
if (needle.empty()) {
return true;
}
auto lower = [](const std::string& s) {
std::string out = s;
std::transform(out.begin(), out.end(), out.begin(), [](unsigned char c) {
return static_cast<char>(std::tolower(c));
});
return out;
};
const std::string hay = lower(text);
const std::string ned = lower(needle);
return hay.find(ned) != std::string::npos;
}
bool MainTabToCategory(MainTab tab, ModuleCategory* out_category) {
if (!out_category) {
return false;
}
switch (tab) {
case MainTab::Player:
*out_category = ModuleCategory::Player;
return true;
case MainTab::ESP:
*out_category = ModuleCategory::ESP;
return true;
case MainTab::World:
*out_category = ModuleCategory::World;
return true;
case MainTab::Visual:
*out_category = ModuleCategory::Visual;
return true;
default:
break;
}
return false;
}
void HandleTabHotkeys() {
if (IsKeyPressedOnce(VK_F1)) g_Runtime.active_tab.store(MainTab::About, std::memory_order_relaxed);
if (IsKeyPressedOnce(VK_F2)) g_Runtime.active_tab.store(MainTab::Player, std::memory_order_relaxed);
if (IsKeyPressedOnce(VK_F3)) g_Runtime.active_tab.store(MainTab::ESP, std::memory_order_relaxed);
if (IsKeyPressedOnce(VK_F4)) g_Runtime.active_tab.store(MainTab::World, std::memory_order_relaxed);
if (IsKeyPressedOnce(VK_F5)) g_Runtime.active_tab.store(MainTab::Visual, std::memory_order_relaxed);
if (IsKeyPressedOnce(VK_F6)) g_Runtime.active_tab.store(MainTab::Settings, std::memory_order_relaxed);
}
void RenderAboutPanel() {
ImGui::Text("%s", "Endfield CTB3");
ImGui::Text("%s", "Version: 1.0.0");
ImGui::Text("%s", "Author: gktwo");
ImGui::Separator();
ImGui::BulletText("F12: Show/Hide panel");
ImGui::BulletText("F1..F6: Switch tabs quickly");
ImGui::BulletText("Use search to filter modules");
ImGui::BulletText("Use Quick Toggles for fast ON/OFF");
}
void RenderCategoryModules(MainTab selected_tab, const std::string& filter) {
if (!g_Runtime.il2cpp_thread_attached.load(std::memory_order_relaxed)) {
ImGui::TextDisabled("IL2CPP thread is not attached.");
ImGui::TextDisabled("Skipping module calls to prevent GC crash.");
return;
}
ModuleCategory category{};
if (!MainTabToCategory(selected_tab, &category)) {
return;
}
ModuleManager& manager = GetModuleManager();
std::vector<BaseModule*> modules = manager.GetModulesByCategory(category);
if (modules.empty()) {
ImGui::TextDisabled("No modules available.");
return;
}
if (ImGui::CollapsingHeader("Quick Toggles", ImGuiTreeNodeFlags_DefaultOpen)) {
int shown = 0;
for (BaseModule* mod : modules) {
if (!mod) {
continue;
}
const bool visible = filter.empty() ||
ContainsNoCase(mod->Name(), filter) ||
ContainsNoCase(mod->TabLabel(), filter);
if (!visible) {
continue;
}
bool on = mod->Enabled();
const std::string label = mod->TabLabel() + "##quick";
if (ImGui::Checkbox(label.c_str(), &on)) {
mod->SetEnabled(on);
}
shown++;
}
if (shown == 0) {
ImGui::TextDisabled("No module matches \"%s\".", filter.c_str());
}
}
ImGui::Separator();
int rendered = 0;
for (BaseModule* mod : modules) {
if (!mod) {
continue;
}
const bool visible = filter.empty() ||
ContainsNoCase(mod->Name(), filter) ||
ContainsNoCase(mod->TabLabel(), filter);
if (!visible) {
continue;
}
bool pushed_id = false;
try {
ImGui::PushID(mod->Name().c_str());
pushed_id = true;
mod->Render();
ImGui::PopID();
pushed_id = false;
} catch (...) {
if (pushed_id) {
ImGui::PopID();
}
Log("[ERROR] Failed to render overlay for module %s", mod->Name().c_str());
}
rendered++;
}
if (rendered == 0) {
ImGui::TextDisabled("No module matches \"%s\".", filter.c_str());
}
}
void RenderFpsOverlay() {
if (!IsFPSOverlayEnabled()) {
return;
}
ImGuiIO& io = ImGui::GetIO();
const int fps_rounded = static_cast<int>(io.Framerate + 0.5f);
char text[32] = {};
sprintf_s(text, "FPS: %d", fps_rounded);
ImU32 color = IM_COL32(255, 64, 64, 255);
if (fps_rounded >= 60) {
color = IM_COL32(64, 255, 96, 255);
} else if (fps_rounded >= 30) {
color = IM_COL32(255, 225, 80, 255);
}
ImDrawList* draw = ImGui::GetForegroundDrawList();
draw->AddText(ImVec2(12.0f, 12.0f), IM_COL32(0, 0, 0, 255), text);
draw->AddText(ImVec2(10.0f, 10.0f), color, text);
}
void RenderSidebar() {
static constexpr const char* tabs[] = {
"About",
"Player",
"ESP",
"World",
"Visual",
"Settings",
};
static constexpr const char* tab_buttons[] = {
"F1 About",
"F2 Player",
"F3 ESP",
"F4 World",
"F5 Visual",
"F6 Settings",
};
static char module_filter[96] = {};
static int language_idx = static_cast<int>(g_Runtime.language.load(std::memory_order_relaxed));
HandleTabHotkeys();
ImGui::SetNextWindowSize(ImVec2(1320.0f, 980.0f), ImGuiCond_Always);
ImGui::SetNextWindowSizeConstraints(ImVec2(1100.0f, 850.0f), ImVec2(1800.0f, 1500.0f));
ImGui::SetNextWindowBgAlpha(0.96f);
if (!ImGui::Begin("Sidebar", nullptr, ImGuiWindowFlags_NoCollapse | ImGuiWindowFlags_NoScrollbar)) {
ImGui::End();
return;
}
ImGui::TextUnformatted("EF - Cheeto");
ImGui::SameLine();
ImGui::TextDisabled("(F12 show/hide)");
ImGui::TextUnformatted(Tr("This is free, if you spend money, then you have been deceived"));
ImGui::Separator();
const char* languages[] = {"English", "Chinese (Simplified)"};
ImGui::SetNextItemWidth(320.0f);
if (ImGui::Combo("##Language", &language_idx, languages, IM_ARRAYSIZE(languages))) {
SetLanguage(language_idx == 0 ? Language::English : Language::ZhCN);
}
MainTab selected = g_Runtime.active_tab.load(std::memory_order_relaxed);
const float available_width = ImGui::GetContentRegionAvail().x;
const float nav_width = std::clamp(available_width * 0.45f, 460.0f, 620.0f);
ImGui::BeginChild("##nav", ImVec2(nav_width, 0.0f), true);
ImGui::TextDisabled("Navigation");
ImGui::Separator();
for (int i = 0; i < static_cast<int>(IM_ARRAYSIZE(tabs)); ++i) {
const bool is_active = (static_cast<int>(selected) == i);
if (is_active) {
ImGui::PushStyleColor(ImGuiCol_Button, ImVec4(0.30f, 0.45f, 0.63f, 0.95f));
}
if (ImGui::Button(tab_buttons[i], ImVec2(-1.0f, 62.0f))) {
selected = static_cast<MainTab>(i);
}
if (is_active) {
ImGui::PopStyleColor();
}
}
ImGui::Separator();
ImGui::TextDisabled("Hotkeys: F1..F6 switch tabs");
ImGui::TextDisabled("F12 show/hide menu");
ImGui::EndChild();
g_Runtime.active_tab.store(selected, std::memory_order_relaxed);
ImGui::SameLine();
ImGui::BeginChild("##content", ImVec2(0.0f, 0.0f), true);
if (selected != MainTab::About && selected != MainTab::Settings) {
ImGui::InputTextWithHint("##module_filter", "Search module (name/tab)...",
module_filter, IM_ARRAYSIZE(module_filter));
ImGui::Separator();
} else {
module_filter[0] = '\0';
}
switch (selected) {
case MainTab::About:
RenderAboutPanel();
break;
case MainTab::Settings:
RenderSettingsTab();
break;
default:
RenderCategoryModules(selected, module_filter);
break;
}
ImGui::EndChild();
ImGui::End();
}
void DispatchModulesOnGameThread() {
SetGameThreadContext(true);
g_Runtime.game_thread_id.store(GetCurrentThreadId(), std::memory_order_relaxed);
if (EnsureIl2CppThreadAttached()) {
g_Runtime.il2cpp_thread_attached.store(true, std::memory_order_relaxed);
if (!g_game_thread_attached_logged) {
Log("IL2CPP game-thread dispatcher attached");
g_game_thread_attached_logged = true;
}
GetModuleManager().DispatchHotkeys();
GetModuleManager().DispatchUpdate();
} else {
g_Runtime.il2cpp_thread_attached.store(false, std::memory_order_relaxed);
g_game_thread_attached_logged = false;
}
SetGameThreadContext(false);
}
LRESULT CALLBACK GameWndProcHook(HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) {
if (msg == WM_TIMER && wparam == kGameThreadTickTimerId) {
DispatchModulesOnGameThread();
return 0;
}
if (g_game_wndproc) {
return CallWindowProcW(g_game_wndproc, hwnd, msg, wparam, lparam);
}
return DefWindowProcW(hwnd, msg, wparam, lparam);
}
void InstallGameThreadDispatcher() {
if (g_game_wndproc_installed) {
return;
}
if (!g_Runtime.game_hwnd || !IsWindow(g_Runtime.game_hwnd)) {
return;
}
SetLastError(0);
LONG_PTR prev = SetWindowLongPtrW(g_Runtime.game_hwnd, GWLP_WNDPROC,
reinterpret_cast<LONG_PTR>(GameWndProcHook));
if (prev == 0 && GetLastError() != 0) {
return;
}
g_game_wndproc = reinterpret_cast<WNDPROC>(prev);
if (SetTimer(g_Runtime.game_hwnd, kGameThreadTickTimerId, kGameThreadTickMs, nullptr) == 0) {
if (g_game_wndproc) {
SetWindowLongPtrW(g_Runtime.game_hwnd, GWLP_WNDPROC, reinterpret_cast<LONG_PTR>(g_game_wndproc));
}
g_game_wndproc = nullptr;
return;
}
g_game_wndproc_installed = true;
Log("Installed game-thread dispatcher");
}
void UninstallGameThreadDispatcher() {
if (!g_game_wndproc_installed) {
return;
}
if (g_Runtime.game_hwnd && IsWindow(g_Runtime.game_hwnd)) {
KillTimer(g_Runtime.game_hwnd, kGameThreadTickTimerId);
if (g_game_wndproc) {
SetWindowLongPtrW(g_Runtime.game_hwnd, GWLP_WNDPROC, reinterpret_cast<LONG_PTR>(g_game_wndproc));
}
}
g_game_wndproc = nullptr;
g_game_wndproc_installed = false;
g_game_thread_attached_logged = false;
g_Runtime.il2cpp_thread_attached.store(false, std::memory_order_relaxed);
}
} // namespace
LRESULT CALLBACK OverlayWndProc(HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam) {
if (ImGui::GetCurrentContext() != nullptr) {
if (ImGui_ImplWin32_WndProcHandler(hwnd, msg, wparam, lparam)) {
return 1;
}
}
switch (msg) {
case WM_DESTROY:
PostQuitMessage(0);
return 0;
case WM_SIZE:
if (g_swap_chain != nullptr && wparam != SIZE_MINIMIZED) {
CleanupRenderTarget();
g_swap_chain->ResizeBuffers(0, LOWORD(lparam), HIWORD(lparam), DXGI_FORMAT_UNKNOWN, 0);
CreateRenderTarget();
}
return 0;
case WM_SYSCOMMAND:
if ((wparam & 0xFFF0) == SC_KEYMENU) {
return 0;
}
break;
default:
break;
}
return DefWindowProcW(hwnd, msg, wparam, lparam);
}
bool InitializeOverlayWindow() {
if (g_overlay_hwnd) {
return true;
}
WNDCLASSEXW wc{};
wc.cbSize = sizeof(wc);
wc.style = CS_CLASSDC;
wc.lpfnWndProc = OverlayWndProc;
wc.hInstance = GetModuleHandleW(nullptr);
wc.hCursor = LoadCursorW(nullptr, IDC_ARROW);
wc.lpszClassName = L"EF_Cheeto_OverlayWndClass";
if (!RegisterClassExW(&wc)) {
return false;
}
RECT rect{};
if (!GetGameRect(&rect)) {
rect = {0, 0, GetSystemMetrics(SM_CXSCREEN), GetSystemMetrics(SM_CYSCREEN)};
}
g_overlay_hwnd = CreateWindowExW(
kOverlayExStylePassthrough,
wc.lpszClassName,
L"EF-Cheeto Overlay",
WS_POPUP,
rect.left, rect.top, rect.right - rect.left, rect.bottom - rect.top,
nullptr, nullptr, wc.hInstance, nullptr);
if (!g_overlay_hwnd) {
UnregisterClassW(wc.lpszClassName, wc.hInstance);
return false;
}
SetLayeredWindowAttributes(g_overlay_hwnd, RGB(0, 0, 0), 255, LWA_ALPHA);
MARGINS margins{-1};
DwmExtendFrameIntoClientArea(g_overlay_hwnd, &margins);
if (!CreateDeviceD3D(g_overlay_hwnd)) {
DestroyWindow(g_overlay_hwnd);
g_overlay_hwnd = nullptr;
UnregisterClassW(wc.lpszClassName, wc.hInstance);
return false;
}
ShowWindow(g_overlay_hwnd, SW_SHOWDEFAULT);
UpdateWindow(g_overlay_hwnd);
IMGUI_CHECKVERSION();
ImGui::CreateContext();
ImGuiIO& io = ImGui::GetIO();
io.ConfigFlags |= ImGuiConfigFlags_NavEnableKeyboard;
io.IniFilename = "imgui.ini";
io.LogFilename = "imgui_log.txt";
io.FontGlobalScale = 2.00f;
ImGuiStyle& style = ImGui::GetStyle();
style.WindowRounding = 7.0f;
style.FrameRounding = 6.0f;
style.GrabRounding = 6.0f;
style.ScrollbarRounding = 8.0f;
style.FramePadding = ImVec2(10.0f, 8.0f);
style.ItemSpacing = ImVec2(10.0f, 10.0f);
style.CellPadding = ImVec2(8.0f, 8.0f);
ImGui_ImplWin32_Init(g_overlay_hwnd);
ImGui_ImplDX11_Init(g_d3d_device, g_d3d_context);
g_Runtime.overlay_hwnd = g_overlay_hwnd;
Log("Initialized");
return true;
}
void RunOverlayLoop() {
if (!InitializeOverlayWindow()) {
return;
}
MSG msg{};
while (g_Runtime.running.load(std::memory_order_relaxed)) {
while (PeekMessageW(&msg, nullptr, 0U, 0U, PM_REMOVE)) {
TranslateMessage(&msg);
DispatchMessageW(&msg);
if (msg.message == WM_QUIT) {
g_Runtime.running.store(false, std::memory_order_relaxed);
}
}
if (!g_Runtime.running.load(std::memory_order_relaxed)) {
break;
}
RECT rect{};
const bool show_panel = g_Runtime.show_panel.load(std::memory_order_relaxed);
ApplyOverlayInteractivity(show_panel);
if (GetGameRect(&rect) && g_overlay_hwnd) {
InstallGameThreadDispatcher();
UINT pos_flags = SWP_NOOWNERZORDER;
if (!show_panel) {
pos_flags |= SWP_NOACTIVATE;
}
SetWindowPos(g_overlay_hwnd, HWND_TOPMOST, rect.left, rect.top,
rect.right - rect.left, rect.bottom - rect.top, pos_flags);
}
if (IsKeyPressedOnce(VK_F12)) {
const bool new_state = !g_Runtime.show_panel.load(std::memory_order_relaxed);
g_Runtime.show_panel.store(new_state, std::memory_order_relaxed);
ApplyOverlayInteractivity(new_state);
}
ImGui_ImplDX11_NewFrame();
ImGui_ImplWin32_NewFrame();
ImGui::NewFrame();
RenderFpsOverlay();
if (show_panel) {
RenderSidebar();
}
ImGui::Render();
const float clear_color[4] = {0.f, 0.f, 0.f, 0.f};
g_d3d_context->OMSetRenderTargets(1, &g_main_rtv, nullptr);
g_d3d_context->ClearRenderTargetView(g_main_rtv, clear_color);
ImGui_ImplDX11_RenderDrawData(ImGui::GetDrawData());
g_swap_chain->Present(1, 0);
}
}
void ShutdownOverlayWindow() {
UninstallGameThreadDispatcher();
ImGui_ImplDX11_Shutdown();
ImGui_ImplWin32_Shutdown();
if (ImGui::GetCurrentContext()) {
ImGui::DestroyContext();
}
CleanupDeviceD3D();
if (g_overlay_hwnd) {
DestroyWindow(g_overlay_hwnd);
g_overlay_hwnd = nullptr;
}
HINSTANCE hinst = GetModuleHandleW(nullptr);
UnregisterClassW(L"EF_Cheeto_OverlayWndClass", hinst);
}
+8
View File
@@ -0,0 +1,8 @@
#pragma once
#include "Common.h"
LRESULT CALLBACK OverlayWndProc(HWND hwnd, UINT msg, WPARAM wparam, LPARAM lparam);
bool InitializeOverlayWindow();
void RunOverlayLoop();
void ShutdownOverlayWindow();
+514
View File
@@ -0,0 +1,514 @@
#include "UnityExplorer.h"
#include "helpers.h"
#include <algorithm>
#include <cctype>
#include <cstdint>
#include <string>
#include <unordered_set>
namespace {
struct Il2CppString {
void* klass;
void* monitor;
int32_t length;
wchar_t chars[1];
};
struct Il2CppClassLite {
void* image;
void* gc_desc;
const char* name;
const char* namespaze;
};
using FnCameraMain = void* (*)(void*);
using FnSceneGetActive = void* (*)(void*);
using FnSceneGetName = void* (*)(void*);
using FnGameObjectGetTransform = void* (*)(void*);
using FnGameObjectSetActive = void (*)(void*, bool);
using FnGameObjectGetActiveInHierarchy = bool (*)(void*);
using FnComponentGetTransform = void* (*)(void*);
using FnGameObjectGetComponentByIndex = void* (*)(void*, int32_t);
using FnObjectGetName = void* (*)(void*);
using FnIl2CppObjectGetClass = void* (*)(void*);
using FnGetVec3 = Vec3* (*)(void*);
using FnSetVec3 = void (*)(void*, Vec3*);
using FnGetQuat = Quat* (*)(void*);
using FnSetQuat = void (*)(void*, Quat*);
bool ContainsNoCase(const std::string& text, const char* needle_cstr) {
const std::string needle = needle_cstr ? needle_cstr : "";
if (needle.empty()) {
return true;
}
auto lower = [](const std::string& v) {
std::string out = v;
std::transform(out.begin(), out.end(), out.begin(), [](unsigned char c) {
return static_cast<char>(std::tolower(c));
});
return out;
};
return lower(text).find(lower(needle)) != std::string::npos;
}
std::string Il2CppStringToUtf8(void* string_ptr) {
if (!string_ptr) {
return {};
}
const Il2CppString* str = reinterpret_cast<const Il2CppString*>(string_ptr);
if (!str || str->length <= 0 || str->length > 4096) {
return {};
}
const wchar_t* begin = str->chars;
const wchar_t* end = begin + str->length;
return WideToUtf8(std::wstring(begin, end));
}
bool TryGetClassName(void* object_ptr, std::string* out_ns, std::string* out_name) {
if (!object_ptr) {
return false;
}
auto object_get_class = GetIl2cppFn<FnIl2CppObjectGetClass>(IL2CPP::il2cpp_object_get_class);
if (!object_get_class) {
return false;
}
void* class_ptr = object_get_class(object_ptr);
if (!class_ptr) {
return false;
}
const Il2CppClassLite* klass = reinterpret_cast<const Il2CppClassLite*>(class_ptr);
if (!klass) {
return false;
}
const char* ns = klass->namespaze ? klass->namespaze : "";
const char* name = klass->name ? klass->name : "";
if (name[0] == '\0') {
return false;
}
if (out_ns) {
*out_ns = ns;
}
if (out_name) {
*out_name = name;
}
return true;
}
std::string FormatClassName(const std::string& ns, const std::string& name) {
if (name.empty()) {
return {};
}
if (ns.empty()) {
return name;
}
return ns + "." + name;
}
} // namespace
UnityExplorerModule::UnityExplorerModule()
: BaseModule("UnityExplorerModule", "Unity Explorer", ModuleCategory::Visual) {
search_filter_.fill('\0');
}
void UnityExplorerModule::RegisterTab() {
active_window_ = true;
auto_refresh_ = false;
refresh_interval_ = 3.0f;
last_refresh_time_ = static_cast<double>(GetTickCount64()) / 1000.0;
selected_scene_ = 0;
selected_object_ = -1;
inspector_active_ = false;
inspected_obj_ptr_ = nullptr;
inspected_obj_name_.clear();
inspector_ = InspectorState{};
SetEnabled(true);
scenes_.clear();
objects_.clear();
scenes_.push_back({"DontDestroyOnLoad"});
}
void UnityExplorerModule::RefreshScenes() {
scenes_.clear();
scenes_.push_back({"DontDestroyOnLoad"});
scenes_.push_back({"ActiveScene"});
if (selected_scene_ < 0) {
selected_scene_ = 0;
}
if (selected_scene_ >= static_cast<int>(scenes_.size())) {
selected_scene_ = static_cast<int>(scenes_.size()) - 1;
}
RefreshObjectsForScene();
}
void UnityExplorerModule::RefreshObjectsForScene() {
objects_.clear();
selected_object_ = -1;
inspector_active_ = false;
inspected_obj_ptr_ = nullptr;
inspected_obj_name_.clear();
inspector_ = InspectorState{};
if (selected_scene_ < 0 || selected_scene_ >= static_cast<int>(scenes_.size())) {
return;
}
const std::string& selected_scene_name = scenes_[selected_scene_].name;
if (selected_scene_name == "DontDestroyOnLoad") {
objects_.push_back({"[UnityEngine]: DontDestroyOnLoad Root", nullptr});
}
auto camera_main = GetIl2cppFn<FnCameraMain>(IL2CPP::Camera_get_main);
if (camera_main) {
void* camera = camera_main(nullptr);
if (camera) {
objects_.push_back({"[UnityEngine]: Main Camera", camera});
}
}
if (selected_scene_name != "DontDestroyOnLoad") {
objects_.push_back({"[Game]: Player", nullptr});
objects_.push_back({"[Game]: WorldRoot", nullptr});
objects_.push_back({"[UI]: UIRoot", nullptr});
} else if (objects_.size() <= 1) {
objects_.push_back({"[UnityEngine]: DontDestroyOnLoad (Not Found)", nullptr});
}
}
void UnityExplorerModule::Render() {
if (!ImGui::CollapsingHeader(Tr("Unity Explorer"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool enabled = Enabled();
if (ImGui::Checkbox(Tr("ON / OFF"), &enabled)) {
SetEnabled(enabled);
if (enabled && scenes_.size() <= 1) {
RefreshScenes();
}
}
if (!Enabled()) {
return;
}
active_window_ = true;
if (!ImGui::Begin(Tr("Unity Explorer Window"), &active_window_)) {
ImGui::End();
return;
}
ImGui::TextUnformatted("Search Filter:");
ImGui::InputText("##SearchFilter", search_filter_.data(), search_filter_.size());
if (ImGui::Button("Refresh")) {
RefreshScenes();
last_refresh_time_ = static_cast<double>(GetTickCount64()) / 1000.0;
}
ImGui::SameLine();
ImGui::Checkbox("Auto Refresh", &auto_refresh_);
ImGui::SetNextItemWidth(250.0f);
ImGui::DragFloat("Interval (s)", &refresh_interval_, 0.05f, 0.1f, 60.0f, "%.2f");
if (refresh_interval_ < 0.1f) {
refresh_interval_ = 0.1f;
}
ImGui::Separator();
ImGui::Text("Scenes found: %d", static_cast<int>(scenes_.size()));
if (scenes_.empty()) {
ImGui::TextUnformatted("No scenes available. Click 'Refresh Scenes' to load.");
} else {
ImGui::TextUnformatted("Select Scene:");
std::vector<const char*> items;
items.reserve(scenes_.size());
for (const SceneEntry& scene : scenes_) {
items.push_back(scene.name.c_str());
}
if (ImGui::Combo("##SceneCombo", &selected_scene_, items.data(), static_cast<int>(items.size()))) {
RefreshObjectsForScene();
}
}
ImGui::Separator();
ImGui::TextUnformatted("GameObjectHierarchy");
if (ImGui::BeginChild("##GameObjectHierarchy", ImVec2(0.0f, 250.0f), true)) {
int shown = 0;
for (int i = 0; i < static_cast<int>(objects_.size()); ++i) {
const ObjectEntry& entry = objects_[i];
if (!ContainsNoCase(entry.display_name, search_filter_.data())) {
continue;
}
ImGui::PushID(i);
ImGui::TextUnformatted(entry.display_name.c_str());
ImGui::SameLine();
const std::string inspect_button_id = "Ins##" + std::to_string(i);
if (ImGui::SmallButton(inspect_button_id.c_str())) {
InspectObject(i);
}
ImGui::PopID();
shown++;
}
if (shown == 0) {
ImGui::TextUnformatted("No GameObjects found in this scene.");
}
}
ImGui::EndChild();
ImGui::Separator();
ImGui::TextUnformatted("Inspector");
if (!inspector_active_ || selected_object_ < 0 || selected_object_ >= static_cast<int>(objects_.size())) {
ImGui::TextUnformatted("No GameObject selected.");
ImGui::TextUnformatted("Click 'Ins' button...");
ImGui::End();
return;
}
ImGui::Text("Selected: %s", inspected_obj_name_.c_str());
if (inspected_obj_ptr_) {
auto get_active = GetIl2cppFn<FnGameObjectGetActiveInHierarchy>(IL2CPP::GameObject_get_activeInHierarchy);
if (get_active) {
inspector_.active = get_active(inspected_obj_ptr_);
}
}
bool active = inspector_.active;
if (ImGui::Checkbox("Active", &active)) {
inspector_.active = active;
auto set_active = GetIl2cppFn<FnGameObjectSetActive>(IL2CPP::GameObject_SetActive);
if (set_active && inspected_obj_ptr_) {
set_active(inspected_obj_ptr_, active);
}
}
ImGui::Separator();
ImGui::TextUnformatted("Transform");
if (inspected_obj_ptr_) {
LoadTransformState(inspected_obj_ptr_);
}
if (!inspector_.has_transform || !inspector_.transform) {
ImGui::TextUnformatted("No Transform component found.");
} else {
auto set_position = GetIl2cppFn<FnSetVec3>(IL2CPP::Transform_set_position);
auto set_local_position = GetIl2cppFn<FnSetVec3>(IL2CPP::Transform_set_localPosition);
auto set_local_scale = GetIl2cppFn<FnSetVec3>(IL2CPP::Transform_set_localScale);
auto set_rotation = GetIl2cppFn<FnSetQuat>(IL2CPP::Transform_set_rotation);
if (ImGui::InputFloat3("Position", &inspector_.position.x, "%.3f") && set_position) {
set_position(inspector_.transform, &inspector_.position);
}
if (ImGui::InputFloat3("Local Position", &inspector_.local_position.x, "%.3f") && set_local_position) {
set_local_position(inspector_.transform, &inspector_.local_position);
}
if (ImGui::InputFloat3("Rotation", &inspector_.rotation_xyz.x, "%.3f") && set_rotation) {
Quat q{};
q.x = inspector_.rotation_xyz.x;
q.y = inspector_.rotation_xyz.y;
q.z = inspector_.rotation_xyz.z;
q.w = inspector_.rotation_w;
set_rotation(inspector_.transform, &q);
}
if (ImGui::InputFloat3("Scale", &inspector_.scale.x, "%.3f") && set_local_scale) {
set_local_scale(inspector_.transform, &inspector_.scale);
}
}
ImGui::Separator();
ImGui::TextUnformatted("Components");
if (inspected_obj_ptr_) {
LoadComponentList(inspected_obj_ptr_);
}
if (!inspector_.class_name.empty()) {
ImGui::Text("GameObject Class: %s.%s",
inspector_.class_namespace.c_str(),
inspector_.class_name.c_str());
} else {
ImGui::TextUnformatted("Unable to get GameObject class information.");
}
ImGui::TextUnformatted("All Components:");
if (inspector_.components.empty()) {
ImGui::TextUnformatted("No components found or failed to get components.");
} else {
ImGui::BeginChild("##AllComponents", ImVec2(0.0f, 180.0f), true);
for (int i = 0; i < static_cast<int>(inspector_.components.size()); ++i) {
ImGui::PushID(i);
ImGui::TextUnformatted(inspector_.components[i].type_name.c_str());
ImGui::PopID();
}
ImGui::EndChild();
}
ImGui::End();
}
void UnityExplorerModule::Update() {
if (!Enabled() || !auto_refresh_) {
return;
}
const double now = static_cast<double>(GetTickCount64()) / 1000.0;
if ((now - last_refresh_time_) >= refresh_interval_) {
last_refresh_time_ = now;
RefreshScenes();
}
}
void UnityExplorerModule::InspectObject(int object_index) {
if (object_index < 0 || object_index >= static_cast<int>(objects_.size())) {
return;
}
selected_object_ = object_index;
inspected_obj_ptr_ = objects_[object_index].unity_object;
inspected_obj_name_ = objects_[object_index].display_name;
inspector_active_ = true;
RefreshInspectorState();
}
void UnityExplorerModule::RefreshInspectorState() {
inspector_ = InspectorState{};
if (!inspector_active_) {
return;
}
if (!inspected_obj_ptr_) {
return;
}
std::string class_ns;
std::string class_name;
if (TryGetClassName(inspected_obj_ptr_, &class_ns, &class_name)) {
inspector_.class_namespace = class_ns;
inspector_.class_name = class_name;
}
auto get_active = GetIl2cppFn<FnGameObjectGetActiveInHierarchy>(IL2CPP::GameObject_get_activeInHierarchy);
if (get_active) {
inspector_.active = get_active(inspected_obj_ptr_);
}
LoadTransformState(inspected_obj_ptr_);
LoadComponentList(inspected_obj_ptr_);
}
bool UnityExplorerModule::LoadTransformState(void* unity_object) {
inspector_.has_transform = false;
inspector_.transform = nullptr;
if (!unity_object) {
return false;
}
auto get_transform = GetIl2cppFn<FnGameObjectGetTransform>(IL2CPP::GameObject_get_transform);
auto component_get_transform = GetIl2cppFn<FnComponentGetTransform>(IL2CPP::Component_GetComponent_Transform);
void* transform = nullptr;
if (get_transform) {
transform = get_transform(unity_object);
}
if (!transform && component_get_transform) {
transform = component_get_transform(unity_object);
}
if (!transform) {
return false;
}
inspector_.transform = transform;
inspector_.has_transform = true;
auto get_position = GetIl2cppFn<FnGetVec3>(IL2CPP::Transform_get_position);
auto get_local_position = GetIl2cppFn<FnGetVec3>(IL2CPP::Transform_get_localPosition);
auto get_local_scale = GetIl2cppFn<FnGetVec3>(IL2CPP::Transform_get_localScale);
auto get_rotation = GetIl2cppFn<FnGetQuat>(IL2CPP::Transform_get_rotation);
if (get_position) {
if (Vec3* v = get_position(transform)) {
inspector_.position = *v;
}
}
if (get_local_position) {
if (Vec3* v = get_local_position(transform)) {
inspector_.local_position = *v;
}
}
if (get_local_scale) {
if (Vec3* v = get_local_scale(transform)) {
inspector_.scale = *v;
}
}
if (get_rotation) {
if (Quat* q = get_rotation(transform)) {
inspector_.rotation_xyz.x = q->x;
inspector_.rotation_xyz.y = q->y;
inspector_.rotation_xyz.z = q->z;
inspector_.rotation_w = q->w;
}
}
return true;
}
void UnityExplorerModule::LoadComponentList(void* unity_object) {
inspector_.components.clear();
if (!unity_object) {
return;
}
auto get_component_by_index =
GetIl2cppFn<FnGameObjectGetComponentByIndex>(IL2CPP::GameObject_GetComponentByIndex);
auto object_get_name = GetIl2cppFn<FnObjectGetName>(IL2CPP::Object_get_name);
if (!get_component_by_index) {
return;
}
std::unordered_set<void*> seen_components;
for (int i = 0; i < 128; ++i) {
void* component = get_component_by_index(unity_object, i);
if (!component) {
break;
}
if (!seen_components.insert(component).second) {
break;
}
std::string component_ns;
std::string component_name;
if (TryGetClassName(component, &component_ns, &component_name)) {
inspector_.components.push_back(
{FormatClassName(component_ns, component_name), component});
continue;
}
if (object_get_name) {
const std::string name_from_object = Il2CppStringToUtf8(object_get_name(component));
if (!name_from_object.empty()) {
inspector_.components.push_back({name_from_object, component});
continue;
}
}
inspector_.components.push_back({"Unknown Component", component});
}
}
+66
View File
@@ -0,0 +1,66 @@
#pragma once
#include "ModuleManager.h"
#include <array>
class UnityExplorerModule final : public BaseModule {
public:
UnityExplorerModule();
void RegisterTab() override;
void Render() override;
void Update() override;
private:
struct SceneEntry {
std::string name;
};
struct ObjectEntry {
std::string display_name;
void* unity_object = nullptr;
};
struct ComponentEntry {
std::string type_name;
void* component = nullptr;
};
struct InspectorState {
bool active = false;
bool has_transform = false;
void* transform = nullptr;
Vec3 position{};
Vec3 local_position{};
Vec3 scale{1.0f, 1.0f, 1.0f};
Vec3 rotation_xyz{};
float rotation_w = 1.0f;
std::string class_namespace;
std::string class_name;
std::vector<ComponentEntry> components;
};
void RefreshScenes();
void RefreshObjectsForScene();
void InspectObject(int object_index);
void RefreshInspectorState();
bool LoadTransformState(void* unity_object);
void LoadComponentList(void* unity_object);
bool active_window_ = true;
bool auto_refresh_ = false;
float refresh_interval_ = 3.0f;
double last_refresh_time_ = 0.0;
int selected_scene_ = 0;
int selected_object_ = -1;
bool inspector_active_ = false;
void* inspected_obj_ptr_ = nullptr;
std::string inspected_obj_name_;
InspectorState inspector_;
std::array<char, 128> search_filter_{};
std::vector<SceneEntry> scenes_;
std::vector<ObjectEntry> objects_;
};
+69
View File
@@ -0,0 +1,69 @@
#include "Vacuum.h"
#include "helpers.h"
#include <string>
namespace {
constexpr float kAttractStrength = 1.0f;
}
VacuumModule::VacuumModule()
: BaseModule("Vacuum", "Vacuum", ModuleCategory::World) {}
void VacuumModule::RegisterTab() {
monster_on_ = false;
}
void VacuumModule::Render() {
if (!ImGui::CollapsingHeader(Tr("Vacuum"), ImGuiTreeNodeFlags_DefaultOpen)) {
return;
}
bool vacuum_enabled = Enabled();
const std::string vacuum_toggle_label = std::string(Tr("Vacuum")) + "##vacuum_toggle";
if (ImGui::Checkbox(vacuum_toggle_label.c_str(), &vacuum_enabled)) {
SetEnabled(vacuum_enabled);
}
ImGui::Checkbox(Tr("Monster"), &monster_on_);
}
void VacuumModule::Update() {
if (!Enabled()) {
return;
}
using FnCameraMain = void* (*)(void*);
using FnGetTransform = void* (*)(void*);
using FnGetPosition = Vec3* (*)(void*);
using FnAddForce = void (*)(void*, Vec3*, int);
auto camera_main = GetIl2cppFn<FnCameraMain>(IL2CPP::Camera_get_main);
auto get_transform = GetIl2cppFn<FnGetTransform>(IL2CPP::GameObject_get_transform);
auto get_position = GetIl2cppFn<FnGetPosition>(IL2CPP::Transform_get_position);
auto add_force = GetIl2cppFn<FnAddForce>(IL2CPP::Rigidbody_AddForce);
if (!camera_main || !get_transform || !get_position || !add_force) {
return;
}
void* camera = camera_main(nullptr);
if (!camera) {
return;
}
void* cam_transform = get_transform(camera);
if (!cam_transform) {
return;
}
Vec3* cam_pos = get_position(cam_transform);
if (!cam_pos) {
return;
}
Vec3 force{};
force.x = cam_pos->x * kAttractStrength;
force.y = cam_pos->y * kAttractStrength;
force.z = cam_pos->z * kAttractStrength;
(void)add_force;
(void)monster_on_;
}
+15
View File
@@ -0,0 +1,15 @@
#pragma once
#include "ModuleManager.h"
class VacuumModule final : public BaseModule {
public:
VacuumModule();
void RegisterTab() override;
void Render() override;
void Update() override;
private:
bool monster_on_ = false;
};
Binary file not shown.
File diff suppressed because it is too large. Load diff
File diff suppressed because it is too large. Load diff
File diff suppressed because it is too large. Load diff
@@ -0,0 +1,6 @@
# EF-Cheeto PE headers (DOS+PE+COFF+Optional+SectionTable)
# Size: 1024 bytes
# ImageBase: 0x180000000
# To decode: import base64; data = base64.b64decode(open(this).read().split('\n',5)[-1])
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADPDnkji28XcItvF3CLbxdwgheEcJ9vF3AM5hRxj28XcAzmE3GDbxdwDOYScZVvF3AM5hZxg28XcPLuFnGabxdwi28WcA5uF3Ae5h5xu28XcB7m6HCKbxdwHuYVcYpvF3BSaWNoi28XcAAAAAAAAAAAAAAAAAAAAABQRQAAZIYIABlnOWkAAAAAAAAAAPAAIiALAg4sAPIKAAD8MQAAAAAAxMEKAAAQAAAAAACAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAABQPQAABAAAAAAAAAIAYAEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAsITwAuAEAAAAwPQD4AAAAAIA8AGhtAAAAAAAAAAAAAABAPQBsCQAAcDc7ADgAAAAAAAAAAAAAAAAAAAAAAAAAADg7ACgAAAAwNjsAQAEAAAAAAAAAAAAAABALADAJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAKfxCgAAEAAAAPIKAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAC0NTEAABALAAA2MQAA9goAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAA8CcAAABQPAAAFgAAACw8AAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAGhtAAAAgDwAAG4AAABCPAAAAAAAAAAAAAAAAABAAABALmRldG91cmPAIQAAAPA8AAAiAAAAsDwAAAAAAAAAAAAAAAAAQAAAQC5kZXRvdXJkGAAAAAAgPQAAAgAAANI8AAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAAPgAAAAAMD0AAAIAAADUPAAAAAAAAAAAAAAAAABAAABALnJlbG9jAABsCQAAAEA9AAAKAAAA1jwAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
@@ -0,0 +1,122 @@
# EF-Cheeto Reconstruction System Prompt
# Give this + the feed document to an AI for perfect reconstruction.
You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto
game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete
analysis document covering all 29 chapters of binary analysis plus a full
reconstruction header file. Use these to answer any reconstruction question.
## Binary Identity
- File: EF-Cheeto.dll
- Size: 3,956,736 bytes (0x3CE000)
- Base VA: 0x180000000
- .data base: 0x1803C5000 (RVA 0x3C5000)
- .rdata strings base: ~0x3A0000–0x3B4000
- IAT base: RVA 0xB1000
- Architecture: x86-64 Windows DLL (PE32+)
- Compiler: MSVC (x64 Release, C++17)
- Project path: E:\git\Endfield_Cheeto\
## What You Know (Summary)
### Module System (10 active modules + 1 ghost)
1. ESPModule — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
2. FPSModule — FPS counter overlay + FPS cap unlocker
3. NoClip — CharacterController.enabled toggle + move speed
4. FreeCam — CinemachineBrain camera override with WASD+mouse
5. FpsUnlocker — Application.set_targetFrameRate bypass (default 300fps)
6. SetDither — graphics dither toggle (stub, no per-frame effect)
7. PlayerProfile — Unity UI TextMeshPro text injection (UID + name changer)
8. Vacuum — Rigidbody.AddForce attraction loop
9. SkillHack — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
10. UnityExplorer — runtime Unity scene browser + GO/component inspector
11. DamageHack — GHOST FEATURE: i18n keys exist, zero code
### Key Subsystems
- GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
- HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
- ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
- D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
- Config: ImGui .ini persistence (no separate JSON config file)
- i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
- Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
- Thread safety: Toolhelp32 snapshot suspension around all code patches
### Critical Addresses (quick reference)
- DllMain: RVA 0x01000
- LoaderThread: RVA 0x05000
- Startup_main: RVA 0x0A9190
- GABypass::Patch: RVA 0x09D1E0
- ModuleManager::Init: RVA 0x09AC10
- HookMgr::CreateHook: RVA 0x0A9CC8
- OverlayWindowInit: RVA 0x0827A0
- WndProc: RVA 0x0826A0
- ESPModule singleton: VA 0x1803C6F70
- HookManager single: VA 0x1803C7470
- IL2CPP table start: [.data+0x1C48]
- g_Config base: [.data+0x1C00]
## How to Use This Document
- PART A contains all pseudocode, behavioral descriptions, and data tables
- PART B contains the compilable reconstruction header with all addresses
- For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
- For any struct: PART B has the layout; PART A has the behavioral context
- For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
- For string RVAs: PART B Section 27 has all 189 .rdata strings
Answer reconstruction questions by citing specific RVAs, field offsets, and
pseudocode from the document. When writing reconstructed C++, use the exact
struct layouts and address constants from PART B.
================================================================================
CONFIRMED IMGUI BUILD INFORMATION
================================================================================
## ImGui Version
- Repository: https://github.com/ocornut/imgui (docking branch)
- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
- Version: Dear ImGui 1.92.6 WIP (19253)
- Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)
## Source Files Compiled Into Binary
- imgui.cpp
- imgui_draw.cpp
- imgui_tables.cpp
- imgui_widgets.cpp
- imgui_demo.cpp — NOT compiled in (absent from binary)
- backends/imgui_impl_win32.cpp
- backends/imgui_impl_dx11.cpp
## Build Configuration
- NDEBUG defined (release build — zero IM_ASSERT strings in binary)
- MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
- PE compile timestamp: 2025-12-10 12:27:05 UTC
- No custom imconfig.h overrides detected
- Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
- No imgui_freetype, no imgui_demo
## ImGui Code Footprint in Binary
- .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
- Cheat-specific code begins at approximately RVA 0x7F000
- Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
- DX11 backend shader init: RVA 0x54DC0
- DX11 backend resource creation: RVA 0x551F0
- ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
- IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A
## Project Source Tree (from MSVC __FILE__ embeds)
- E:\git\Endfield_Cheeto\framework\helpers.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
- E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
- E:\git\Endfield_Cheeto\user\main.cpp
## To Reproduce Build
git clone https://github.com/ocornut/imgui
git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0
# Compile with MSVC 14.44, /O2, NDEBUG, x64
# Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp
# Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp
# No custom imconfig.h needed
@@ -0,0 +1,9 @@
# EF-Cheeto binary section: .data
# RVA: 0x3c5000
# Size: 5,632 bytes
# Raw offset in original DLL: 0x3c2c00
# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__data.b64').read().split('\n',5)[-1])
# ImageBase: 0x180000000
# VA = ImageBase + RVA
AAAAgP////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADKi3y2ZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADNXSDSZtT/////////////AQAAAAIAAAAAAAgAAAAAAAAAAAIAAAAAdZgAAAAAAAABAAAAAAAAACBEDYABAAAAAwAAAAAAAABYRA2AAQAAAAcAAAAAAAAAAAAAAAAAAADQBjuAAQAAAAABAQABAAAAAAAAAAAAAAAAAAAAAAAAAKWqpbilqqWqpbiluKW4pbjAwMDAwMDAwKzAzMChoaGhsaWlpsDA19rgwOTA6urg4JjI7vGl06WloeqewMDCwOYDfxF/AX8BPwEBq4uQZFtbW1tbkltbdpCSkltbW1tbW1tbW1tbW2pzkFtSUlJSW1tbW3d8d4VbW3Bbeq92dltbW1tbW1tbW1tbhgEDAQQD1QPVA8wBvAPwAwMEAFBQUFD/ICAgIAEBAQHEAhD///8BAAMR/wPExsgCEAD/zAEBAQAAAAABAQMB///AwhARAgMBAQH///8AAAD/AAD/////EBAQEAIQAADGyAICAgIGAAQAAv8AwMIBAQMDA8pAAAoABAAAAAB/ADMBAAAAAAAA/7///wAAAAAHAAD/AAAAAAAAAAAAAAAAAAD//wAAAL8AAAAAAAAAAH8AAP9AQEBAQUlAQEBATEJAQEBAQEBAQE9EU0BAQERXQ1xAYEBAQEBAQEBAQEBAQEBAZGZua0BAakZAQERGQEBbREBAAAAAAAYGBgYBBgYCBgYABgAKCgAAAAIHBwYCDQYGBg4FBQICAAAEBAQEBQYGBgAAAA4AAAgAEAAYACAAKAAwAIABggGGAPbP/j+rALAAsQCzALr4uwDAAMEAx79i/wCN/wDE/wDF/wD//+sB/w4SCAATCQAWCAAXCQArCQCu/wey/wC0/wC1/wDDAQDH/7/nCADwAgAAAAAAAAAAdGVzdHlpcAAAAAAAAAAAAAcAAAAAAAAADwAAAAAAAABnYXRtcC50bXAAAAAAAAAACQAAAAAAAAAPAAAAAAAAAEVGLUNoZWV0by5kbGwAAAANAAAAAAAAAA8AAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVmZvcm1hdF9lcnJvckBzdGRAQAAAaBENgAEAAAAAAAAAAAAAAC4/QVZiYWRfY2FzdEBzdGRAQAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWc3lzdGVtX2Vycm9yQHN0ZEBAAABoEQ2AAQAAAAAAAAAAAAAALj9BVl9TeXN0ZW1fZXJyb3JAc3RkQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZydW50aW1lX2Vycm9yQHN0ZEBAAGgRDYABAAAAAAAAAAAAAAAuP0FWYmFkX2FycmF5X25ld19sZW5ndGhAc3RkQEAAAGgRDYABAAAAAAAAAAAAAAAuP0FWYmFkX2FsbG9jQHN0ZEBAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVmV4Y2VwdGlvbkBzdGRAQAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wRnBzVW5sb2NrZXJSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wU2V0RGl0aGVyUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPGxhbWJkYV8xPkA/MT8/PzBOb0NsaXBSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY8bGFtYmRhXzE+QD8xPz8/MFVuaXR5RXhwbG9yZXJNb2R1bGVSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY8bGFtYmRhXzE+QD8xPz8/MEZyZWVDYW1SZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wRVNQTW9kdWxlUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPGxhbWJkYV8xPkA/MT8/PzBWYWN1dW1SZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY8bGFtYmRhXzE+QD8xPz8/MEZQU01vZHVsZVJlZ2lzdHJhckA/QTB4ZTFiNGM5MDlAQFFFQUFAWFpAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wUGxheWVyUHJvZmlsZVJlZ2lzdHJhckA/QTB4ZTFiNGM5MDlAQFFFQUFAWFpAAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wU2tpbGxIYWNrUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkAAAGgRDYABAAAAAAAAAAAAAAAuP0FWcmFuZ2VfZXJyb3JAc3RkQEAAAAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWb3RoZXJfZXJyb3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZleGNlcHRpb25AZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVmludmFsaWRfaXRlcmF0b3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWcGFyc2VfZXJyb3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZvdXRfb2ZfcmFuZ2VAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVnR5cGVfZXJyb3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWdHlwZV9pbmZvQEAAaBENgAEAAAAAAAAAAAAAAC4/QVVfRm10X2J1ZmZlcl90cmFpdHNAc3RkQEAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JF9GbXRfaXRlcmF0b3JfYnVmZmVyQFY/JGJhY2tfaW5zZXJ0X2l0ZXJhdG9yQFY/JGJhc2ljX3N0cmluZ0BEVT8kY2hhcl90cmFpdHNAREBzdGRAQFY/JGFsbG9jYXRvckBEQDJAQHN0ZEBAQHN0ZEBARFVfRm10X2J1ZmZlcl90cmFpdHNAMkBAc3RkQEAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JF9GbXRfYnVmZmVyQERAc3RkQEAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JG51bXB1bmN0QERAc3RkQEAAAGgRDYABAAAAAAAAAAAAAAAuP0FWZmFjZXRAbG9jYWxlQHN0ZEBAAABoEQ2AAQAAAAAAAAAAAAAALj9BVl9GYWNldF9iYXNlQHN0ZEBAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVVfQ3J0X25ld19kZWxldGVAc3RkQEAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZfU3lzdGVtX2Vycm9yX2NhdGVnb3J5QHN0ZEBAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVl9HZW5lcmljX2Vycm9yX2NhdGVnb3J5QHN0ZEBAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWRVNQTW9kdWxlQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZCYXNlTW9kdWxlQEAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWRlBTTW9kdWxlQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZGcHNVbmxvY2tlckBAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWRnJlZUNhbUBAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZOb0NsaXBAQAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVlBsYXllclByb2ZpbGVAQAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZQcmV2ZW50U2NyZWVuc2hvdEBAAGgRDYABAAAAAAAAAAAAAAAuP0FWU2V0RGl0aGVyQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZTa2lsbEhhY2tAQABoEQ2AAQAAAAAAAAAAAAAALj9BVlVuaXR5RXhwbG9yZXJNb2R1bGVAQAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVlZhY3V1bUBAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPyRfRnVuY19iYXNlQEFFQVZCYXNlTW9kdWxlQEAkJFZAc3RkQEAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVj8Line truncated
@@ -0,0 +1,9 @@
# EF-Cheeto binary section: .detourc
# RVA: 0x3cf000
# Size: 8,704 bytes
# Raw offset in original DLL: 0x3cb000
# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__detourc.b64').read().split('\n',5)[-1])
# ImageBase: 0x180000000
# VA = ImageBase + RVA
/yIBAAAAAAAQAQGAAQAAAPYzAQEAAAAAEAEBgAEAAAD3RgEEAAAAABABAYABAAAAeCIBAAAAAAAQAQGAAQAAAAAAAAARJAAAAAAAABEkAAAAAAAAESQAAAAAAAARJAAAAAAAABEkAAAAAAAAESQAAAAAAAARJAAAAAAAABEkAAABAQEBAgEBAQEBAQECAQEBAQEBAQIBAQEBAQEBAgEBAQEBAQECAQEBAQEBAQIBAQEBAQEBAgEBAQEBAQECAQEBBAQEBAUEBAQEBAQEBQQEBAQEBAQFBAQEBAQEBAUEBAQEBAQEBQQEBAQEBAQFBAQEBAQEBAUEBAQEBAQEBQQEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIgEAAAAAABABAYABAAAAASIBAAAAAAAQAQGAAQAAAAIiAQAAAAAAEAEBgAEAAAADIgEAAAAAABABAYABAAAABAAAAAAAAACABAGAAQAAAAURAAAAAAAAEAEBgAEAAAAGEQAAAAAAABABAYABAAAABxEAAAAAAAAQAQGAAQAAAAgRAAAAAAAAEAEBgAEAAAAJEQAAAAAAABABAYABAAAACgAAAAAAAACABAGAAQAAAAsRAAAAAAAAEAEBgAEAAAAMAAAAAAAAAIAEAYABAAAADSIBAAAAAAAQAQGAAQAAAA4RAAAAAAAAEAEBgAEAAAAPMwEBAAAAABABAYABAAAAECIBAAAAAAAQAQGAAQAAABEiAQAAAAAAEAEBgAEAAAASIgEAAAAAABABAYABAAAAEyIBAAAAAAAQAQGAAQAAABQiAQAAAAAAEAEBgAEAAAAVIgEAAAAAABABAYABAAAAFiIBAAAAAAAQAQGAAQAAABciAQAAAAAAEAEBgAEAAAAYIgEAAAAAABABAYABAAAAGSIBAAAAAAAQAQGAAQAAABoiAQAAAAAAEAEBgAEAAAAbIgEAAAAAABABAYABAAAAHCIBAAAAAAAQAQGAAQAAAB0iAQAAAAAAEAEBgAEAAAAeIgEAAAAAABABAYABAAAAHyIBAAAAAAAQAQGAAQAAACAiAQAAAAAAEAEBgAEAAAAhIgEAAAAAABABAYABAAAAIiIBAAAAAAAQAQGAAQAAACMiAQAAAAAAEAEBgAEAAAAkAAAAAAAAAIAEAYABAAAAJQAAAAAAAACABAGAAQAAACYAAAAAAAAAgAQBgAEAAAAnAAAAAAAAAIAEAYABAAAAKCIBAAAAAAAQAQGAAQAAACkiAQAAAAAAEAEBgAEAAAAqIgEAAAAAABABAYABAAAAKyIBAAAAAAAQAQGAAQAAACwiAQAAAAAAEAEBgAEAAAAtIgEAAAAAABABAYABAAAALiIBAAAAAAAQAQGAAQAAAC8iAQAAAAAAEAEBgAEAAAAwEQAAAAAAABABAYABAAAAMREAAAAAAAAQAQGAAQAAADIRAAAAAAAAEAEBgAEAAAAzEQAAAAAAABABAYABAAAANBEAAAAAAAAQAQGAAQAAADURAAAAAAAAEAEBgAEAAAA2AAAAAAAAAIAEAYABAAAANxEAAAAAAAAQAQGAAQAAADgzAgAAAAAAEAEBgAEAAAA5AAAAAAAAAIAEAYABAAAAOkQCAQAAAAAQAQGAAQAAADsAAAAAAAAAgAQBgAEAAAA8AAAAAAAAAIAEAYABAAAAPQAAAAAAAACABAGAAQAAAD4AAAAAAAAAgAQBgAEAAAA/AAAAAAAAAIAEAYABAAAAQCIBAAAAAAAQAQGAAQAAAEEiAQAAAAAAEAEBgAEAAABCIgEAAAAAABABAYABAAAAQyIBAAAAAAAQAQGAAQAAAEQiAQAAAAAAEAEBgAEAAABFIgEAAAAAABABAYABAAAARiIBAAAAAAAQAQGAAQAAAEciAQAAAAAAEAEBgAEAAABIIgEAAAAAABABAYABAAAASSIBAAAAAAAQAQGAAQAAAEoiAQAAAAAAEAEBgAEAAABLIgEAAAAAABABAYABAAAATCIBAAAAAAAQAQGAAQAAAE0iAQAAAAAAEAEBgAEAAABOIgEAAAAAABABAYABAAAATyIBAAAAAAAQAQGAAQAAAFAiAQAAAAAAEAEBgAEAAABRIgEAAAAAABABAYABAAAAUiIBAAAAAAAQAQGAAQAAAFMiAQAAAAAAEAEBgAEAAABUIgEAAAAAABABAYABAAAAVSIBAAAAAAAQAQGAAQAAAFYiAQAAAAAAEAEBgAEAAABXIgEAAAAAABABAYABAAAAWCIBAAAAAAAQAQGAAQAAAFkiAQAAAAAAEAEBgAEAAABaIgEAAAAAABABAYABAAAAWyIBAAAAAAAQAQGAAQAAAFwiAQAAAAAAEAEBgAEAAABdIgEAAAAAABABAYABAAAAXiIBAAAAAAAQAQGAAQAAAF8iAQAAAAAAEAEBgAEAAABgIgEAAAAAABABAYABAAAAYSIBAAAAAAAQAQGAAQAAAGIiAQAAAAAAEAEBgAEAAABjIgEAAAAAABABAYABAAAAZCIBAAAAAAAQAQGAAQAAAGUiAQAAAAAAEAEBgAEAAABmIgEAAAAAABABAYABAAAAZyIBAAAAAAAQAQGAAQAAAGgiAQAAAAAAEAEBgAEAAABpIgEAAAAAABABAYABAAAAaiIBAAAAAAAQAQGAAQAAAGsiAQAAAAAAEAEBgAEAAABsIgEAAAAAABABAYABAAAAbSIBAAAAAAAQAQGAAQAAAG4iAQAAAAAAEAEBgAEAAABvIgEAAAAAABABAYABAAAAcDMBAQAAAAAQAQGAAQAAAHEzAQEAAAAAEAEBgAEAAAByMwEBAAAAABABAYABAAAAczMBAQAAAAAQAQGAAQAAAHQiAQAAAAAAEAEBgAEAAAB1IgEAAAAAABABAYABAAAAdiIBAAAAAAAQAQGAAQAAAHcRAAAAAAAAEAEBgAEAAAB4AAAAAAAAAMAEAYABAAAAeSIBAAAAAAAQAQGAAQAAAHoAAAAAAAAAgAQBgAEAAAB7AAAAAAAAAIAEAYABAAAAfCIBAAAAAAAQAQGAAQAAAH0iAQAAAAAAEAEBgAEAAAB+IgEAAAAAABABAYABAAAAfyIBAAAAAAAQAQGAAQAAAIBVEAAAAAAAEAEBgAEAAACBVRAAAAAAABABAYABAAAAglUQAAAAAAAQAQGAAQAAAINVEAAAAAAAEAEBgAEAAACEVRAAAAAAABABAYABAAAAhVUQAAAAAAAQAQGAAQAAAIZVEAAAAAAAEAEBgAEAAACHVRAAAAAAABABAYABAAAAiFUQAAAAAAAQAQGAAQAAAIlVEAAAAAAAEAEBgAEAAACKVRAAAAAAABABAYABAAAAi1UQAAAAAAAQAQGAAQAAAIxVEAAAAAAAEAEBgAEAAACNVRAAAAAAABABAYABAAAAjlUQAAAAAAAQAQGAAQAAAI9VEAAAAAAAEAEBgAEAAACQIgEAAAAAABABAYABAAAAkSIBAAAAAAAQAQGAAQAAAJIiAQAAAAAAEAEBgAEAAACTIgEAAAAAABABAYABAAAAlCIBAAAAAAAQAQGAAQAAAJUiAQAAAAAAEAEBgAEAAACWIgEAAAAAABABAYABAAAAlyIBAAAAAAAQAQGAAQAAAJgiAQAAAAAAEAEBgAEAAACZIgEAAAAAABABAYABAAAAmiIBAAAAAAAQAQGAAQAAAJsiAQAAAAAAEAEBgAEAAACcIgEAAAAAABABAYABAAAAnSIBAAAAAAAQAQGAAQAAAJ4iAQAAAAAAEAEBgAEAAACfIgEAAAAAABABAYABAAAAoBEAAAAAAAAQAQGAAQAAAKERAAAAAAAAEAEBgAEAAACiEQAAAAAAABABAYABAAAAoyIBAAAAAAAQAQGAAQAAAKQzAQEAAAAAEAEBgAEAAAClIgEAAAAAABABAYABAAAApiIBAAAAAAAQAQGAAQAAAKciAQAAAAAAEAEBgAEAAACoEQAAAAAAABABAYABAAAAqREAAAAAAAAQAQGAAQAAAKoRAAAAAAAAEAEBgAEAAACrIgEAAAAAABABAYABAAAArDMBAQAAAAAQAQGAAQAAAK0iAQAAAAAAEAEBgAEAAACuIgEAAAAAABABAYABAAAAryIBAAAAAAAQAQGAAQAAALAiAQAAAAAAEAEBgAEAAACxIgEAAAAAABABAYABAAAAsiIBAAAAAAAQAQGAAQAAALMiAQAAAAAAEAEBgAEAAAC0IgEAAAAAABABAYABAAAAtSIBAAAAAAAQAQGAAQAAALYiAQAAAAAAEAEBgAEAAAC3IgEAAAAAABABAYABAAAAuCIBAAAAAAAQAQGAAQAAALkAAAAAAAAAgAQBgAEAAAC6MwEBAAAAABABAYABAAAAuyIBAAAAAAAQAQGAAQAAALwiAQAAAAAAEAEBgAEAAAC9IgEAAAAAABABAYABAAAAviIBAAAAAAAQAQGAAQAAAL8iAQAAAAAAEAEBgAEAAADAIgEAAAAAABABAYABAAAAwSIBAAAAAAAQAQGAAQAAAMIzAQEAAAAAEAEBgAEAAADDIgEAAAAAABABAYABAAAAxDMBAQAAAAAQAQGAAQAAAMUzAQEAAAAAEAEBgAEAAADGMwEBAAAAABABAYABAAAAxyIBAAAAAAAQAQGAAQAAAMgRAAAAAAAAEAEBgAEAAADJEQAAAAAAABABAYABAAAAyhEAAAAAAAAQAQGAAQAAAMsRAAAAAAAAEAEBgAEAAADMEQAAAAAAABABAYABAAAAzREAAAAAAAAQAQGAAQAAAM4RAAAAAAAAEAEBgAEAAADPEQAAAAAAABABAYABAAAA0CIBAAAAAAAQAQGAAQAAANEiAQAAAAAAEAEBgAEAAADSIgEAAAAAABABAYABAAAA0yIBAAAAAAAQAQGAAQAAANQiAQAAAAAAEAEBgAEAAADVIgEAAAAAABABAYABAAAA1iIBAAALine truncated
@@ -0,0 +1,9 @@
# EF-Cheeto binary section: .pdata
# RVA: 0x3c8000
# Size: 28,160 bytes
# Raw offset in original DLL: 0x3c4200
# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__pdata.b64').read().split('\n',5)[-1])
# ImageBase: 0x180000000
# VA = ImageBase + RVA
EBAAAOYYAAA86TsA8BgAABwZAADMWDsAQBkAAAwaAABEATwAEBoAANwaAABEATwA4BoAAKwbAABEATwAsBsAAHwcAABEATwAgBwAAEwdAABEATwAUB0AABweAABEATwAIB4AAOweAABEATwA8B4AALwfAABEATwAwB8AAIwgAABEATwAkCAAAFwhAABEATwAYCEAAI0hAADMWDsAoCEAAJYiAABgVjsAoCIAAHokAAD0VjsAgCQAAKAkAABIVzsAoCQAAMclAABUVzsAxyUAANElAAB0VzsA0SUAAN4lAACEVzsA4CUAAFImAACkVzsAYCYAAH8mAADAVzsAfyYAALsmAADIVzsAuyYAAMEmAADcVzsA0CYAAD0nAADsVzsAPScAAE4nAAAIWDsATicAAJknAAAcWDsAmScAAKonAAAwWDsAqicAAOgpAABAWDsA8CkAAD0sAABQWDsAPSwAAG0tAABkWDsAbS0AACwuAAB8WDsAMC4AAAgvAACMWDsAEC8AADw2AACoWDsAQDYAALw3AADMWDsAwDcAAPI3AADUWDsA8jcAAA07AADoWDsADTsAACI7AAAIWTsAIjsAAGM7AAAYWTsAYzsAAGg7AAAIWTsAaDsAANA7AAAYWTsA0DsAAO47AAA4WTsA8DsAAJQ+AADMWDsAoD4AAFdAAABAWTsAYEAAAOpAAACQWTsA8EAAAFdHAACgWTsAYEcAAKpKAAD4WTsAsEoAAAdRAAA0WjsAEFEAAGdXAAA0WjsAcFcAAJFXAAB4WjsAkVcAAKVXAACQWjsApVcAAOVXAACkWjsA5VcAAPNXAAC4WjsA81cAAHBYAADIWjsAcFgAAP5YAADYWjsA/lgAAHtaAAD0WjsAe1oAAJ1aAAAIWzsAoFoAANlaAAAYWzsA2VoAAHJbAAAoWzsAclsAAJ5bAABAWzsAoFsAAAZdAABQWzsAEF0AAKpeAABQWzsAsF4AAJhiAABcWzsAoGIAAJdkAACsWzsAoGQAAOhoAADcWzsA8GgAABdrAAAwXDsAIGsAAFhvAABgXDsAYG8AAKhzAACgXDsAsHMAANd1AADgXDsA4HUAABh6AAAQXTsAIHoAAN96AABQXTsA33oAAJl7AABoXTsAmXsAALZ7AAB8XTsAwHsAAN57AACMXTsA3nsAADl8AACcXTsAOXwAAE18AACwXTsAUHwAAH18AADAXTsAfXwAAIJ9AADcXTsAgn0AAPl9AAD0XTsAAH4AADx+AAAEXjsAPH4AAKZ/AAAkXjsApn8AACSAAAA4XjsAJIAAAEiAAABIXjsAUIAAABeCAABcXjsAIIIAAFyCAACAXjsAXIIAAJqDAACQXjsAmoMAAKCDAACwXjsAoIMAAM2DAADAXTsAzYMAANKEAADAXjsA0oQAAEmFAADYXjsAUIUAAH2FAADAXTsAfYUAAIKGAADoXjsAgoYAAPmGAAAAXzsAAIcAAC2HAADAXTsALYcAADKIAAAQXzsAMogAAKmIAAAoXzsAsIgAAAqMAAA4XzsAEIwAACSNAABcXzsAMI0AAEGNAADMWDsAUI0AAGSOAABcXzsAcI4AAIGOAADMWDsAkI4AAKeQAABkXzsAsJAAAP6QAAB8XzsA/pAAAKKSAACQXzsAopIAAP+SAACkXzsAAJMAAE2TAAC0XzsATZMAAM6UAADIXzsAzpQAACuVAADcXzsAMJUAAEuXAADsXzsAUJcAALOXAAAEYDsAs5cAALuXAAAcYDsAu5cAACeZAAAwYDsAJ5kAAK+ZAABQYDsAr5kAALyZAABkYDsAvJkAAFeaAAB0YDsAV5oAAHaaAACQYDsAgJoAAGCcAACgYDsAYJwAANmcAAC4YDsA2ZwAAFadAADEYDsAVp0AAH6dAADYYDsAfp0AADSeAADsYDsAQJ4AALKeAAD8YDsAsp4AAC+fAAAIYTsAL58AAFefAAAcYTsAV58AAKOgAAAwYTsAsKAAAK+mAABAYTsAsKYAAByoAABcYTsAHKgAAGitAABwYTsAcK0AAAWuAACEYTsABa4AAFiuAACQYTsAWK4AADCvAACkYTsAMK8AAKGvAAC4YDsAoa8AAB2wAAC4YTsAHbAAAEWwAADMYTsARbAAAHCwAADgYTsAcLAAAFm1AADwYTsAYLUAADW2AAAIYjsAQLYAAEi2AAAcYjsASLYAAFu2AAAkYjsAW7YAAK62AAA4YjsArrYAALi2AABQYjsAuLYAAOC2AABgYjsA4LYAAOW3AABwYjsA8LcAAIu/AACAYjsAkL8AAPO/AACcYjsA878AAPu/AAC0YjsA+78AACfBAADIYjsAJ8EAAK/BAADoYjsAr8EAALvBAAD8YjsAu8EAAFbCAAAMYzsAVsIAAHXCAAAoYzsAgMIAANjDAAA4YzsA2MMAAPjDAABMYzsA+MMAADDEAABgYzsAMMQAAI3EAAC4YDsAjcQAAAfFAABwYzsAB8UAAC/FAACEYzsAL8UAAO3FAACYYzsA8MUAAPvHAACoYzsAAMgAAFrIAADAYzsAWsgAANfIAADMYzsA18gAAAPJAADgYzsAA8kAADnKAAD0YzsAQMoAAM7PAAAEZDsAQNAAAEHRAABwYjsAUNEAAOrRAAAcZDsA8NEAAHXSAAAoZDsAddIAAC/TAABEZDsAL9MAACbUAABYZDsAMNQAANLXAABoZDsA4NcAAEvYAAB8ZDsAS9gAANHYAACMZDsA0dgAAOXYAACkZDsA8NgAADjZAAC0ZDsAONkAAMLZAADAZDsAwtkAAOnZAADUZDsA6dkAAHLaAADoZDsAgNoAAODaAAAAZTsAANsAAD7bAAAMZTsAQNsAAH7bAAAMZTsAgNsAAL7bAAAMZTsAwNsAAPjbAAAUZTsAANwAAPfdAAAcZTsAAN4AAAXfAAB4ZTsAEN8AADzfAAC4ZTsAPN8AAJbfAADAZTsAlt8AANPfAADUZTsA098AAPHfAADUZTsA8d8AAJjgAADoZTsAmOAAAKjgAAAEZjsAqOAAAMTgAADUZTsA0OAAADThAAAgZjsAYOEAAKPhAAAAZTsAsOEAAO3hAAAUZTsA8OEAABPiAAAwZjsAIOIAAHLjAAA4ZjsAgOMAAJ/jAADAVzsAn+MAAMrjAABsZjsAyuMAANzjAACAZjsA4OMAAE3kAAAMZTsAUOQAAHDmAAC4ZjsAcOYAAMPnAADwZjsA0OcAAOLnAADMWDsA8OcAAGfoAAAgZzsAoOgAAN3oAAAUZTsA4OgAAADpAAAwZjsAIOkAAFLpAADMWDsAYOkAAJXpAACQWTsAlekAAPTpAAAwZzsA9OkAADPqAABEZzsAM+oAAEjqAABYZzsAUOoAAG/qAABoZzsAb+oAAMXqAAB0ZzsAxeoAAATrAACIZzsAEOsAAHzrAACYZzsAfOsAALrrAACoZzsAuusAAOrrAAC8ZzsAEOwAAEfsAADMZzsAUOwAAIDsAADUZzsAgOwAAJPtAADkZzsAk+0AAJntAAAEaDsAoO0AAFPuAAAUaDsAYO4AAJnuAADMZzsAoO4AALzuAAAoaDsAvO4AAKzvAAA0aDsArO8AALXvAABQaDsAte8AALvvAABgaDsAwO8AAATwAAB4aDsABPAAACjwAACIaDsAKPAAAIHwAACgaDsAgfAAAAfxAAC0aDsAB/EAAA3xAADEaDsAIPIAAE7yAADYaDsATvIAAIXzAADoaDsAhfMAAIvzAAAEaTsAi/MAAJHzAAAUaTsAoPMAAMHzAAAUZTsA8PMAAIf0AAAsaTsAoPQAAO70AAAMZTsA8PQAAGP1AABcaTsAoPUAAN/1AAAMZTsAAPYAADj2AAB4aTsAOPYAAEj3AACIaTsASPcAAE73AACkaTsAUPcAAHP3AAC0aTsAc/cAALL3AADAaTsAsvcAAND3AADUaTsA0PcAAI/4AACMXTsAkPgAANP4AAAAZTsA4PgAADj5AAAAZTsAQPkAAI75AAAAZTsAkPkAAM35AAAUZTsA0PkAAEP6AAAMZTsAYPoAANL6AAAMZTsA8PoAAAL7AADMWDsAQPsAAH37AAAUZTsAgPsAAL37AAAUZTsA4PsAABP8AAAUZTsAIPwAAED8AAAwZjsAQPwAAKb8AAA4WTsAsPwAAPr8AADkaTsA+vwAAE/9AAD0aTsAT/0AAFX9AAAIajsAYP0AAJf9AAAUZTsAoP0AAHb/AAAYajsAgP8AAL7/AAB8ajsAwP8AAOT/AACYajsA8P8AAE8AAQCwajsATwABAOwAAQDAajsA7AABAAYBAQDUajsABgEBAAwBAQDoajsAEAEBAGEDAQD4ajsA4AUBAF0GAQAAZTsAcAcBAI0HAQAUZTsAjQcBAAoIAQAUazsACggBABAIAQAoazsAEAgBACwIAQA4azsAUAgBAKIIAQBQazsAsAgBAAIJAQBcazsAEAkBAJYJAQBoazsAsAkBADQLAQCEazsAQAsBAIYMAQC0azsAkAwBAC0OAQDUazsAUA4BAP4QAQAUZTsAABEBADwTAQAAZTsAQBMBAPoTAQDoazsAABQBALwUAQDwazsAwBQBAEsVAQAUZTsAUBUBAHQVAQAwZjsAdBUBAEQXAQAAbDsARBcBAEkXAQAYbDsAUBcBAHYXAQAwZjsAdhcBAMIYAQAobDsAwhgBAMcYAQA8bDsA0BgBAPgYAQBMbDsA+BgBANkaAQBYbDsA2RoBAOQaAQB0bDsA8BoBAMEbAQCEbDsA0BsBAEccAQCMbDsAUBwBAG0cAQCcbDsAcBwBADwdAQCkbDsAPB0BAJodAQC0bDsAmh0BAMgdAQDQbDsAyB0BAOEdAQDobDsA8B0BAJgeAQD4bDsAoB4BAEQgAQAAbTsAUCABAOIhAQBEbTsA8CEBAJwjAQBcbTsAECUBAGQlAQB4bTsAZCUBALAmAQCIbTsAsCYBAMgmAQCcbTsA0CYBAFsnAQCsbTsAYCcBANEnAQD4bDsA4CcBAIcLine truncated
@@ -0,0 +1,9 @@
# EF-Cheeto binary section: .rdata_cheat
# RVA: 0x3A0000
# Size: 81,920 bytes
# Raw offset in original DLL: 0x39e600
# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__rdata_cheat.b64').read().split('\n',5)[-1])
# ImageBase: 0x180000000
# VA = ImageBase + RVA
qWsACqp6AAqriAAKrOMACq4bAAqvAYIDJ80ACrDZAAqygo8kswMACrSCqzC1yAAKt7oACrkcAAq6QQAKvIIDIL2Cxzi+PgAKvycACsCHAArB0gAKw/wACsTzAArFgncox1QACsiTAArKgjMsyyQACsxRAArNRwAKzoJzNM+nAArQ/wAK0hEACtNXAArUhgAK1YK3LNbBAArXnQAK2L8ACtqCGzTb9gAK3hQACuAHAArhYgAK4zkACuSCLzDlwwAK5t0ACuiDAArqWAAK64I7CFTtXwAK7jMACu98AArwywAK8gIACvOaAAr1CAAK9jQACvcXAAr4iQAK+mcACvx1AAr90QALAGkACwHcAAsC1QALBB4ACwVzAAsHJQALCF0ACwm1AAsLgh8xDKcACw3LAAsQKQALEaQACxMOggMIJ/0ACxYJAAsX7AALGiQACxtJAAsc2AALHskACyBqAAsiSAALI/UACyWCHwgwKBcACylHAAsqxwALLRQACy4zAAsvcQALMIoACzKDAAszlAALNKoACzZmAAs4AAALOYIrLDqrAAs8DgALPbMACz+CFyBAgp88QuQAC0QHAAtGLQALSBAAC0myAAtLQgALTSgAC06CBzBPjQALUaUAC1NSAAtUxQALVoIzIFmCQyxadAALW+8AC14DAAtfgsMkYNQAC2KC1wg4ZNYAC2aiAAtn8AALaVQAC2uQAAtufAALcQYAC3OCAAt0VgALdV4AC3ZAAAt3NwALeEIAC3lVAAt6gjsse7kAC3zpAAt+IgALf4J3JIC/AAuBgg8gg4LHMIS3AAuGPgALh10AC4iMAAuJghssixMAC4xaAAuOLAALj4JjIJGCwwhEko8AC5PjAAuV0AALl1gAC5lBAAubDAALnJYAC50bAAueGAALnwEAC6A1AAuhFwALoh0AC6MlAAukpgALpeUAC6bAAAungjcsp9oAC6haAAupTAALqoK7IKuCKymr7gALrRIAC64yggMv0wALr4YAC7BOAAuxiQALsoLTJLNmAAu0gk8ktWQAC7aCwyy3hwALuC4AC7lxAAu6gr8ou6IAC7zcAAu+gis4v7IAC8C0AAvBrAALwrUAC8OdAAvEwQALxYJ3JccOAAvIGoIDJ+gAC8o7AAvLgn8wzEsAC805AAvOeQAL0CEAC9GCgwgk0gUAC9NMAAvU0QAL1bwAC9b5AAvX3QAL2TAAC9okAAvboQAL3IJDLN29AAvelAAL33wAC+CCmwg04TgAC+JlAAvj2wAL5KcAC+VwAAvmdQAL554AC+hhAAvpVwAL6n4AC+tsAAvsQwAL7WoAC+6CJwgh72YAC/A+AAvxfwAL8xEAC/SkAAv1wwAL9qsAC/fUAAv5EoIDCCTkAAv6sQAL+9kAC/1EAAv+kwAL/7UADACbAAwBrgAMAwYADAQYggMIM/YADAZBAAwHFQAMCFUADAk/AAwKYwAMC1kADAy5AAwN6wAMDwoADBBnAAwRTwAMEk4ADBOCHwhMFC0ADBV3AAwWyAAMGAAADBkuAAwaoQAMHDsADB3WAAwe8wAMIEkADCF+AAwinAAMJFEADCU8AAwmeQAMJ70ADCkTAAwqIAAMK3sADC2CPwgwLf4ADC8iAAwwXQAMMaIADDLAAAw0QgAMNXgADDZWAAw3cgAMOLMADDmkAAw6rAAMPIJ/MD2+AAw+pgAMP8kADEClAAxBglcgQoLPIESCdyhFdQAMRpAADEeCwzRJQwAMSnwADEvlAAxNCQAMTjoADE+C6zhQtgAMUbQADFLFAAxT/QAMVXMADFcmAAxYgnM8WY4ADFrVAAxcMQAMXcEADF9MAAxgMwAMYUcADGKCsyBjghswZSUADGYqAAxnBwAMaGoADGmC5yhq4QAMbCkADG2CVyhvEgAMcEEADHGC+zRy2wAMc8QADHU0AAx2ugAMeA4ADHmCBzB7PAAMfR4ADH4TAAx/gwAMgILHKIIsAAyDgQAMhYJXIIaCyyyHywAMiTAADIqSAAyMgr8ojR0ADI4UAAyPgmckkCsADJGCAwggkrsADJPWAAyVAAAMlkUADJeGAAyZAQAMmm4ADJvTAAydgksIIJ4ZAAyfqgAMoO4ADKICAAyjqQAMpJsADKXlAAyndgAMqYIjIKqCLwhcrCcADK5tAAyvyAAMsNQADLI7AAyzmgAMtLcADLYYAAy3YAAMuMcADLoLAAy7VQAMvPcADL6TAAzAlgAMwe0ADMPmAAzE+wAMxk8ADMdnAAzIxQAMylIADMvOAAzNgusgzoL3CDjQGgAM0jkADNNZAAzUvgAM1e8ADNc4AAzYygAM2jEADNvnAAzdWAAM3qEADOBwAAzh8AAM4y4ADOSCZyzmNAAM59EADOjkAAzqgj8g64KbOOzZAAzuTQAM8B0ADPFlAAzzNwAM9QkADPaCewiY+LkADPpGAAz70gAM/YAADP7lAA0APwANAgsADQNLAA0E3AANBhwADQfHAA0J6AANC50ADQ0lAA0PRgANEMMADRI8AA0UIgANFZEADRc1AA0YwQANGiMADRtmAA0c/QANHnUADSCgAA0iIQANI4sADSTnAA0mpAANJ+wADSnfAA0rEQANLFUADS4gAA0vjAANMMUADTJ+AA0zgncwNaIADTdHAA04uAANOh8ADTyCIyQ+GwANQIKPKEGaAA1DBAANRYILCDBHQwANSL0ADUqnAA1MSgANTmMADVADAA1RcAANU8wADVXAAA1XeQANWWUADVtaAA1dgn8oX1YADWDTAA1igjcoZOMADWapAA1ogtsgaoL7IGyCRwgtbrEADXAtAA1yOAANdNkADXafAA15EAANe1AADX0AAA1/HgANgPIADYGJAA2CF4IDgqMkg5AADYSC9zCFQQANhhUADYdAAA2IJwANiYIvLIpMAA2LWAANjEYADY2CSzyPLAANkEkADZGRAA2SpgANlAsADZVyAA2W3QANmIIzIJmCXySaWQANm4KXPJ0TAA2eVwANn9sADaEaAA2iMQANo5MADaU9AA2mgsMgqIJvJKoqAA2qgus5q9EADa0YAA2uSAANryUADbAdAA2xxQANs3OCAyPVAA20gtcsth8ADbd7AA24nQANuYK3CCS6MAANusQADbuyAA28pQANvXEADb5iAA2/agANwGsADcGuAA3Cghs4xQUADcXHAA3HEAANyL8ADcn9AA3LeQANzYKrKM5zAA3P2QAN0YJzJNJfAA3Ugs801WAADddRAA3ZBAAN2lIADdsrAA3cgtMh3KiCByj7AA3dZAAN3jiCA4JzJN9cAA3ggisg4YInLeJGAA3iwAAN4zwADeQBggMkoAAN5RSCAyfLAA3m1AAN54I/Keh+AA3pewAN6jGCAzD0AA3reAAN7FUADe0kAA3uKoIDgiMk71sADfCCPyTw5AAN8YIvJPI/AA3zgrsp86wADfQ1AA31PYIDJ+sADfZlAA33gq8g+IJjKfk+AA36XQAN+xqCAyOuAA39gi8l/fUADf9FggMIP+sADgDQAA4BxQAOAroADgQ7AA4FcgAOBkcADgcaAA4IDAAOCVcADgosAA4LfwAODIkADg2qAA4OUwAOD2wADhCCGygRJwAOEj8ADhOCIwgpFBsADhTRAA4V5QAOFtsADhfiAA4Y+AAOGdQADhrxAA4b8AAOHOYADh4ZggMj5wAOIII7MCESAA4iBgAOI2UADiTVAA4mgkskJ1kADiiCWwg0KZIADiquAA4sHAAOLQ0ADi4vAA4vNAAOMKgADjKjAA4zqgAONSEADjZwAA435QAOOVgADjuCIyU8kwAOPqCCAyvqAA4/cQAOQGsADkGCVwglQjEADkL1AA5D2AAORL8ADkWHAA5GdwAOR3UADkh0AA5JfAAOSh2CAyPTAA5MglcwTUgADk6dAA5PxwAOUPoADlKCqyBTghcgVIJjLVU1AA5WVgAOWCkADlotggMkjQAOWwKCA4JrIFuCiyVcvgAOXUmCAyPWAA5egscgX4J7KWAFAA5hCAAOYhaCAyPjAA5jgoclZUQADmYsggM3yAAOZ9EADmikAA5pyQAOapEADmsjAA5sglMwbOYADm3pAA5u5AAOb3MADnCCrwgkcRAADnGaAA5ytgAOc34ADnSxAA51jAAOdn8ADnemAA54WwAOeYKfKXoGAA56rAAOe0qCAyf4AA58/QAOfoJ/JH8wAA6Agnc1gTgADoI5AA6DVwAOhGUADoUBAA6GH4IDJOoADogdggMz4AAOidwADorCAA6LZgAOjE8ADo2C1zSODgAOjvsADpA6AA6RbgAOkkIADpOCdziUxgAOlf4ADpayAA6XdwAOmGAADplTAA6agqMkm7QADpyCpzGd0wAOnt0ADp/XAA6giQAOoTWCAzPwAA6jOwAOpLwADqXRAA6mlgAOp4KTOagTAA6ouAAOqZ0ADqpGAA6rQAAOrGEADq0JggOCPyCugnMIKK+GAA6wjgAOsUcADrJ2AA6zmAAOtHoADrV7AA629gAOuFsADrlrAA66ghcgu4JHJbzyAA6+G4IDI+wADr+CAyDAgnMIJMHkAA7CvgAOw9YADsSlAA7FZQAOxnMADsciAA7IiAAOyW8ADsqCYwghy88ADsyVAA7NzAAOzrUADs+6AA7Q6gAO0eYADtMEAA7UAYIDLK4ADtYvAA7XlwAO2UOCAyvpAA7bAwAO3B0ADt2CDyjd9AAO3sUADt+CPyDhghc44b8ADuJxAA7jJgAO5F8ADuUrAA7mtwAO54I/NOhqAA7plAAO6rIADuv9AA7s+wAO7YKzCEHuyAAO7/UADvFEAA7yZgAO87UADvVUAA72WAAO94kADvjGAA75lgAO+mQADvuBAA78vQAO/hMADv8MAA8ADgAPARWCAz/aAA8C+wAPBFgADwWiAA8HGAAPCJ0ADwoGAA8LCQAPDIIjCEANKQAPDjgADw+IAA8QqgAPEfwADxLxAA8UFwAPFXkADxbGAA8X0AAPGMIADxo7AA8Line truncated
@@ -0,0 +1,9 @@
# EF-Cheeto binary section: .rdata_iat
# RVA: 0xB1000
# Size: 4,096 bytes
# Raw offset in original DLL: 0xaf600
# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__rdata_iat.b64').read().split('\n',5)[-1])
# ImageBase: 0x180000000
# VA = ImageBase + RVA
Vj48AAAAAAAAAAAAAAAAAPY0PAAAAAAABjU8AAAAAAAAAAAAAAAAAPY9PAAAAAAAKD48AAAAAAA8PjwAAAAAAA4+PAAAAAAAAAAAAAAAAACwLDwAAAAAAMAsPAAAAAAA0Cw8AAAAAADgLDwAAAAAAPQsPAAAAAAADC08AAAAAAAgLTwAAAAAADAtPAAAAAAAQi08AAAAAABQLTwAAAAAAGYtPAAAAAAAfC08AAAAAACKLTwAAAAAAJgtPAAAAAAApi08AAAAAAC8LTwAAAAAAMwtPAAAAAAA4C08AAAAAADyLTwAAAAAAAIuPAAAAAAAHi48AAAAAAAwLjwAAAAAAEYuPAAAAAAAYC48AAAAAABwLjwAAAAAAIYuPAAAAAAAli48AAAAAACoLjwAAAAAALouPAAAAAAAyC48AAAAAADmLjwAAAAAAAAvPAAAAAAACC88AAAAAAAYLzwAAAAAAC4vPAAAAAAASi88AAAAAABkLzwAAAAAAHwvPAAAAAAAkC88AAAAAACsLzwAAAAAAL4vPAAAAAAA4C88AAAAAACKLDwAAAAAAPovPAAAAAAACjA8AAAAAAAaMDwAAAAAACgwPAAAAAAANDA8AAAAAABCMDwAAAAAAFAwPAAAAAAAAkU8AAAAAADuRDwAAAAAANJEPAAAAAAAvkQ8AAAAAACgRDwAAAAAAIREPAAAAAAAcEQ8AAAAAABWRDwAAAAAAEJEPAAAAAAAJkQ8AAAAAAAKRDwAAAAAAPBDPAAAAAAA1kM8AAAAAADEQzwAAAAAALJDPAAAAAAAoEM8AAAAAACUQzwAAAAAAJosPAAAAAAAdiw8AAAAAABoLDwAAAAAAO4vPAAAAAAAViw8AAAAAABCLDwAAAAAABxFPAAAAAAAzC88AAAAAAAAAAAAAAAAAJA8PAAAAAAAajw8AAAAAAAyPDwAAAAAANw7PAAAAAAAxDs8AAAAAACuOzwAAAAAAFo7PAAAAAAA6jw8AAAAAABCPTwAAAAAAJg9PAAAAAAAvDw8AAAAAAAWOzwAAAAAANo6PAAAAAAAQDU8AAAAAABiNTwAAAAAAII1PAAAAAAAoDU8AAAAAADCNTwAAAAAAAI2PAAAAAAATjY8AAAAAACENjwAAAAAAKo2PAAAAAAAxjY8AAAAAADgNjwAAAAAAAA3PAAAAAAAHDc8AAAAAAA8NzwAAAAAAF43PAAAAAAAkjc8AAAAAACwNzwAAAAAANw3PAAAAAAAAjg8AAAAAAAcODwAAAAAAEI4PAAAAAAAbjg8AAAAAACcODwAAAAAAMI4PAAAAAAAAjk8AAAAAAA+OTwAAAAAAIA5PAAAAAAAojk8AAAAAADCOTwAAAAAAAA6PAAAAAAARDo8AAAAAACMOjwAAAAAAKw6PAAAAAAAuDo8AAAAAADGOjwAAAAAAAAAAAAAAAAA/js8AAAAAAAAAAAAAAAAACQ1PAAAAAAAAAAAAAAAAADANDwAAAAAAKQ0PAAAAAAAmDQ8AAAAAACENDwAAAAAANw0PAAAAAAAcjQ8AAAAAABiNDwAAAAAAFI0PAAAAAAANjQ8AAAAAAAoNDwAAAAAABQ0PAAAAAAAljA8AAAAAAC6MDwAAAAAAAA0PAAAAAAA7DM8AAAAAADcMzwAAAAAAMwzPAAAAAAAuDM8AAAAAACsMzwAAAAAAJozPAAAAAAAyjA8AAAAAADaMDwAAAAAAOYwPAAAAAAA9jA8AAAAAAACMTwAAAAAABgxPAAAAAAAKjE8AAAAAACoMDwAAAAAAIgzPAAAAAAAdjM8AAAAAABgMzwAAAAAAG4wPAAAAAAAUjM8AAAAAAA8MzwAAAAAADAzPAAAAAAAIDM8AAAAAAAYMzwAAAAAAIIwPAAAAAAACDM8AAAAAAD0MjwAAAAAAOAyPAAAAAAAPDE8AAAAAABSMTwAAAAAAGIxPAAAAAAAdDE8AAAAAACAMTwAAAAAAI4xPAAAAAAAnDE8AAAAAACwMTwAAAAAALwxPAAAAAAA2jE8AAAAAADmMTwAAAAAAPwxPAAAAAAAEDI8AAAAAAAiMjwAAAAAACwyPAAAAAAAPjI8AAAAAABQMjwAAAAAAF4yPAAAAAAAbDI8AAAAAAB+MjwAAAAAAJIyPAAAAAAApjI8AAAAAAC4MjwAAAAAAMoyPAAAAAAAAAAAAAAAAACgPzwAAAAAAII/PAAAAAAAYj88AAAAAABYPzwAAAAAAE4/PAAAAAAARD88AAAAAAA6PzwAAAAAACI/PAAAAAAAFj88AAAAAAAyRTwAAAAAAPw+PAAAAAAA5D48AAAAAADSPjwAAAAAALY/PAAAAAAAbD88AAAAAAAAAAAAAAAAALw+PAAAAAAAAAAAAAAAAABKQTwAAAAAAGJBPAAAAAAAPkE8AAAAAAAEQTwAAAAAAAAAAAAAAAAAZEA8AAAAAACCQTwAAAAAADxAPAAAAAAAIkA8AAAAAAAAAAAAAAAAAFRBPAAAAAAAbEE8AAAAAAAAAAAAAAAAAEZAPAAAAAAAWkA8AAAAAACMRTwAAAAAAH5FPAAAAAAAhEU8AAAAAAB2RTwAAAAAAFJFPAAAAAAAkkU8AAAAAABGRTwAAAAAADxFPAAAAAAAUEA8AAAAAABmRTwAAAAAAKJFPAAAAAAAbkU8AAAAAACaRTwAAAAAAF5FPAAAAAAAAAAAAAAAAACgQTwAAAAAALpBPAAAAAAA3EE8AAAAAACOQTwAAAAAADRBPAAAAAAA+EE8AAAAAAAUQjwAAAAAAFxCPAAAAAAAUEI8AAAAAABEQjwAAAAAADpCPAAAAAAA/D88AAAAAAAsQjwAAAAAAAAAAAAAAAAANEA8AAAAAAAqQDwAAAAAABhAPAAAAAAADkA8AAAAAAAMQTwAAAAAAOpAPAAAAAAAxkA8AAAAAACSQDwAAAAAAHhAPAAAAAAAgEA8AAAAAACaQDwAAAAAANBAPAAAAAAAAAAAAAAAAAC8QDwAAAAAAG5APAAAAAAAqkU8AAAAAAAqQTwAAAAAAAAAAAAAAAAAGEE8AAAAAAAAAAAAAAAAALRAPAAAAAAAAAAAAAAAAAAYLDwAAAAAAAAAAAAAAAAAeD48AAAAAACYPjwAAAAAAAAAAAAAAAAAYAcBgAEAAABgBwGAAQAAADDKCoABAAAAUMoKgAEAAABQygqAAQAAAAAAAAAAAAAAZMgKgAEAAAAAAAAAAAAAAJAhAIABAAAAABAAgAEAAAAQEACAAQAAAPAYAIABAAAAIBkAgAEAAAAwGQCAAQAAAEAZAIABAAAAEBoAgAEAAADgGgCAAQAAALAbAIABAAAAgBwAgAEAAABQHQCAAQAAACAeAIABAAAA8B4AgAEAAADAHwCAAQAAAJAgAIABAAAAYCEAgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAABAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIQB4AC0AcwB5AHMALQBkAGUAZgBhAHUAbAB0AC0AbABvAGMAYQBsAGUAAAAAAAAAAAECAwQFBgcBAgMEBQYHBwACAwQFBgcHAgMEBQYHBgcAAQMEBQYHBwEDBAUGBwYHAAMEBQYHBgcDBAUGBwUGBwABAgQFBgcHAQIEBQYHBgcAAgQFBgcGBwIEBQYHBQYHAAEEBQYHBgcBBAUGBwUGBwAEBQYHBQYHBAUGBwQFBgcAAQIDBQYHBwECAwUGBwYHAAIDBQYHBgcCAwUGBwUGBwABAwUGBwYHAQMFBgcFBgcAAwUGBwUGBwMFBgcEBQYHAAECBQYHBgcBAgUGBwUGBwACBQYHBQYHAgUGBwQFBgcAAQUGBwUGBwEFBgcEBQYHAAUGBwQFBgcFBgcDBAUGBwABAgMEBgcHAQIDBAYHBgcAAgMEBgcGBwIDBAYHBQYHAAEDBAYHBgcBAwQGBwUGBwADBAYHBQYHAwQGBwQFBgcAAQIEBgcGBwECBAYHBQYHAAIEBgcFBgcCBAYHBAUGBwABBAYHBQYHAQQGBwQFBgcABAYHBAUGBwQGBwMEBQYHAAECAwYHBgcBAgMGBwUGBwACAwYHBQYHAgMGBwQFBgcAAQMGBwUGBwEDBgcEBQYHAAMGBwQFBgcDBgcDBAUGBwABAgYHBQYHAQIGBwQFBgcAAgYHBAUGBwIGBwMEBQYHAAEGBwQFBgcBBgcDBAUGBwAGBwMEBQYHBgcCAwQFBgcAAQIDBAUHBwECAwQFBwYHAAIDBAUHBgcCAwQFBwUGBwABAwQFBwYHAQMEBQcFBgcAAwQFBwUGBwMEBQcEBQYHAAECBAUHBgcBAgQFBwUGBwACBAUHBQYHAgQFBwQFBgcAAQQFBwUGBwEEBQcEBQYHAAQFBwQFBgcEBQcDBAUGBwABAgMFBwYHAQIDBQcFBgcAAgMFBwUGBwIDBQcEBQYHAAEDBQcFBgcBAwUHBAUGBwADBQcEBQYHAwUHAwQFBgcAAQIFBwUGBwECBQcEBQYHAAIFBwQFBgcCBQcDBAUGBwABBQcEBQYHAQUHAwQFBgcABQcDBAUGBwUHAgMEBQYHAAECAwQHBgcBAgMEBwUGBwACAwQHBQYHAgMEBwQFBgcAAQMEBwUGBwEDBAcEBQYHAAMEBwQLine truncated
@@ -0,0 +1,9 @@
# EF-Cheeto binary section: .reloc
# RVA: 0x3d4000
# Size: 2,560 bytes
# Raw offset in original DLL: 0x3cd600
# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__reloc.b64').read().split('\n',5)[-1])
# ImageBase: 0x180000000
# VA = ImageBase + RVA
ABALADgAAAAwqTipQKlIqVCpYKlwqXipgKmIqZCpmKmgqaipsKm4qcCpyKnQqdip4KnoqfCpAAAAEA0AJAAAAGChaKFwoXihiKGQoZihoKGoobChyKHQodihAAAAQA0AuAAAADCjOKNAo0ijUKNYo2CjaKNwo4ijkKOYo6CjqKPIo9Cj2KMYpCCkKKQwpDikQKRIpFCkWKRgpGikcKR4pICkkKSYpKCkqKSwpLikwKTIpNCkGKkoqTipSKlYqWipeKmIqZipqKm4qcip2KlQqvCu+K4ArwivEK8YryCvKK8wrzivQK9Ir1CvWK9gr2ivcK94r4CviK+Qr5ivoK+or7CvuK/Ar8iv0K/Yr+Cv6K/wr/ivAFANAPwAAAAAoAigEKAYoCCgKKAwoDigQKBIoFCgWKBgoGigcKB4oICgiKCQoJigoKCooLCguKDAoMig0KDYoOCg6KDwoPigAKEIoRChGKEgoSihMKE4oUChSKFQoVihYKFooXCheKGAoYihkKGYoaChqKGwobihwKHIodCh2KHgoeih8KH4oQCiCKIQohiiIKIoojCiOKJAokiiUKJYomCiaKJwoniigKKIopCimKKgoqiisKK4osCiyKLQotii4KLoovCi+KIAowijEKMYoyCjKKMwozijQKNIo1CjWKNgo2ijcKN4o4CjiKOQo5ijoKOoo7CjuKPAo8ijAIANAFAAAADYp+Cn6Kf4pwCoCKgYqCCoKKg4qECoSKhYqGCoaKh4qICoiKiYqKCoqKi4qMCoyKjYqOCo6Kj4qACpCKkYqSCpKKk4qUCpSKkA8DoAtAAAAKCjsKPAo9Cj4KPwowCkEKQgpDCkQKRQpGCkcKQgqTCpQKlQqWCpcKnYqeCp6KnwqfipAKoIqhCqGKogqiiqMKo4qkCqSKpQqliqYKpoqnCqeKqAqriqwKrIqtCq2Krgquiq8Kr4qgCrCKtQrFisYKxorHCseKyArIiskKyYrKCsCK4QrhiuIK4orjCuOK5ArkiuUK5YrmiucK54roCuiK6QrpiuoK6orrCuuK4AADsAIAEAAGCgaKBwoHiggKCIoJCgmKCgoKigsKAIoRChGKEgoSihMKE4oUChSKFQoVihqKGwobihwKHIodCh2KHgoeih8KH4oSCiKKIwojiiQKJIolCiWKJgomiicKJ4ooCiiKKQopiioKKoorCiuKLAosiieKaApoimkKaYpqCmqKawprimwKbIplCtWK1grWitcK14rYCtiK2QrZitoK2orbCtuK3Arcit0K3YreCt6K3wrfitAK4IrhCuGK4griiuMK44rkCuSK5QrliuYK5ornCueK6AroiukK6YrqCuqK6wrriuwK7IrtCu2K7gruiu8K74rgCvCK8QrxivIK8orzCvOK9Ar0ivUK9Yr2CvaK9wr3iv4K/or/Cv+K8AEDsALAAAAACgCKAQoBigIKAooDCgOKBAoEigUKBYoLigwKDIoNCg2KDgoAAgOwAQAAAA2K3greitAAAAMDsANAAAADCgOKBAoGigcKB4oICgiKCQoIimoKaopjCnSKdQp1inYKdopwCoCKgQqBioAFA8AHgAAAC4oMig4KCAo6ij0KP4oyCkSKR4pKCk0KQwpYCl0KUwpoCm0KYgp3Cn0KcgqFCooKjwqECpkKngqTCqUKqAqiirWKuAq6ir0KsArDiscKygrMCs6KwIrTCtUK1wrZitwK3grQCuMK5QrpCuEK+QrwAAAGA8ACAAAAAgoKCgIKGwoUCiwKJAo8CjAKQwpLCkAAAA8DwA6AEAAAigGKAooDigSKFYoWiheKGIoZihqKG4ocih2KHoofihCKIYoiiiOKJIoliiaKJ4ooiimKKooriiyKLYouii+KIIoxijKKM4o0ijWKNoo3ijiKOYo6ijuKPIo9ij6KP4owikGKQopDikSKRYpGikeKSIpJikqKS4pMik2KTopPikCKUYpSilOKVIpVilaKV4pYilmKWopbilyKXYpeil+KUIphimKKY4pkimWKZopnimiKaYpqimuKbIptim6Kb4pginGKcopzinSKdYp2ineKeIp5inqKe4p8in2Kfop/inCKgYqCioOKhIqFioaKh4qIiomKioqLioyKjYqOio+KgIqRipKKk4qUipWKloqXipiKmYqaipuKnIqdip6Kn4qQiqGKooqjiqSKpYqmiqeKqIqpiqqKq4qsiq2KroqviqCKsYqyirOKtIq1iraKt4q4irmKuoq7iryKvYq+ir+KsIrBisKKw4rEisWKxorHisiKyYrKisuKzIrNis6Kz4rAitGK0orTitSK1YrWiteK2IrZitqK24rcit2K3orfitCK4YriiuOK5IrliuaK54roiumK6orriuyK7Yruiu+K4IrxivKK84r0ivWK9or3iviK+Yr6ivuK/Ir9iv6K/4rwAAPQAIAgAACKAYoCigOKBIoFigaKB4oIigmKCooLigyKDYoOig+KAIoRihKKE4oVihaKF4oYihmKGoobihyKHYoeih+KEIohiiKKI4okiiWKJooniiiKKYoqiiuKLIotii6KL4ogijGKMoozijSKNYo2ijeKOIo5ijqKO4o8ij2KPoo/ijCKQYpCikOKRIpFikaKR4pIikmKSopLikyKTYpOik+KQIpRilKKU4pUilWKVopXiliKWYpailuKXIpdil6KX4pQimGKYopjimSKZYpmimeKaIppimqKa4psim2KbopvimCKcYpyinOKdIp1inaKd4p4inmKeop7inyKfYp+in+KcIqBioKKg4qEioWKhoqHioiKiYqKiouKjIqNio6Kj4qAipGKkoqTipSKlYqWipeKmIqZipqKm4qcip2KnoqfipCKoYqiiqOKpIqliqaKp4qoiqmKqoqriqyKrYquiq+KoIqxirKKs4q0irWKtoq3iriKuYq6iruKvIq9ir6Kv4qwisGKworDisSKxYrGiseKyIrJisqKy4rMis2KzorPisCK0YrSitOK1IrVitaK14rYitmK2orbityK3Yreit+K0IrhiuKK44rkiuWK5orniuiK6YrqiuuK7Irtiu6K74rgivGK8orzivSK9Yr2iveK+Ir5ivqK+4r8iv2K/or/ivAAAAED0AQAAAAAigGKAooDigSKBYoGigeKCIoJigqKC4oMig2KDooPigCKEYoSihOKFIoWiheKGIoZihqKG4oQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
@@ -0,0 +1,7 @@
# EF-Cheeto .text section — chunk 1/4
# RVA range: 0x01000–0x2CF20
# Size: 180,000 bytes / ~60,000 tokens
# ImageBase: 0x180000000 VA = 0x0180001000
# To decode: import base64; data = base64.b64decode(open(this).read().split('\n',6)[-1])
SI0Nie0KAOnYqwoAzMzMzEiJXCQISIl0JBBIiXwkGEyJZCQgVUFWQVdIjawkcPr//0iB7JAGAADGRCRAAkiNBVTmOgBIiUQkSMZEJFAESI0FS+Y6AEiJRCRYxkQkYAVIjQVC5joASIlEJGjGRCRwBkiNBTnmOgBIiUQkeMZFgAhIjQUx5joASIlFiMZFkAlIjQUu5joASIlFmMZFoAxIjQUj5joASIlFqMZFsA1IjQUc5joASIlFuMZFwBBIjQUV5joASIlFyMZF0BFIjQUO5joASIlF2MZF4BJIjQUH5joASIlF6MZF8BNIjQX85ToASIlF+MZFABRIjQX55ToASIlFCMZFEBtIjQX25ToASIlFGMZFICBIjQXr5ToASIlFKMZFMCFIjQXk5ToASIlFOMZFQCJIjQXd5ToASIlFSMZFUCNIjQXW5ToASIlFWMZFYCRIjQXL5ToASIlFaMZFcCVIjQXE5ToASIlFeMaFgAAAACZIjQW65ToASImFiAAAAMaFkAAAACdIjQWp5ToASImFmAAAAMaFoAAAAChIjQWc5ToASImFqAAAAMaFsAAAAC1IjQWP5ToASImFuAAAAMaFwAAAAC5IjQV+5ToASImFyAAAAMaF0AAAACxIjQVt5ToASImF2AAAAMaF4AAAADBIjQXsAw0ASImF6AAAAMaF8AAAADFIjQUnsToASImF+AAAAMaFAAEAADJIjQUWsToASImFCAEAAMaFEAEAADNIjQUFsToASImFGAEAAMaFIAEAADRIjQX0sDoASImFKAEAAMaFMAEAADVIjQXjsDoASImFOAEAAMaFQAEAADZIjQXSsDoASImFSAEAAMaFUAEAADdIjQXBsDoASImFWAEAAMaFYAEAADhIjQWwsDoASImFaAEAAMaFcAEAADlIjQWfsDoASImFeAEAAMaFgAEAAEFIjQWOsDoASImFiAEAAMaFkAEAAEJIjQV9sDoASImFmAEAAMaFoAEAAENIjQVssDoASImFqAEAAMaFsAEAAERIjQVbsDoASImFuAEAAMaFwAEAAEVIjQVKsDoASImFyAEAAMaF0AEAAEZIjQU5sDoASImF2AEAAMaF4AEAAEdIjQUosDoASImF6AEAAMaF8AEAAEhIjQUXsDoASImF+AEAAMaFAAIAAElIjQUGsDoASImFCAIAAMaFEAIAAEpIjQX1rzoASImFGAIAAMaFIAIAAEtIjQXkrzoASImFKAIAAMaFMAIAAExIjQXTrzoASImFOAIAAMaFQAIAAE1IjQXCrzoASImFSAIAAMaFUAIAAE5IjQWxrzoASImFWAIAAMaFYAIAAE9IjQWgrzoASImFaAIAAMaFcAIAAFBIjQWPrzoASImFeAIAAMaFgAIAAFFIjQV+rzoASImFiAIAAMaFkAIAAFJIjQVtrzoASImFmAIAAMaFoAIAAFNIjQVcrzoASImFqAIAAMaFsAIAAFRIjQVLrzoASImFuAIAAMaFwAIAAFVIjQU6rzoASImFyAIAAMaF0AIAAFZIjQUprzoASImF2AIAAMaF4AIAAFdIjQUYrzoASImF6AIAAMaF8AIAAFhIjQUHrzoASImF+AIAAMaFAAMAAFlIjQX2rjoASImFCAMAAMaFEAMAAFpIjQXlrjoASImFGAMAAMaFIAMAAFtIjQVs4joASImFKAMAAMaFMAMAAFxIiYU4AwAAxoVAAwAAYEiNBVHiOgBIiYVIAwAAxoVQAwAAYUiNBUTiOgBIiYVYAwAAxoVgAwAAYkiNBTfiOgBIiYVoAwAAxoVwAwAAY0iNBSriOgBIiYV4AwAAxoWAAwAAZEiNBR3iOgBIiYWIAwAAxoWQAwAAZUiNBRDiOgBIiYWYAwAAxoWgAwAAZkiNBQPiOgBIiYWoAwAAxoWwAwAAZ0iNBfbhOgBIiYW4AwAAxoXAAwAAaEiNBenhOgBIiYXIAwAAxoXQAwAAaUiNBdzhOgBIiYXYAwAAxoXgAwAAakiNBc/hOgBIiYXoAwAAxoXwAwAAa0iNBcbhOgBIiYX4AwAAxoUABAAAbEiNBbXhOgBIiYUIBAAAxoUQBAAAbUiNBbDhOgBIiYUYBAAAxoUgBAAAbkiNBavhOgBIiYUoBAAAxoUwBAAAb0iNBZ7hOgBIiYU4BAAAxoVABAAAcEiNBWGtOgBIiYVIBAAAxoVQBAAAcUiNBVCtOgBIiYVYBAAAxoVgBAAAckiNBT+tOgBIiYVoBAAAxoVwBAAAc0iNBS6tOgBIiYV4BAAAxoWABAAAdEiNBR2tOgBIiYWIBAAAxoWQBAAAdUiNBQytOgBIiYWYBAAAxoWgBAAAdkiNBfusOgBIiYWoBAAAxoWwBAAAd0iNBeqsOgBIiYW4BAAAxoXABAAAeEiNBdmsOgBIiYXIBAAAxoXQBAAAeUiNBcisOgBIiYXYBAAAxoXgBAAAekiNBbesOgBIiYXoBAAAxoXwBAAAe0iNBaasOgBIiYX4BAAAxoUABQAAoEiNBZXgOgBIiYUIBQAAxoUQBQAAoUiNBYjgOgBIiYUYBQAAxoUgBQAAokiNBXvgOgBIiYUoBQAAxoUwBQAAo0iNBW7gOgBIiYU4BQAAxoVABQAApEiNBWHgOgBIiYVIBQAAxoVQBQAApUiNBVTgOgBIiYVYBQAAuTAAAADoG58KAEiL8EiJAEiJQAhIiUAQZsdAGAEBSIkFqFY8AEiNXCRASbxVVVVVVVVVBUyNNZJWPABFM/8PH4AAAAAATIvLTIvGSI2VeAUAAOieIAgADxAADxFEJCDyDxBAEPIPEYVwBQAAgL1wBQAAAHVgTDklWVY8AA+EkwAAAEiLPURWPABMiXQkMEyJfCQ4uTAAAADoiJ4KAJAPEAMPEUAgSIk4SIl4CEiJeBBmx0AYAABMiXwkOA8QRCQgDylEJCBMi8BIjVQkIEmLzuiQIggASIPDEEiNhWAFAABIO9gPhVz///9IjQ2l5QoATI2cJJAGAABJi1sgSYtzKEmLezBNi2M4SYvjQV9BXl3pBKMKAOh7HggAkMzMzMzMzMzMzMxIg+wouRgAAADo8p0KAEiNDdvlCgBIiQBIiUAISIkFvVs8AEiDxCjpyKIKAMzMzMxIjQ0Z5goA6biiCgDMzMzMSI0NGeYKAOmoogoAzMzMzEiB7IgAAACLDY9RPABlSIsEJVgAAAC6BAAAAEiLBMiLDAI5DWhaPAB+LUiNDV9aPADomp4KAIM9U1o8AP91GEiNDQrmCgDoWaIKAEiNDT5aPADoDZ4KAEiNRCRASImEJJAAAABIjQX99DoASIlEJEBIjUQkQEiJRCR4D1fADxFEJCAPV8nzD39MJDBBuAsAAABIjRVA8zoASI1MJCDozuIAAJBMjUQkQEiNVCQgSI0NxFk8AOjHmAkAkEiNTCQg6FzgAABIgcSIAAAAw8zMzMxIgeyIAAAAiw2/UDwAZUiLBCVYAAAAugQAAABIiwTIiwwCOQ2YWTwAfi1IjQ2PWTwA6MqdCgCDPYNZPAD/dRhIjQ065QoA6ImhCgBIjQ1uWTwA6D2dCgBIjUQkQEiJhCSQAAAASI0FnfQ6AEiJRCRASI1EJEBIiUQkeA9XwA8RRCQgD1fJ8w9/TCQwQbgJAAAASI0VgN06AEiNTCQg6P7hAACQTI1EJEBIjVQkIEiNDfRYPADo95cJAJBIjUwkIOiM3wAASIHEiAAAAMPMzMzMSIHsiAAAAIsN7088AGVIiwQlWAAAALoEAAAASIsEyIsMAjkNyFg8AH4tSI0Nv1g8AOj6nAoAgz2zWDwA/3UYSI0NauQKAOi5oAoASI0Nnlg8AOhtnAoASI1EJEBIiYQkkAAAAEiNBQX0OgBIiUQkQEiNRCRASIlEJHgPV8APEUQkIA9XyfMPf0wkMEG4CQAAAEiNFcjxOgBIjUwkIOgu4QAAkEyNRCRASI1UJCBIjQ0kWDwA6CeXCQCQSI1MJCDovN4AAEiBxIgAAADDzMzMzEiB7IgAAACLDR9PPABlSIsEJVgAAAC6BAAAAEiLBMiLDAI5DfhXPAB+LUiNDe9XPADoKpwKAIM941c8AP91GEiNDZrjCgDo6Z8KAEiNDc5XPADonZsKAEiNRCRASImEJJAAAABIjQXl8ToASIlEJEBIjUQkQEiJRCR4D1fADxFEJCAPV8nzD39MJDBBuAkAAABIjRVA5ToASI1MJCDoXuAAAJBMjUQkQEiNVCQgSI0NVFc8AOhXlgkAkEiNTCQg6OzdAABIgcSIAAAAw8zMzMxIgeyIAAAAiw1PTjwAZUiLBCVYAAAAugQAAABIiwTIiwwCOQ0oVzwAfi1IjQ0fVzwA6FqbCgCDPRNXPAD/dRhIjQ3K4goA6BmfCgBIjQ3+VjwA6M2aCgBIjUQkQEiJhCSQAAAASI0FbfA6AEiJRCRASI1EJEBIiUQkeA9XwA8RRCQgD1fJ8w9/TCQwQbgHAAAASI0VkN86AEiNTCQg6I7fAACQTI1EJEBIjVQkIEiNDYRWPADoh5UJAJBIjUwkIOgc3QAASIHEiAAAAMPMzMzMSIHsiAAAAIsNf008AGVIiwQlWAAAALoEAAAASIsEyIsMAjkNWFY8AH4tSI0NT1Y8AOiKmgoAgz1DVjwA/3UYSI0N+uEKAOhJngoASI0NLlY8AOj9mQoASI1EJEBIiYQkkAAAAEiNBbXwOgBIiUQkQEiNRCRASIlEJHgPV8APEUQkIA9XyfMPf0wkMEG4CQAAAEiNFRjkOgBIjUwkIOi+3gAAkEyNRCRASI1UJCBIjQ20VTwA6LeUCQCQSI1MJCDoTNwAAEiBxIgAAADDzMzMzEiB7IgAAACLDa9MPABlSIsEJVgAAAC6BAAAAEiLBMiLDAI5DYhVPAB+LUiNDX9VPADoupkKAIM9c1U8AP91GEiNDSrhCgDoeZ0KAEiNDV5VPADoLZkKAEiNRCRASImEJJAAAABIjQVV8DoASIlEJEBIjUQkQEiJRCR4D1fADxFEJCAPV8nLine truncated
@@ -0,0 +1,7 @@
# EF-Cheeto .text section — chunk 2/4
# RVA range: 0x2CF20–0x58E40
# Size: 180,000 bytes / ~60,000 tokens
# ImageBase: 0x180000000 VA = 0x018002CF20
# To decode: import base64; data = base64.b64decode(open(this).read().split('\n',6)[-1])
EoO/lBwAAP91CUAPttXrBUUywDLSi4tMFgAAhcl1HUWEyXQgi4O4IQAAiYPQIQAAx4PcIQAAAgAAAOsIO4u4IQAAdTiE0nQSi4O4IQAAiYPQIQAAiavcIQAAhcl0CDuLuCEAAHUWQIT2dQVFhMB0DIuDuCEAAImD1CEAAIuDTBYAAIXAdAg7g7ghAAB1JUWEyXUEhNJ0HIuDuCEAAImD2CEAAImH8CEAAMeH9CEAAM3MzD0z9kiLg8AhAABIhcB0EvdAFAAAAQB0CcaDtCEAAADrFoB7fwB0EIC7ECIAAAB1B0CIq7QhAADzDxCL9CEAAA8vznYXDyjBD1fJ8w9cQ0jzD1/I8w8Ri/QhAAAPLs56CHUGibPwIQAAi4P4IQAAhcB0HomD2CEAAImD1CEAAImD0CEAAIuD/CEAAImD3CEAAImz+CEAAOgDBAAAg7tgIgAA/0iLPYWbOQAPhT8BAABMi4/AIQAATYXJD4QvAQAASIO/mCMAAAAPhSEBAABB90EUAAABAA+FEwEAAIC/QAEAAAAPhAYBAADzDxCHRAEAAA8v8A+H9QAAAA8uxkyLx3oCdCvzDxCPqAAAAA8vwQ+G2gAAAPMPEJesAAAAuQACAADoqID//4XAD47AAAAAQYC4ZB8AAAB0DkGDuEwWAAD/D4WoAAAAQYO4xBYAAP8PhZoAAACAvzgBAAAAD4WNAAAAgL86AQAAAA+FgAAAAA+2hzkBAABAhG8wdCGEwHQHvf/////rLoC/tCEAAAB1JYO/TBYAAAB1HIvu6xiEwHQHvf/////rDYO/TBYAAACL7kAPlcWJr5AiAAC4IQAAAEGAuQgBAAAAuf////9BuAAUAABED0Xwwf0fRYvOjVUD6Crw///Hh5QiAAD/////gL9RIgAAAEyLtCTAAAAASIusJLAAAAB1DYC/EiIAAAB1BDLA6wKwAYiHESIAAEiLi8AhAADGg7chAAAASIXJD4TEAQAA90EUAAABAA+FtwEAAEiDu5gjAAAAD4WpAQAAZoO5rAEAAADzDxCBEAMAAPMPWQXQYDgAi5NgIgAA8w8QFR5gOADzD1lDSPMPWAXRXzgA8w8swGYPbtgPW9sPhY4AAACAubIBAAAAD4SBAAAAg/r/dHzzDxAN6mA4AIXSdAqD+gF1Mw8owusDDyjB8w9Zw4mx5AAAAImx7AAAAPMPWIHMAAAA8w8swGYPbsAPW8DzDxGB3AAAAIP6AnQIg/oDdS4PKMrzD1nLibHoAAAAibHwAAAA8w9YidAAAADzDyzBZg9uwA9bwPMPEYHgAAAARYTtD4TOAAAAgL9gCQAAAEiLx/MPEI/8CQAA8w8Qh9wJAADzD1yP7AkAAPMPXIfMCQAAdBOAv+QcAAAAdQrzDxAVrF44AOsagLhwCQAAAHQRgLjwHAAAAHUI8w8QFXRfOAAPLsZ6AnQ4gLn8AAAAAHQv8w9Zw4mx5AAAAImx7AAAAPMPWcLzD1iBzAAAAPMPLMBmD27AD1vA8w8RgdwAAAAPLs56AnQv8w9Zy4mx6AAAAImx8AAAAPMPWcrzD1iJ0AAAAPMPLMFmD27AD1vA8w8RgeAAAAAPKHQkcEWE5EyLpCS4AAAAdRBFhO11C2bHg7QhAAAAAOtWRYT/dFGAe3oAdEv2QzQEdEVIjUwkIOja8f//8w8QAPMPEEgE8w8Rh/QKAADzDxGP+AoAAPMPEYcYAQAA8w8RjxwBAABIx4cEAQAAAAAAAMaH6wAAAAGJs4wiAABIi0wkaEgzzOh84gcASIHEgAAAAEFfQV1fXlvDzMzMzMzMzMzMzMzMzEiJXCQYSIlsJCBWV0FXSIHsoAAAAEiLPXSXOQBEDylcJEBIi99EDylsJDCLbzBIi7fAIQAAQPbFAnQL9kc0AXQFQbEB6wNFMslAgOUBDym0JJAAAABFM/8PKbwkgAAAAEQ4v1IiAAB0L0iF9nQq9odUKgAAEHQZi5dgIgAASI0NHP43AOh3+AAASIs9AJc5AA9X9unwAwAAx4dgIgAA/////w9X9kyJv1QiAABIhfYPhJoDAABMOb+YIwAAD4WNAwAA90YUAAABAA+FgAMAAESLl2AfAADzDxAt8lw4APMPED32XDgAQfbCAQ+FzgAAAEWEyXRVRDi/IAkAAHRM8w8QhyQJAAAPL/B3Pw8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2GLl+AgAA6PR7//+FwH4KQYO4rBwAAP90bUCE7XRvRDi/UAEAAHRm8w8Qh1QBAAAPL/B3WQ8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2MrkBAgAA6Jp7//+FwH4kRTi4ZB8AAHQKQYO4TBYAAP91EUGDuNAWAAD/dQdEib9gIgAAQfbCAg+F0QAAAEWEyXRVRDi/MAkAAHRM8w8QhzQJAAAPL/B3Pw8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2GLl/AgAA6Bx7//+FwH4KQYO4uBwAAP90bUCE7XRyRDi/YAEAAHRp8w8Qh2QBAAAPL/B3XA8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2NbkCAgAA6MJ6//+FwH4nRTi4ZB8AAHQKQYO4TBYAAP91FEGDuNwWAAD/dQrHh2AiAAABAAAAQfbCBA+F0QAAAEWEyXRVRDi/QAkAAHRM8w8Qh0QJAAAPL/B3Pw8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2GLmAAgAA6EF6//+FwH4KQYO4xBwAAP90bUCE7XRyRDi/cAEAAHRp8w8Qh3QBAAAPL/B3XA8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2NbkDAgAA6Od5//+FwH4nRTi4ZB8AAHQKQYO4TBYAAP91FEGDuOgWAAD/dQrHh2AiAAACAAAAQfbCCA+F0QAAAEWEyXRVRDi/UAkAAHRM8w8Qh1QJAAAPL/B3Pw8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2GLmBAgAA6GZ5//+FwH4KQYO40BwAAP90bUCE7XRyRDi/gAEAAHRp8w8Qh4QBAAAPL/B3XA8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2NbkEAgAA6Ax5//+FwH4nRTi4ZB8AAHQKQYO4TBYAAP91FEGDuPQWAAD/dQrHh2AiAAADAAAAi4dgIgAAiYdoIgAAx4d8IgAA//9/f8eHgCIAAP//f3/Hh4QiAAD//3//x4eIIgAA//9//0iF9nQdg7tgIgAA/3UUQITtdA/otQwAAEiLPe6SOQAPKPCLi2AiAABEiLtSIgAAg/n/dBlEi4tYIgAARIuDVCIAAIuTaCIAAOig6P//RDi7UCIAAHRbRDm7uCEAAHVS9oNUKgAAEHQsSIX2dAZIi1YI6wdIjRUz9zcARIuDzCEAAEiNDbX5NwDo8PMAAEiLPXmSOQBmx4MSIgAAAQFEibsgIgAARDh7fnQHxoO0IQAAAfNEDxAdn1k4APNEDxAtrlg4AEyJtCTIAAAARA8pRCRwRA8pTCRgRA8pVCRQRDi7UCIAAA+EGQIAAIO7ACIAAAMPhQwCAABEObvMIQAAD4X/AQAASIX2D4T2AQAAi6tUIgAASI2MJMAAAADzDxCGYAEAAESL9fMPEI5kAQAASIvW8w8QvnACAACD5QrzRA8QhnQCAADzQQ9c/fNEDxCWeAIAAPNFD1zF80QPEI58AgAA80UPWNXzRQ9YzfMPXPjzRA9cwfNED1zQ80QPXMnoyrv///MPEADzDxBIBPMPXIbMAAAA8w9cjtAAAADzD1j480QPWMHzRA9Y0PNED1jJQYPmBXQIhe0PhUYBAABIY4PMIQAASIPARUgDwPMPEATGDy/HciDzDxBExgRBDy/AchREDy9UxghyDEQPL0zGDA+DDgEAAPaDVCoAABB0E0iNDXD4NwDoc/IAAEiLPfyQOQDzDxCGEAMAAEEPKMrzD1kFDFc4AEEPKNHzDxAdZFg4APMPXM/zQQ9c0PMPXcjzD13QRYX2dQvzD1j580QPXNHrBw8o+0UPKNOF7XUM80QPWMLzRA9cyusIRA8ow0UPKMtIY4PMIQAASIPARUgDwPMPEETGBEQPL8B2BkEPKMjrCEEPKMnzD13I8w8QFMYPL/p2BQ8ox+sIQQ8owvMPXcLzDxEExvMPEUzGBPMPEETGDEQPL8B3CUUPKMHzRA9dwPMPEETGCA8v+HcIQQ8o+vMPXfjzDxF8xgjzRA8RRMYMRIm7uCEAAESJfCQkRIl8JCzrEQ9XwA8RRCQgSIX2D4QPAgAASGODzCEAAEiDwEVIA8DzDxAExg8vRMYIdxPzDxBExgQPL0TGDHcGDxAkxusDD1fk8w8QjmQBAAAPKMTzDxC+YAEAAA8o2YuDVCIAAA8o1w/GxFXzD1jU8w9Y2A8oxA/GxKoPxuT/8w9Y+PMPWMzzDxFUJCDzDxFcJCTzDxF8JCjzDxFMJCwPuuALD4OZAAAADy+WcAIAAHIsDy+edAIAAHIj8w8QhngCAAAPL8dyFvMPEIZ8AgAADy/BcgmDyCCJg1QiAAAPEEQkIPMPWN4PL8LzD1jO8w8RXCQkDxGDfCIAAPMPEUwkLHYI8w8Rk3wiAADzDxCDgCIAAA8vw3YI8w8Rm4AiAAAPL7uEIgAAdgjzDxG7hCIAAA8vi4giAAB2CPMPEYuIIgAARDi7UCIAAA+E2QAAAPaDVCIAAIBIi4fAIQAARIuDYCIAAEhji8whAABIi5YwBAAA8w8QoGABAADzDxCoZAEAAHVR8w8QhMpwBAAAQQ8uw3oYdRbzQQ9Y1fMPXdfzD1zU8w8RlMpwBAAA8w8QhMp0BAAAQQ8uw3obdRnzD1jL8w9ZDW5UOADzD1zN8w8RjMp0BAAAQY1Line truncated
@@ -0,0 +1,7 @@
# EF-Cheeto .text section — chunk 3/4
# RVA range: 0x58E40–0x84D60
# Size: 180,000 bytes / ~60,000 tokens
# ImageBase: 0x180000000 VA = 0x0180058E40
# To decode: import base64; data = base64.b64decode(open(this).read().split('\n',6)[-1])
QFNIg+wgSItZUEiLC/8VfYcFAEiLC/8VvIYFAEiLC0iDxCBbSP8lbYcFAMzMzMzMQFNIg+wgSItZUP8VcIcFAEg7Aw+UwEiDxCBbw8zMzMxIg+woSItJUEiLCf8Vb4YFAIXAD5XASIPEKMPMzMzMzEiJXCQISIlsJBBIiXQkGEiJfCQgQVZIg+xASIvyTItxUDPtiWwkKEiJbCQgQbn/////TIvCM9K56f0AAP8VroEFAIv4SIlsJDCL3UiJXCQ4hcB+HovQuAgAAAA70A9M0IXSfg5IY8pIA8nocf/7/0iL2Il8JChIiVwkIEG5/////0yLxjPSuen9AAD/FV+BBQBMi8tFM8C6DAAAAEmLDv8V64UFAJBIhdt0ckyLBZ7cNgBNhcB0XEWLSARJD7+QHCsAAEmNiCArAABIjQzRRDkJdDWNSgG4q6qqKvfpi8LB6B8D0I0EUgPAK8hmQYmIHCsAAEgPv8lIgcFkBQAASY0MyESJCYlpBGb/QQZB/4AYKwAASIvL/xVshwUAkEiLXCRQSItsJFhIi3QkYEiLfCRoSIPEQEFew8zMzMzMzMzMQFNIg+wwSItZULrs////8w8QBV2iNQAPKXQkIA8o8Q8vxkiLC3ZE/xUbhQUASIsLuuz///8PuugTRIvA/xV+hQUA8w9ZNeKiNQAz0kiLC0G5AgAAAPNEDyzGDyh0JCBIg8QwW0j/JYWFBQD/FdeEBQBIiwu67P///w+68BNEi8APKHQkIEiDxDBbSP8lL4UFAMzMzMzMzMzMzMzMzMzMzEiD7ChIi0lQugIAAABIiwn/FeqEBQBIi8hIg8Qo6X70///MzMzMzMzMzMzMzMzMzEiJXCQISIlsJBBIiXQkGEiJfCQgQVZIg+wwi/JJi+lIjRXaWjUATYvwSIvZ/xX2hAUATIvNTYvGSIv4i9ZIi8tIhcAPhKgAAABIg8AwSIlEJCDoCeb//0iFwHQKuAEAAADpkQAAAEiLj4gNAABIY4eADQAASI0UwUg7ynRpDx8ASIsBSDlYWHQLSIPBCEg7ynXu61KLzoPpA3RHg+kCdDyD6Qt0L4PpEXQUg/ljdTf2QASAdDFIx8D/////6zmLSASD4UCLwffYSBvAg+ADhcl1JesSxkBrATPA6xvGQGoB6wTGQGkBTIvNTYvGi9ZIi8v/FYmDBQBIi1wkQEiLbCRISIt0JFBIi3wkWEiDxDBBXsPMzMzMzMzMzMzMzMzMzEiJXCQISIl0JBBXSIHskAAAAEiLBUe+NgBIM8RIiYQkgAAAAEiNBbX+///HRCQwUAAAADP2SIlEJDgzyUiJdCRAx0QkNAMAAAD/FWGABQBmD28NaaE1AEiNTCQwSIlEJEgPV8BIjQWtWjUAZg9/RCRQSIlEJHBmD39MJGBIiXQkeP8V0YMFAEiLBZLZNgBIhcB0CUiLuNAAAADrA0iL/kiNmGANAACLSwSFyXkYi8GZK8KL1tH4A8iFyQ9P0UiLy+hLAgAARTPJiTNMjQWf2f//M9Izyf8VnYMFAEiLDT7ZNgBIjQWn8///QIh3MEiJgZgMAABIjQWl9f//SImBoAwAAEiNBbf2//9IiYGoDAAASI0FOfn//0iJgbAMAABIjQW7+P//SImBuAwAAEiNBV36//9IiYHADAAASI0F3/n//0iJgcgMAABIjQUR+///SImB2AwAAEiNBTP7//9IiYHgDAAASI0FRfv//0iJgegMAABIjQVX+///SImB8AwAAEiNBYn8//9IiYH4DAAASI0Fm/b//0iJgQANAABIjQUN/f//SImBGA0AAEiNBc9z+/9IiYEgDQAASIuBQCEAAEiLudAAAAC5IAAAAEiLGP8VbIMFAEyLFUXYNgBMi8BNhdJ0W0kPv5IcKwAASY2CICsAAEWLSgRIjQTQRDkIdDSNSgG4q6qqKvfpi8LB6B8D0I0EUgPAK8hmQYmKHCsAAEgPv8FIBWQFAABJjQTCRIkIiXAEZv9ABEH/ghQrAABNhcB0EUmJcAhJiTBBiHAQSYlwFOsDTIvGSIsHSYkAQYhwEEyJQ1BIi4wkgAAAAEgzzOh7IgUATI2cJJAAAABJi1sQSYtzGEmL41/DzMzMzMzMSIlcJAhXSIPsIESLQQRIi9mLCUiL+kE7yHUo/8FFhcB0DUGLwJkrwtH4QQPA6wW4CAAAADvBD0/Ii9FIi8voPQAAAEhjAw8QB0iNDEBIi0MISAPJDxEEyA8QTxAPEUzIEA8QRyAPEUTIIP8DSItcJDBIg8QgX8PMzMzMzMzMzMxIiVwkEFdIg+wgSGP6SIvZO3kED469AAAASI0Mf0iJdCQwSMHhBOh1+fv/SItTCEiL8EiF0g+EjwAAAEhjC0yNBElIi8hJweAE6CYzBQBMi0sITYXJdGpMiwWy1jYATYXAdF5JD7+QHCsAAEmNiCArAABFi1AESI0M0UQ5EXQ3jUoBuKuqqir36YvCwegfA9CNBFIDwCvIZkGJiBwrAABID7/JSIHBZAUAAEmNDMgzwESJEYlBBGb/QQZB/4AYKwAASYvJ/xV+gQUASIlzCEiLdCQwiXsESItcJDhIg8QgX8PMzMzMzMzMzMzMzMzMzMxIiVwkCItBBEyLyiUA4AAATIvRuwgAAAA9ACAAAHQKRIvDPQBAAAB1BkG4EAAAAEmLyUi4R1juaYTlnkZJK0oYSPfpuQAAAgBIwfoFSIvCSMHoP0gD0LgAAAEAhdJBD7ZRcQ9EyEGLwIPIIEH2QgQBQcZBcgBBD0XAgOIDC8hBiFFxQYsBJQAAAA8LyEGJCUGLSgSEy3RXD7rhG0HGQXIJuGAAAABBuHAAAABED0PAuAwAAAAPQ8NECsBECsJmQYN5Xv9FiEFxdCVBD7bQi8LB6gSD4AMPo8JyFEGA4PxBgPABRYhBcUHGgjoCAAABSItcJAjDzMzMzMzMzMzMzMzMSIvEVVNXSI1o2EiB7BABAACLeQRIi9lIiXAQgecA4AAASIs1+NQ2ADPSTIlgGEUz5EyJaCBMiXDgTIl42A8pcMgPKXi4RA8pSJhEDymgaP///0QPKahY////i0Fsg8AfxoFAAgAAAcH4BUxjwGZEiaECAgAASItJUEnB4AJIiXQkWIl8JDDo/zAFAItDbDPSSItLSIPAH8H4BUxjwEnB4ALo5DAFAPNEDxAt1Zo1ALr/////i0tsRTLSQQ8oxWaJkxwCAADzD1+G3A0AAEUy/0SJZCQoRIlUJCRFi8xFi+yL8kUPV+QPV/bzDxGDuAAAAA9X5EWL9IXJD45RAgAAkEiLQyhJD788BEE7/nQHxoNAAgAAAExr33RMA1sYZjm7BgIAAH8vSYvTSIvL6M/9//9Ei0wkKLr/////RItUJCRmQYlTVEHHQzQAAAAAQcdDIAAAgL/2QwQEdAZB9gOAdAVBxkNoAUEPtkNoQThDZ3QLQYhDZ8aDPwIAAAFBgHtnAHQKQfYDAXUEsAHrAjLAZkGDe17/QYhDZnQLhMB1B8aDOgIAAAFmQYN7XgB+EPdDBAAAAAR1B8aDOgIAAAFB9gMQdAdFDy9jEOsFRQ8vYxwPl8CEwHQHZkHHQ28HB0GAe2YAdQpmQYlTWOlHAQAAZkGJc1pmQYlTXIP+/3QSSGPGSGvIdEiLQxhmiXwBXOsHZom7HAIAAA+3iwICAABMi8dJwfgFi/eNQQFmiYMCAgAAZkGJS1iLz0iLU1CD4R9CiwSCD6vIQokEgk0Pv0NWSItLSEmL0EjB+gVBg+AfiwSRRA+rwIkEkUGAe20AdV9mg3t4AHVY80EPEEtE80EPX0tI80EPEFM4QYsD8w9cyg+64A1yDvNBDxBDUPMPXMLzD1/IqBB0GfNBDxBDIEEPL8R2DfZDBAF0BKggdAMPKMjzD1+LuAAAAPNBDxFLFEGLC0G4AQAAAIvBRQ+20oPgIEUPRNBEiVQkJPbBEHQW80EPEEMgQQ8vxHYKhcB0BvNBDxFDFEGAe28Auv/////zQQ8QQxRFD7b/RQ9F+PbBCHQJ8w9Y8EH/xesMQf/B8w9f4ESJTCQoi0tsQf/GSYPEAkQ78Q+Mt/3//4t8JDBFM+SLQwSoCHQXZoO7AAIAAAB1DQ+64BtyB8aDOgIAAAFmibMeAgAARYT/dCFIi4OIAQAASDmDgAEAAHQKxoAGAQAAAItLbMaDPwIAAAHHgyACAAD/////QQ8o1EEPKOxFi9SFyQ+OpwEAAPMPEB0QmDUASItDUEGL0k1jwoPiH0mLyEjB+QWLDIgPo9EPg3ABAABMi0sYTWvAdEOLBAiLyIPhIKgQD4SDAAAA80MPEEwIFIH/AEAAAHUPQ4B8CG8AdQSFyXQDDyjMQw+2RAhvhMB0PPNDDxFMCBA8AXZEgLs5AgAAAHQ7Q4B8CG0AdTPzDxCDuAAAAPMPWcPzD1/I80MPEUwIEPMPWNHp3QAAAIXJdA9DgHwIawB0B/NDDxFMCBDzQw9YVAgQ6b4AAABDgHwIbwB1EfNDDxBMCBxEDy/hdwSFyXRL80MPEEwIIEEPL8x2CfNDDxFMCBzrNYH/AGAAAHUg80MPEEwIFPMPXs5mQQ9uxQ9bwPMPWcjzQw8RTAgc6w1Dx0QIHAAAgD9BDyjNSA+/gyACAADzD1jpZoP4/3QVSItLGEhr0HRDD7dECFZmOUQKVn4IZkSJkyACAABID7+DIgIAAGaD+P90FUiLSxhIa9B0Qw+3RAhWZjlEClZ9CGZEiZMiAgAAQ8ZECG0A8w8Qg8AAAADzD1jA8w9Y0ItLbEH/wkQ70Q+MYf7//4C7SAIAAACLRCQoD7+TAgIAAPMPEJvIAAAA8w9Ym8QAAADzDxCLvAAAAA8QsxABAABmiYMEAgAAjUL/Zg9uwPMPWMkPW8DzDxGr2AAAAPMPWdgPEXQkaPMPWNl0H0iLg4gBAACAuP0AAAAAdQ9Ii3wkWPMPEI8UDgAA6wlIi3wkWEEPKMyLQwQPuuAYcyLzDxCDzAAAAEEPLsR6FHUS8w8QgygBAADLine truncated
@@ -0,0 +1,7 @@
# EF-Cheeto .text section — chunk 4/4
# RVA range: 0x84D60–0xB0200
# Size: 177,312 bytes / ~59,104 tokens
# ImageBase: 0x180000000 VA = 0x0180084D60
# To decode: import base64; data = base64.b64decode(open(this).read().split('\n',6)[-1])
D1fJ8w9/TahBuAEAAABIjRV/qzIASI1NmOgyr/j/kEyNRZhIjZWAAAAASI0NHyo0AOg6igEASIvYSIN4GA92A0iLGPMPLNdIjU0w6BCo//+QScfA/////w8fhAAAAAAASf/AQoA8AwB19kiL00iNTTDoeqn4/w8QAA8RhaAAAAAPEEgQDxGNsAAAAMYAAEyJcBBIx0AYDwAAAEiNlaAAAABmSA9+wWYPb8FmD3PYCGZID37ASIP4D0gPR9FmSQ9+yEiNjcAAAADoI6n4/0iNlcAAAABIjU0Q6JOp+P9IjU0Q6Bqs+P+QSI2NoAAAAOgNrPj/kEiNTTDoA6z4/5BIjY2AAAAA6Par+P+QSI1NmOjsq/j/gH86AA+ELgEAAA9XwA8RhaAAAABMibWwAAAATIm1uAAAAEG4BwAAAEiNFVWqMgBIjY2gAAAA6AGu+P+QSIsFKR40ADPSSYvP/9BIhcB0dkiL0EiNTZjooWsBAEiLlbgAAABIg/oPdjRI/8JIi42gAAAASIvBSIH6ABAAAHIZSIPCJ0iLSfhIK8FIg+gISIP4Hw+H+AMAAOhIaAIADxBFmA8RhaAAAAAPEE2oDxGNsAAAAPNED39NqMZFmABIjU2Y6Cer+P9Ig73QAAAAAHQZQbgDAAAASI0VsKkyAEiNjcAAAADo9Kf4/0iNlaAAAABIg724AAAAD0gPR5WgAAAATIuFsAAAAEiNjcAAAADoyqf4/0iNlcAAAABIjU0Q6Dqo+P9IjU0Q6MGq+P+QSI2NoAAAAOi0qvj/gH88AA+E3gAAAEmLxkiNDUCw9/85tIEI+ToAdBVI/8BIg/gGcu5IjRULpjIATYvG6x5IA8APEIzBIPk6AGYPb8FmD3PYCGZJD37AZkgPfsoPV8APEYWgAAAATIm1sAAAAEyJtbgAAABIjY2gAAAA6JCs+P+QSIO90AAAAAB0GUG4AwAAAEiNFcioMgBIjY3AAAAA6Ayn+P9IjZWgAAAASIO9uAAAAA9ID0eVoAAAAEyLhbAAAABIjY3AAAAA6OKm+P9IjZXAAAAASI1NEOhSp/j/SI1NEOjZqfj/kEiNjaAAAADozKn4/0iDvdAAAAAAD4TWAQAA8w8QRfDzDxFEJGhmQQ9uzA9byfMPXE308w8RTCRsSIsdORs0AEiLc3BIhfZ0B/MPEHYc6wtBDyjwSIuz4BIAAEiLg+ASAABIiUUA8w8Qg/QSAADzDxFFCPMPEIvwEgAA8w8RTQxIjYvIIAAASI1VAOgZjvv/QQ8u8HoKdQjzDxCz9BIAAEEPKNAPKM5Ii87o+vj5/0iLBcMaNABIi4jYFQAATI0FxW0yALoBAAAASItJQOjXPfn/TIvQTI2FwAAAAEiDvdgAAAAPTA9HhcAAAABIjUwkdOjj0vj/i/CpAAAA/3RSTYXAdE1BgDgAdEdBDxBCYA8RRCRwSYtKOESJdCRI80QPEUQkQEyJdCQ4TIlEJDBIjUQkcEiJRCQoiXQkIEyNTCRoQQ8o0kmL0kiLSRjoqMP8/0iLHSEaNABIY4PIIAAAhcB/DkiNDe9vMgDoOjD6/+smSAPASIuL0CAAAPMPEFTB/PMPEEzB+EiLTMHw6Bj4+f//i8ggAABIiwXbGTQASIuI2BUAAEyNBd1sMgC6AQAAAEiLSUDo7zz5/0iLyEGLxZkrwtH4Zg9uwA9bwPMPEUWIx0WMAAAAAPNEDxFcJCBEi85MjUQkaEiNVYjoqUX8/5BIjY3AAAAA6Nyn+P9Ii1wkWEj/w0iJXCRYTIt9kEmDxwhMiX2QSGNEJFBIO9gPgoX4//9Ii43gAAAASDPM6BZkAgBMjZwkcAIAAEmLWzBJi3M4SYt7QEEPKHPwQQ8oe+BFDyhD0EUPKEvARQ8oU7BFDyhboEUPKGOQRQ8oa4BJi+NBX0FeQV1BXF3DTIl0JCBFM8lFM8Az0jPJ/xUoxQIAzMzMzMzMzMxMi9xJiVsYSYlrIFZXQVZIgeygAAAATIsFwxg0AEyL8UEPKXPYSIv6QQ8pe8jzDxA9h98yAEmLgNgVAABFDylDuEUPKVOoQcdDEAAAIELGgAMBAAABSYuI2BUAAEHHQxQAAKBB8g8QgVABAABIi7EYAwAA8kEPEUMI6OL4+f9Iiw1bGDQAi9BIi5nYFQAASIvL6Fr5+f9IgcNAAQAAi+hEi0MEiwtBO8h1KP/BRYXAdA1Bi8CZK8LR+EEDwOsFuAgAAAA7wQ9PyIvRSIvL6H6d+/9IYwtIjZQkyAAAAEiLQwiJLIj/A+hFuP3/RTPAM9Izyei5B/r/hMB0FzPJ6L4z+f+EwHQMgD8AswEPlMCIB+sCMtvzDxCEJMQAAABMjYQkyAAAAIA/APMPWMfzRA8QhCTAAAAASI2UJMAAAADzRA8QFWHeMgBBDyjw8w9YNYHeMgC4ZMhk/0G5yFBQ/0QPRcjzDxGEJMwAAAAz7UiLzolsJCjzDxG0JMgAAADzRA8RVCQg6MdF/P9AOC90CvMPEAWu3TIA6wMPV8DzDxAVAd4yAPNFD1jC8w9Zx0iNlCTIAAAARTPJx0QkIDAAAABIi87zQQ9YwPMPEYQkyAAAAPMPEIQkxAAAAPNBD1jC8w8RhCTMAAAA6OQ1/P//TlBBuf////9Ei0ZQSIvOSItWWOg7MPz/8w8QLTveMgAPV8APKM2JblDoNTj6/0iLFb4WNADzDxCi8BIAAE2F9nRN8w8QHfXdMgBIjYwkyAAAAEiLkuASAAAPKNSJbCRQSIlsJEBIiWwkOEiJbCQwTIl0JCjzDxFsJCDoxLn8//MPEKQkzAAAAEiLFWQWNABIi4LYFQAA8w9c/PMPWDUN3TIAQbgBAAAASYvOxoADAQAAAUiLgtgVAAAz0vMPWT1U3DIA8w8RsFABAADzD1i8JMQAAADGgJEBAAAB8w8RuFQBAADoW539/0iLDQQWNABIi5HYFQAAi4JAAQAAg/gBfw5IjQ3zazIA6BYs+v/rCP/IiYJAAQAATI2cJKAAAAAPtsNJi1swSYtrOEEPKHPwQQ8oe+BFDyhD0EUPKFPASYvjQV5fXsPMzMzMzMzMzMzMzMzMSIlcJAhIiXQkEEiJfCQYQVZIg+xgSIvxixVeFDQAZUiLBCVYAAAAQb4EAAAASIs80EKLBDc5BREhNAB+TUiNDQghNADoZ2ECAIM9/CA0AP91OMcF9CA0AAAAAAAz0kiNDfMgNADoxi8CAJDokH8BAJBIjQ1YqgIA6AdlAgCQSI0NxyA0AOi6YAIAD1fADxFEJCAPV8nzD39MJDBBuAsAAABIjRWAozIASI1MJCDonqX4/5BMjUQkIEiNVCRASI0NjCA0AOingAEAkEiDeBgPdgNIiwAz0kiLyOjisP7/D7bYSI1MJEDoFaP4/5BIjUwkIOgKo/j/hNsPhFcBAABIiw2bFDQASIuB2BUAAMaAAwEAAAFIi4HYFQAA8w8QgQwOAADzD1iAlAEAAPMPEYCUAQAA8w9YQFjzD1iAmAEAAPMPEYBQAQAAQosENzkF+x80AH5NSI0N8h80AOhRYAIAgz3mHzQA/3U4xwXeHzQAAAAAADPSSI0N3R80AOiwLgIAkOh6fgEAkEiNDUKpAgDo8WMCAJBIjQ2xHzQA6KRfAgAPV8APEUQkIA9XyfMPf0wkMEG4EAAAAEiNFXqiMgBIjUwkIOiIpPj/kEyNRCQgSI1UJEBIjQ12HzQA6JF/AQCQSIN4GA92A0iLAEiNVihIi8joyvr//5BIjUwkQOj/ofj/kEiNTCQg6PSh+P9Iiw2NEzQASIuB2BUAAMaAAwEAAAFIi4HYFQAA8w8QgJQBAADzD1yBDA4AAPMPEYCUAQAA8w9YQFjzD1iAmAEAAPMPEYBQAQAASItcJHBIi3QkeEiLvCSAAAAASIPEYEFew8zMSIvESIlYEEiJeBhVSI1ooUiB7PAAAAAPKXDoM/9AOHkoD4QmAgAASIsFOhQ0ADPJ/9DzDxA1WtkyAPMPXvDHRWcAACBBx0VrAAAgQkiLBd0SNABIi4jYFQAATI0F32UyALoBAAAASItJQOjxNfn/SIvY8w8s1kiNTQfocZz//5CLFYYRNABlSIsMJVgAAAC4BAAAAEiLDNGLFAg5FTseNAB+SUiNDTIeNADokV4CAIM9Jh40AP91NIk9Ih40ADPSSI0NIR40AOj0LAIAkOi+fAEAkEiNDYanAgDoNWICAJBIjQ31HTQA6OhdAgAPV8APEUXnD1fJ8w9/TfdBuAUAAABIjRXUoDIASI1N5+jPovj/kEyNRedIjVUnSI0Nvx00AOjafQEAkEiDeBgPdgNIiwBJx8H/////Dx+EAAAAAABJ/8FCgDwIAHX2TIvAM9JIjU0H6HgA+P8PV8APEUXHD1fJ8w9/TdcPEAAPEUXHDxBIEA8RTdfGAABIiXgQSMdAGA8AAABMjUXHSIN93w9MD0dFxw8vNZLYMgByCmYPbwW82jIA6xsPLzVr2DIAcgpmD28FudoyAOsIZg9vBX/aMgAPEUW3SI1Nt+jCyfj/SItTOEiLShipAAAA/3RJTYXAdERBgDgAdD4PEENgDxFFt4l8JEgPV8nzDxFMJEBIiXwkOEyJRCQwTI1Ft0yJRCQoiUQkIEyNTWfzDxBSIEiL0+iLuvz/kEiNTcfoYZ/4/5BIjU0n6Fef+P+QSI1N5+hNn/j/kEiNTQfoQ5/4/0yNnCTwAAAASYtbGEmLeyBBDyhz8EmL413DzMzMzMzMzMzMSIlcJAhXSIPsIEiL+YvaSIPBCOgIn/j/9sMBdA26OAAAAEiLz+juWwIASItcJDBIi8dIg8QgX8PMzMzMzMzMzEiNFSkEAADpdAQAAMzMzMxIiVwkEEiJdCQYVVdBVEFWQVdIjWwkyUiB7LAAAABMi/GLFSUPNABlSIsEJVgAAABBvAQAAABIizTQRTP/QosEJjkF1Rs0AH5KSI0NzBs0AOgrXAIAgz3AGzQA/3U1RIk9uxs0ADPSSI0Nuhs0AOiNKgIAkOhLine truncated
File diff suppressed because it is too large. Load diff
File diff suppressed because it is too large. Load diff
@@ -0,0 +1,266 @@
# COMPLETE IMPORT TABLE — EF-Cheeto.dll
# All imported DLLs and functions needed for Visual Studio .def / linker
# These must ALL be linked in the VS project
## KERNEL32.dll (76 functions)
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateThread
TerminateThread
SuspendThread
ResumeThread
OpenThread
CloseHandle
GetLastError
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleHandleA
GetModuleHandleW
FlushInstructionCache
SetThreadContext
GetThreadContext
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapCreate
HeapAlloc
HeapFree
HeapReAlloc
HeapDestroy
AllocConsole
FreeConsole
GetConsoleMode
SetConsoleMode
GetConsoleWindow
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleOutputCP
SetConsoleTitleA
GetStdHandle
CreateToolhelp32Snapshot
Thread32First
Thread32Next
K32EnumProcessModules
K32GetModuleFileNameExW
Sleep
OutputDebugStringA
GetSystemInfo
DisableThreadLibraryCalls
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocaleInfoA
IsDBCSLeadByte
VerSetConditionMask
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
LocalFree
FormatMessageA
GetLocaleInfoEx
AreFileApisANSI
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
WakeAllConditionVariable
InitializeSListHead
memmove
## USER32.dll (67 functions)
CreateWindowExW
DestroyWindow
RegisterClassExW
UnregisterClassW
DefWindowProcW
PeekMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
UpdateWindow
GetClientRect
GetWindowRect
GetWindowLongW
GetWindowLongPtrW
SetWindowLongW
SetWindowLongPtrW
SetWindowPos
ShowWindow
BringWindowToTop
IsIconic
IsWindow
IsWindowVisible
IsWindowUnicode
IsChild
FindWindowA
EnumWindows
GetForegroundWindow
SetForegroundWindow
SetFocus
GetCursorPos
SetCursorPos
GetCapture
SetCapture
ReleaseCapture
GetAsyncKeyState
GetKeyState
GetKeyboardLayout
GetMessageExtraInfo
TrackMouseEvent
ClientToScreen
ScreenToClient
WindowFromPoint
GetDC
ReleaseDC
GetDeviceCaps
CreateSolidBrush
LoadCursorW
LoadIconW
SetCursor
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromWindow
GetSystemMetrics
GetClassNameA
GetWindowThreadProcessId
AdjustWindowRectEx
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetPropA
SetPropA
SetLayeredWindowAttributes
SetWindowDisplayAffinity
GetWindowDisplayAffinity
SetProcessDPIAware
## GDI32.dll/SHELL32.dll (1 functions)
ShellExecuteW
## imm32.dll (4 functions)
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
## d3d11.dll (1 functions)
D3D11CreateDeviceAndSwapChain
## d3dcompiler_47.dll (1 functions)
D3DCompile
## dwmapi.dll (2 functions)
DwmExtendFrameIntoClientArea
DwmGetWindowAttribute
## xinput1_4.dll (2 functions)
XInputGetState
XInputGetCapabilities
## ntdll.dll (2 functions)
RtlGetVersion
RtlVerifyVersionInfo
## shcore.dll (3 functions)
SetThreadDpiAwarenessContext
SetProcessDpiAwareness
GetDpiForMonitor
## api-ms-win-crt-*.dll (CRT) (62 functions)
malloc
calloc
free
realloc
memcmp
memcpy
memset
memchr
memmove
strcmp
strncmp
strncpy
strchr
strtod
strtoll
strtoull
atof
tolower
fopen
fclose
fread
fwrite
ftell
fseek
fflush
freopen_s
_wfopen
qsort
localeconv
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
__acrt_iob_func
___lc_codepage_func
_errno
_localtime64_s
acosf
ceilf
cosf
fmodf
logf
powf
sinf
sqrtf
_dclass
_dsign
_fdclass
_fdsign
_ldclass
_ldsign
_callnewh
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
## vcruntime140.dll / vcruntime140_1.dll (11 functions)
__CxxFrameHandler4
__C_specific_handler
_CxxThrowException
__std_terminate
__std_exception_copy
__std_exception_destroy
__current_exception
__current_exception_context
__std_type_info_destroy_list
_invoke_watson
_purecall
## msvcp140.dll (5 functions)
_Mtx_lock
_Mtx_unlock
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
@@ -0,0 +1,122 @@
# EF-Cheeto Reconstruction System Prompt
# Give this + the feed document to an AI for perfect reconstruction.
You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto
game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete
analysis document covering all 29 chapters of binary analysis plus a full
reconstruction header file. Use these to answer any reconstruction question.
## Binary Identity
- File: EF-Cheeto.dll
- Size: 3,956,736 bytes (0x3CE000)
- Base VA: 0x180000000
- .data base: 0x1803C5000 (RVA 0x3C5000)
- .rdata strings base: ~0x3A0000–0x3B4000
- IAT base: RVA 0xB1000
- Architecture: x86-64 Windows DLL (PE32+)
- Compiler: MSVC (x64 Release, C++17)
- Project path: E:\git\Endfield_Cheeto\
## What You Know (Summary)
### Module System (10 active modules + 1 ghost)
1. ESPModule — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
2. FPSModule — FPS counter overlay + FPS cap unlocker
3. NoClip — CharacterController.enabled toggle + move speed
4. FreeCam — CinemachineBrain camera override with WASD+mouse
5. FpsUnlocker — Application.set_targetFrameRate bypass (default 300fps)
6. SetDither — graphics dither toggle (stub, no per-frame effect)
7. PlayerProfile — Unity UI TextMeshPro text injection (UID + name changer)
8. Vacuum — Rigidbody.AddForce attraction loop
9. SkillHack — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
10. UnityExplorer — runtime Unity scene browser + GO/component inspector
11. DamageHack — GHOST FEATURE: i18n keys exist, zero code
### Key Subsystems
- GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
- HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
- ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
- D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
- Config: ImGui .ini persistence (no separate JSON config file)
- i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
- Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
- Thread safety: Toolhelp32 snapshot suspension around all code patches
### Critical Addresses (quick reference)
- DllMain: RVA 0x01000
- LoaderThread: RVA 0x05000
- Startup_main: RVA 0x0A9190
- GABypass::Patch: RVA 0x09D1E0
- ModuleManager::Init: RVA 0x09AC10
- HookMgr::CreateHook: RVA 0x0A9CC8
- OverlayWindowInit: RVA 0x0827A0
- WndProc: RVA 0x0826A0
- ESPModule singleton: VA 0x1803C6F70
- HookManager single: VA 0x1803C7470
- IL2CPP table start: [.data+0x1C48]
- g_Config base: [.data+0x1C00]
## How to Use This Document
- PART A contains all pseudocode, behavioral descriptions, and data tables
- PART B contains the compilable reconstruction header with all addresses
- For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
- For any struct: PART B has the layout; PART A has the behavioral context
- For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
- For string RVAs: PART B Section 27 has all 189 .rdata strings
Answer reconstruction questions by citing specific RVAs, field offsets, and
pseudocode from the document. When writing reconstructed C++, use the exact
struct layouts and address constants from PART B.
================================================================================
CONFIRMED IMGUI BUILD INFORMATION
================================================================================
## ImGui Version
- Repository: https://github.com/ocornut/imgui (docking branch)
- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
- Version: Dear ImGui 1.92.6 WIP (19253)
- Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)
## Source Files Compiled Into Binary
- imgui.cpp
- imgui_draw.cpp
- imgui_tables.cpp
- imgui_widgets.cpp
- imgui_demo.cpp — NOT compiled in (absent from binary)
- backends/imgui_impl_win32.cpp
- backends/imgui_impl_dx11.cpp
## Build Configuration
- NDEBUG defined (release build — zero IM_ASSERT strings in binary)
- MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
- PE compile timestamp: 2025-12-10 12:27:05 UTC
- No custom imconfig.h overrides detected
- Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
- No imgui_freetype, no imgui_demo
## ImGui Code Footprint in Binary
- .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
- Cheat-specific code begins at approximately RVA 0x7F000
- Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
- DX11 backend shader init: RVA 0x54DC0
- DX11 backend resource creation: RVA 0x551F0
- ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
- IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A
## Project Source Tree (from MSVC __FILE__ embeds)
- E:\git\Endfield_Cheeto\framework\helpers.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
- E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
- E:\git\Endfield_Cheeto\user\main.cpp
## To Reproduce Build
git clone https://github.com/ocornut/imgui
git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0
# Compile with MSVC 14.44, /O2, NDEBUG, x64
# Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp
# Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp
# No custom imconfig.h needed
File diff suppressed because it is too large. Load diff
File diff suppressed because it is too large. Load diff
@@ -0,0 +1,266 @@
# COMPLETE IMPORT TABLE — EF-Cheeto.dll
# All imported DLLs and functions needed for Visual Studio .def / linker
# These must ALL be linked in the VS project
## KERNEL32.dll (76 functions)
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CreateThread
TerminateThread
SuspendThread
ResumeThread
OpenThread
CloseHandle
GetLastError
GetProcAddress
LoadLibraryA
FreeLibrary
GetModuleHandleA
GetModuleHandleW
FlushInstructionCache
SetThreadContext
GetThreadContext
MultiByteToWideChar
WideCharToMultiByte
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
HeapCreate
HeapAlloc
HeapFree
HeapReAlloc
HeapDestroy
AllocConsole
FreeConsole
GetConsoleMode
SetConsoleMode
GetConsoleWindow
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleOutputCP
SetConsoleTitleA
GetStdHandle
CreateToolhelp32Snapshot
Thread32First
Thread32Next
K32EnumProcessModules
K32GetModuleFileNameExW
Sleep
OutputDebugStringA
GetSystemInfo
DisableThreadLibraryCalls
QueryPerformanceCounter
QueryPerformanceFrequency
GetLocaleInfoA
IsDBCSLeadByte
VerSetConditionMask
GetSystemTimeAsFileTime
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
LocalFree
FormatMessageA
GetLocaleInfoEx
AreFileApisANSI
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
WakeAllConditionVariable
InitializeSListHead
memmove
## USER32.dll (67 functions)
CreateWindowExW
DestroyWindow
RegisterClassExW
UnregisterClassW
DefWindowProcW
PeekMessageW
TranslateMessage
DispatchMessageW
PostQuitMessage
UpdateWindow
GetClientRect
GetWindowRect
GetWindowLongW
GetWindowLongPtrW
SetWindowLongW
SetWindowLongPtrW
SetWindowPos
ShowWindow
BringWindowToTop
IsIconic
IsWindow
IsWindowVisible
IsWindowUnicode
IsChild
FindWindowA
EnumWindows
GetForegroundWindow
SetForegroundWindow
SetFocus
GetCursorPos
SetCursorPos
GetCapture
SetCapture
ReleaseCapture
GetAsyncKeyState
GetKeyState
GetKeyboardLayout
GetMessageExtraInfo
TrackMouseEvent
ClientToScreen
ScreenToClient
WindowFromPoint
GetDC
ReleaseDC
GetDeviceCaps
CreateSolidBrush
LoadCursorW
LoadIconW
SetCursor
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromWindow
GetSystemMetrics
GetClassNameA
GetWindowThreadProcessId
AdjustWindowRectEx
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetPropA
SetPropA
SetLayeredWindowAttributes
SetWindowDisplayAffinity
GetWindowDisplayAffinity
SetProcessDPIAware
## GDI32.dll/SHELL32.dll (1 functions)
ShellExecuteW
## imm32.dll (4 functions)
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
## d3d11.dll (1 functions)
D3D11CreateDeviceAndSwapChain
## d3dcompiler_47.dll (1 functions)
D3DCompile
## dwmapi.dll (2 functions)
DwmExtendFrameIntoClientArea
DwmGetWindowAttribute
## xinput1_4.dll (2 functions)
XInputGetState
XInputGetCapabilities
## ntdll.dll (2 functions)
RtlGetVersion
RtlVerifyVersionInfo
## shcore.dll (3 functions)
SetThreadDpiAwarenessContext
SetProcessDpiAwareness
GetDpiForMonitor
## api-ms-win-crt-*.dll (CRT) (62 functions)
malloc
calloc
free
realloc
memcmp
memcpy
memset
memchr
memmove
strcmp
strncmp
strncpy
strchr
strtod
strtoll
strtoull
atof
tolower
fopen
fclose
fread
fwrite
ftell
fseek
fflush
freopen_s
_wfopen
qsort
localeconv
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsscanf
__acrt_iob_func
___lc_codepage_func
_errno
_localtime64_s
acosf
ceilf
cosf
fmodf
logf
powf
sinf
sqrtf
_dclass
_dsign
_fdclass
_fdsign
_ldclass
_ldsign
_callnewh
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
## vcruntime140.dll / vcruntime140_1.dll (11 functions)
__CxxFrameHandler4
__C_specific_handler
_CxxThrowException
__std_terminate
__std_exception_copy
__std_exception_destroy
__current_exception
__current_exception_context
__std_type_info_destroy_list
_invoke_watson
_purecall
## msvcp140.dll (5 functions)
_Mtx_lock
_Mtx_unlock
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
@@ -0,0 +1,166 @@
# EF-Cheeto Reconstruction System Prompt
# Give this + the feed document to an AI for perfect reconstruction.
You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto
game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete
analysis document covering all 29 chapters of binary analysis plus a full
reconstruction header file. Use these to answer any reconstruction question.
## Binary Identity
- File: EF-Cheeto.dll
- Size: 3,956,736 bytes (0x3CE000)
- Base VA: 0x180000000
- .data base: 0x1803C5000 (RVA 0x3C5000)
- .rdata strings base: ~0x3A0000–0x3B4000
- IAT base: RVA 0xB1000
- Architecture: x86-64 Windows DLL (PE32+)
- Compiler: MSVC (x64 Release, C++17)
- Project path: E:\git\Endfield_Cheeto\
## What You Know (Summary)
### Module System (10 active modules + 1 ghost)
1. ESPModule — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
2. FPSModule — FPS counter overlay + FPS cap unlocker
3. NoClip — CharacterController.enabled toggle + move speed
4. FreeCam — CinemachineBrain camera override with WASD+mouse
5. FpsUnlocker — Application.set_targetFrameRate bypass (default 300fps)
6. SetDither — graphics dither toggle (stub, no per-frame effect)
7. PlayerProfile — Unity UI TextMeshPro text injection (UID + name changer)
8. Vacuum — Rigidbody.AddForce attraction loop
9. SkillHack — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
10. UnityExplorer — runtime Unity scene browser + GO/component inspector
11. DamageHack — GHOST FEATURE: i18n keys exist, zero code
### Key Subsystems
- GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
- HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
- ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
- D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
- Config: ImGui .ini persistence (no separate JSON config file)
- i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
- Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
- Thread safety: Toolhelp32 snapshot suspension around all code patches
### Critical Addresses (quick reference)
- DllMain: RVA 0x01000
- LoaderThread: RVA 0x05000
- Startup_main: RVA 0x0A9190
- GABypass::Patch: RVA 0x09D1E0
- ModuleManager::Init: RVA 0x09AC10
- HookMgr::CreateHook: RVA 0x0A9CC8
- OverlayWindowInit: RVA 0x0827A0
- WndProc: RVA 0x0826A0
- ESPModule singleton: VA 0x1803C6F70
- HookManager single: VA 0x1803C7470
- IL2CPP table start: [.data+0x1C48]
- g_Config base: [.data+0x1C00]
## How to Use This Document
- PART A contains all pseudocode, behavioral descriptions, and data tables
- PART B contains the compilable reconstruction header with all addresses
- For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
- For any struct: PART B has the layout; PART A has the behavioral context
- For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
- For string RVAs: PART B Section 27 has all 189 .rdata strings
Answer reconstruction questions by citing specific RVAs, field offsets, and
pseudocode from the document. When writing reconstructed C++, use the exact
struct layouts and address constants from PART B.
================================================================================
CONFIRMED IMGUI BUILD INFORMATION
================================================================================
## ImGui Version
- Repository: https://github.com/ocornut/imgui (docking branch)
- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
- Version: Dear ImGui 1.92.6 WIP (19253)
- Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)
## Source Files Compiled Into Binary
- imgui.cpp
- imgui_draw.cpp
- imgui_tables.cpp
- imgui_widgets.cpp
- imgui_demo.cpp — NOT compiled in (absent from binary)
- backends/imgui_impl_win32.cpp
- backends/imgui_impl_dx11.cpp
## Build Configuration
- NDEBUG defined (release build — zero IM_ASSERT strings in binary)
- MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
- PE compile timestamp: 2025-12-10 12:27:05 UTC
- No custom imconfig.h overrides detected
- Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
- No imgui_freetype, no imgui_demo
## ImGui Code Footprint in Binary
- .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
- Cheat-specific code begins at approximately RVA 0x7F000
- Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
- DX11 backend shader init: RVA 0x54DC0
- DX11 backend resource creation: RVA 0x551F0
- ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
- IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A
## Project Source Tree (from MSVC __FILE__ embeds)
- E:\git\Endfield_Cheeto\framework\helpers.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
- E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
- E:\git\Endfield_Cheeto\user\main.cpp
## To Reproduce Build
git clone https://github.com/ocornut/imgui
git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0
# Compile with MSVC 14.44, /O2, NDEBUG, x64
# Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp
# Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp
# No custom imconfig.h needed
================================================================================
CONFIRMED THIRD-PARTY LIBRARY VERSIONS (extracted from binary)
================================================================================
## 1. Dear ImGui
- Repo: https://github.com/ocornut/imgui
- Branch: docking
- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0
- Version: 1.92.6 WIP (19253)
- Files to compile:
imgui.cpp
imgui_draw.cpp
imgui_tables.cpp
imgui_widgets.cpp
backends/imgui_impl_win32.cpp
backends/imgui_impl_dx11.cpp
- Config: NDEBUG, no custom imconfig.h, default ImDrawIdx (uint16_t)
## 2. nlohmann/json
- Repo: https://github.com/nlohmann/json
- Version: v3.12.0
- Commit: 961c151d2e87f2686a955a9be24d316f1362bf21
- Usage: Header-only (single-file json.hpp) — used ONLY for i18n translation table
- Include: #include "nlohmann/json.hpp" or #include "json.hpp"
- Note: The ABI namespace in this binary is nlohmann_json_abi_v3_12_0
## 3. Microsoft Detours — NOT USED
- .detourc/.detourd sections are MSVC thread-safe static init sections, NOT Detours
- The hook system is 100% custom (documented in HookManager chapters)
## Visual Studio Project Settings
- Platform: x64
- Configuration: Release
- Toolset: MSVC v143 (VS2022), toolchain version 14.44
- Subsystem: DLL (/LD)
- Runtime: /MD (Multi-threaded DLL — uses msvcp140.dll, vcruntime140.dll)
- Optimization: /O2 (maximize speed) — inferred from release build
- C++ Standard: /std:c++17 (confirmed from RTTI and STL usage)
- Character set: Unicode
- Additional libs to link:
kernel32.lib user32.lib gdi32.lib shell32.lib
d3d11.lib d3dcompiler.lib dwmapi.lib imm32.lib
shcore.lib xinput.lib ntdll.lib
File diff suppressed because it is too large. Load diff
File diff suppressed because it is too large. Load diff
@@ -0,0 +1,122 @@
# EF-Cheeto Reconstruction System Prompt
# Give this + the feed document to an AI for perfect reconstruction.
You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto
game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete
analysis document covering all 29 chapters of binary analysis plus a full
reconstruction header file. Use these to answer any reconstruction question.
## Binary Identity
- File: EF-Cheeto.dll
- Size: 3,956,736 bytes (0x3CE000)
- Base VA: 0x180000000
- .data base: 0x1803C5000 (RVA 0x3C5000)
- .rdata strings base: ~0x3A0000–0x3B4000
- IAT base: RVA 0xB1000
- Architecture: x86-64 Windows DLL (PE32+)
- Compiler: MSVC (x64 Release, C++17)
- Project path: E:\git\Endfield_Cheeto\
## What You Know (Summary)
### Module System (10 active modules + 1 ghost)
1. ESPModule — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
2. FPSModule — FPS counter overlay + FPS cap unlocker
3. NoClip — CharacterController.enabled toggle + move speed
4. FreeCam — CinemachineBrain camera override with WASD+mouse
5. FpsUnlocker — Application.set_targetFrameRate bypass (default 300fps)
6. SetDither — graphics dither toggle (stub, no per-frame effect)
7. PlayerProfile — Unity UI TextMeshPro text injection (UID + name changer)
8. Vacuum — Rigidbody.AddForce attraction loop
9. SkillHack — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
10. UnityExplorer — runtime Unity scene browser + GO/component inspector
11. DamageHack — GHOST FEATURE: i18n keys exist, zero code
### Key Subsystems
- GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
- HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
- ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
- D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
- Config: ImGui .ini persistence (no separate JSON config file)
- i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
- Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
- Thread safety: Toolhelp32 snapshot suspension around all code patches
### Critical Addresses (quick reference)
- DllMain: RVA 0x01000
- LoaderThread: RVA 0x05000
- Startup_main: RVA 0x0A9190
- GABypass::Patch: RVA 0x09D1E0
- ModuleManager::Init: RVA 0x09AC10
- HookMgr::CreateHook: RVA 0x0A9CC8
- OverlayWindowInit: RVA 0x0827A0
- WndProc: RVA 0x0826A0
- ESPModule singleton: VA 0x1803C6F70
- HookManager single: VA 0x1803C7470
- IL2CPP table start: [.data+0x1C48]
- g_Config base: [.data+0x1C00]
## How to Use This Document
- PART A contains all pseudocode, behavioral descriptions, and data tables
- PART B contains the compilable reconstruction header with all addresses
- For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
- For any struct: PART B has the layout; PART A has the behavioral context
- For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
- For string RVAs: PART B Section 27 has all 189 .rdata strings
Answer reconstruction questions by citing specific RVAs, field offsets, and
pseudocode from the document. When writing reconstructed C++, use the exact
struct layouts and address constants from PART B.
================================================================================
CONFIRMED IMGUI BUILD INFORMATION
================================================================================
## ImGui Version
- Repository: https://github.com/ocornut/imgui (docking branch)
- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
- Version: Dear ImGui 1.92.6 WIP (19253)
- Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)
## Source Files Compiled Into Binary
- imgui.cpp
- imgui_draw.cpp
- imgui_tables.cpp
- imgui_widgets.cpp
- imgui_demo.cpp — NOT compiled in (absent from binary)
- backends/imgui_impl_win32.cpp
- backends/imgui_impl_dx11.cpp
## Build Configuration
- NDEBUG defined (release build — zero IM_ASSERT strings in binary)
- MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
- PE compile timestamp: 2025-12-10 12:27:05 UTC
- No custom imconfig.h overrides detected
- Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
- No imgui_freetype, no imgui_demo
## ImGui Code Footprint in Binary
- .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
- Cheat-specific code begins at approximately RVA 0x7F000
- Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
- DX11 backend shader init: RVA 0x54DC0
- DX11 backend resource creation: RVA 0x551F0
- ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
- IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A
## Project Source Tree (from MSVC __FILE__ embeds)
- E:\git\Endfield_Cheeto\framework\helpers.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
- E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
- E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
- E:\git\Endfield_Cheeto\user\main.cpp
## To Reproduce Build
git clone https://github.com/ocornut/imgui
git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0
# Compile with MSVC 14.44, /O2, NDEBUG, x64
# Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp
# Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp
# No custom imconfig.h needed
+598
View File
@@ -0,0 +1,598 @@
#include "helpers.h"
#include <algorithm>
#include <array>
#include <cctype>
#include <cstdarg>
#include <cstdio>
#include <cstring>
#include <cwctype>
#include "nlohmann/json.hpp"
RuntimeConfig g_Runtime;
namespace {
std::mutex g_il2cpp_mutex;
std::unordered_map<uintptr_t, void*> g_il2cpp_slots;
void* g_il2cpp_domain_cached = nullptr;
void* (*g_il2cpp_domain_get_fn)() = nullptr;
void* (*g_il2cpp_thread_attach_fn)(void*) = nullptr;
void* (*g_il2cpp_thread_current_fn)() = nullptr;
void (*g_il2cpp_thread_detach_fn)(void*) = nullptr;
thread_local void* g_tls_il2cpp_thread = nullptr;
thread_local bool g_tls_il2cpp_attached_by_us = false;
thread_local bool g_tls_game_thread_context = false;
std::mutex g_i18n_mutex;
bool g_i18n_initialized = false;
std::unordered_map<std::string, std::string> g_en;
std::unordered_map<std::string, std::string> g_zh_cn;
constexpr const char* kI18nBlob = R"json(
{
"NoClip": {"en":"NoClip", "zh_cn":"NoClip"},
"FreeCam": {"en":"FreeCam", "zh_cn":"????"},
"Free Camera": {"en":"Free Camera", "zh_cn":"????"},
"Fps Unlocker": {"en":"Fps Unlocker", "zh_cn":"????"},
"FPSModule": {"en":"FPSModule", "zh_cn":"FPS??"},
"SetDither": {"en":"SetDither", "zh_cn":"????"},
"Set Dither": {"en":"Set Dither", "zh_cn":"????"},
"PlayerProfile": {"en":"PlayerProfile", "zh_cn":"????"},
"Vacuum": {"en":"Vacuum", "zh_cn":"??"},
"SkillHack": {"en":"SkillHack", "zh_cn":"????"},
"Free Skill": {"en":"Free Skill", "zh_cn":"????"},
"ESPModule": {"en":"ESPModule", "zh_cn":"ESP??"},
"ESP Features": {"en":"ESP Features", "zh_cn":"ESP??"},
"Prevent Screenshot": {"en":"Prevent Screenshot", "zh_cn":"???"},
"Unity Explorer": {"en":"Unity Explorer", "zh_cn":"Unity???"},
"Unity Explorer Window": {"en":"Unity Explorer Window", "zh_cn":"Unity?????"},
"ON / OFF": {"en":"ON / OFF", "zh_cn":"? / ?"},
"Move Speed": {"en":"Move Speed", "zh_cn":"????"},
"Look Sensitivity": {"en":"Look Sensitivity", "zh_cn":"?????"},
"Roll Speed": {"en":"Roll Speed", "zh_cn":"????"},
"FOV Speed": {"en":"FOV Speed", "zh_cn":"????"},
"FOV": {"en":"FOV", "zh_cn":"??"},
"Fps Value": {"en":"Fps Value", "zh_cn":"???"},
"UID text": {"en":"UID text", "zh_cn":"UID??"},
"Name text": {"en":"Name text", "zh_cn":"????"},
"Name changer": {"en":"Name changer", "zh_cn":"??"},
"Monster": {"en":"Monster", "zh_cn":"??"},
"Show Monsters": {"en":"Show Monsters", "zh_cn":"????"},
"Show NPC": {"en":"Show NPC", "zh_cn":"??NPC"},
"Show Friendly": {"en":"Show Friendly", "zh_cn":"????"},
"Show Puzzles": {"en":"Show Puzzles", "zh_cn":"??????"},
"Show All": {"en":"Show All", "zh_cn":"????"},
"Show Distance": {"en":"Show Distance", "zh_cn":"????"},
"Show Name": {"en":"Show Name", "zh_cn":"????"},
"Show Type": {"en":"Show Type", "zh_cn":"????"},
"Theme": {"en":"Theme", "zh_cn":"??"},
"Toggle Console": {"en":"Toggle Console", "zh_cn":"?????"},
"About": {"en":"About", "zh_cn":"??"},
"Player": {"en":"Player", "zh_cn":"??"},
"ESP": {"en":"ESP", "zh_cn":"ESP"},
"World": {"en":"World", "zh_cn":"??"},
"Visual": {"en":"Visual", "zh_cn":"??"},
"Settings": {"en":"Settings", "zh_cn":"??"},
"Damagehack Toggle": {"en":"Damagehack Toggle", "zh_cn":"????"},
"Damage Multiplier": {"en":"Damage Multiplier", "zh_cn":"????"},
"Multiplier Value": {"en":"Multiplier Value", "zh_cn":"???"},
"Random Damage Type": {"en":"Random Damage Type", "zh_cn":"??????"},
"This is free, if you spend money, then you have been deceived": {
"en":"This is free, if you spend money, then you have been deceived",
"zh_cn":"?????,??????,?????"
}
}
)json";
ImVec4 ParseHexColor(const char* rrggbbaa) {
unsigned int rgba = 0u;
sscanf_s(rrggbbaa, "%x", &rgba);
const float r = static_cast<float>((rgba >> 24) & 0xFF) / 255.0f;
const float g = static_cast<float>((rgba >> 16) & 0xFF) / 255.0f;
const float b = static_cast<float>((rgba >> 8) & 0xFF) / 255.0f;
const float a = static_cast<float>(rgba & 0xFF) / 255.0f;
return ImVec4(r, g, b, a);
}
void ApplyThemePalette(const std::array<const char*, 11>& colors) {
ImGuiStyle& style = ImGui::GetStyle();
style.Colors[ImGuiCol_Text] = ParseHexColor(colors[0]);
style.Colors[ImGuiCol_WindowBg] = ParseHexColor(colors[1]);
style.Colors[ImGuiCol_ChildBg] = ParseHexColor(colors[2]);
style.Colors[ImGuiCol_PopupBg] = ParseHexColor(colors[3]);
style.Colors[ImGuiCol_Border] = ParseHexColor(colors[4]);
style.Colors[ImGuiCol_FrameBg] = ParseHexColor(colors[5]);
style.Colors[ImGuiCol_FrameBgHovered] = ParseHexColor(colors[6]);
style.Colors[ImGuiCol_FrameBgActive] = ParseHexColor(colors[7]);
style.Colors[ImGuiCol_Button] = ParseHexColor(colors[8]);
style.Colors[ImGuiCol_ButtonHovered] = ParseHexColor(colors[9]);
style.Colors[ImGuiCol_ButtonActive] = ParseHexColor(colors[10]);
}
uintptr_t FindGameAssemblyBaseNow() {
HMODULE h = GetModuleHandleW(L"GameAssembly.dll");
if (!h) {
h = GetModuleHandleW(L"gameassembly.dll");
}
if (h) {
return reinterpret_cast<uintptr_t>(h);
}
HMODULE modules[2048] = {};
DWORD needed = 0;
if (!K32EnumProcessModules(GetCurrentProcess(), modules, sizeof(modules), &needed)) {
return 0;
}
const size_t count = needed / sizeof(HMODULE);
for (size_t i = 0; i < count; ++i) {
wchar_t path[MAX_PATH] = {};
if (K32GetModuleFileNameExW(GetCurrentProcess(), modules[i], path, MAX_PATH) == 0) {
continue;
}
std::wstring name = path;
std::transform(name.begin(), name.end(), name.begin(), [](wchar_t c) {
return static_cast<wchar_t>(::towlower(c));
});
if (name.find(L"gameassembly.dll") != std::wstring::npos) {
return reinterpret_cast<uintptr_t>(modules[i]);
}
}
return 0;
}
void ResolveIl2CppThreadApisOnce() {
HMODULE ga = GetModuleHandleW(L"GameAssembly.dll");
if (!ga) {
ga = GetModuleHandleW(L"gameassembly.dll");
}
if (!ga) {
return;
}
g_il2cpp_domain_get_fn =
reinterpret_cast<void* (*)()>(GetProcAddress(ga, "il2cpp_domain_get"));
g_il2cpp_thread_attach_fn =
reinterpret_cast<void* (*)(void*)>(GetProcAddress(ga, "il2cpp_thread_attach"));
g_il2cpp_thread_current_fn =
reinterpret_cast<void* (*)()>(GetProcAddress(ga, "il2cpp_thread_current"));
g_il2cpp_thread_detach_fn =
reinterpret_cast<void (*)(void*)>(GetProcAddress(ga, "il2cpp_thread_detach"));
}
} // namespace
const std::array<Il2cppSlotDefinition, 71> kIl2cppSlotMap = {{
{0x1C48, 0x09DC0120, "GameObject.GetComponentByIndex"},
{0x1C50, 0x0018CEC0, "il2cpp_domain_get_assemblies_A"},
{0x1C58, 0x0B390700, "Component.GetComponent<Transform>"},
{0x1C60, 0x0B3A2D20, "Transform.get_localScale"},
{0x1C68, 0x0B3A2CB0, "Transform.get_rotation"},
{0x1C70, 0x0018AD80, "il2cpp_object_get_class"},
{0x1C78, 0x00007480, "il2cpp_class_get_method_from_name"},
{0x1C80, 0x0B3A1AE0, "Transform.get_localPosition"},
{0x1C88, 0x0B3A1A70, "Transform.get_position"},
{0x1C90, 0x0B3A51D0, "Transform.set_localPosition"},
{0x1C98, 0x0B398830, "GameObject.SetActive"},
{0x1CA0, 0x0B3911F0, "GameObject.get_transform"},
{0x1CA8, 0x0B3A59D0, "Transform.set_rotation"},
{0x1CB0, 0x0B391D90, "GameObject.get_activeInHierarchy"},
{0x1CB8, 0x0B3B2410, "GameObject.get_tag"},
{0x1CC0, 0x0B3B2120, "GameObject.get_name"},
{0x1CC8, 0x0B3B40B0, "GameObject.get_layer"},
{0x1CD0, 0x0B397980, "GameObject.get_scene"},
{0x1CD8, 0x02F3DA80, "Game_SkillBuff_A"},
{0x1CE0, 0x00F27E10, "GetEntityName"},
{0x1CE8, 0x0B329000, "Component.GetComponents"},
{0x1CF0, 0x0B329D80, "Component.GetComponentsInChildren"},
{0x1CF8, 0x03E9BB50, "Game_SkillSlot_A"},
{0x1D00, 0x0B383F60, "Object.get_name"},
{0x1D08, 0x0B33CAB0, "Component.GetType_A"},
{0x1D10, 0x0B33CB00, "Component.GetType_B"},
{0x1D18, 0x039D1AA0, "Game_SkillSlot_B"},
{0x1D20, 0x026DE9F0, "Game_Combat_HitA"},
{0x1D28, 0x0478E860, "GetEntityManager"},
{0x1D30, 0x025E2D40, "Game_Combat_HitB"},
{0x1D38, 0x087C2CD0, "Game_Movement_PhysA"},
{0x1D40, 0x03419AF0, "Game_Movement_PhysB"},
{0x1D48, 0x0B322FB0, "Scene.get_name / Application.set_targetFrameRate ref"},
{0x1D50, 0x0B396A20, "SceneManager.GetActiveScene"},
{0x1D58, 0x0B397700, "CinemachineBrain.get_ActiveVirtualCamera"},
{0x1D60, 0x03766810, "Game_EntityState_A"},
{0x1D68, 0x0B3A2A60, "Transform.set_localScale"},
{0x1D70, 0x0B326660, "Rigidbody.get_velocity"},
{0x1D78, 0x0B3266B0, "Rigidbody.set_velocity"},
{0x1D80, 0x0B383200, "Object.Destroy"},
{0x1D88, 0x0B3A1A10, "Transform.set_position"},
{0x1D90, 0x0B3A2340, "Game_EntityState_B"},
{0x1D98, 0x0B421800, "Input.GetAxis(Mouse X)"},
{0x1DA0, 0x0B3A26D0, "Game_PlayerState_A"},
{0x1DA8, 0x0B3A1FB0, "Game_PlayerState_B"},
{0x1DB0, 0x0B32B030, "Game_PlayerHealthStat"},
{0x1DB8, 0x0B391240, "GameObject.SetActive (second ref)"},
{0x1DC0, 0x0B390440, "Camera.get_main"},
{0x1DC8, 0x0B390F80, "GameObject.FindObjectOfType"},
{0x1DD0, 0x0B3A19A0, "Transform.get_position (second ref)"},
{0x1DD8, 0x03F85430, "Game_SkillAction_C"},
{0x1DE0, 0x0B3A1D30, "Transform.set_rotation (second ref)"},
{0x1DE8, 0x0B3A1C90, "Camera.get_fieldOfView"},
{0x1DF0, 0x00E92CF0, "Game_EntityState_C"},
{0x1E00, 0x03DC14C0, "Game_SkillAction_D"},
{0x1E08, 0x03E0D2C0, "Game_SkillAction_E"},
{0x1E10, 0x03D9DF30, "Game_SkillAction_F"},
{0x1E18, 0x00E9E9F0, "Game_SkillAction_G"},
{0x1E20, 0x03EA53C0, "Game_SkillAction_H"},
{0x1E28, 0x0ACA0EC0, "TMPro.set_text"},
{0x1E30, 0x0B391D40, "UnityUI.Text.set_text"},
{0x1E38, 0x036AA8F0, "Game_SkillAction_I"},
{0x1E40, 0x03EC31C0, "Game_SkillAction_J"},
{0x1E48, 0x037F8CD0, "Game_EntityActor_D"},
{0x1E50, 0x036EA640, "Game_SkillAction_K"},
{0x1E58, 0x03EC30E0, "Game_SkillAction_L"},
{0x1E60, 0x037F2A40, "Game_EntityActor_E"},
{0x1E68, 0x037FD7E0, "Game_EntityActor_F"},
{0x1E70, 0x00D94C10, "il2cpp_domain_get"},
{0x1E78, 0x00D94DA0, "il2cpp_assembly_get_image"},
{0x1E80, 0x00D93A60, "il2cpp_domain_get_assemblies_B"},
}};
void Log(const char* fmt, ...) {
char buffer[2048] = {};
va_list args;
va_start(args, fmt);
std::vsnprintf(buffer, sizeof(buffer), fmt, args);
va_end(args);
OutputDebugStringA(buffer);
OutputDebugStringA("\n");
HANDLE h = GetStdHandle(STD_OUTPUT_HANDLE);
if (h != nullptr && h != INVALID_HANDLE_VALUE) {
DWORD written = 0;
WriteConsoleA(h, buffer, static_cast<DWORD>(std::strlen(buffer)), &written, nullptr);
WriteConsoleA(h, "\n", 1, &written, nullptr);
}
}
std::wstring Utf8ToWide(const std::string& value) {
if (value.empty()) {
return {};
}
const int size = MultiByteToWideChar(65001, 0, value.c_str(), -1, nullptr, 0);
if (size <= 0) {
return {};
}
std::wstring result(static_cast<size_t>(size), L'\0');
MultiByteToWideChar(65001, 0, value.c_str(), -1, result.data(), size);
if (!result.empty() && result.back() == L'\0') {
result.pop_back();
}
return result;
}
std::string WideToUtf8(const std::wstring& value) {
if (value.empty()) {
return {};
}
const int size = WideCharToMultiByte(65001, 0, value.c_str(), -1, nullptr, 0, nullptr, nullptr);
if (size <= 0) {
return {};
}
std::string result(static_cast<size_t>(size), '\0');
WideCharToMultiByte(65001, 0, value.c_str(), -1, result.data(), size, nullptr, nullptr);
if (!result.empty() && result.back() == '\0') {
result.pop_back();
}
return result;
}
uintptr_t GetGameAssemblyBase() {
if (g_Runtime.game_assembly_base != 0) {
return g_Runtime.game_assembly_base;
}
g_Runtime.game_assembly_base = FindGameAssemblyBaseNow();
return g_Runtime.game_assembly_base;
}
bool WaitForGameAssembly(uint32_t timeout_ms, uint32_t poll_ms) {
const ULONGLONG start = GetTickCount64();
while (g_Runtime.running.load(std::memory_order_relaxed) || timeout_ms == 0) {
const uintptr_t base = FindGameAssemblyBaseNow();
if (base != 0) {
g_Runtime.game_assembly_base = base;
return true;
}
if (timeout_ms != 0) {
const ULONGLONG elapsed = GetTickCount64() - start;
if (elapsed >= timeout_ms) {
break;
}
}
Sleep(poll_ms);
}
return false;
}
void ResolveGABypassSlots() {
std::scoped_lock lock(g_il2cpp_mutex);
g_il2cpp_slots.clear();
const uintptr_t base = GetGameAssemblyBase();
if (base == 0) {
Log("IL2CPP Domain Not Found!");
return;
}
for (const auto& slot : kIl2cppSlotMap) {
g_il2cpp_slots[slot.slot_offset] = reinterpret_cast<void*>(base + slot.gameassembly_offset);
}
Log("IL2CPP Domain Found: 0x%p", reinterpret_cast<void*>(base));
}
void* GetIl2cppSlot(uintptr_t slot_offset) {
std::scoped_lock lock(g_il2cpp_mutex);
const auto it = g_il2cpp_slots.find(slot_offset);
if (it == g_il2cpp_slots.end()) {
return nullptr;
}
return it->second;
}
bool EnsureIl2CppThreadAttached() {
if (!g_il2cpp_thread_attach_fn || !g_il2cpp_domain_get_fn) {
ResolveIl2CppThreadApisOnce();
}
if (!g_il2cpp_thread_attach_fn || !g_il2cpp_domain_get_fn) {
g_Runtime.il2cpp_thread_attached.store(false, std::memory_order_relaxed);
return false;
}
void* domain = g_il2cpp_domain_cached;
if (!domain) {
domain = g_il2cpp_domain_get_fn();
g_il2cpp_domain_cached = domain;
}
if (!domain) {
g_Runtime.il2cpp_thread_attached.store(false, std::memory_order_relaxed);
return false;
}
if (g_il2cpp_thread_current_fn) {
void* current = g_il2cpp_thread_current_fn();
if (current) {
g_tls_il2cpp_thread = current;
g_tls_il2cpp_attached_by_us = false;
g_Runtime.il2cpp_thread_attached.store(true, std::memory_order_relaxed);
return true;
}
} else if (g_tls_il2cpp_thread) {
g_Runtime.il2cpp_thread_attached.store(true, std::memory_order_relaxed);
return true;
}
void* attached = g_il2cpp_thread_attach_fn(domain);
if (!attached) {
g_Runtime.il2cpp_thread_attached.store(false, std::memory_order_relaxed);
return false;
}
g_tls_il2cpp_thread = attached;
g_tls_il2cpp_attached_by_us = true;
g_Runtime.il2cpp_thread_attached.store(true, std::memory_order_relaxed);
return true;
}
bool WaitForIl2CppThreadAttach(uint32_t timeout_ms, uint32_t poll_ms) {
const ULONGLONG start = GetTickCount64();
for (;;) {
if (EnsureIl2CppThreadAttached()) {
return true;
}
if (timeout_ms != 0) {
const ULONGLONG elapsed = GetTickCount64() - start;
if (elapsed >= timeout_ms) {
return false;
}
}
Sleep(poll_ms);
}
}
void DetachIl2CppThreadIfAttached() {
if (!g_tls_il2cpp_thread || !g_tls_il2cpp_attached_by_us) {
return;
}
if (!g_il2cpp_thread_detach_fn) {
ResolveIl2CppThreadApisOnce();
}
if (g_il2cpp_thread_detach_fn) {
g_il2cpp_thread_detach_fn(g_tls_il2cpp_thread);
}
g_tls_il2cpp_thread = nullptr;
g_tls_il2cpp_attached_by_us = false;
g_Runtime.il2cpp_thread_attached.store(false, std::memory_order_relaxed);
}
void SetGameThreadContext(bool enabled) {
g_tls_game_thread_context = enabled;
if (enabled) {
const DWORD tid = GetCurrentThreadId();
DWORD known = g_Runtime.game_thread_id.load(std::memory_order_relaxed);
if (known == 0) {
g_Runtime.game_thread_id.store(tid, std::memory_order_relaxed);
}
}
}
bool IsGameThreadContext() {
if (g_tls_game_thread_context) {
return true;
}
const DWORD known = g_Runtime.game_thread_id.load(std::memory_order_relaxed);
return known != 0 && known == GetCurrentThreadId();
}
bool IsWindowsBuildAtLeast(uint32_t build_number) {
using RtlGetVersionFn = LONG(WINAPI*)(PRTL_OSVERSIONINFOW);
static std::atomic<uint32_t> cached_build{0};
uint32_t value = cached_build.load(std::memory_order_acquire);
if (value == 0) {
HMODULE ntdll = GetModuleHandleW(L"ntdll.dll");
if (!ntdll) {
ntdll = LoadLibraryW(L"ntdll.dll");
}
if (!ntdll) {
return false;
}
auto* rtl_get_version = reinterpret_cast<RtlGetVersionFn>(
GetProcAddress(ntdll, "RtlGetVersion"));
if (!rtl_get_version) {
return false;
}
RTL_OSVERSIONINFOW info{};
info.dwOSVersionInfoSize = sizeof(info);
if (rtl_get_version(&info) == 0) {
value = info.dwBuildNumber;
cached_build.store(value, std::memory_order_release);
}
}
return value >= build_number;
}
void ToggleConsole(bool enabled) {
if (enabled) {
if (GetConsoleWindow() == nullptr) {
AllocConsole();
FILE* stream = nullptr;
freopen_s(&stream, "CONOUT$", "w", stdout);
freopen_s(&stream, "CONOUT$", "w", stderr);
SetConsoleOutputCP(65001);
SetConsoleTitleA("il2cpp Game Console");
}
} else {
if (GetConsoleWindow() != nullptr) {
ShowWindow(GetConsoleWindow(), SW_HIDE);
}
}
}
bool ScanLoadedModulesForInjectionMarkers() {
static const std::wstring kMarkerA = L"testyip";
static const std::wstring kMarkerB = L"gatmp.tmp";
static const std::wstring kMarkerC = L"ef-cheeto.dll";
HMODULE modules[2048] = {};
DWORD needed = 0;
if (!K32EnumProcessModules(GetCurrentProcess(), modules, sizeof(modules), &needed)) {
return false;
}
const size_t count = needed / sizeof(HMODULE);
for (size_t i = 0; i < count; ++i) {
wchar_t path[MAX_PATH] = {};
if (K32GetModuleFileNameExW(GetCurrentProcess(), modules[i], path, MAX_PATH) == 0) {
continue;
}
std::wstring lower = path;
std::transform(lower.begin(), lower.end(), lower.begin(), [](wchar_t c) {
return static_cast<wchar_t>(::towlower(c));
});
if (lower.find(kMarkerA) != std::wstring::npos ||
lower.find(kMarkerB) != std::wstring::npos ||
lower.find(kMarkerC) != std::wstring::npos) {
return true;
}
}
return false;
}
void InitializeI18N() {
std::scoped_lock lock(g_i18n_mutex);
if (g_i18n_initialized) {
return;
}
const nlohmann::json parsed = nlohmann::json::parse(kI18nBlob, nullptr, false);
if (!parsed.is_object()) {
g_i18n_initialized = true;
return;
}
for (auto it = parsed.begin(); it != parsed.end(); ++it) {
const std::string key = it.key();
const nlohmann::json& item = it.value();
if (!item.is_object()) {
continue;
}
g_en[key] = item.value("en", key);
g_zh_cn[key] = item.value("zh_cn", key);
}
g_i18n_initialized = true;
}
const char* Tr(const char* key) {
InitializeI18N();
std::scoped_lock lock(g_i18n_mutex);
const std::string k = key ? key : "";
const Language lang = g_Runtime.language.load(std::memory_order_relaxed);
const auto fallback_it = g_en.find(k);
if (lang == Language::ZhCN) {
const auto it = g_zh_cn.find(k);
if (it != g_zh_cn.end()) {
return it->second.c_str();
}
}
if (fallback_it != g_en.end()) {
return fallback_it->second.c_str();
}
return key ? key : "";
}
void SetLanguage(Language language) {
g_Runtime.language.store(language, std::memory_order_relaxed);
}
void ApplyThemeDefault() {
ImGui::StyleColorsDark();
}
void ApplyThemeEvangelionUnit01() {
static constexpr std::array<const char*, 11> kColors = {{
"FFFFFFFF", "7857A7FF", "19171CFF", "2A282EFF", "2A282EE6", "4DE6A5FF",
"00000000", "4A455240", "A38CCF80", "7857A780", "4A4552FF"}};
ApplyThemePalette(kColors);
}
void ApplyThemeEvangelionUnit02() {
static constexpr std::array<const char*, 11> kColors = {{
"FFFFFFFF", "D9293BFF", "1E1E1EFF", "3A3A3AFF", "3A3A3AE6", "F7B302FF",
"00000000", "4A455240", "F7465880", "D9293B80", "4A4552FF"}};
ApplyThemePalette(kColors);
}
void ApplyThemeMatrix() {
static constexpr std::array<const char*, 11> kColors = {{
"00FF41FF", "00AA2CFF", "000000FF", "0A0A0AFF", "0A0A0AE6", "004400FF",
"00000000", "00440040", "00881EFF", "00FF4180", "00FF4180"}};
ApplyThemePalette(kColors);
}
bool IsKeyPressedOnce(int vk) {
return (GetAsyncKeyState(vk) & 0x1) != 0;
}
+51
View File
@@ -0,0 +1,51 @@
#pragma once
#include "Common.h"
struct Il2cppSlotDefinition {
uintptr_t slot_offset;
uintptr_t gameassembly_offset;
const char* name;
};
extern const std::array<Il2cppSlotDefinition, 71> kIl2cppSlotMap;
void Log(const char* fmt, ...);
void ResolveGABypassSlots();
void* GetIl2cppSlot(uintptr_t slot_offset);
uintptr_t GetGameAssemblyBase();
bool WaitForGameAssembly(uint32_t timeout_ms = 0, uint32_t poll_ms = 100);
bool EnsureIl2CppThreadAttached();
bool WaitForIl2CppThreadAttach(uint32_t timeout_ms = 15000, uint32_t poll_ms = 100);
void DetachIl2CppThreadIfAttached();
void SetGameThreadContext(bool enabled);
bool IsGameThreadContext();
std::wstring Utf8ToWide(const std::string& value);
std::string WideToUtf8(const std::wstring& value);
bool IsWindowsBuildAtLeast(uint32_t build_number);
void ToggleConsole(bool enabled);
bool ScanLoadedModulesForInjectionMarkers();
void InitializeI18N();
const char* Tr(const char* key);
void SetLanguage(Language language);
void ApplyThemeDefault();
void ApplyThemeEvangelionUnit01();
void ApplyThemeEvangelionUnit02();
void ApplyThemeMatrix();
bool IsKeyPressedOnce(int vk);
template <typename Fn>
Fn GetIl2cppFn(uintptr_t slot_offset) {
if (!IsGameThreadContext()) {
return nullptr;
}
if (!EnsureIl2CppThreadAttached()) {
return nullptr;
}
return reinterpret_cast<Fn>(GetIl2cppSlot(slot_offset));
}
+59
View File
@@ -0,0 +1,59 @@
#include "ModuleManager.h"
#include "UI.h"
#include "helpers.h"
namespace {
DWORD WINAPI LoaderThreadProc(LPVOID) {
ToggleConsole(true);
Log("Initializing..");
g_Runtime.running.store(true, std::memory_order_relaxed);
InitializeI18N();
Log("Waiting for GameAssembly.dll ...");
if (!WaitForGameAssembly(120000, 200)) {
Log("IL2CPP Domain Not Found!");
g_Runtime.running.store(false, std::memory_order_relaxed);
return 0;
}
ResolveGABypassSlots();
g_Runtime.il2cpp_thread_attached.store(false, std::memory_order_relaxed);
g_Runtime.game_thread_id.store(0, std::memory_order_relaxed);
Log("IL2CPP thread attach deferred to game-thread dispatcher");
if (ScanLoadedModulesForInjectionMarkers()) {
Log("Module path scanner matched testyip/gatmp.tmp/EF-Cheeto.dll");
}
RegisterDefaultModules();
GetModuleManager().Init();
RunOverlayLoop();
ShutdownOverlayWindow();
DetachIl2CppThreadIfAttached();
g_Runtime.running.store(false, std::memory_order_relaxed);
Log("Shutdown complete");
return 0;
}
} // namespace
BOOL APIENTRY DllMain(HMODULE module, DWORD reason, LPVOID) {
switch (reason) {
case DLL_PROCESS_ATTACH: {
DisableThreadLibraryCalls(module);
HANDLE thread = CreateThread(nullptr, 0, LoaderThreadProc, nullptr, 0, nullptr);
if (thread) {
CloseHandle(thread);
}
break;
}
case DLL_PROCESS_DETACH:
g_Runtime.running.store(false, std::memory_order_relaxed);
break;
default:
break;
}
return TRUE;
}
+35
View File
@@ -0,0 +1,35 @@
i:\ef-cheeto\project\obj\modulemanager.obj
i:\ef-cheeto\project\obj\playerprofile.obj
i:\ef-cheeto\project\obj\imgui_draw.obj
i:\ef-cheeto\project\obj\imgui_impl_dx11.obj
i:\ef-cheeto\project\obj\unityexplorer.obj
i:\ef-cheeto\project\obj\imgui_tables.obj
i:\ef-cheeto\project\obj\ui.obj
i:\ef-cheeto\project\obj\fpsunlocker.obj
i:\ef-cheeto\project\obj\fpsmodule.obj
i:\ef-cheeto\project\obj\setdither.obj
i:\ef-cheeto\project\obj\skillhack.obj
i:\ef-cheeto\project\obj\helpers.obj
i:\ef-cheeto\project\obj\main.obj
i:\ef-cheeto\project\obj\imgui.obj
i:\ef-cheeto\project\obj\vacuum.obj
i:\ef-cheeto\project\obj\noclip.obj
i:\ef-cheeto\project\obj\imgui_impl_win32.obj
i:\ef-cheeto\project\obj\freecam.obj
i:\ef-cheeto\project\obj\settingstab.obj
i:\ef-cheeto\project\obj\esp.obj
i:\ef-cheeto\project\obj\imgui_widgets.obj
i:\ef-cheeto\project\obj\preventscreenshot.obj
i:\ef-cheeto\project\obj\vc143.pdb
i:\ef-cheeto\project\bin\ef-cheeto.dll
i:\ef-cheeto\project\obj\ef-cheeto.ipdb
i:\ef-cheeto\project\obj\ef-cheeto.iobj
i:\ef-cheeto\project\obj\ef-cheeto.vcxproj.filelistabsolute.txt
i:\ef-cheeto\project\obj\ef-cheeto.tlog\cl.11360.write.1.tlog
i:\ef-cheeto\project\obj\ef-cheeto.tlog\cl.command.1.tlog
i:\ef-cheeto\project\obj\ef-cheeto.tlog\cl.items.tlog
i:\ef-cheeto\project\obj\ef-cheeto.tlog\cl.read.1.tlog
i:\ef-cheeto\project\obj\ef-cheeto.tlog\link.command.1.tlog
i:\ef-cheeto\project\obj\ef-cheeto.tlog\link.read.1.tlog
i:\ef-cheeto\project\obj\ef-cheeto.tlog\link.secondary.1.tlog
i:\ef-cheeto\project\obj\ef-cheeto.tlog\link.write.1.tlog
+11
View File
@@ -0,0 +1,11 @@
<?xml version="1.0" encoding="utf-8"?>
<Project>
<ProjectOutputs>
<ProjectOutput>
<FullPath>I:\EF-Cheeto\project\bin\EF-Cheeto.dll</FullPath>
</ProjectOutput>
</ProjectOutputs>
<ContentFiles />
<SatelliteDlls />
<NonRecipeFileRefs />
</Project>
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
+22
View File
@@ -0,0 +1,22 @@
I:\EF-Cheeto\project\third_party\imgui\imgui.cpp;I:\EF-Cheeto\project\obj\imgui.obj
I:\EF-Cheeto\project\third_party\imgui\imgui_draw.cpp;I:\EF-Cheeto\project\obj\imgui_draw.obj
I:\EF-Cheeto\project\third_party\imgui\imgui_tables.cpp;I:\EF-Cheeto\project\obj\imgui_tables.obj
I:\EF-Cheeto\project\third_party\imgui\imgui_widgets.cpp;I:\EF-Cheeto\project\obj\imgui_widgets.obj
I:\EF-Cheeto\project\third_party\imgui\backends\imgui_impl_win32.cpp;I:\EF-Cheeto\project\obj\imgui_impl_win32.obj
I:\EF-Cheeto\project\third_party\imgui\backends\imgui_impl_dx11.cpp;I:\EF-Cheeto\project\obj\imgui_impl_dx11.obj
I:\EF-Cheeto\project\main.cpp;I:\EF-Cheeto\project\obj\main.obj
I:\EF-Cheeto\project\helpers.cpp;I:\EF-Cheeto\project\obj\helpers.obj
I:\EF-Cheeto\project\ModuleManager.cpp;I:\EF-Cheeto\project\obj\ModuleManager.obj
I:\EF-Cheeto\project\UI.cpp;I:\EF-Cheeto\project\obj\UI.obj
I:\EF-Cheeto\project\SettingsTAB.cpp;I:\EF-Cheeto\project\obj\SettingsTAB.obj
I:\EF-Cheeto\project\ESP.cpp;I:\EF-Cheeto\project\obj\ESP.obj
I:\EF-Cheeto\project\NoClip.cpp;I:\EF-Cheeto\project\obj\NoClip.obj
I:\EF-Cheeto\project\FreeCam.cpp;I:\EF-Cheeto\project\obj\FreeCam.obj
I:\EF-Cheeto\project\FpsUnlocker.cpp;I:\EF-Cheeto\project\obj\FpsUnlocker.obj
I:\EF-Cheeto\project\FPSModule.cpp;I:\EF-Cheeto\project\obj\FPSModule.obj
I:\EF-Cheeto\project\SkillHack.cpp;I:\EF-Cheeto\project\obj\SkillHack.obj
I:\EF-Cheeto\project\Vacuum.cpp;I:\EF-Cheeto\project\obj\Vacuum.obj
I:\EF-Cheeto\project\PlayerProfile.cpp;I:\EF-Cheeto\project\obj\PlayerProfile.obj
I:\EF-Cheeto\project\SetDither.cpp;I:\EF-Cheeto\project\obj\SetDither.obj
I:\EF-Cheeto\project\PreventScreenshot.cpp;I:\EF-Cheeto\project\obj\PreventScreenshot.obj
I:\EF-Cheeto\project\UnityExplorer.cpp;I:\EF-Cheeto\project\obj\UnityExplorer.obj
@@ -0,0 +1,2 @@
PlatformToolSet=v143:VCToolArchitecture=Native32Bit:VCToolsVersion=14.44.35207:TargetPlatformVersion=10.0.26100.0:
Release|x64|I:\EF-Cheeto\project\|
Binary file not shown.
Binary file not shown.
@@ -0,0 +1,3 @@
^I:\EF-CHEETO\PROJECT\OBJ\ESP.OBJ|I:\EF-CHEETO\PROJECT\OBJ\FPSMODULE.OBJ|I:\EF-CHEETO\PROJECT\OBJ\FPSUNLOCKER.OBJ|I:\EF-CHEETO\PROJECT\OBJ\FREECAM.OBJ|I:\EF-CHEETO\PROJECT\OBJ\HELPERS.OBJ|I:\EF-CHEETO\PROJECT\OBJ\IMGUI.OBJ|I:\EF-CHEETO\PROJECT\OBJ\IMGUI_DRAW.OBJ|I:\EF-CHEETO\PROJECT\OBJ\IMGUI_IMPL_DX11.OBJ|I:\EF-CHEETO\PROJECT\OBJ\IMGUI_IMPL_WIN32.OBJ|I:\EF-CHEETO\PROJECT\OBJ\IMGUI_TABLES.OBJ|I:\EF-CHEETO\PROJECT\OBJ\IMGUI_WIDGETS.OBJ|I:\EF-CHEETO\PROJECT\OBJ\MAIN.OBJ|I:\EF-CHEETO\PROJECT\OBJ\MODULEMANAGER.OBJ|I:\EF-CHEETO\PROJECT\OBJ\NOCLIP.OBJ|I:\EF-CHEETO\PROJECT\OBJ\PLAYERPROFILE.OBJ|I:\EF-CHEETO\PROJECT\OBJ\PREVENTSCREENSHOT.OBJ|I:\EF-CHEETO\PROJECT\OBJ\SETDITHER.OBJ|I:\EF-CHEETO\PROJECT\OBJ\SETTINGSTAB.OBJ|I:\EF-CHEETO\PROJECT\OBJ\SKILLHACK.OBJ|I:\EF-CHEETO\PROJECT\OBJ\UI.OBJ|I:\EF-CHEETO\PROJECT\OBJ\UNITYEXPLORER.OBJ|I:\EF-CHEETO\PROJECT\OBJ\VACUUM.OBJ
I:\EF-Cheeto\project\obj\EF-Cheeto.IPDB
I:\EF-Cheeto\project\obj\EF-Cheeto.iobj
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
File diff suppressed because it is too large. Load diff