113 KiB
EF-CHEETO RECONSTRUCTION FEED — PART 2/3
This part: Reconstruction header with all structs, RVAs, string table, IL2CPP table.
Feed with Parts 1 and 3 for complete reconstruction context.
================================================================================ RECONSTRUCTION HEADER (ef_cheeto_reconstruction.h) Compiles: g++ -std=c++17 -fsyntax-only 2,092 lines covering 538 RVAs, 97 .data addresses, 189 strings, 75 IAT entries
// ============================================================================ // EF-Cheeto (unityexplorer.dll) — Reconstruction Headers // Derived from: EF-Cheeto_Vol12_Final_Analysis.docx (complete binary audit) // Target: x86-64 Windows DLL, MSVC build, GameAssembly.dll (Endfield) // Base VA: 0x180000000 | .data base: 0x1803C5000 (RVA 0x3C5000) // ============================================================================
#pragma once #include #include
// ============================================================================ // SECTION 1 — PRIMITIVE TYPEDEFS // ============================================================================
using u8 = uint8_t; using u16 = uint16_t; using u32 = uint32_t; using u64 = uint64_t; using i32 = int32_t; using f32 = float; using f64 = double; using BOOL = int; // IL2CPP managed bool return (al register)
// ============================================================================ // SECTION 2 — GLOBAL .DATA LAYOUT (abridged — key singletons) // ============================================================================ // All offsets are RVA from binary base 0x180000000. // VA = 0x180000000 + RVA. // .data region starts at RVA 0x3C5000 (VA 0x1803C5000). // References below use shorthand [.data+N] meaning VA 0x1803C5000 + N. // // Key global pointers: // [.data+0x00D8] g_D3DState ptr (D3D11 device/swap chain block) // [.data+0x00E0] active_preset_name (std::string — "Preset0".."Preset3") // [.data+0x00EC] active_preset_index (DWORD — 0-3) // [.data+0x00F0] gameassembly_base (cached GetModuleHandleW result) // [.data+0x1E88] hook_spinlock (DWORD — 0=free, 1=held) // [.data+0x1E90] hook_allocator_ptr (IAllocator for hook_array, capacity 0x80) // [.data+0x23B8] ModuleManager.registrars_begin // [.data+0x23C0] ModuleManager.registrars_end // [.data+0x23C8] ModuleManager.registrars_cap // [.data+0x2398] ModuleManager object ptr // [.data+0x23A8] ModuleManager secondary ptr // [.data+0x23D0] ModuleManager once_flag (std::once_flag)
// ============================================================================ // SECTION 3 — g_Config (global config object) // ============================================================================ // g_Config is a large global object stored in .data. // Fields below are offsets FROM the g_Config object base (not from .data base). // g_Config does not have a single documented base address — it IS .data in // the relevant regions. Use field VA = 0x1803C5000 + offset where offset // matches the [.data+N] values from the doc. // // PANEL / UI scroll state (used by all module Render() panel-open sequences) struct GConfigPanelFields { // offset from g_Config (which sits at .data) // [g_Config+0x0058] scroll_base (float) — horizontal scroll base offset // [g_Config+0x00D8] d3d_state_ptr (void*) — D3D11 state block // [g_Config+0x0150] panel_width (float) — rendered panel content width // [g_Config+0x0194] scroll_accum (float) — accumulated horizontal scroll // [g_Config+0x0198] scroll_total (float) — total scroll range // [g_Config+0x0E0C] scroll_step (float) — per-frame scroll delta // [g_Config+0x15D8] panel_ptr (void*) — pointer to active ImGui panel struct // [g_Config+0x1BEC] imgui_ini_fallback (void*) — fallback .ini path ptr // [g_Config+0x1C00] scroll_region_root (void*) — root of scroll region config // [g_Config+0x1F68] active_tab_idx (DWORD) — written by binding state array };
// Panel-open sequence (all modules — addss path): // rax = *panel_ptr; // rax->field_0x103 = 1; // xmm0 = scroll_step + rax->scroll_accum + rax->scroll_base + rax->scroll_total; // rax->panel_width = xmm0; // Panel-close sequence (subss path): same but scroll_accum -= scroll_step.
// HOOK SLOTS [g_Config+0x1E40..0x1E68] (SkillHack IL2CPP hook target pointers) // [g_Config+0x1E40] hook5_target — ApplySkillCost() (void fn) // [g_Config+0x1E48] hook6_target — (dispatcher target) // [g_Config+0x1E50] hook3_target — GetCooldownPercent() (float fn) // [g_Config+0x1E58] hook4_target — IsSkillAvailable() (BOOL fn) // [g_Config+0x1E60] hook1_target — skill check A (BOOL fn) // [g_Config+0x1E68] hook2_target — skill check B (BOOL fn)
// OVERLAY FLAGS (written by UnityExplorer when window is active) // [g_Config+0x1F78] overlay_flags (DWORD) — |= 1 when UE window open // [g_Config+0x1F90] overlay_scale (float) — set to 300.0f when UE open
// ============================================================================ // SECTION 4 — IL2CPP FUNCTION POINTER TABLE // ============================================================================ // GABypass::Patch (RVA 0xA9120) resolves 71 function pointers from // GameAssembly.dll at DLL attach and writes them to .data slots. // Format: slot_rva = .data offset from g_base 0x1803C5000 // Access: fn_ptr = (void*)(gameassembly_base + il2cpp_offset) // // Key: ptr = (void*)(.data + slot_rva) // call as: ((RetType(*)(Args...))(ptr))(args...);
struct IL2CPP_Table { // Slot .data-offset | IL2CPP offset | Resolved name void* GameObject_GetComponentByIndex; // 0x1C48 +0x09DC0120 void* il2cpp_domain_get_assemblies_A; // 0x1C50 +0x0018CEC0 void* Component_GetComponent_Transform; // 0x1C58 +0x0B390700 void* Transform_get_localScale; // 0x1C60 +0x0B3A2D20 void* Transform_get_rotation; // 0x1C68 +0x0B3A2CB0 void* il2cpp_object_get_class; // 0x1C70 +0x0018AD80 void* il2cpp_class_get_method_from_name;// 0x1C78 +0x00007480 void* Transform_get_localPosition; // 0x1C80 +0x0B3A1AE0 void* Transform_get_position; // 0x1C88 +0x0B3A1A70 [also 0x1DD0] void* Transform_set_localPosition; // 0x1C90 +0x0B3A51D0 void* GameObject_SetActive; // 0x1C98 +0x0B398830 [also 0x1DB8] void* GameObject_get_transform; // 0x1CA0 +0x0B3911F0 void* Transform_set_rotation; // 0x1CA8 +0x0B3A59D0 [also 0x1DE0] void* GameObject_get_activeInHierarchy; // 0x1CB0 +0x0B391D90 void* GameObject_get_tag; // 0x1CB8 +0x0B3B2410 void* GameObject_get_name; // 0x1CC0 +0x0B3B2120 void* GameObject_get_layer; // 0x1CC8 +0x0B3B40B0 void* GameObject_get_scene; // 0x1CD0 +0x0B397980 void* Game_SkillBuff_A; // 0x1CD8 +0x02F3DA80 (SkillHack) void* GetEntityName; // 0x1CE0 +0x00F27E10 (ESP label) void* Component_GetComponents; // 0x1CE8 +0x0B329000 void* Component_GetComponentsInChildren;// 0x1CF0 +0x0B329D80 void* Game_SkillSlot_A; // 0x1CF8 +0x03E9BB50 (SkillHack) void* Object_get_name; // 0x1D00 +0x0B383F60 void* Component_GetType_A; // 0x1D08 +0x0B33CAB0 void* Component_GetType_B; // 0x1D10 +0x0B33CB00 void* Game_SkillSlot_B; // 0x1D18 +0x039D1AA0 (SkillHack) void* Game_Combat_HitA; // 0x1D20 +0x026DE9F0 void* GetEntityManager; // 0x1D28 +0x0478E860 (NoClip/FpsUnlocker) void* Game_Combat_HitB; // 0x1D30 +0x025E2D40 void* Game_Movement_PhysA; // 0x1D38 +0x087C2CD0 (NoClip CharCtrl) void* Game_Movement_PhysB; // 0x1D40 +0x03419AF0 (NoClip CharCtrl) void* Application_set_targetFrameRate; // 0x1D48 +0x0B322FB0 (FpsUnlocker) void* SceneManager_GetActiveScene; // 0x1D50 +0x0B396A20 void* CinemachineBrain_GetActiveVCam; // 0x1D58 +0x0B397700 (FreeCam) void* Game_EntityState_A; // 0x1D60 +0x03766810 (ESP/SkillHack) void* Transform_set_localScale; // 0x1D68 +0x0B3A2A60 void* Rigidbody_get_velocity; // 0x1D70 +0x0B326660 (NoClip/Vacuum) void* Rigidbody_set_velocity; // 0x1D78 +0x0B3266B0 (NoClip/Vacuum) void* Object_Destroy; // 0x1D80 +0x0B383200 void* Transform_set_position; // 0x1D88 +0x0B3A1A10 (NoClip/Vacuum) void* Game_EntityState_B; // 0x1D90 +0x0B3A2340 (ESP) void* Input_GetAxis_MouseX; // 0x1D98 +0x0B421800 (FreeCam look X) void* Game_PlayerState_A; // 0x1DA0 +0x0B3A26D0 (ESP/SkillHack) void* Game_PlayerState_B; // 0x1DA8 +0x0B3A1FB0 (ESP/SkillHack) void* Game_PlayerHealthStat; // 0x1DB0 +0x0B32B030 (ESP health) void* Camera_get_main; // 0x1DC0 +0x0B390440 (ESP/FreeCam) void* GameObject_FindObjectOfType; // 0x1DC8 +0x0B390F80 void* Game_SkillAction_C; // 0x1DD8 +0x03F85430 (SkillHack) void* GetDeltaTime; // 0x1D38 +0x087C2CD0 (also FPS overlay) void* Camera_get_fieldOfView; // 0x1DE8 +0x0B3A1C90 (FreeCam FOV) void* Game_EntityState_C; // 0x1DF0 +0x00E92CF0 (ESP) void* Rigidbody_AddForce; // 0x1E00 +0x03DC14C0 (Vacuum) void* CharCtrl_set_enabled; // 0x1E08 +0x03E0D2C0 (NoClip) void* Game_SkillAction_F; // 0x1E10 +0x03D9DF30 (SkillHack) void* Game_SkillAction_G; // 0x1E18 +0x00E9E9F0 (SkillHack) void* GetCharacterController; // 0x1E20 +0x03EA53C0 (NoClip) void* TMPro_set_text; // 0x1E28 +0x0ACA0EC0 (PlayerProfile/NameChanger) void* UnityUI_Text_set_text; // 0x1E30 +0x0B391D40 (ON/OFF labels) void* Game_SkillAction_I; // 0x1E38 +0x036AA8F0 (SkillHack) void* Game_SkillAction_J; // 0x1E40 +0x03EC31C0 (SkillHack hook5 target) void* Game_EntityActor_D; // 0x1E48 +0x037F8CD0 (ESP/combat, hook6 target) void* Game_SkillAction_K; // 0x1E50 +0x036EA640 (hook3/cooldown target) void* Game_SkillAction_L; // 0x1E58 +0x03EC30E0 (hook4/avail target) void* Game_EntityActor_E; // 0x1E60 +0x037F2A40 (hook1 target) void* Game_EntityActor_F; // 0x1E68 +0x037FD7E0 (hook2 target) void* il2cpp_domain_get; // 0x1E70 +0x00D94C10 void* il2cpp_assembly_get_image; // 0x1E78 +0x00D94DA0 void* il2cpp_domain_get_assemblies_B; // 0x1E80 +0x00D93A60 };
// ============================================================================ // SECTION 5 — BASE CLASS // ============================================================================
struct BaseModule { void* vtable; // [+0x00] vtable ptr // std::string name at [+0x08] (SSO string, 24 bytes total: ptr+len+cap) char name_sso[24]; // [+0x08] SSO buffer // std::string tab_name at [+0x20] char tab_name_sso[24]; // [+0x20] secondary name / tab label (SSO) u8 enabled; // [+0x28] ON/OFF flag (BYTE) u8 _pad[7]; // [+0x29..+0x2F] // module-specific fields follow at [+0x30] };
// BaseModule vtable layout (from factory stubs RVA 0x9B660–0x9B7A0): // [0] +0x00 copy-ctor / factory() — placement-new ctor, writes vtable, returns this // [1] +0x08 copy-ctor / factory() — same as [0] // [2] +0x10 Init() / RegisterTab() — jmp stub → actual RegisterTab fn // [3] +0x18 Render() — per-frame UI + game-state dispatch // [4] +0x20 ~BaseModule() — dtor: frees name string, optional delete // [5] +0x28 getNamePtr() — returns &this->name_string (+0x08) // [6] +0x30 onHotkey() — pure virtual (sentinel value = 1) // [7] +0x38 getLinkedModuleFactory() — returns paired module factory ptr
// ============================================================================ // SECTION 6 — MODULE STATE STRUCTS // ============================================================================
// --- NoClip --- // Singleton base: [.data+0x27B0] (referenced by RegisterTab / Render calls) // Object size: ~0x38 bytes struct NoClipModule : BaseModule { // [+0x28] u8 enabled (ON/OFF checkbox) i32 move_speed; // [+0x30] DragInt range [1, 10], default unknown }; // NoClip function table: // RegisterTab 0x081300 — one-time init // Render 0x0813D0 — ImGui panel (checkbox + Move Speed slider) // Update 0x089B50 — per-frame CharacterController toggle // Update stub 0x089B00 — tab destructor/cleanup wrapper // Update stub2 0x089B40 — tab #2 setup (lea rdx, panel_callback → jmp 0x89060)
// --- FreeCam --- // Singleton base: [.data+0x2200] (0xD8 bytes, zeroed by RegisterMainTab) struct FreeCamModule : BaseModule { // [+0x28] u8 enabled f32 move_speed; // [+0x30] SliderFloat max=500.0f default=30.0f f32 roll_speed; // [+0x34] SliderFloat max=100.0f f32 fov_speed; // [+0x38] (Look Sensitivity slider) u8 _pad2[0x28]; // [+0x3C..+0x63] void* active_cam_ptr; // [+0x68] cached active camera GameObject* void* override_cam_ptr; // [+0x70] override camera ptr (cleared on disable) u8 _pad3[0x40]; // [+0x78..+0xB7] u8 cam_override_active; // [+0xB8] // Key bindings written at RegisterMainTab to [.data+0x2230..0x225E]: // [+0x2230] movdqa block1 = 0x1803B34F0 (WASD + misc keys) // [+0x2240] movdqa block2 = 0x1803B35C0 // [+0x2250] 0x3F800000 = 1.0f (FOV multiplier default) // [+0x2254] 0x44415357 = 'WASD' key code mask // [+0x2258] 0x6D6BA220 = additional keybind // [+0x225C] 0x2725 = two-byte keybind // [+0x225E] 0x60 = backtick key code // Accumulator floats [+0x2260..0x22A8] pitch/yaw/roll/FOV — zeroed on init }; // FreeCam function table: // RegisterFpsTab 0x0814C0 — registers FPS Monitor overlay tab // RegisterMainTab 0x081590 — zeroes 0xD8 state, writes key defaults // FpsUpdate stub 0x087150 — FPS overlay destructor wrapper // Update 0x0871A0 — per-frame camera override (WASD+mouse)
// --- FpsUnlocker --- // Singleton base: [.data+0x21E8] // Object size: 0x38 bytes struct FpsUnlockerModule : BaseModule { // [+0x28] u8 enabled i32 fps_target; // [+0x30] DragInt max=500, min=30, default=300 }; // FpsUnlocker function table: // RegisterTab 0x081730 — registers tab, writes fps_target default = 300 // Render 0x085B90 — ImGui panel + Application.set_targetFrameRate call // Update stub 0x085B40 — destructor wrapper, size 0x38
// --- SetDither --- // Singleton base: referenced from registrar at RVA 0x001C41 // Object size: 0x38 bytes (shared stub with SkillHack) struct SetDitherModule : BaseModule { // [+0x28] u8 enabled (unused — no per-frame write) }; // SetDither function table: // RegisterTab/Render 0x081810 — registers tab only; no ImGui panel body // Update stub 0x083DC0 — shared no-op: frees name string, optional delete
// --- PlayerProfile --- // Singleton base: referenced from registrar at RVA 0x001E20 // Object size: 0x78 bytes struct PlayerProfileModule : BaseModule { // [+0x28] u8 enabled u8 _pad3[7]; // [+0x30] std::string uid_str (wstring buffer for UID display text) char uid_str_sso[24]; // [+0x30] u8 _pad4[8]; // [+0x48..+0x4F] // [+0x50] std::string name_str (wstring buffer for ManagerName text) char name_str_sso[24]; // [+0x50] u8 _pad5[8]; // [+0x68..+0x6F] u8 name_changer_enabled; // [+0x70] }; // PlayerProfile function table: // RegisterTab/Render 0x0818E0 — zeroes uid_str, name_str; stores IL2CPP fn ptrs // Update 0x08A4F0 — per-frame UI path walk + SetText on TMP labels // Update stub 0x08A4A0 — dtor: frees [+0x50],[+0x30],[+0x08], delete(0x78) // UI paths used: // UID: "/UINode/UIRoot/UIDPanelPanel/Main/TextNode/Text" (RVA 0x3AFED0, len 0x2F) // Name: "/UINode/WorldUIRoot/WatchPanel/Content/WatchNode/canvas_watch/ // LeftBottomNode/PlayInfoPosNode/PlayInfoLifengCell(Clone)/PlayerInfo/ManagerName" // (RVA 0x3AFFD0, len 0x8D)
// --- Vacuum --- // Singleton base: [.data+0x05D0] fn-ptr slot; obj referenced from registrar 0x001FC0 // Object size: 0x38 bytes struct VacuumModule : BaseModule { // [+0x28] u8 vacuum_on ('Vacuum' main checkbox) u8 _pad3[7]; u8 monster_on; // [+0x30] 'Monster' sub-checkbox }; // Vacuum function table: // RegisterTab 0x081A20 — stores update fn ptr 0x1803B0680 → 0x085B40 stub // Render 0x093CA0 — 'Vacuum' + 'Monster' checkboxes // PhysicsLoop 0x093F10 — per-frame Rigidbody.AddForce attraction // Update stub 0x085B40 — shared destructor wrapper (frees [+0x08], delete 0x38) // Attraction constant: (float)0x1803B32B4
// --- SkillHack --- // Singleton base: referenced from registrar at RVA 0x001D50 // Object size: ~0x38 bytes struct SkillHackModule : BaseModule { // [+0x28] u8 enabled — read by all 6 hook callbacks // No per-frame Update; all work done by IL2CPP hook callbacks }; // SkillHack function table: // Render 0x08D1F0 — hook installer only (installs 6 hooks, tail-jmps to 0x8D8A0) // RenderPanel 0x08D240 — actual ImGui panel ('Free Skill' + ON/OFF toggle) // Update stub 0x083DC0 — shared no-op (same as SetDither) // Dispatcher 0x08D4B0 — BOOL callback: returns 1 when enabled // CooldownBypass 0x08D500 — float callback: returns 100.0f when enabled // AvailBypass 0x08D640 — BOOL callback: returns 1 when enabled // CostBypass 0x08D780 — void callback: early-return (skip cost deduction)
// --- ESPModule --- // Singleton base: [.data+0x1F70] VA 0x1803C6F70 // Object size: 0x100 bytes (12 RGBA color slots × 16 bytes = 0xC0, starts at +0x40) struct ESPModule : BaseModule { // [+0x28] u8 enabled u8 _pad3[7]; i32 max_draw_distance; // [+0x30] default 300 (0x12C) u8 show_monsters; // [+0x34] default 1 u8 show_npc; // [+0x35] default 1 u8 show_friendly; // [+0x36] default 1 u8 show_puzzles; // [+0x37] default 1 u8 show_all; // [+0x38] default 0 u8 show_distance; // [+0x39] default 1 u8 show_name; // [+0x3A] default 1 u8 show_type; // [+0x3B] default 0 (reserved, unused) u8 _reserved; // [+0x3C] u8 _pad4[3]; // [+0x3D..+0x3F] float color[12][4]; // [+0x40] 12 × RGBA float4, 16-byte aligned // Color slot defaults (RGBA): // [0] +0x40 enemy RED (1.0, 0.0, 0.0, 1.0) // [1] +0x50 interactive ORANGE (1.0, 0.65, 0.0, 1.0) // [2] +0x60 slot2 YELLOW (1.0, 1.0, 0.0, 1.0) // [3] +0x70 friendly GREEN (0.0, 1.0, 0.0, 1.0) // [4] +0x80 npc BLUE (0.0, 0.0, 1.0, 1.0) // [5] +0x90 slot5 CYAN (0.0, 1.0, 1.0, 1.0) // [6] +0xA0 slot6 PURPLE (0.58, 0.0, 0.83, 1.0) // [7] +0xB0 default WHITE (1.0, 1.0, 1.0, 1.0) // [8] +0xC0 slot8 PINK (1.0, 0.08, 0.58, 1.0) // [9] +0xD0 slot9 LPINK (1.0, 0.75, 0.80, 1.0) // [10] +0xE0 slot10 BLACK (0.0, 0.0, 0.0, 1.0) // [11] +0xF0 slot11 GRAY (0.502, 0.502, 0.502, 1.0) }; // ESPModule function table: // Singleton init 0x083E00 — lazy init via MSVC thread-safe static // RenderOverlay 0x083FA0 — ImGui 'ESP Features' panel (large, 0x83FA0–0x8499E) // Update 0x085C00 — per-frame world-space entity label loop (approx) // Entity type dispatch in Update (byte code → color slot): // 0=enemy, 1=interactive, 2=friendly, 3=npc, 4=puzzle, default=slot7(white)
// --- FPSModule (FpsOverlay) --- // Singleton base: [.data+0x22E0] VA 0x1803C72E0 // Object size: 0xD8 bytes struct FPSModule : BaseModule { // [+0x28] u8 enabled u8 _pad3[7]; u8 show_fps_overlay; // [+0x30] 'Show FPS Overlay' checkbox u8 _pad4[0x2F]; // [+0x31..+0x5F] float overlay_pos[4]; // [+0x60] XMMWORD (position/size, zeroed on init) }; // FPSModule function table: // RegisterTab 0x081810 — shared with SetDither registrar // Render [via FpsOverlay chain]
// --- PreventScreenshot --- // Singleton base: [.data+0x2358] VA 0x1803C7358 // Object size: 0x48 bytes struct PreventScreenshotModule : BaseModule { // [+0x28] u8 enabled — drives SetWindowDisplayAffinity arg u8 _pad3[7]; u8 state_dirty; // [+0x30] 1 = affinity applied, guard re-apply u8 _pad4[7]; u8 second_flag; // [+0x38] purpose unclear, zeroed on init };
// ============================================================================ // SECTION 7 — HOOK MANAGER // ============================================================================
// Singleton: [.data+0x2470] VA 0x1803C7470 // Object size: 0x90 bytes struct HookManager { void* hook_array; // [+0x00] flat array of HookEntry (0x38 bytes each) u32 hook_capacity; // [+0x08] allocated slot count (initial 0x80) u32 hook_count; // [+0x0C] active hook count void* hash_buckets; // [+0x10] hash table bucket array (linked list heads) u32 bucket_count; // [+0x18] power of 2, initial 8 u32 bucket_mask; // [+0x1C] = bucket_count * 2 - 1 void* free_list_head; // [+0x20] freed/recycled slot free list head u8 _pad[4]; // [+0x28..+0x2B] f32 load_factor; // [+0x28] hash load factor threshold (1.0f = 0x3F800000) u8 initialized; // [+0x30] 0 after init (prevents double-init) // Global spinlock: [.data+0x1E88] (DWORD, separate from struct) };
// Each hook entry in hook_array is 0x38 bytes: struct HookEntry { u64 target_va; // [+0x00] VA of hooked IL2CPP function u64 callback_va; // [+0x08] VA of replacement/detour function u64 trampoline_va; // [+0x10] VirtualAlloc'd trampoline (orig bytes + JMP back) u32 orig_bytes_0_3; // [+0x18] saved original bytes 0-3 u16 orig_bytes_4_5; // [+0x1C] saved original bytes 4-5 u8 orig_byte_6; // [+0x1E] saved original byte 6 u8 flags; // [+0x20] bit0=has_far_jmp, bit1=enabled, bit2=suspended u32 flags2; // [+0x24] lower nibble: hook type (0=near JMP, 1=far) u64 hash_next; // [+0x28] next ptr in hash bucket chain // [+0x30..+0x37] additional chain/bookkeeping fields };
// HookManager API (all acquire spinlock at [.data+0x1E88]): // CreateHook RVA 0x0A9CC8 — install new hook (FNV-1a hash lookup, trampoline alloc) // RemoveHook RVA 0x0A9FA0 — remove and free hook // EnableHook RVA 0x0AA140 — enable suspended hook // GetHookInfo RVA 0x0AA2C0 — query hook by target VA // Spinlock acq RVA 0x0A9C88 — acquire [.data+0x1E88] // Spinlock rel inline — mov [.data+0x1E88], 0
// ============================================================================ // SECTION 8 — MODULE MANAGER // ============================================================================
// Singleton: [.data+0x2398] // Registrar array: [.data+0x23B8]..[.data+0x23C0] (stride 0x60 bytes/slot) struct ModuleManager { u8 _pad[0x18]; // [+0x00..+0x17] u8 initialized; // [+0x18] double-init guard u8 _pad2[7]; // [+0x19..+0x1F] // [+0x20..+0x57] registrar list (vector — 0x60-byte stride) };
// ModuleManager API: // AddRegistrar RVA 0x09B2C0 — push registrar slot (name str + factory fn) // Grow helper RVA 0x09B3C0 — expand registrar vector // Init RVA 0x09AC10 — called once from startup (RVA 0xA9190) // Dispatch loops (each wraps vtable call in __try/__except via CxxFrameHandler4): // Update loop RVA 0x09AE80 — calls vtable[+0x18] on each module // Render loop RVA 0x09AEF0 — calls vtable[+0x20] on each module // Hotkey loop RVA 0x09AF60 — calls vtable[+0x28] on each module // Exception handlers (log + resume, do not propagate): // Update catch RVA 0x0AEBC0 — logs "[ERROR] Failed to update module ''" // Render catch RVA 0x0AEC50 — logs "[ERROR] Failed to render overlay for module ''" // Hotkey catch RVA 0x0AECE0 — logs "[ERROR] Failed to process hotkeys for module ''"
// Registration order (DLL init lambdas, before ModuleManager::Init): // 1. SetDither (RVA 0x001C41) vtable 0x3B0D58 // 2. FreeCam FPS (RVA 0x001C80) vtable 0x3B0E70 // 3. SkillHack (RVA 0x001D50) vtable 0x3B0EE0 // 4. PlayerProfile (RVA 0x001E20) vtable 0x3B0D90 // 5. NoClip (RVA 0x001EF0) vtable 0x3B0DC8 // 6. Vacuum (RVA 0x001FC0) vtable 0x3B0E38 // 7. UnityExplorer (RVA 0x002090) vtable 0x3B0D28 // 8. FpsUnlocker (RVA 0x001B80) vtable 0x3B0E00 // 9. FreeCam main (RVA 0x001AB0) vtable 0x3B0E70 // 10. ESPModule (RVA 0x001980)
// ============================================================================ // SECTION 9 — KEY FUNCTION RVA REFERENCE // ============================================================================ // All RVAs relative to binary base 0x180000000. // Add 0x180000000 to get VA; add file raw offset base for file seek.
namespace RVA { // Startup / init constexpr u32 DllMain_entry = 0x0AC840; // CRT DllMain thunk constexpr u32 Startup_sequence = 0x0A9190; // main init: GABypass + ModMgr constexpr u32 GABypass_Patch = 0x0A9120; // writes 71 IL2CPP fn ptrs constexpr u32 ModuleManager_Init = 0x09AC10;
// D3D11 / overlay
constexpr u32 D3D11_Hook_Install = 0x0827A0; // hooks IDXGISwapChain::Present
constexpr u32 D3D11_Present_Hook = 0x082820; // Present detour entry
constexpr u32 D3D11_CreateBuffers = 0x0551F0; // post-shader vertex/index buffer init
constexpr u32 ImGui_EndFrame = 0x001C2D0; // D3D11/ImGui EndFrame boundary
// ImGui wrappers (cheat-side)
constexpr u32 ImGui_Toggle = 0x070820; // TabManager::BeginTab
constexpr u32 CheckboxToggle = 0x085320; // flip enabled flag
constexpr u32 ImGui_DragInt = 0x066750; // move_speed DragInt
constexpr u32 ImGui_SliderFloat = 0x065570; // move_speed SliderFloat (max 500)
constexpr u32 ImGui_InputText_ws = 0x08AC20; // InputText wstring wrapper
// Config I/O
constexpr u32 ConfigSerialize = 0x012050; // serialize config to string
constexpr u32 BuildFilePath = 0x030A90; // build config file path
constexpr u32 ConfigFileIO = 0x011EA0; // UTF-8→wide fopen helper
constexpr u32 ConfigWrite = 0x0170D6; // fwrite config to file (approx)
// Hook manager
constexpr u32 HookMgr_singleton = 0x081B00; // thread-safe static accessor
constexpr u32 HookMgr_CreateHook = 0x0A9CC8;
constexpr u32 HookMgr_RemoveHook = 0x0A9FA0;
constexpr u32 HookMgr_EnableHook = 0x0AA140;
constexpr u32 HookMgr_Spinlock = 0x0A9C88;
constexpr u32 Trampoline_Alloc = 0x0AA478; // GetSystemInfo+VirtualQuery sub
// IL2CPP infrastructure
constexpr u32 IL2CPP_FindByPath = 0x09BCB0; // resolve Unity path to object
constexpr u32 WideToString = 0x00EB10; // UTF-8 → wstring
constexpr u32 BaseModule_Dtor = 0x00FA60; // shared dtor
// ModuleManager dispatch
constexpr u32 ModMgr_UpdateLoop = 0x09AE80;
constexpr u32 ModMgr_RenderLoop = 0x09AEF0;
constexpr u32 ModMgr_HotkeyLoop = 0x09AF60;
constexpr u32 ModMgr_AddRegistrar = 0x09B2C0;
// Theme / config preset writers (Ch.17 / Ch.28)
constexpr u32 Theme_Writer_Preset0 = 0x094890; // writes 52 color slots
constexpr u32 Theme_Writer_Preset1 = 0x096770;
constexpr u32 Theme_Writer_Preset2 = 0x098650;
constexpr u32 ColorApplicator = 0x094190; // shared helper: hex→RGBA×159 calls
// Settings / NameChanger (Ch.19)
constexpr u32 Settings_RenderOverlay = 0x09A4F0; // Settings panel render
constexpr u32 Settings_end = 0x09AB98; // (end of Settings body)
// UnityExplorer (Ch.16)
constexpr u32 UE_RegisterTab = 0x090060;
constexpr u32 UE_Render = 0x090250;
constexpr u32 UE_RefreshScenes = 0x090D40;
}
// ============================================================================ // SECTION 10 — CONFIG PRESET NAMES & STRINGS // ============================================================================ // Preset name string: [.data+0x00E0] (std::string, set during Settings load) // Preset index: [.data+0x00EC] (DWORD, 0-3) // Config file path: built by BuildFilePath (RVA 0x030A90) from [.data+0x0050]+0x50 // Config strings (RVA): // "Preset0" 0x3B0680 // "Preset1" 0x3B0688 // "Preset2" 0x3B0690 // "Preset3" 0x3B0698 // "EF-Cheeto.dll" 0x3B0358 (used by GABypass file scan) // "gatmp.tmp" 0x3B0338 (temp file for bypass) // "testyip" 0x3B0328 (test bypass marker) // Source path embedded: "E:\git\Endfield_Cheeto\libraries\pipeline..."
// ============================================================================ // SECTION 11 — KNOWN GAME API SIGNATURES (inferred from call sites) // ============================================================================ // These are IL2CPP managed method signatures inferred from cheat call sites. // Calling convention: __fastcall (RCX=this/arg0, RDX=arg1, R8=arg2, etc.) // Return in RAX (ptr/int) or XMM0 (float).
// Transform methods using fn_get_position = void*()(void transform); // returns vec3* using fn_set_position = void ()(void transform, void* vec3); using fn_get_rotation = void*()(void transform); // returns Quaternion* using fn_set_rotation = void ()(void transform, void* quaternion); using fn_get_localPos = void*()(void transform); using fn_set_localPos = void ()(void transform, void* vec3); using fn_get_localScale= void*()(void transform); using fn_set_localScale= void ()(void transform, void* vec3);
// GameObject methods using fn_get_transform = void*()(void gameObject); using fn_SetActive = void ()(void gameObject, bool active); using fn_get_name_go = void*()(void gameObject); // returns System.String*
// Rigidbody methods using fn_AddForce = void ()(void rigidbody, void* vec3, int forceMode); using fn_get_velocity = void*()(void rigidbody); using fn_set_velocity = void ()(void rigidbody, void* vec3);
// Application using fn_setTargetFPS = void (*)(int targetFrameRate);
// TMPro / UI using fn_set_text = void ()(void textComponent, int zero, void* wstring_ptr);
// CharacterController using fn_setEnabled = void ()(void ctrl, bool enabled, int zero);
// Camera using fn_Camera_main = void*()(void zero); // Camera.get_main using fn_get_fov = float()(void camera);
// SkillHack hook callbacks (return types match hooked method signatures): using fn_BOOL_bypass = BOOL ()(void); // Dispatcher / AvailBypass using fn_float_bypass = float()(void); // CooldownBypass → returns 100.0f using fn_void_bypass = void (*)(void); // CostBypass → early return
// ============================================================================ // END OF RECONSTRUCTION HEADERS // ============================================================================
// ============================================================================ // SECTION 12 — IL2CPP TABLE ACCESSOR MACROS // ============================================================================ // Usage: CALL_IL2CPP(slot_name, RetType, arg0, ...) // All slots live at fixed .data offsets from binary base 0x1803C5000. // At runtime: ptr = (void*)([.data + slot_offset]) // // Direct call helpers — use after GABypass has patched the table:
#define IL2CPP_BASE_VA ((uintptr_t)0x1803C5000) #define IL2CPP_SLOT(off) (*(void**)(IL2CPP_BASE_VA + (off)))
// Transform #define IL2_Transform_get_position(t) ((fn_get_position) IL2CPP_SLOT(0x1C88))(t) #define IL2_Transform_set_position(t,v) ((fn_set_position) IL2CPP_SLOT(0x1D88))(t,v) #define IL2_Transform_get_localPos(t) ((fn_get_localPos) IL2CPP_SLOT(0x1C80))(t) #define IL2_Transform_set_localPos(t,v) ((fn_set_localPos)IL2CPP_SLOT(0x1C90))(t,v) #define IL2_Transform_get_rotation(t) ((fn_get_rotation)IL2CPP_SLOT(0x1C68))(t) #define IL2_Transform_set_rotation(t,q) ((fn_set_rotation)IL2CPP_SLOT(0x1CA8))(t,q) #define IL2_Transform_get_localScale(t) ((fn_get_localScale)IL2CPP_SLOT(0x1C60))(t) #define IL2_Transform_set_localScale(t,v) ((fn_set_localScale)IL2CPP_SLOT(0x1D68))(t,v)
// GameObject #define IL2_GO_get_transform(go) ((fn_get_transform)IL2CPP_SLOT(0x1CA0))(go) #define IL2_GO_SetActive(go,a) ((fn_SetActive) IL2CPP_SLOT(0x1C98))(go,a) #define IL2_GO_get_name(go) ((fn_get_name_go) IL2CPP_SLOT(0x1CC0))(go)
// Rigidbody #define IL2_RB_AddForce(rb,v,fm) ((fn_AddForce) IL2CPP_SLOT(0x1E00))(rb,v,fm) #define IL2_RB_get_velocity(rb) ((fn_get_velocity) IL2CPP_SLOT(0x1D70))(rb) #define IL2_RB_set_velocity(rb,v) ((fn_set_velocity) IL2CPP_SLOT(0x1D78))(rb,v)
// Application #define IL2_App_setTargetFPS(fps) ((fn_setTargetFPS) IL2CPP_SLOT(0x1D48))(fps)
// Camera #define IL2_Camera_main() ((fn_Camera_main) IL2CPP_SLOT(0x1DC0))(nullptr) #define IL2_Camera_get_fov(cam) ((fn_get_fov) IL2CPP_SLOT(0x1DE8))(cam)
// UI #define IL2_TMPro_set_text(comp,ws) ((fn_set_text) IL2CPP_SLOT(0x1E28))(comp,0,ws) #define IL2_UI_Text_set_text(comp,ws) ((fn_set_text) IL2CPP_SLOT(0x1E30))(comp,0,ws)
// CharacterController #define IL2_CharCtrl_setEnabled(c,en) ((fn_setEnabled) IL2CPP_SLOT(0x1E08))(c,en,0)
// ============================================================================ // END // ============================================================================
// ============================================================================ // SECTION 13 — STARTUP / LOADER CHAIN // ============================================================================ // DLL entry and initialization sequence (Ch.11 / Ch.29)
namespace RVA { // Entry point chain constexpr u32 DllMain_entry_real = 0x01000; // CRT DllMain (spawns loader thread) constexpr u32 LoaderThread = 0x05000; // main init thread: IL2CPP + window + hooks constexpr u32 Startup_main = 0x0A9190; // step-by-step startup (steps 1-11) constexpr u32 ModMgr_RegisterAll = 0x09AE00; // 11 modules registered via stubs constexpr u32 ModMgr_MainLoop = 0x082000; // Present hook + ImGui render loop (0x82000-0x82300) constexpr u32 D3D11Init_Shaders = 0x054DC0; // D3DCompile vertex+pixel shader (x2: 0x54DC0, 0x551E8) constexpr u32 D3D11Init_Setup = 0x082500; // ImGui Win32+D3D11 backend init, WndProc subclass
// Startup step addresses (from Ch.11.4):
// 1 0x0A91CE AllocConsole — 'il2cpp Game Console'
// 2 0x0A9267 SetConsoleCP(0xFDE9) — UTF-8
// 3 0x0A92F7 FindWindowA(NULL,'UnityWndClass') — poll until game window present
// 4 0x0A93CC HookInstallerWrapper(EnumProcessModules) — module scanner install
// 5 0x0A93E6 Log 'Initializing..' (source: main.cpp:53)
// 6 0x0A942F Call [g_Config+0x1E80] — IL2CPP domain resolver
// 7 0x0A945A Log 'IL2CPP Domain Found: ' (if domain non-null)
// 8 0x0A94C4 Log 'IL2CPP Thread Attached Successfully: '
// 9 0x0A9506 Error: Log 'Failed to Attach IL2CPP Thread!'
// 10 0x0A9545 Error: Log 'IL2CPP Domain Not Found!'
// 11 0x0A959F Success: Log 'Initialized' → then launch overlay window thread (0x827A0)
// D3D11 overlay window subsystem (Ch.29)
constexpr u32 OverlayWindowInit = 0x0827A0; // create layered window + D3D11 device (0x827A0-0x8375C)
constexpr u32 FindGameWindow = 0x0835D0; // EnumWindows callback — locate Unity window
constexpr u32 GetOverlayRect = 0x0836A0; // compute overlay rect from game window bounds
constexpr u32 D3D11_Setup_sub = 0x0825B0; // D3D11::Reinit — recreate RT + ImGui D3D11 backend
constexpr u32 WndProc = 0x0826A0; // Win32 WndProc (HWND,UINT,WPARAM,LPARAM)→LRESULT
constexpr u32 ImGui_Win32_Handler = 0x057720; // ImGui_ImplWin32_WndProcHandler — all kb/mouse
constexpr u32 PresentHook_callsite = 0x082F00; // IDXGISwapChain::Present hook call site (inside msg loop)
constexpr u32 RenderFrame = 0x082FC0; // ImGui NewFrame + per-module Render dispatch
constexpr u32 ImGui_Begin_wrapper = 0x0937D0; // ImGui::Begin wrapper (Unity Explorer Window title)
constexpr u32 ImGui_Selectable = 0x0708D0; // ImGui::Selectable (preset selector, Ch.17)
// Thread suspension for hook install (Ch.3)
constexpr u32 CollectProcessThreads = 0x0A96B0; // Toolhelp32 snapshot → thread ID array (0xA96B0-0xA9A1C)
constexpr u32 SuspendOrResumeThreads= 0x0A9A20; // OpenThread + Suspend/Resume all (0xA9A20-0xA9A98)
constexpr u32 PatchCode = 0x0A9A9C; // VirtualProtect + write hook bytes (0xA9A9C-0xA9BC3)
// Hook manager detailed RVAs (Ch.8)
constexpr u32 HookMgr_Install = 0x0A9CC8; // alloc trampoline + FNV hash (= CreateHook)
constexpr u32 HookMgr_Remove = 0x0A9E8C; // remove + restore original bytes
constexpr u32 HookMgr_Enable_fn = 0x0A9A9C; // toggle enabled bit + patch
constexpr u32 HookMgr_AllocTramp = 0x0A960C; // allocate trampoline slot near target VA
constexpr u32 HookMgr_FreeSlot = 0x0AA684; // free trampoline + compact hook array
constexpr u32 HookInstaller_Wrapper = 0x08BAF0; // wrapper called at 0xA93CC during startup
// Module scanner (Ch.11.2)
constexpr u32 ModulePathScanner = 0x08B650; // scan loaded modules for testyip/gatmp/EF-Cheeto
constexpr u32 ModPathScanner_EF = 0x08B937; // wcsstr branch: search for 'EF-Cheeto.dll'
// String helpers
constexpr u32 UTF8ToWide = 0x08B4E0; // MultiByteToWideChar CP_UTF8(0xFDE9) wrapper
constexpr u32 WideStr_wcsstr = 0x0AB6A0; // custom wcsstr — returns iterator, -1 if not found
constexpr u32 WideStr_Dtor = 0x0AB758; // wstring destructor (used in path scanner)
// Module-specific helpers
constexpr u32 NoClip_RegisterTab = 0x00FCB0; // one-time NoClip tab init
constexpr u32 FreeCam_RegisterTab = 0x00F7D0; // one-time FreeCam tab init
constexpr u32 ManagerName_Init = 0x00FFF0; // zero std::string fields for ModuleManager name
constexpr u32 NoClip_EntityIter = 0x089DC0; // entity iterator inner loop (NoClip::Update)
constexpr u32 SetDither_Render = 0x08C490; // SetDither::Render — graphics dither toggle
constexpr u32 SkillHack_PatchFloat = 0x08E220; // installs FloatReturn hook on [g_Config+0x1E50]
constexpr u32 SkillHack_PatchBool = 0x08EBC0; // installs BoolTrue hook on [g_Config+0x1E58]
constexpr u32 SkillHack_PatchVoid = 0x08F560; // installs VoidReturn hook on [g_Config+0x1E40]
constexpr u32 SkillHack_Trampoline = 0x08FF00; // common trampoline dispatcher (calls original fn)
constexpr u32 UE_GuardReturn = 0x0901D8; // early return after once_flag sealed (UE::RegisterTab)
constexpr u32 UE_AutoRefresh = 0x093B10; // auto-refresh timer check for scene list
constexpr u32 UE_Memset_block = 0x0AC86A; // memset 0xD8 bytes at [.data+0x2200] (FreeCam init)
constexpr u32 PreventSS_Init = 0x08AD70; // once_flag guarded PreventScreenshot init
constexpr u32 PreventSS_Render = 0x08AE60; // ImGui single checkbox 'Prevent Screenshot'
constexpr u32 PreventSS_Update = 0x08AFC0; // SetWindowDisplayAffinity dispatch (per-frame)
constexpr u32 PreventSS_OsCheck = 0x08B220; // Win10 build check + affinity setter
constexpr u32 TabMgr_BeginTab_full = 0x09D7D0; // full BeginTab with state+title resolution
constexpr u32 GABypass_Init = 0x09D1E0; // 71 IL2CPP stub patch sequence
constexpr u32 Std_once_flag_Execute = 0x0AFF60; // MSVC _Execute_once (once_flag)
constexpr u32 Sidebar_Settings = 0x080770; // sidebar settings section (0x80770-0x80B50)
// ImGui_EndFrame alias: see RVA::ImGui_EndFrame (0x001C2D0) defined in Section 9
}
// ============================================================================ // SECTION 14 — D3D11 OVERLAY WINDOW INIT (Ch.29 summary) // ============================================================================ // OverlayWindowInit (RVA 0x827A0) sequence: // // 29.1 DPI setup (0x827FF-0x82923): // Try SetThreadDpiAwarenessContext(DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE_V2) // Fallback: SetProcessDpiAwareness(2) // Final fallback: SetProcessDPIAware() // Guard: [.data+0x3C7440] / [.data+0x3C7448] // // 29.2 Game window location + class registration (0x82924-0x82A28): // EnumWindows(FindGameWindow@0x835D0) → locate Unity game HWND // WNDCLASSEX: CreateSolidBrush(0x7F00), LoadCursorW, LoadIconW×2 // RegisterClassExW // GetSystemMetrics(SM_CXSCREEN/SM_CYSCREEN) // // 29.3 Overlay window + D3D11 device (0x82A29-0x82BFF): // CreateWindowExW(WS_EX_LAYERED|WS_EX_TRANSPARENT) // SetLayeredWindowAttributes // DwmExtendFrameIntoClientArea (full glass) // D3D11CreateDeviceAndSwapChain — attempt 1: DXGI_FORMAT_R8G8B8A8_UNORM // on failure: attempt 2: DXGI_FORMAT_B8G8R8A8_UNORM // D3D11::Reinit (0x825B0) — set up ImGui D3D11 backend // ShowWindow / UpdateWindow // CreateMutexA — prevent duplicate instances // // 29.4 Message loop (0x82C01-0x8352F): // Log 'Initialized' (source: UI.cpp, RVA 0x3AF610) // Loop: PeekMessageW / TranslateMessage / DispatchMessageW // Each iter: FindWindowA('UnityWndClass',NULL) — exit if game gone // IsWindow, GetWindowThreadProcessId, GetWindowRect // SetWindowPos to track game window
// WndProc (RVA 0x826A0) — pseudocode: // LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) { // if (g_ImGuiCtx) { // LRESULT r = ImGui_ImplWin32_WndProcHandler(hwnd, msg, wParam, lParam); // if (r) return 1; // } // switch (msg) { // case WM_DESTROY: PostQuitMessage(0); return 0; // case WM_SIZE: // if (g_pSwapChain && wParam != SIZE_MINIMIZED) { // if (g_pRenderTargetView) { g_pRenderTargetView->Release(); g_pRenderTargetView=NULL; } // g_pSwapChain->ResizeBuffers(0,LOWORD(lParam),HIWORD(lParam),DXGI_FORMAT_UNKNOWN,0); // D3D11_Setup_sub(); // 0x825B0 — recreate RT + shaders // } // return 0; // case WM_SYSCOMMAND: // if ((wParam & 0xFFF0) == SC_KEYMENU) return 0; // break; // default: // return ImGui_ImplWin32_WndProcHandler(hwnd, msg, wParam, lParam); // } // return 0; // }
// ============================================================================ // SECTION 15 — MODULE PATH SCANNER (Ch.11.2) // ============================================================================ // ModulePathScanner (RVA 0x8B650): // Args: HANDLE process, void** module_array, DWORD count // For each module path: // UTF8ToWide(path) → wpath // wcsstr(wpath, L"testyip") → if found: found_count++ // wcsstr(wpath, L"gatmp.tmp") → if found: found_count++ // if not found: ModPathScanner_EF (0x8B937): // wcsstr(wpath, L"EF-Cheeto.dll") → if found: found_count++ // Returns found_count // // Injection identity strings (.data): // L"testyip" [.data+0x0318] alternate temp-file loader name // L"gatmp.tmp" [.data+0x0338] primary temp-file loader name // L"EF-Cheeto.dll" [.data+0x0358] published DLL name (fallback)
// ============================================================================ // SECTION 16 — THREAD SUSPENSION SUBSYSTEM (Ch.3) // ============================================================================ // CollectProcessThreads (RVA 0xA96B0): // CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD,0) → hSnapshot // THREADENTRY32 te32; te32.dwSize = sizeof(THREADENTRY32); // Thread32First(hSnapshot, &te32) // while Thread32Next: if te32.th32OwnerProcessID==GetCurrentProcessId() // AND te32.th32ThreadID != calling_thread: append to array // // SuspendOrResumeThreads (RVA 0xA9A20): // For each collected thread ID: // hThread = OpenThread(THREAD_SUSPEND_RESUME, FALSE, tid) // if suspend: SuspendThread(hThread) // if resume: ResumeThread(hThread) // CloseHandle(hThread) // // PatchCode (RVA 0xA9A9C): // VirtualProtect(target, size, PAGE_EXECUTE_READWRITE, &oldProt) // memcpy(target, patch_bytes, size) // VirtualProtect(target, size, oldProt, &oldProt) // FlushInstructionCache(GetCurrentProcess(), target, size)
// ============================================================================ // SECTION 17 — PREVENT SCREENSHOT MODULE (Ch.21 supplement) // ============================================================================ // PreventScreenshot::Initialize (RVA 0x8AD70): // Guarded by once_flag at [.data+0x2390] // Allocates module object (0x48 bytes) // Sets vtable: 0x3AFA38 → 0x3B0110 after init // Zeroes: enabled, state_dirty, second_flag // // PreventScreenshot::Update (RVA 0x8AFC0): // 1. Call GetInstance (0x8AD70) // 2. Check enabled [module+0x28] // 3. If enabled && !state_dirty: call OsCheck (0x8B220) // 4. Build HWND list at [.data+0x24D0] // 5. For each HWND node [rbx+0x10]: call OsCheck affinity setter // 6. Call HookMgr_singleton (0x81B00) to update hook state // // PreventScreenshot::OsCheck (RVA 0x8B220): // Checks Windows 10 build version // Calls SetWindowDisplayAffinity(hwnd, WDA_MONITOR) via IAT[0xB1460] // On disable: SetWindowDisplayAffinity(hwnd, WDA_NONE)
// ============================================================================ // SECTION 18 — COMPLETE FUNCTION INDEX (all 91 named functions) // ============================================================================ // Cross-reference: function name → RVA (use RVA:: namespace above for most) // This table captures every named entry from the doc cross-reference (Ch.24/25).
// Name RVA Chapter // DllMain 0x001000 Entry // LoaderThread 0x005000 Ch.11 // FreeCam::RegisterTab 0x00F7D0 Ch.12.3 // FreeCam::RegisterFpsTab 0x0814C0 Ch.12.3 // NoClip::RegisterTab 0x00FCB0 Ch.12.2 // ManagerName::Init 0x00FFF0 Ch.15 // ImGui::EndFrame 0x01C2D0 Ch.15 // ConfigSerialize 0x012050 Ch.6 // ConfigFileIO (UTF8→wide fopen) 0x011EA0 Ch.6 // BuildFilePath 0x030A90 Ch.6 // D3D11Init_Shaders A 0x054DC0 Ch.5 // D3D11Init_Shaders B 0x0551E8 Ch.5 // D3D11::CreateBuffers 0x0551F0 Ch.5 // ImGui_ImplWin32_WndProcHandler 0x057720 Ch.7 // ImGui::Toggle (TabMgr) 0x070820 Ch.12 // ImGui::Selectable 0x0708D0 Ch.17 // TabMgr::BeginTabFull 0x09D7D0 Ch.12 // Sidebar_Settings entry 0x080770 Ch.25 // D3D11::Setup (ImGui backend init) 0x082500 Ch.29 // D3D11::Reinit 0x0825B0 Ch.7/29 // WndProc 0x0826A0 Ch.7 // OverlayWindowInit 0x0827A0 Ch.29 // FindGameWindow 0x0835D0 Ch.29 // GetOverlayRect 0x0836A0 Ch.29 // PresentHook callsite 0x082F00 Ch.15.5 // RenderFrame 0x082FC0 Ch.15 // HookMgr_singleton 0x081B00 Ch.8 // ESPModule singleton init 0x083E00 Ch.9 // ESPModule::RenderOverlay 0x083FA0 Ch.22 // SetDither::Render 0x08C490 Ch.12.5 // CheckboxToggle 0x085320 Ch.12 // ImGui::SliderFloat 0x065570 Ch.12.3 // ImGui::DragInt 0x066750 Ch.12.2 // NoClip::Render 0x0813D0 Ch.12.2 // NoClip::Update 0x089B50 Ch.12.2 // NoClip::EntityIterator 0x089DC0 Ch.12.2 // FreeCam::Update 0x0871A0 Ch.12.3 // FpsUnlocker::Render 0x085B90 Ch.12.4 // PlayerProfile::Update 0x08A4F0 Ch.12.6 // Vacuum::Render 0x093CA0 Ch.12.7 // Vacuum::PhysicsLoop 0x093F10 Ch.12.7 // Vacuum::EntityIterator 0x094000 Ch.12.7 // SkillHack::Render (hook install) 0x08D1F0 Ch.12.8 // SkillHack::RenderPanel 0x08D240 Ch.12.8 // SkillHack::Dispatcher 0x08D4B0 Ch.10 // SkillHack::CooldownBypass 0x08D500 Ch.10 // SkillHack::AvailBypass 0x08D640 Ch.10 // SkillHack::CostBypass 0x08D780 Ch.10 // SkillHack::PatchFloat 0x08E220 Ch.10 // SkillHack::PatchBool 0x08EBC0 Ch.10 // SkillHack::PatchVoid 0x08F560 Ch.10 // SkillHack::TrampolineDispatch 0x08FF00 Ch.10 // PreventScreenshot::Initialize 0x08AD70 Ch.21 // PreventScreenshot::Render 0x08AE60 Ch.21 // PreventScreenshot::Update 0x08AFC0 Ch.21 // PreventScreenshot::OsCheck 0x08B220 Ch.21 // UTF8ToWide 0x08B4E0 Ch.11 // ModulePathScanner 0x08B650 Ch.11.2 // ModulePathScanner::EFSearch 0x08B937 Ch.11.2 // HookInstallerWrapper 0x08BAF0 Ch.11.3 // ImGui::InputText_ws 0x08AC20 Ch.12.6 // HookInstaller inner 0x08BAF0 Ch.11.3 // ColorApplicator 0x094190 Ch.28.2.1 // Theme_Writer_Preset0 0x094890 Ch.17/28 // Theme_Writer_Preset1 0x096770 Ch.17/28 // Theme_Writer_Preset2 0x098650 Ch.17/28 // Settings::RenderOverlay 0x09A4F0 Ch.19.8 // UnityExplorer::RegisterTab 0x090060 Ch.16 // UnityExplorer::Render 0x090250 Ch.16 // UnityExplorer::RefreshScenes 0x090D40 Ch.16 // UnityExplorer::GuardReturn 0x0901D8 Ch.16 // UnityExplorer::AutoRefresh 0x093B10 Ch.16 // ImGui::Begin wrapper 0x0937D0 Ch.16 // ModuleManager::AddRegistrar 0x09B2C0 Ch.15 // ModuleManager::Grow 0x09B3C0 Ch.15 // ModuleManager::Init 0x09AC10 Ch.15 // ModuleManager::UpdateLoop 0x09AE80 Ch.15 // ModuleManager::RenderLoop 0x09AEF0 Ch.15 // ModuleManager::HotkeyLoop 0x09AF60 Ch.15 // ModuleManager::RegisterAll 0x09AE00 Ch.15 // DispatchLoop_UpdateCatch 0x0AEBC0 Ch.15.4.1 // DispatchLoop_RenderCatch 0x0AEC50 Ch.15.4.1 // DispatchLoop_HotkeyCatch 0x0AECE0 Ch.15.4.1 // IL2CPP_FindByPath 0x09BCB0 Ch.16/19 // GABypass::Init 0x09D1E0 Ch.18 // CollectProcessThreads 0x0A96B0 Ch.3 // SuspendOrResumeThreads 0x0A9A20 Ch.3 // PatchCode 0x0A9A9C Ch.3 // Startup_main 0x0A9190 Ch.11.4 // HookMgr_AllocTrampoline 0x0A960C Ch.8 // HookMgr_CreateHook 0x0A9CC8 Ch.8 // HookMgr_RemoveHook 0x0A9FA0 Ch.8 // HookMgr_EnableHook 0x0AA140 Ch.8 // HookMgr_FreeSlot 0x0AA684 Ch.8 // HookMgr_Spinlock 0x0A9C88 Ch.8 // WideStr::wcsstr 0x0AB6A0 Ch.11 // WideStr::Dtor 0x0AB758 Ch.11 // Memset_block 0x0AC86A (alloc+memset 0xD8 bytes) // BaseModule::Dtor 0x00FA60 Ch.12 // WideToString 0x00EB10 Ch.11 // PreventScreenshot::SetAffinity 0x08B490 Ch.21 (SetWindowDisplayAffinity call site) // Vacuum::Render (alt addr) 0x093C90 Ch.12.7 (one-byte offset alias for 0x93CA0)
// ============================================================================ // END OF RECONSTRUCTION HEADERS // ============================================================================
// ============================================================================ // SECTION 19 — CONFIG I/O FUNCTIONS (Ch.6 complete) // ============================================================================
namespace RVA { // Config I/O constexpr u32 ReadConfig = 0x0302D2; // fread JSON config on startup → populate g_Config constexpr u32 ReadConfig_end = 0x030348; // ReadConfig range end constexpr u32 SaveConfig = 0x030620; // fwrite g_Config state to JSON file (0x30620-0x307A0) constexpr u32 SaveConfig_end = 0x0307A0; constexpr u32 ImGuiSaveIni = 0x017078; // fwrite ImGui window layout to .ini (0x17078-0x172CA) constexpr u32 ImGuiSaveIni_end = 0x0172CA; constexpr u32 ConsoleDebugWrite = 0x00EA1B; // fwrite to stdout/console (debug output, size=1)
// SaveConfig (RVA 0x30620) pseudocode:
// Check state->enabled_flag [rbx+0x2900]
// Load state->file_path ptr [rbx+0x50]
// Call BuildFilePath (0x30A90)
// Call OpenConfigFile(path, "wt") → FILE* fp
// Serialize via ConfigSerialize (0x12050) → string
// fwrite(string, 1, len, fp); fclose(fp)
// Auto-save timer: xmm0=[rbx+0x2904], timer -= delta; on expire: re-save
//
// Config field written by language selector:
// [g_Config+0x2764] content ref-count (DWORD, decremented on lang change)
constexpr u32 LangSelector_refcount_off = 0x2764; // g_Config+0x2764 = content ref-count
}
// ============================================================================ // SECTION 20 — LOG / PRINT / CRC32 / REGISTRY (Ch.15 / Ch.26 helpers) // ============================================================================
namespace RVA { constexpr u32 Log_Print = 0x00FDA0; // shared logging helper (called by all 3 dispatch catchers) constexpr u32 ImGui_PushStyleColor = 0x010840; // ImGui::PushStyleColor — theme system (159 calls) constexpr u32 CRC32_Lookup = 0x011DF0; // CRC32 of module key string (e.g. "Sidebar", "Content") constexpr u32 Module_RegistryLookup = 0x03D1A0; // registry lookup by CRC32 hash → module ptr constexpr u32 Module_Notify = 0x01D2B0; // module notify/update (called after lang change) constexpr u32 ImGui_Epilogue = 0x023E20; // ImGui epilogue tail-call target (Sidebar tail-jmps here) constexpr u32 I18n_Refresh = 0x02A530; // i18n content refresh — reload translations on lang change constexpr u32 Locale_ContextInit = 0x09D660; // locale context init — selects "en" or "zh_cn" based on flag constexpr u32 Label_Formatter = 0x05FB60; // sprintf-style: build "Key Name: %s" label strings constexpr u32 ImGui_Combo = 0x064220; // ImGui::Combo (language dropdown, 2-item list) constexpr u32 FPS_StringBuild = 0x07F5C0; // build "FPS: NNN" string for FPS overlay }
// i18n language flag: [.data+0x3C77B0] (VA 0x1803C77B0) // 0 = English (RVA 0x3AF310) // 1 = 简体中文 (RVA 0x3AF318) // Language tab label: " Language" (RVA 0x3AF328, 5-space indent) // Combo widget ID: "##Language" (RVA 0x3AF338)
// ============================================================================ // SECTION 21 — SIDEBAR / MAIN PANEL (Ch.25 complete) // ============================================================================
namespace RVA { constexpr u32 Sidebar_Render = 0x07F8F0; // top-level overlay panel (0x7F8F0, ~0x146E bytes) // Sidebar_Render calls: // CRC32_Lookup(0x11DF0) on "Sidebar" key (RVA 0x3AF2C8) // Module_RegistryLookup(0x3D1A0) // Module_Notify(0x1D2B0) // Language selector sub-panel (0x80770-0x80B50) unconditionally // Jump-table dispatch for all tab bodies // Tail-jmp to ImGui_Epilogue (0x23E20) at 0x80D5E // Stack frame: 0x380 bytes; saves xmm6–xmm8; single rcx arg (ModuleManager ptr) // // Key strings: // Banner: "EF - Cheeto Press F12 to show panel" (RVA 0x3AF258) // Disclaimer: "This is free, if you spend money, then you have been deceived" (RVA 0x3AF288) // Window key: "Sidebar" (RVA 0x3AF2C8) — ImGui::Begin not called inside 0x7F8F0 itself // Active tab index written to [.data+0x1F68] on click, read by jump table
constexpr u32 Lang_Selector_start = 0x080770; // language selector sub-panel start (unconditional)
constexpr u32 Lang_Selector_end = 0x080B50; // language selector sub-panel end
}
// Language selector execution flow (Ch.26.2): // 0x80895 call Locale_ContextInit(0x9D660) // 0x808DD lea rsi, "English" (RVA 0x3AF310) // 0x808E3 lea rbx, "简体中文" (RVA 0x3AF318) // 0x809A1 lea rdx, " Language" (RVA 0x3AF328) // 0x809C6 call TabMgr::BeginTab(0x9D7D0) // 0x80A03 call ImGui::Combo(0x64220) → al=1 if changed // 0x80A2F if English: mov [.data+0x3C77B0], 0 // 0x80A5D if ZH-CN: mov [.data+0x3C77B0], 1 // 0x80A6E call I18n_Refresh(0x2A530) // 0x80A73 dec [g_Config+0x2764] (content ref-count) // 0x80A80 rax = [g_Config+0x15D8] (active config preset ptr) // 0x80A87 [rax+0x103] = 1 (dirty flag → triggers config save) // 0x80B0B lea rcx, "Content" (RVA 0x3ADFC8) // 0x80B12 call CRC32_Lookup(0x11DF0) // 0x80B33 call Module_RegistryLookup(0x3D1A0) // 0x80B4D call Module_Notify(0x1D2B0)
// ============================================================================ // SECTION 22 — ESPMODULE COMPLETE FUNCTION TABLE (Ch.22) // ============================================================================
namespace RVA { constexpr u32 ESPModule_Init = 0x083E00; // lazy singleton init (thread-safe static) constexpr u32 ESPModule_Render = 0x083F60; // Ch.22 §22.1 — "ESP Features" collapsing header constexpr u32 ESPModule_DrawOverlay = 0x083000; // Ch.22 §22.2 — world-space entity label overlay constexpr u32 ESPModule_Update = 0x084A00; // per-frame entity label draw loop start constexpr u32 ESPModule_Update_loop = 0x0852A5; // entity label loop body } // ESPModule::RenderOverlay (0x83FA0–0x8499E): large monolithic ImGui panel // ESPModule::Update entity type dispatch: 0=enemy, 1=interactive, 2=friendly, 3=npc, 4=puzzle
// ============================================================================ // SECTION 23 — FPSMODULE COMPLETE (Ch.20) // ============================================================================
namespace RVA { constexpr u32 FPSModule_Initialize = 0x0814C0; // once_flag guarded init (once_flag at [.data+0x2310]) constexpr u32 FPSModule_RenderPanel = 0x085660; // panel render (two checkboxes: FPS Monitor + Show FPS Overlay) constexpr u32 FPSModule_RenderPanel_branch = 0x0856F0; // inner ImGui branch of panel render constexpr u32 FPSModule_RenderOverlay = 0x085700; // FPS counter overlay start constexpr u32 FPSModule_RenderOverlay_end = 0x085900; // FPS counter overlay end constexpr u32 FPSModule_RenderOverlay_counter = 0x0858D0; // "##Foreground" frameless window (FPS display) } // FPSModule::Initialize (0x814C0): // Guarded by once_flag at [.data+0x2310] // Alloc 0xD8 bytes (via 0xAC86A), store ptr at [.data+0x22E0] // vtable: 0x3AFA38 → 0x3AFAC0 after init // name: "FPS Monitor" (RVA 0x3AFA88) at [.data+0x22E8] // enabled = 0 at [.data+0x2308] // // FPSModule overlay color thresholds (RVA of XMMWORD constants): // fps >= 60: 0x1803B3530 (green) // 30 <= fps < 60: 0x1803B3540 (yellow) // fps < 30: 0x1803B3510 (red) // FPS display string built by FPS_StringBuild (0x7F5C0): "FPS: " + integer
// ============================================================================ // SECTION 24 — SETDITHER COMPLETE (Ch.12.5.1) // ============================================================================
namespace RVA { constexpr u32 SetDither_RenderOverlay = 0x08C4A0; // SetDither::RenderOverlay — distinct from RegisterTab // SetDither::RenderOverlay is invoked by the tab-callback pointer chain // (not directly from RegisterTab at 0x81810) // Implements the graphics dither toggle panel body }
// ============================================================================ // SECTION 25 — FREECAM KEY BINDING DISPLAY (Ch.27.3) // ============================================================================ // Key display sub-panel inside FreeCam tab (when enabled): // Each row uses: MakeString(0xFCB0) → Label_Formatter(0x5FB60) → TabMgr::BeginTab(0x9D7D0) // Key binding state array: [rip + ...] # 0x1803C6E98 ("Pu;" RTTI sentinel in .data) // Key label format strings (RVAs): // "Forward Key: %s" 0x3AFD08 VA 0x180087A87 // "Backward Key: %s" 0x3AFD18 VA 0x180087B1A (approx) // "Left Key: %s" 0x3AFD30 // "Right Key: %s" 0x3AFD40 // "Up Key: %s" 0x3AFD50 // "Down Key: %s" 0x3AFD60 // "IncFOV Key: %s" 0x3AFD70 // "DecFOV Key: %s" 0x3AFD80 // "LeftRoll Key: %s" 0x3AFD90 // "RightRoll Key: %s" 0x3AFDA8 // "ResetRoll Key: %s" 0x3AFDC0 // "NONE" 0x3AF820 — displayed for any unbound key
namespace RVA { constexpr u32 FreeCam_KeyDisplay = 0x087A87; // FreeCam key binding display panel start }
// ============================================================================ // SECTION 26 — SKILLHACK INTERNALS (Ch.10 complete) // ============================================================================
namespace RVA { constexpr u32 SkillHack_FNV_hash = 0x08D555; // FNV-1a 64-bit hash (unrolled, 8-byte XOR/MUL loop) // FNV constants: prime=0x100000001B3, offset=0xCBF29CE484222325 constexpr u32 SkillHack_HashMiss = 0x08D770; // hash miss fallback: xor al,al → ret 0 constexpr u32 SkillHack_CallOrig = 0x08D891; // call-original trampoline: call r8 (original fn) constexpr u32 SkillHack_SkipRet = 0x08D894; // skip-to-ret jmp target (cost bypass early exit) constexpr u32 Vacuum_Monster_subss = 0x093EAC; // Vacuum::Render Monster sub-checkbox subss sequence }
// ============================================================================ // SECTION 27 — CRT SECURITY FUNCTIONS (Ch.4) // ============================================================================
namespace RVA { constexpr u32 CRT_SecurityInit = 0x0AC580; // __security_check_cookie + SEH init (0xAC580-0xAC6CA) constexpr u32 CRT_SecurityInit_end = 0x0AC6CA; constexpr u32 CRT_SecurityCookie = 0x0AC6CC; // __security_check_cookie verifier (0xAC6CC-0xAC77B) constexpr u32 CRT_SecurityCookie_end= 0x0AC77B; } // CRT_SecurityInit pseudocode (called at DllMain + first-chance exception dispatch): // call IsProcessorFeaturePresent(0x17) → if supported: int 29h (fast fail) // call __security_check_cookie helper (sub_0x1800AC574) // RtlCaptureContext / RtlLookupFunctionEntry / RtlVirtualUnwind // Build EXCEPTION_RECORD: code=0x40000015 (STATUS_FATAL_APP_EXIT), flags=NONCONTINUABLE // call IsDebuggerPresent → save eax // call SetUnhandledExceptionFilter(NULL) // call UnhandledExceptionFilter(&record) // if !result && !debugger: call TerminateProcess(handle, code) [via int 29h at 0xAC628]
// ============================================================================ // SECTION 28 — THREAD ENUMERATION DETAIL (Ch.3 call-site map) // ============================================================================ // All CollectProcessThreads (0xA96B0) internal call sites: // 0xA9701 TH32CS_SNAPTHREAD = 4 (lea ecx,[rbx+4]) // 0xA970B CreateToolhelp32Snapshot(4, pid) // 0xA971E sizeof(THREADENTRY32) = 28 = 0x1C // 0xA972F Thread32First(hSnapshot, &te32) // [loop body] // 0xA9740 check te32.th32OwnerProcessID offset (0x10) // 0xA974B GetCurrentProcessId() // 0xA9751 cmp te32.th32OwnerProcessID, eax // 0xA9757 GetCurrentThreadId() // 0xA975D cmp te32.th32ThreadID, eax // 0xA9761 je skip (exclude caller thread) // 0xA9763 get vector data ptr // 0xA9778 VirtualAlloc/HeapReAlloc if vector full // 0xA97CA store thread ID: [rdx+rcx*4] = eax // 0xA97CD inc [rdi+0xC] (vector count++) // 0xA97DD Thread32Next(hSnapshot, &te32) // 0xA97E3 test eax,eax → jne loop // 0xA97EB GetLastError → cmp 0x12 (ERROR_NO_MORE_FILES) // 0xA9815 CloseHandle(hSnapshot) // // SuspendOrResumeThreads (0xA9A20) call sites: // 0xA9849 OpenThread(THREAD_SUSPEND_RESUME, FALSE, tid) // 0xA9861 SuspendThread(hThread) // 0xA9964 ResumeThread(hThread) [×37 total resume calls] // 0xA988B GetThreadContext(hThread, &ctx) // 0xA993C CreateToolhelp32Snapshot (secondary snapshot) // // PatchCode (0xA9A9C) call sites: // 0xA9AFC VirtualProtect(target, size, PAGE_EXECUTE_READWRITE, &old) // 0xA9B6C VirtualProtect(target, size, old, &old) (restore) // 0xA9B72 GetCurrentProcess() // 0xA9B81 FlushInstructionCache(hProc, target, size)
// ============================================================================ // SECTION 29 — IAT CALL SITE MAP (Ch.2 complete) // ============================================================================ // All Win32 IAT entries with RVAs and call sites: // SuspendThread IAT 0xB1050 call site 0xA9861 // ResumeThread IAT 0xB1058 call site 0xA9964 (×37) // GetThreadContext IAT 0xB1068 call site 0xA988B // FlushInstructionCache IAT 0xB1070 call site 0xA9B81 // SetThreadContext IAT 0xB1078 call site 0xA993C // GetProcAddress IAT 0xB1088 call sites 0x55F7E, 0x55F92 (×7) // LoadLibraryA IAT 0xB10E0 call sites 0x55F57, 0x585AE (×4) // AllocConsole IAT 0xB1108 // GetConsoleMode IAT 0xB1120 // SetConsoleMode IAT 0xB1128 // SetConsoleTitleA IAT 0xB12A0 // GetCurrentProcess IAT 0xB1270 call site 0xA9B72 // VirtualFree IAT 0xB1278 call sites 0x81D5B, 0xAA6E1 // VirtualProtect IAT 0xB1288 call sites 0xA9AFC, 0xA9B6C // VirtualAlloc IAT 0xB11A0 call sites 0xAA566, 0xAA607 // IsDebuggerPresent IAT 0xB11E8 call site 0xAC67B // IsProcessorFeaturePresent IAT 0xB11F0 call site 0xAC5A2 // TerminateProcess IAT 0xB11F8 call site 0xAC628 (via int 29h) // SetUnhandledExceptionFilter IAT 0xB1200 call site 0xAC698 // UnhandledExceptionFilter IAT 0xB1208 call site 0xAC6A3 // RtlVirtualUnwind IAT 0xB1210 // RtlLookupFunctionEntry IAT 0xB1218 // RtlCaptureContext IAT 0xB1220 // OpenThread IAT 0xB11D0 call site 0xA9849 (×38) // Thread32Next IAT 0xB11A8 call site 0xA97DD // Thread32First IAT 0xB11B0 call site 0xA972F // CreateToolhelp32Snapshot IAT 0xB1160 call site 0xA970B // SetWindowDisplayAffinity IAT 0xB1460 call site 0x8B48F // FindWindowA IAT 0xB14A8 call site 0x8301F // EnumWindows IAT 0xB14A0 // GetWindowRect IAT 0xB1488 // GetWindowThreadProcessId IAT 0xB1498 // IsWindow IAT 0xB1468 // GetSystemMetrics IAT 0xB14E0 // LoadIconW IAT 0xB14E8 // GetAsyncKeyState IAT 0xB???? call site 0x8301A // ShowWindow IAT 0xB1628 // UpdateWindow IAT 0xB14D8 // RegisterClassExW IAT 0xB1638 // CreateWindowExW IAT 0xB1650 // SetLayeredWindowAttributes IAT 0xB15E0 // SetProcessDPIAware IAT 0xB15A0 // LoadCursorW IAT 0xB15C8 // PeekMessageW IAT 0xB14D0 // TranslateMessage IAT 0xB14C8 // DispatchMessageW IAT 0xB14C0 // PostQuitMessage IAT 0xB???? (WndProc WM_DESTROY) // SetWindowPos IAT 0xB???? (overlay alignment) // CreateSolidBrush IAT 0xB1018 // CreateMutexA IAT 0xB1720 // DwmExtendFrameIntoClientArea IAT 0xB1918 // D3D11CreateDeviceAndSwapChain IAT 0xB1908 // D3DCompile IAT 0xB1000 call sites 0x54E77, 0x55069 // _wfopen IAT 0xB1888 call site 0x11F93 // fwrite IAT 0xB1868 call sites 0xEA1B, 0x170D6, 0x3033B, 0x3076D // fread IAT 0xB1870 (via 0x11EA0 helper) // fclose IAT 0xB1878 call sites 0x170DF, 0x30776
// ============================================================================ // END OF RECONSTRUCTION HEADERS // ============================================================================
// ============================================================================ // SECTION 30 — REMAINING CALL-SITE ADDRESSES (final gap closure) // ============================================================================ // These are internal addresses referenced in the doc that complete coverage. // They are instruction-level addresses, not function entry points.
namespace RVA { // Config I/O range markers constexpr u32 OpenConfigFile_end = 0x012043; // OpenConfigFile range end (0x11EA0–0x12043) constexpr u32 ImGuiSaveIni_caller = 0x0170B9; // caller VA of ImGuiSaveIni (fopen 'wt' for .ini) constexpr u32 SaveConfig_iniwrite = 0x030750; // SaveConfig: write ImGui ini section call site
// FpsUnlocker alt address (function table ref)
constexpr u32 FpsUnlocker_Render_alt = 0x085B80; // FpsUnlocker::Render alt ref addr (one-byte offset)
// FreeCam key display
constexpr u32 FreeCam_BackwardKey = 0x087B1A; // "Backward Key: %s" display address (approx)
// ModuleManager::DispatchRegistrarInit call site
constexpr u32 DispatchRegInit_callsite = 0x083348; // called at 0x83348 — init ImGui panel layout after first Present
// ModulePathScanner skip-on-failure
constexpr u32 ModPathScanner_skip = 0x08BA41; // je target: skip module on GetModuleFileNameW failure
// CollectProcessThreads instruction-level addresses (within 0xA96B0 body)
// 0xA96E7 xor ebx,ebx — thread count = 0
// 0xA96F8 init empty vector — mov [rcx],rbx; mov [rcx+8],rbx
// 0xA9711 mov r14,rax — hSnapshot = CreateToolhelp32Snapshot result
// 0xA9714 cmp rax,-1 — INVALID_HANDLE_VALUE check
// 0xA9725 lea rdx,[rsp+0x30] — THREADENTRY32 buffer ptr
// 0xA972A mov [rsp+0x30],r12d — te32.dwSize = 28
// 0xA9751 cmp [rsp+0x3C],eax — te32.th32OwnerProcessID == GetCurrentProcessId
// 0xA9755 jne skip — skip threads from other processes
// (All within CollectProcessThreads body at 0xA96B0; see Section 28 for full map)
}
// ============================================================================ // END // ============================================================================
// ============================================================================ // SECTION 19 — SIDEBAR / MAIN PANEL (Ch.25) // ============================================================================ // Top-level overlay panel function: RVA 0x7F8F0 (~0x146E bytes) // Called every Present() frame from ModuleManager render loop. // Stack frame: 0x380 bytes; saves xmm6-xmm8; single rcx arg (global ctx ptr) // // Key strings: // "Sidebar" RVA 0x3AF2C8 — window lookup key (CRC32 0x11DF0, reg 0x3D1A0/0x1D2B0) // "EF - Cheeto Press F12 to show panel" RVA 0x3AF258 // "This is free, if you spend money, then you have been deceived" RVA 0x3AF288 // Active tab index: [.data+0x1F68] VA 0x1803C6F68 (written on click, read at 0x80B52) // // Six tabs (jump-table dispatch at 0x80B52, case bodies): // Tab 0 "About" RVA 0x3AF2D0 — banner + disclaimer + About sub-fn (0x80E80) // Tab 1 "Player" RVA 0x3AF2DC — NoClip, SkillHack // Tab 2 "ESP" RVA 0x3AF2E8 — ESPModule overlay // Tab 3 "World" RVA 0x3AF2F0 — Vacuum // Tab 4 "Visual" RVA 0x3AF2FC — FPSMonitor, FreeCam, SetDither, FpsUnlocker, PlayerProfile // Tab 5 "Settings" RVA 0x3ADFD8 — Settings::RenderOverlay (case 5 at 0x80D25) // // i18n label dispatcher: 0x9D660 (translates label string per language toggle) // Sidebar function tail-calls into ImGui epilogue at 0x23E20 via jmp at 0x80D5E
namespace RVA { constexpr u32 Sidebar_Main = 0x07F8F0; // top-level sidebar render constexpr u32 Sidebar_About = 0x080E80; // About tab sub-function constexpr u32 Sidebar_JumpTable = 0x080B52; // tab jump table (reads [.data+0x1F68]) constexpr u32 Sidebar_Case5 = 0x080D25; // Settings tab case entry constexpr u32 i18n_Dispatcher = 0x09D660; // translation dispatcher (en/zh_cn) // ImGui_Combo = 0x064220 (already defined in Section 9 RVA namespace) // ImGui_Epilogue = 0x023E20 (already defined in Section 9 RVA namespace) constexpr u32 CRC32_fn = 0x011DF0; // CRC32 hash (window key) constexpr u32 Registry_lookup = 0x03D1A0; // registry lookup by CRC32 constexpr u32 Registry_lookup2 = 0x01D2B0; // secondary registry lookup }
// ============================================================================ // SECTION 20 — FREECAM KEY BINDING DISPLAY PANEL (Ch.27) // ============================================================================ // Sub-section of FreeCam::Update (RVA 0x871A0), begins at ~0x87A70, ends 0x88606 // (FreeCam::Update is 0x14C6 bytes total) // // Float sliders (ImGui variant 0x65570): // "Free Camera" RVA 0x3AFCB0 — sub-panel BeginTab label // "ON / OFF" RVA 0x3AF848 — toggle checkbox // "Move Speed" RVA 0x3AFCC0 — DragFloat fmt "%.3f" (0x3ADFB0) // "Look Sensitivity" RVA 0x3AFCD0 — DragFloat fmt "%.3f" // "Roll Speed" RVA 0x3AFCE8 — DragFloat fmt "%.3f" // "FOV Speed" RVA 0x3AFCF8 — DragFloat fmt "%.3f" // "FOV" RVA 0x3AFD04 — DragFloat fmt "%.1f" (0x3ADFEC) // // Key binding rows (11 total) — each row: // MakeString(0xFCB0) → sprintf(0x5FB60, "Key: %s", key_name) → TabLabel(0x9D7D0) // "NONE" RVA 0x3AF820 — displayed for unbound keys // Key-binding state array: [rip+...] 0x1803C6E98 // Rows: // "Forward Key: %s" RVA 0x3AFD08 (VA 0x180087A87) // "Backward Key: %s" RVA 0x3AFD18 // "Left Key: %s" RVA 0x3AFD30 // "Right Key: %s" RVA 0x3AFD40 // "Up Key: %s" RVA 0x3AFD50 // "Down Key: %s" RVA 0x3AFD60 // "IncFOV Key: %s" RVA 0x3AFD70 // "DecFOV Key: %s" RVA 0x3AFD80 // "LeftRoll Key: %s" RVA 0x3AFD90 // "RightRoll Key: %s" RVA 0x3AFDA8 // "ResetRoll Key: %s" RVA 0x3AFDC0
namespace RVA { constexpr u32 FreeCam_KeyBindPanel = 0x087A70; // key binding display section start constexpr u32 FreeCam_KeyBind_end = 0x088606; // end of FreeCam::Update constexpr u32 Sprintf_label = 0x05FB60; // sprintf-style label formatter }
// ============================================================================ // SECTION 21 — SETTINGS TAB (Ch.28) // ============================================================================ // Settings::RenderOverlay RVA 0x9A4F0 (source: SettingsTAB.cpp RVA 0x3B0B30) // Called from sidebar case 5 (0x80D25). Ends at ~0x9AB31. // // 28.1 Theme selector: // ImGui::Combo("Theme", ...) via 0x64220 // Four themes → four applicator functions: // "Default" RVA 0x3B0AF8 → applicator 0x941F0 (restores ImGui defaults) // "Evangelion Unit 01" RVA 0x3B06D0 → applicator 0x94890 (52 color writes) // "Evangelion Unit 02" RVA 0x3B0AE0 → applicator 0x96770 // "Matrix" RVA 0x3B0B10 → applicator 0x98650 // Each non-default applicator uses per-slot helper RVA 0x94190 (159 calls total): // reads RRGGBBAA hex string → __stdio_common_vsscanf → ImGui::PushStyleColor (0x10840) // // Evangelion Unit 01 colors (RVA 0x94890, in write order): // #FFFFFFFF #7857A7FF #19171CFF #2A282EFF #2A282EE6 #4DE6A5FF // #00000000 #4A455240 #A38CCF80 #7857A780 #4A4552FF // // Evangelion Unit 02 colors (RVA 0x96770): // #FFFFFFFF #D9293BFF #1E1E1EFF #3A3A3AFF #3A3A3AE6 #F7B302FF // #00000000 #4A455240 #F7465880 #D9293B80 #4A4552FF // // Matrix colors (RVA 0x98650): // #00FF41FF #00AA2CFF #000000FF #0A0A0AFF #0A0A0AE6 #004400FF // #00000000 #00440040 #00881EFF #00FF4180 // // 28.3 Console toggle: // CheckboxToggle(0x85320) with label "Toggle Console" (RVA 0x3B0B00) // Enabled branch: AllocConsole (IAT 0xB1178) / GetStdHandle → display "Console {}" // Disabled branch: FreeConsole
namespace RVA { constexpr u32 Theme_Default = 0x0941F0; // restores ImGui default palette constexpr u32 StyleColor_push = 0x010840; // ImGui::PushStyleColor wrapper // Settings_end 0x09AB31 — see also RVA::Settings_end 0x09AB98 in Section 9 }
// ============================================================================ // SECTION 22 — CONFIG / IMGUI .INI SYSTEM (Ch.19) // ============================================================================ // ImGui .ini filename: "imgui.ini" RVA 0x3ABB60 // Set at RVA 0x1117A into ImGuiIO+0x20 (IniFilename field) // // Config save/load: // Load path (startup): RVA 0x30661 → ConfigSerialize (0x12050) // → ftell (0x120A0) → fseek (0x120BC, 0x120E7) → ftell → fread → fclose // Manual save trigger: RVA 0x17072 // Sets [ImGuiContext+0x2900]=1, [ImGuiContext+0x2904]=0 → forces immediate write // fwrite calls: 0x3076D (config body), also 0x170D6 // fclose: 0x30776 // // Module settings handler struct (ImGuiContext+0x2920 array, 0x48 bytes each): // +0x00 TypeName (const char*) — .ini section name // +0x08 TypeHash (u32) — CRC32 of TypeName (computed 0x3079C–0x30803) // +0x18 ReadOpenFn — called on section header encounter // +0x38 WriteAllFn — called during save to emit key=value lines // 11 registered modules (RTTI .data+0x0590–0x0E60): // ESPModule, FPSModule, FpsUnlocker, FreeCam, NoClip, PlayerProfile, // PreventScreenshot, SetDither, SkillHack, Vacuum, UnityExplorerModule // // i18n blob: RVA 0x3B10E8 (0xEED bytes, nlohmann JSON, en→zh_cn map) // Copied to [.data+0x1EB8] at startup RVA 0x2164 // Loader: RVA 0x9D660 — selects en or zh_cn based on language flag // nlohmann version: v3.12.0 (statically linked; error strings at 0x3B3010–0x3B30D8)
namespace RVA { constexpr u32 ImGuiIni_set = 0x01117A; // IniFilename = "imgui.ini" write constexpr u32 Config_save_trigger = 0x017072; // manual save: set ImGuiCtx+0x2900 constexpr u32 Config_load_entry = 0x030661; // config file load entry constexpr u32 Config_ftell = 0x0120A0; // ftell in config read constexpr u32 Config_fseek_A = 0x0120BC; // fseek in config read constexpr u32 Config_fseek_B = 0x0120E7; // fseek in config read constexpr u32 Config_fwrite = 0x03076D; // config body fwrite constexpr u32 Config_fclose = 0x030776; // config fclose constexpr u32 ImGui_handler_CRC = 0x03079C; // CRC32 of TypeName (start) constexpr u32 ImGui_handler_CRC_end = 0x030803; // CRC32 of TypeName (end) constexpr u32 i18n_blob_rva = 0x3B10E8; // JSON localization blob (.rdata) constexpr u32 i18n_loader = 0x09D660; // translation dispatcher constexpr u32 i18n_copy_site = 0x02164; // startup: copies blob to [.data+0x1EB8] constexpr u32 Registrar_name_str = 0x01B71; // registrar constructor name string RVA ref }
// ============================================================================ // SECTION 23 — UNITY EXPLORER MODULE (Ch.16 supplement) // ============================================================================ // UE draw body: RVA 0x0902E0 (per-frame inspector UI, called from UE::Render 0x90250) // Window title: "Unity Explorer Window" RVA 0x3B02E0 (via ImGui::Begin wrapper 0x937D0) // // Scene panel (pseudocode): // if (scene_list empty) { // ImGui::Text("No scenes available. Click 'Refresh Scenes' to load."); // } else { // ImGui::Text("Select Scene:"); // ImGui::Combo("##SceneCombo", &selected_scene_idx, scene_list, n_scenes); // if (changed) LoadScene(selected_scene_idx); // } // // When scene panel active: g_Config->overlay_flags |= 1; overlay_scale = 300.0f // // ([g_Config+0x1F78], [g_Config+0x1F90]) // // Auto-refresh (RVA 0x090250): // if (enabled && auto_refresh) { // now = GetTime(); // 0x93B10 // if ((now - last_refresh_time) * SCALE >= refresh_interval) // RefreshScenes(this); last_refresh_time = now; // } // // Scene list storage: vector at [this+0x58]..[this+0x60] // GameObject list: vector at [this+0x40]..[this+0x48] // Search filter: [this+?] char[0x100] buffer "##SearchFilter" // // Inspector panel (when object selected via 'Ins' button): // 'Active' checkbox → GameObject.SetActive via IL2CPP // Transform: Position, LocalPosition, Rotation, Scale (float3 inputs) // 'Components' section via IL2CPP GetComponents(UnityEngine.Component) // Per component: "%s.%s" (namespace.classname) // Failure strings: "Unknown Component", "Unable to get GameObject class information." // // Key strings (Ch.16.4): // "No scenes available. Click 'Refresh Scenes' to load." // "Select Scene:" "No GameObjects found in this scene." "DontDestroyOnLoad" // "No GameObject selected." "Active" "Components" "All Components:"
namespace RVA { constexpr u32 UE_DrawBody = 0x0902E0; // main per-frame inspector draw constexpr u32 UE_AutoRefresh_fn = 0x093B10; // auto-refresh timer check }
// ============================================================================ // SECTION 24 — ADDITIONAL IAT ENTRIES (referenced in doc but not in Ch.2 table) // ============================================================================ // IAT base: RVA 0xB1000 (file raw offset 0xAF600) // These slots appear in inline code references throughout the doc:
// IAT[0xB1148] SwitchToThread — spinlock backoff (if backoff<32: SwitchToThread else Sleep(1)) // IAT[0xB1168] GetModuleFileNameExW — module path scanner, get full path of each module // IAT[0xB1178] AllocConsole — Settings console toggle enable branch // IAT[0xB1290] GetModuleHandleW — GABypass: GetModuleHandleW(L"GameAssembly.dll") // also: PreventScreenshot::OsCheck loads ntdll for RtlGetVersion
// ============================================================================ // SECTION 25 — MODULEMANGER INIT VARIANT ADDRESS (Ch.19.7) // ============================================================================ // Two RVAs for ModuleManager::Init appear in the doc: // RVA 0x09AC10 — from Ch.15 (primary reference) // RVA 0x09ACA4 — from Ch.19.7 (alternate call site / body continuation) // Both refer to the same function; 0x9AC10 is entry, 0x9ACA4 is within body. // Body action (Ch.19.7): // Iterates module registry [.data+0x23B8], calls vtable[+0x10] → module instance, // then vtable[+0x18] (Render dispatch) per registered module. // Source: ModuleManager.cpp lines 34 and 52 (assert strings in binary).
// Vacuum::RegisterTab stub at RVA 0x9B650 resolves via jmp to // UnityExplorerModule::RegisterTab at RVA 0x090060. // (Vacuum and UE share a registrar stub due to module ordering in init sequence)
// GABypass::Patch call site in startup: RVA 0x0A942A // Called exactly once from LoaderThread, immediately after 'Initializing..' log (0xA93E6) // and before any module Update()/Render() calls.
// ============================================================================ // SECTION 26 — COMPLETE ADDRESS COVERAGE INDEX // ============================================================================ // All 282 unique cheat-range addresses extracted from the doc, organized by subsystem. // Addresses not in RVA:: namespace appear inline below with descriptions.
// -- Config / i18n / .ini system -- // 0x01B71 registrar constructor name string ref // 0x02164 i18n blob copy to [.data+0x1EB8] at startup // 0x1117A ImGuiIO.IniFilename = "imgui.ini" write site // 0x17072 manual config save trigger (sets ImGuiCtx+0x2900=1) // 0x30661 config file load entry (calls ConfigSerialize 0x12050) // 0x30904 ImGui handler struct layout base (from CRC32 compute chain)
// -- Sidebar / UI -- // 0x80B52 sidebar tab jump table (reads active_tab_idx [.data+0x1F68])
// -- D3D11 overlay window (detailed call sites Ch.29) -- // 0x8298B EnumWindows → FindGameWindow, end of DPI section // 0x82A60 DwmExtendFrameIntoClientArea call site // 0x82B24 D3D11CreateDeviceAndSwapChain attempt 1 (R8G8B8A8) // 0x82B7E D3D11CreateDeviceAndSwapChain attempt 2 (B8G8R8A8 fallback) // 0x82C0D CreateMutexA — duplicate-instance guard // 0x82F5F Log "Initialized" (source UI.cpp, before message loop) // 0x83386 DispatchRegistrarInit once_flag — install registrar hooks // 0x8348A SwitchToThread yield site (game out of focus)
// -- FreeCam -- // 0x87A70 FreeCam key binding display panel start (inside FreeCam::Update) // 0x88606 FreeCam::Update end
// -- UnityExplorer -- // 0x902E0 UE main draw body (scene panel + GO inspector)
// -- Settings / Theme -- // 0x941F0 Default theme applicator (restores ImGui defaults) // 0x9AB31 Settings::RenderOverlay approximate end
// -- ModuleManager -- // 0x9ACA4 ModuleManager::Init body (alt addr, iterates registry vtable[+0x10]/[+0x18]) // 0x9B650 Vacuum/UE RegisterTab shared stub (resolves to UE::RegisterTab 0x90060)
// -- Startup -- // 0xA942A GABypass::Patch call site in LoaderThread (after 'Initializing..' log)
// -- IAT slots (additional, not in main IAT table) -- // 0xB1148 SwitchToThread // 0xB1168 GetModuleFileNameExW // 0xB1178 AllocConsole // 0xB1290 GetModuleHandleW (GameAssembly + ntdll RtlGetVersion)
// ============================================================================ // SECTION 27 — COMPLETE .RDATA STRING TABLE // ============================================================================ // All 189 .rdata string RVAs from the document, grouped by subsystem. // Format: RVA — "string content" — usage
// --- ImGui / config filenames --- // 0x3ABB60 "imgui.ini" ImGuiIO+0x20 IniFilename (written at RVA 0x1117A) // 0x3ABB70 "imgui_log.txt" ImGuiIO+0x28 LogFilename (written at same site) // 0x3ABF10 "##Foreground" FPS overlay frameless window label // 0x3AC160 "Calling EndDisabled() too many times!" ImGui assert string
// --- D3D11 shaders (HLSL source, compiled at runtime) --- // 0x3AE660 Vertex shader HLSL source length=0x2DD (733 bytes) // entry="main" target="vs_4_0" // cbuffer vertexBuffer:b0 { float4x4 ProjectionMatrix } // VS_INPUT{float2 pos:POSITION, float4 col:COLOR0, float2 uv:TEXCOORD0} // PS_INPUT main: output.pos = mul(ProjectionMatrix, float4(pos.xy,0,1)) // 0x3AE940 Pixel shader HLSL source length=0x191 (401 bytes) // entry="main" target="ps_4_0" // sampler sampler0; Texture2D texture0; // float4 main: return input.col * texture0.Sample(sampler0, input.uv)
// --- PreventScreenshot --- // 0x3AEC70 dynamic import string for SetWindowDisplayAffinity (from user32.dll, RVA 0x3C34A6) // 0x3B00B8 module name "PreventScreenshot" (registrar)
// --- About page (Tab 0, sub-fn 0x80E80) --- // 0x3AF350 "%s Game: Endfield CTB3" format string // 0x3AF368 "Version: " label // 0x3AF374 "1.0.0" version value // 0x3AF380 "Author: " label // 0x3AF38C "gktwo" author value // (All direct string literals, not i18n-dispatched)
// --- Window class detection --- // 0x3AF658 "UnityWndClass" FindWindowA arg / string-compare (0xACA12)
// --- ESP module (ESPModule::RenderOverlay RVA 0x83FA0) --- // 0x3AF828 "ESPModule" module name // 0x3AF838 "ESP Features" CollapsingHeader title → state [.data+0x27B0] // 0x3AF848 "ON / OFF" checkbox label → [module+0x28] // 0x3AF858 "Display Types" CollapsingHeader sub-header (via 0x6EC20) // 0x3AF868 "Show Monsters" checkbox → [rsi+0x34] show_monsters // 0x3AF878 "Show NPC" checkbox → [rsi+0x35] show_npc // 0x3AF888 "Show Friendly" checkbox → [rsi+0x36] show_friendly // 0x3AF898 "Show Puzzles" checkbox → [rsi+0x37] show_puzzles // 0x3AF8A8 "Show All" checkbox → [rsi+0x38] show_all // 0x3AF8B8 "Display Info" CollapsingHeader sub-header // 0x3AF8C8 "Show Distance" checkbox → [rsi+0x39] show_distance // 0x3AF8D8 "Show Name" checkbox → [rsi+0x3A] show_name // 0x3AF8E8 "Show Type" checkbox → [rsi+0x3C] show_type // 0x3AF8F4 (entity label separator string, used in Update DrawOverlay) // 0x3AF900 (entity label buffer string) // 0x3AF908 entity type dispatch table start (type→name pairs) // 0x3AF920 entity type dispatch table continued (0xFFFFFFFF sentinel) // 0x3AF9E0 vtable ptr value (0x3AF9E0 = post-init vtable for ESPModule)
// --- FPS overlay (FPSModule) --- // 0x3AFA98 FPSModule vtable block start // 0x3AFAAC "FPS: " prefix for FPS display string (via 0x7F5C0) // Color thresholds for FPS display (XMMWORD constants, already in .rdata): // fps >= 60: color at 0x1803B3530 (green 0.0, 1.0, 0.0, 1.0) // 30<=fps<60: color at 0x1803B3540 (yellow 1.0, 1.0, 0.0, 1.0) // fps < 30: color at 0x1803B3510 (red 1.0, 0.0, 0.0, 1.0)
// --- FreeCam --- // 0x3AF820 "NONE" unbound key display in key binding rows
// --- PlayerProfile UI paths --- // 0x3AFED0 "/UINode/UIRoot/UIDPanelPanel/Main/TextNode/Text" (len 0x2F) // 0x3AFFD0 "/UINode/WorldUIRoot/WatchPanel/Content/WatchNode/canvas_watch/ // LeftBottomNode/PlayInfoPosNode/PlayInfoLifengCell(Clone)/PlayerInfo/ManagerName" // (len 0x8D)
// --- FreeCam key binding panel (Ch.27) --- // 0x3AFCB0 "Free Camera" // 0x3AFCC0 "Move Speed" // 0x3AFCD0 "Look Sensitivity" // 0x3AFCE8 "Roll Speed" // 0x3AFCF8 "FOV Speed" // 0x3AFD04 "FOV" // 0x3AFD08 "Forward Key: %s" // 0x3AFD18 "Backward Key: %s" // 0x3AFD30 "Left Key: %s" // 0x3AFD40 "Right Key: %s" // 0x3AFD50 "Up Key: %s" // 0x3AFD60 "Down Key: %s" // 0x3AFD70 "IncFOV Key: %s" // 0x3AFD80 "DecFOV Key: %s" // 0x3AFD90 "LeftRoll Key: %s" // 0x3AFDA8 "RightRoll Key: %s" // 0x3AFDC0 "ResetRoll Key: %s"
// --- UE module string table (Ch.16.4) --- // 0x3B02D0 "Unity Explorer" tab label / ImGui::Begin title // 0x3B02E0 "Unity Explorer Window" ImGui window title // 0x3B02F8 "Search Filter:" label above search input // 0x3B0308 "##SearchFilter" ImGui InputText widget ID // 0x3B0318 "Inspector" inspector sub-panel label // 0x3B0328 "GameObjectHierarchy" hierarchy sub-panel label // 0x3B0340 "No scenes loaded. Click Refresh..." // 0x3B0390 "Scene: " scene prefix label // 0x3B0398 "No GameObjects found in this scene." // 0x3B03C0 "DontDestroyOnLoad" special DDOL scene label // 0x3B03D8 "DontDestroyOnLoad (Not Found)" // 0x3B03F8 "Refresh" button label // 0x3B0400 "Auto Refresh" checkbox label // 0x3B0410 "Interval (s)" refresh interval slider // 0x3B0420 "Scenes found: %d" // 0x3B0438 "No scenes available. Click 'Refresh Scenes' to load." // 0x3B0470 "Select Scene:" // 0x3B0480 "Select Scene" combo default text // 0x3B0490 "##SceneCombo" ImGui Combo widget ID // 0x3B04A0 "]: " object list entry separator // 0x3B04A8 "Ins##" inspect button label prefix // 0x3B04B8 "No GameObject selected." // 0x3B04D0 "Click 'Ins' button..." inspector hint // 0x3B0508 "Active" active checkbox label // 0x3B0510 "Transform" section header // 0x3B0520 "Position" // 0x3B0530 "Local Position" // 0x3B0540 "Rotation" // 0x3B054C "Scale" // 0x3B0558 "No Transform component found." // 0x3B0578 "Components" section header // 0x3B0588 "GameObject Class: %s.%s" // 0x3B05A0 "All Components:" // 0x3B05B0 "UnityEngine.Component, UnityEngine.CoreModule" (GetComponents type arg) // 0x3B05E0 "%s.%s" component name format // 0x3B05E8 "Unknown Component" // 0x3B0600 "No components found or failed to get components." // 0x3B0638 "Unable to get GameObject class information." // 0x3B0D28 "UnityExplorerModule" module name (registrar) // UE auto-refresh state: bool at [.data+0x2640], float at [.data+0x2644]
// --- Settings tab (Ch.28) --- // 0x3B0AD4 "Theme" combo label // 0x3B0AF8 "Default" theme name // 0x3B06D0 "Evangelion Unit 01" theme name // 0x3B0AE0 "Evangelion Unit 02" theme name // 0x3B0B10 "Matrix" theme name // 0x3B0B00 "Toggle Console" checkbox label // 0x3B0B18 (Settings key address for enabled state) // 0x3B0B28 "enabled" UI label for module on/off state (not JSON key) // 0x3B0B78 "Console {}" console enabled display format // 0x3B0B30 SettingsTAB.cpp source file path string
// Theme color string RVAs (Evangelion Unit 01): // 0x3B06E8 0x3B06F8 0x3B0708 0x3B0718 0x3B0728 0x3B0738 // 0x3B0748 0x3B0758 0x3B0768 0x3B0778 0x3B0798 // Theme color string RVAs (Evangelion Unit 02): // 0x3B0888 0x3B0898 0x3B08A8 0x3B08B8 0x3B08C8 0x3B08D8 0x3B08F8 // Theme color string RVAs (Matrix): // 0x3B09A8 0x3B09B8 0x3B09C8 0x3B09D8 0x3B09E8 0x3B09F8 // 0x3B0A08 0x3B0A18 0x3B0A38
// --- ModuleManager log strings (Ch.15.7) --- // 0x3B0B88 "[WARNING] ModuleManager already initialized" // 0x3B0BC0 ModuleManager.cpp assert source file path // 0x3B0C08 "Initializing ModuleManager" // 0x3B0C28 "Failed to initialize module {}" // 0x3B0C48 "Module {} initialized" // 0x3B0C60 "ModuleManager initialization complete" // 0x3B0C90 "[ERROR] Failed to update module " // 0x3B0CB8 "[ERROR] Failed to render overlay for module " // 0x3B0CE8 "[ERROR] Failed to process hotkeys for module "
// --- Config file mode strings --- // 0x3AD590 "rb" Config READ - binary read mode // 0x3AD594 "wt" Config WRITE - text write mode (ImGui ini)
// --- DamageHack ghost keys (Ch.23) --- // 0x3B1484 i18n table — four keys with no RTTI class (ghost/unimplemented feature)
// --- Locale --- // 0x3B2020 "en" locale string passed to string-construct at 0x9D890
// --- Startup / project identity --- // 0x3B3148 "E:\git\Endfield_Cheeto\user\main.cpp" (confirms project name)
// --- ESP color constant addresses in .data (ESP Update type dispatch) --- // 0x3B3224 drawlist color source (XMMWORD, type-selected RGBA) // 0x3B3308 100.0f constant (SkillHack CooldownBypass return value) // ESP color table .rdata bases (correspond to ESPModule::color[] slots): // 0x3B3500 color[10] BLACK (0.0,0.0,0.0,1.0) // 0x3B3510 color[0] RED (1.0,0.0,0.0,1.0) also FPS<30 threshold // 0x3B3520 color[1] ORANGE (1.0,0.647,0.0,1.0) // 0x3B3530 color[3] GREEN (0.0,1.0,0.0,1.0) also FPS>=60 threshold // 0x3B3540 color[2] YELLOW (1.0,1.0,0.0,1.0) also FPS 30-60 threshold // 0x3B3550 color[11] GRAY (0.502,0.502,0.502,1.0) // 0x3B3560 color[8] PINK (1.0,0.078,0.576,1.0) // 0x3B3570 color[9] LPINK (1.0,0.753,0.796,1.0) // 0x3B3580 color[6] PURPLE (0.58,0.0,0.827,1.0) // 0x3B3590 color[4] BLUE (0.0,0.0,1.0,1.0) // 0x3B35A0 color[5] CYAN (0.0,1.0,1.0,1.0) // 0x3B35B0 color[7] WHITE (1.0,1.0,1.0,1.0)
// --- Preset/config JSON keys (Ch.17/19) --- // 0x3B06F8 "Default" preset name (also used as JSON key, via 0x3B0AF8)
// --- FPS Overlay / PreventScreenshot extra --- // 0x3B0198 "FPSMonitor" / FPS module registrar tab label (inside main cheat overlay)
// ============================================================================ // SECTION 28 — COMPLETE IAT TABLE (all 75 entries) // ============================================================================ // IAT base: RVA 0xB1000 (file raw 0xAF600). Format: IAT[RVA] = function (DLL)
// Previously documented entries (Sections 9/24) plus newly added: // 0xB1148 SwitchToThread KERNEL32 spinlock backoff (if backoff<32) // 0xB1168 GetModuleFileNameExW PSAPI module path scanner full-path retrieval // 0xB1178 AllocConsole KERNEL32 Settings console toggle enable // 0xB1268 GetCurrentThreadId KERNEL32 stack cookie check (RVA 0xAC709) // 0xB1290 GetModuleHandleW KERNEL32 GABypass: L"GameAssembly.dll"; OsCheck: ntdll // 0xB1470 GetWindowLongPtrW USER32 overlay: read GWL_STYLE, GWL_EXSTYLE // 0xB1480 IsWindowVisible USER32 overlay: check game window visible // 0xB1490 GetClassNameA USER32 overlay: detect foreground window class (×3) // 0xB1510 IsIconic USER32 overlay: check not minimized // 0xB1518 SetForegroundWindow USER32 overlay: bring game to front on match // 0xB1570 DestroyWindow USER32 overlay: cleanup on loop exit // 0xB1588 SetWindowPos USER32 overlay: reposition to match game window // 0xB15A8 GetClientRect USER32 overlay: get inner client area // 0xB15B0 SetWindowLongW USER32 overlay: update window style ×2 // 0xB15F0 GetForegroundWindow USER32 overlay: check active foreground window // 0xB1640 UnregisterClassW USER32 overlay: cleanup window class on exit // 0xB1858 fread CRT config file read (called ONLY from 0x12121) // 0xB1880 __stdio_common_vsscanf CRT theme color parser (RRGGBBAA hex→RGBA) // 0xB1890 _wfopen CRT config file open (called ONLY from 0x11F93) // 0xB1898 fseek CRT config seek (from 0x120BC, 0x120E7) // 0xB1920 DwmGetWindowAttribute DWMAPI overlay: DWMWA_EXTENDED_FRAME_BOUNDS rect
// ============================================================================ // SECTION 29 — IMGUI HELPER RVAs (inline functions used throughout modules) // ============================================================================ // ImGui wrapper functions used by module Render() bodies (not in main RVA namespace)
namespace RVA { constexpr u32 ImGui_CollapsingHeader = 0x06EC20; // lightweight wrapper; checks ImGuiCtx+0x106 locked flag constexpr u32 ImGui_Checkbox_commit = 0x061FE0; // checkbox state commit helper constexpr u32 ImGui_Separator_cursor = 0x070630; // Separator + cursor Y adjust constexpr u32 ImGui_AddText_colored = 0x051580; // drawlist AddText with explicit color constexpr u32 FPS_string_builder = 0x07F5C0; // "FPS: " + int → display string constexpr u32 Str_compare_helper = 0x0ACA12; // internal string compare (wchar/char) constexpr u32 ImGui_EndDisabled_path = 0x0ACA1F; // EndDisabled via ImGuiCtx+0x27F0 decrement }
// ImGuiContext field offsets referenced in cheat code: // [ImGuiContext+0x106] locked_input_flag (BYTE) — CollapsingHeader disabled check // [ImGuiContext+0x15D8] foreground_drawlist — FPS overlay drawlist ptr (+0x40 = draw cmds) // [ImGuiContext+0x27F0] EndDisabled_counter (WORD) — decremented on EndDisabled call // [ImGuiContext+0x2900] save_to_disk_flag (set=1 by manual save trigger 0x17072) // [ImGuiContext+0x2904] save_timer (set=0 by manual save trigger) // [ImGuiContext+0x2910] custom IniFilename (ptr; config save path source) // [ImGuiContext+0x2920] settings_handlers (dynamically-grown array of 0x48-byte structs)
// ============================================================================ // SECTION 30 — D3D11 SHADER SOURCE (Ch.5) // ============================================================================ // Both shaders are stored as raw HLSL text in .rdata and compiled at runtime // via D3DCompile (IAT[0xB1000]) during D3D11Init (RVA 0x54DC0/0x551E8).
// Vertex shader (RVA 0x3AE660, 733 bytes, "main"/"vs_4_0"): static const char* VS_HLSL_SOURCE_RVA = "0x3AE660"; // marker only — see comment // cbuffer vertexBuffer : register(b0) { float4x4 ProjectionMatrix; }; // struct VS_INPUT { float2 pos:POSITION; float4 col:COLOR0; float2 uv:TEXCOORD0; }; // struct PS_INPUT { float4 pos:SV_POSITION; float4 col:COLOR0; float2 uv:TEXCOORD0; }; // PS_INPUT main(VS_INPUT input) { // PS_INPUT output; // output.pos = mul(ProjectionMatrix, float4(input.pos.xy, 0.f, 1.f)); // output.col = input.col; output.uv = input.uv; // return output; }
// Pixel shader (RVA 0x3AE940, 401 bytes, "main"/"ps_4_0"): static const char* PS_HLSL_SOURCE_RVA = "0x3AE940"; // marker only — see comment // struct PS_INPUT { float4 pos:SV_POSITION; float4 col:COLOR0; float2 uv:TEXCOORD0; }; // sampler sampler0; Texture2D texture0; // float4 main(PS_INPUT input) : SV_Target { // return input.col * texture0.Sample(sampler0, input.uv); }
// Shader init sequence (RVA 0x54DC0): // load g_D3DState from [g_Config+0xD8] → R14 // check already-init: cmp (*r14), null; je skip // call 0x551F0 (create vertex/index buffers) // D3DCompile(0x3AE660, 0x2DD, NULL,NULL,NULL, "main","vs_4_0",0,0,...) → vertex blob // D3DCompile(0x3AE940, 0x191, NULL,NULL,NULL, "main","ps_4_0",0,0,...) → pixel blob
// ============================================================================ // END OF RECONSTRUCTION HEADERS // ============================================================================
// ============================================================================ // SECTION 31 — COMPLETE .DATA ADDRESS MAP (SUPPLEMENTAL) // ============================================================================ // All 97 .data offsets documented across all chapters, with absolute VAs and // semantic descriptions. Base: .data = 0x1803C5000 (RVA 0x3C5000)
// --- Module dispatch fn ptr state blocks (vtable[+0x18] accessor targets) --- // Each module's vtable[+0x18] stub returns the module's .data state block. // At offset [+0x00] of that block is the actual Render/Update fn ptr written // by RegisterTab. The ModuleManager dispatch loop calls stub → gets this ptr → calls it. // // [.data+0x0530] FpsOverlay state block → fn ptr (overlay render) // [.data+0x0580] PlayerProfile state block → fn ptr // [.data+0x0630] SetDither state block → fn ptr (no-op stub 0x83DC0) // [.data+0x06D0] NoClip state block → fn ptr // [.data+0x0770] SkillHack state block → fn ptr (hook installer) // [.data+0x07D0] FreeCam state block → fn ptr
// --- RTTI / module name strings (.data) --- // [.data+0x0590]–[.data+0x0E60] 11 module RTTI class descriptors // (ESPModule, FPSModule, FpsUnlocker, FreeCam, NoClip, PlayerProfile, // PreventScreenshot, SetDither, SkillHack, Vacuum, UnityExplorerModule)
// --- Panel state init config block (.data, written by DispatchRegistrarInit) --- // [.data+0x1F08] panel_config_src_A (16 bytes) — source for movups xmm0 // [.data+0x1F18] panel_config_src_B (16 bytes) — source for movups xmm1 // [.data+0x1F28] panel_config_dst_A (16 bytes) — dest: initial panel state copy // [.data+0x1F38] panel_config_dst_B (16 bytes) — dest: initial panel state copy
// --- ESPModule singleton — absolute .data field addresses --- // Base: [.data+0x1F70] VA 0x1803C6F70 // // [.data+0x1F70] QWORD vtable ptr (pre-init: 0x3AFA38; post-init: 0x3AF9E0) // [.data+0x1F78] STRING name = "ESPModule" (SSO std::string, RVA 0x3AF828) // [.data+0x1F98] BYTE enabled = 0 // [.data+0x1FA0] DWORD max_draw_distance = 300 (0x12C) // [.data+0x1FA4] BYTE show_monsters = 1 // [.data+0x1FA5] BYTE show_npc = 1 // [.data+0x1FA6] BYTE show_friendly = 1 // [.data+0x1FA7] BYTE show_puzzles = 1 // [.data+0x1FA8] BYTE show_all = 0 // [.data+0x1FA9] BYTE show_distance = 1 // [.data+0x1FAA] BYTE show_name = 1 // [.data+0x1FAB] BYTE reserved = 0 // [.data+0x1FAC] BYTE show_type = 0 // [.data+0x1FB0] XMMWD color[0] RED (1.00, 0.00, 0.00, 1.00) — Enemies // [.data+0x1FC0] XMMWD color[1] ORANGE (1.00, 0.65, 0.00, 1.00) — Interactive/NPC // [.data+0x1FD0] XMMWD color[2] YELLOW (1.00, 1.00, 0.00, 1.00) — spare // [.data+0x1FE0] XMMWD color[3] GREEN (0.00, 1.00, 0.00, 1.00) — Friendly // [.data+0x1FF0] XMMWD color[4] BLUE (0.00, 0.00, 1.00, 1.00) — NPC/spare // [.data+0x2000] XMMWD color[5] CYAN (0.00, 1.00, 1.00, 1.00) — spare // [.data+0x2010] XMMWD color[6] PURPLE (0.58, 0.00, 0.83, 1.00) — spare // [.data+0x2020] XMMWD color[7] WHITE (1.00, 1.00, 1.00, 1.00) — spare // [.data+0x2030] XMMWD color[8] PINK (1.00, 0.08, 0.58, 1.00) — spare // [.data+0x2040] XMMWD color[9] LPINK (1.00, 0.75, 0.80, 1.00) — spare // (color[10] BLACK and color[11] GRAY not stored separately; loaded from .rdata at runtime) // Note: Color slots 2,5,6,8,9 are spare palette entries with no current entity type mapping. // Slots 0,1,3,4 map to Enemies/Interactive/Friendly/NPC respectively.
// --- FPSModule singleton --- // [.data+0x22E0] QWORD FPSModule singleton ptr VA 0x1803C72E0 // [.data+0x22E8] STRING name = "FPS Monitor" (SSO std::string) // [.data+0x2308] BYTE enabled = 0 // [.data+0x2310] QWORD once_flag (std::once_flag, guards Initialize RVA 0x814C0)
// --- PreventScreenshot singleton --- // [.data+0x2358] QWORD PreventScreenshot singleton ptr VA 0x1803C7358 // [.data+0x2360] STRING name = "Prevent Screenshot" (SSO std::string) // [.data+0x2380] BYTE enabled = 0 // [.data+0x2388] BYTE second_toggle_flag = 0 // [.data+0x2390] QWORD once_flag (guards Initialize RVA 0x8AD70) // [.data+0x24D0] QWORD hook/window list head (linked list; nodes have HWND at [+0x10]) // [.data+0x24F0] DWORD cached OSVERSIONINFOEXW.dwBuildNumber (from memcpy of RtlGetVersion) // [.data+0x24FC] DWORD cached OS build number (same value, second copy for comparison)
// --- UnityExplorer module --- // [.data+0x260C] QWORD once_flag (guards RegisterTab RVA 0x90060) // [.data+0x2610] QWORD update_fn_ptr = 0x083DC0 (shared no-op stub) // [.data+0x2618] STRING tab_string = "Unity Explorer" (std::string) // [.data+0x2638] BYTE enabled = 0 // [.data+0x2640] BOOL auto_refresh = 0 // [.data+0x2644] float refresh_interval = 3.0f (0x40400000) // [.data+0x2648] QWORD* scene_list_begin = NULL // [.data+0x2650] QWORD* scene_list_end = NULL // [.data+0x2660] QWORD* scene_list_cap = NULL // [.data+0x2670] DWORD selected_scene_idx = 0 // [.data+0x2680] DWORD selected_obj_idx = 0 // [.data+0x2684] char[0x100] search_filter = "" (zero-filled) // [.data+0x2784] BOOL inspector_active = 0 // [.data+0x2788] QWORD inspected_obj_ptr = 0 // [.data+0x2790] STRING inspected_obj_name = "" (std::string)
// ============================================================================ // SECTION 32 — MAGIC CONSTANTS AND IEEE 754 VALUES // ============================================================================
// --- IEEE 754 float constants --- static_assert(sizeof(float) == 4, "float must be 32-bit");
// 0x41F00000 = 30.0f — FreeCam Move Speed default // 0x3DCCCCCD = 0.1f — FreeCam Move Speed / Roll Speed / FOV Speed step // 0x42C80000 = 100.0f — FreeCam Roll Speed max; SkillHack CooldownBypass return value // 0x43FA0000 = 500.0f — FreeCam Move Speed max // 0x40400000 = 3.0f — UnityExplorer auto-refresh interval default // 0x3F800000 = 1.0f — HookManager load factor threshold; FreeCam FOV multiplier default // 0x42960000 = 75.0f — FreeCam Look Sensitivity default // 0x44415357 = (reinterpret: packed 'WASD' ASCII) — FreeCam default key binding word
// --- FreeCam default key binding block --- // Written to [.data+0x2230..0x225E] by FreeCam::RegisterMainTab: // [+0x2230..0x223F] = [0x1803B34F0] (key config block 1, 16 bytes) // [+0x2240..0x224F] = [0x1803B35C0] (key config block 2, 16 bytes) // [+0x2250] = 0x3F800000 (1.0f — FOV multiplier) // [+0x2254] = 0x44415357 ('WASD' key mask) // [+0x2258] = 0x6D6BA220 (additional keybind data) // [+0x225C] = 0x2725 (two-byte keybind word) // [+0x225E] = 0x60 (backtick key — FreeCam toggle)
// --- Security cookie --- // Stack canary magic value (lower 48 bits): 0x2B992DDFA232 // Full XOR combination of: GetSystemTimeAsFileTime, GetCurrentThreadId, // GetCurrentProcessId, QueryPerformanceCounter (see Ch.4 / Section 4) // Checked at RVA 0x0AC6CC by __security_check_cookie (CRT standard)
// --- Windows version constants --- // 0x4A61 = 19041 decimal — Windows 10 Build 19041 (20H1) // Used in PreventScreenshot::OsCheck to select WDA_MONITOR vs WDA_EXCLUDEFROMCAPTURE: // build < 19041: SetWindowDisplayAffinity(..., 1) // WDA_MONITOR // build >= 19041: SetWindowDisplayAffinity(..., 0x11) // WDA_EXCLUDEFROMCAPTURE
// --- Hash constants --- // FNV-1a 64-bit (used in HookManager hash table): // Offset basis: 0xCBF29CE484222325ULL // Prime: 0x00000100000001B3ULL // (See Section 8 / Ch.8.7 for unrolled implementation at RVA 0x8D555)
// --- CP_UTF8 --- // 0xFDE9 = 65001 = CP_UTF8 // Used in: MultiByteToWideChar calls in OpenConfigFile (0x11EA0), // SetConsoleOutputCP (startup), UTF8ToWide helper (0x8B4E0)
// --- Module object sizes --- // BaseModule object size: 0x30 bytes (used by operator delete in NoOpUpdateStub) // FPSModule object size: 0xD8 bytes (zeroed by memset 0xAC86A in Initialize) // PreventScreenshot object size: 0x48 bytes (from vtable dtor stub size arg) // UnityExplorer state block size: 0x190 bytes (zero-filled in RegisterTab) // FreeCam state block size: 0xD8 bytes (zeroed in RegisterMainTab) // HookEntry size: 0x38 bytes (stride in hook_array) // HookManager singleton size: 0x90 bytes // ModuleManager registrar stride: 0x60 bytes per slot // ImGui settings handler size: 0x48 bytes per handler struct // THREADENTRY32 size: 28 (sizeof: written as r12d = [rbx+0x1C]) // OSVERSIONINFOEXW size: 0x11C bytes (stack-allocated in OsCheck)
// --- HookManager array constants --- // Initial hook array capacity: 0x80 slots // Shrink threshold: count <= capacity/2 AND count > 0x20 // Load factor threshold: 1.0f (0x3F800000) — triggers hash table rehash
// --- SkillHack callback return constants --- // 0x42C80000 = 100.0f returned by Callback_CooldownBypass (RVA 0x8D500) // stored at .rdata RVA 0x3B3308 // Note: prior summary incorrectly stated 0.0; doc confirms 100.0f
// ============================================================================ // SECTION 33 — IAT SUPPLEMENTAL ENTRIES (Ch.19 / final resolution) // ============================================================================ // Additional IAT entries resolved in Ch.19 not previously in header: // IAT[0xB1278] VirtualFree KERNEL32 hook manager cleanup // IAT[0xB1288] VirtualProtect KERNEL32 hook patcher (Ch.8.6) // IAT[0xB1628] ShowWindow USER32 Settings console toggle visibility // IAT[0xB1868] fwrite CRT config body (0xEA1B, 0x170D6, 0x3033B, 0x3076D) // IAT[0xB1870] fclose CRT (0xEAB0, 0x1212F, 0x121A9, 0x170DF)
// ============================================================================ // END SUPPLEMENTAL SECTIONS // ============================================================================
// ============================================================================ // SECTION 34 — FINAL FIVE .DATA ADDRESSES // ============================================================================
// [.data+0x2180] QWORD SetDither update fn ptr = 0x1803B01B0 → 0x83DC0 (no-op stub) // Written by SetDither::RegisterTab (RVA 0x181810)
// [.data+0x2307] BYTE End of FPSModule name std::string SSO buffer // Name "FPS Monitor" occupies [.data+0x22E8]..[.data+0x2307] // (19 chars + null = 20 bytes; SSO inline storage)
// [.data+0x237F] BYTE End of PreventScreenshot name std::string SSO buffer // Name "Prevent Screenshot" occupies [.data+0x2360]..[.data+0x237F] // +0x28 field = enabled BYTE (checkbox state; drives affinity arg)
// [.data+0x245C] BYTE g_showPanel — overlay panel visibility flag // 0 = hidden, 1 = visible // Toggled by VK_F12 (0x7B) poll at RVA 0x8301A (GetAsyncKeyState) // Banner shown when hidden: "EF - Cheeto ... Press F12" (RVA 0x3AF258)
// [.data+0x24D8] QWORD PreventScreenshot HWND list count / tracked window count // Companion to [.data+0x24D0] (linked list head) // Used in Update affinity application loop (RVA 0x8AFC0)