118 KiB
EF-CHEETO RECONSTRUCTION FEED — PART 2/3
This part: Reconstruction header with all structs, RVAs, string table, IL2CPP table.
Feed with Parts 1 and 3 for complete reconstruction context.
================================================================================ RECONSTRUCTION HEADER (ef_cheeto_reconstruction.h) Compiles: g++ -std=c++17 -fsyntax-only 2,092 lines covering 538 RVAs, 97 .data addresses, 189 strings, 75 IAT entries
// ============================================================================ // EF-Cheeto (unityexplorer.dll) — Reconstruction Headers // Derived from: EF-Cheeto_Vol12_Final_Analysis.docx (complete binary audit) // Target: x86-64 Windows DLL, MSVC build, GameAssembly.dll (Endfield) // Base VA: 0x180000000 | .data base: 0x1803C5000 (RVA 0x3C5000) // ============================================================================
#pragma once #include #include
// ============================================================================ // SECTION 1 — PRIMITIVE TYPEDEFS // ============================================================================
using u8 = uint8_t; using u16 = uint16_t; using u32 = uint32_t; using u64 = uint64_t; using i32 = int32_t; using f32 = float; using f64 = double; using BOOL = int; // IL2CPP managed bool return (al register)
// ============================================================================ // SECTION 2 — GLOBAL .DATA LAYOUT (abridged — key singletons) // ============================================================================ // All offsets are RVA from binary base 0x180000000. // VA = 0x180000000 + RVA. // .data region starts at RVA 0x3C5000 (VA 0x1803C5000). // References below use shorthand [.data+N] meaning VA 0x1803C5000 + N. // // Key global pointers: // [.data+0x00D8] g_D3DState ptr (D3D11 device/swap chain block) // [.data+0x00E0] active_preset_name (std::string — "Preset0".."Preset3") // [.data+0x00EC] active_preset_index (DWORD — 0-3) // [.data+0x00F0] gameassembly_base (cached GetModuleHandleW result) // [.data+0x1E88] hook_spinlock (DWORD — 0=free, 1=held) // [.data+0x1E90] hook_allocator_ptr (IAllocator for hook_array, capacity 0x80) // [.data+0x23B8] ModuleManager.registrars_begin // [.data+0x23C0] ModuleManager.registrars_end // [.data+0x23C8] ModuleManager.registrars_cap // [.data+0x2398] ModuleManager object ptr // [.data+0x23A8] ModuleManager secondary ptr // [.data+0x23D0] ModuleManager once_flag (std::once_flag)
// ============================================================================ // SECTION 3 — g_Config (global config object) // ============================================================================ // g_Config is a large global object stored in .data. // Fields below are offsets FROM the g_Config object base (not from .data base). // g_Config does not have a single documented base address — it IS .data in // the relevant regions. Use field VA = 0x1803C5000 + offset where offset // matches the [.data+N] values from the doc. // // PANEL / UI scroll state (used by all module Render() panel-open sequences) struct GConfigPanelFields { // offset from g_Config (which sits at .data) // [g_Config+0x0058] scroll_base (float) — horizontal scroll base offset // [g_Config+0x00D8] d3d_state_ptr (void*) — D3D11 state block // [g_Config+0x0150] panel_width (float) — rendered panel content width // [g_Config+0x0194] scroll_accum (float) — accumulated horizontal scroll // [g_Config+0x0198] scroll_total (float) — total scroll range // [g_Config+0x0E0C] scroll_step (float) — per-frame scroll delta // [g_Config+0x15D8] panel_ptr (void*) — pointer to active ImGui panel struct // [g_Config+0x1BEC] imgui_ini_fallback (void*) — fallback .ini path ptr // [g_Config+0x1C00] scroll_region_root (void*) — root of scroll region config // [g_Config+0x1F68] active_tab_idx (DWORD) — written by binding state array };
// Panel-open sequence (all modules — addss path): // rax = *panel_ptr; // rax->field_0x103 = 1; // xmm0 = scroll_step + rax->scroll_accum + rax->scroll_base + rax->scroll_total; // rax->panel_width = xmm0; // Panel-close sequence (subss path): same but scroll_accum -= scroll_step.
// HOOK SLOTS [g_Config+0x1E40..0x1E68] (SkillHack IL2CPP hook target pointers) // [g_Config+0x1E40] hook5_target — ApplySkillCost() (void fn) // [g_Config+0x1E48] hook6_target — (dispatcher target) // [g_Config+0x1E50] hook3_target — GetCooldownPercent() (float fn) // [g_Config+0x1E58] hook4_target — IsSkillAvailable() (BOOL fn) // [g_Config+0x1E60] hook1_target — skill check A (BOOL fn) // [g_Config+0x1E68] hook2_target — skill check B (BOOL fn)
// OVERLAY FLAGS (written by UnityExplorer when window is active) // [g_Config+0x1F78] overlay_flags (DWORD) — |= 1 when UE window open // [g_Config+0x1F90] overlay_scale (float) — set to 300.0f when UE open
// ============================================================================ // SECTION 4 — IL2CPP FUNCTION POINTER TABLE // ============================================================================ // GABypass::Patch (RVA 0xA9120) resolves 71 function pointers from // GameAssembly.dll at DLL attach and writes them to .data slots. // Format: slot_rva = .data offset from g_base 0x1803C5000 // Access: fn_ptr = (void*)(gameassembly_base + il2cpp_offset) // // Key: ptr = (void*)(.data + slot_rva) // call as: ((RetType(*)(Args...))(ptr))(args...);
struct IL2CPP_Table { // Slot .data-offset | IL2CPP offset | Resolved name void* GameObject_GetComponentByIndex; // 0x1C48 +0x09DC0120 void* il2cpp_domain_get_assemblies_A; // 0x1C50 +0x0018CEC0 void* Component_GetComponent_Transform; // 0x1C58 +0x0B390700 void* Transform_get_localScale; // 0x1C60 +0x0B3A2D20 void* Transform_get_rotation; // 0x1C68 +0x0B3A2CB0 void* il2cpp_object_get_class; // 0x1C70 +0x0018AD80 void* il2cpp_class_get_method_from_name;// 0x1C78 +0x00007480 void* Transform_get_localPosition; // 0x1C80 +0x0B3A1AE0 void* Transform_get_position; // 0x1C88 +0x0B3A1A70 [also 0x1DD0] void* Transform_set_localPosition; // 0x1C90 +0x0B3A51D0 void* GameObject_SetActive; // 0x1C98 +0x0B398830 [also 0x1DB8] void* GameObject_get_transform; // 0x1CA0 +0x0B3911F0 void* Transform_set_rotation; // 0x1CA8 +0x0B3A59D0 [also 0x1DE0] void* GameObject_get_activeInHierarchy; // 0x1CB0 +0x0B391D90 void* GameObject_get_tag; // 0x1CB8 +0x0B3B2410 void* GameObject_get_name; // 0x1CC0 +0x0B3B2120 void* GameObject_get_layer; // 0x1CC8 +0x0B3B40B0 void* GameObject_get_scene; // 0x1CD0 +0x0B397980 void* Game_SkillBuff_A; // 0x1CD8 +0x02F3DA80 (SkillHack) void* GetEntityName; // 0x1CE0 +0x00F27E10 (ESP label) void* Component_GetComponents; // 0x1CE8 +0x0B329000 void* Component_GetComponentsInChildren;// 0x1CF0 +0x0B329D80 void* Game_SkillSlot_A; // 0x1CF8 +0x03E9BB50 (SkillHack) void* Object_get_name; // 0x1D00 +0x0B383F60 void* Component_GetType_A; // 0x1D08 +0x0B33CAB0 void* Component_GetType_B; // 0x1D10 +0x0B33CB00 void* Game_SkillSlot_B; // 0x1D18 +0x039D1AA0 (SkillHack) void* Game_Combat_HitA; // 0x1D20 +0x026DE9F0 void* GetEntityManager; // 0x1D28 +0x0478E860 (NoClip/FpsUnlocker) void* Game_Combat_HitB; // 0x1D30 +0x025E2D40 void* Game_Movement_PhysA; // 0x1D38 +0x087C2CD0 (NoClip CharCtrl) void* Game_Movement_PhysB; // 0x1D40 +0x03419AF0 (NoClip CharCtrl) void* Application_set_targetFrameRate; // 0x1D48 +0x0B322FB0 (FpsUnlocker) void* SceneManager_GetActiveScene; // 0x1D50 +0x0B396A20 void* CinemachineBrain_GetActiveVCam; // 0x1D58 +0x0B397700 (FreeCam) void* Game_EntityState_A; // 0x1D60 +0x03766810 (ESP/SkillHack) void* Transform_set_localScale; // 0x1D68 +0x0B3A2A60 void* Rigidbody_get_velocity; // 0x1D70 +0x0B326660 (NoClip/Vacuum) void* Rigidbody_set_velocity; // 0x1D78 +0x0B3266B0 (NoClip/Vacuum) void* Object_Destroy; // 0x1D80 +0x0B383200 void* Transform_set_position; // 0x1D88 +0x0B3A1A10 (NoClip/Vacuum) void* Game_EntityState_B; // 0x1D90 +0x0B3A2340 (ESP) void* Input_GetAxis_MouseX; // 0x1D98 +0x0B421800 (FreeCam look X) void* Game_PlayerState_A; // 0x1DA0 +0x0B3A26D0 (ESP/SkillHack) void* Game_PlayerState_B; // 0x1DA8 +0x0B3A1FB0 (ESP/SkillHack) void* Game_PlayerHealthStat; // 0x1DB0 +0x0B32B030 (ESP health) void* Camera_get_main; // 0x1DC0 +0x0B390440 (ESP/FreeCam) void* GameObject_FindObjectOfType; // 0x1DC8 +0x0B390F80 void* Game_SkillAction_C; // 0x1DD8 +0x03F85430 (SkillHack) void* GetDeltaTime; // 0x1D38 +0x087C2CD0 (also FPS overlay) void* Camera_get_fieldOfView; // 0x1DE8 +0x0B3A1C90 (FreeCam FOV) void* Game_EntityState_C; // 0x1DF0 +0x00E92CF0 (ESP) void* Rigidbody_AddForce; // 0x1E00 +0x03DC14C0 (Vacuum) void* CharCtrl_set_enabled; // 0x1E08 +0x03E0D2C0 (NoClip) void* Game_SkillAction_F; // 0x1E10 +0x03D9DF30 (SkillHack) void* Game_SkillAction_G; // 0x1E18 +0x00E9E9F0 (SkillHack) void* GetCharacterController; // 0x1E20 +0x03EA53C0 (NoClip) void* TMPro_set_text; // 0x1E28 +0x0ACA0EC0 (PlayerProfile/NameChanger) void* UnityUI_Text_set_text; // 0x1E30 +0x0B391D40 (ON/OFF labels) void* Game_SkillAction_I; // 0x1E38 +0x036AA8F0 (SkillHack) void* Game_SkillAction_J; // 0x1E40 +0x03EC31C0 (SkillHack hook5 target) void* Game_EntityActor_D; // 0x1E48 +0x037F8CD0 (ESP/combat, hook6 target) void* Game_SkillAction_K; // 0x1E50 +0x036EA640 (hook3/cooldown target) void* Game_SkillAction_L; // 0x1E58 +0x03EC30E0 (hook4/avail target) void* Game_EntityActor_E; // 0x1E60 +0x037F2A40 (hook1 target) void* Game_EntityActor_F; // 0x1E68 +0x037FD7E0 (hook2 target) void* il2cpp_domain_get; // 0x1E70 +0x00D94C10 void* il2cpp_assembly_get_image; // 0x1E78 +0x00D94DA0 void* il2cpp_domain_get_assemblies_B; // 0x1E80 +0x00D93A60 };
// ============================================================================ // SECTION 5 — BASE CLASS // ============================================================================
struct BaseModule { void* vtable; // [+0x00] vtable ptr // std::string name at [+0x08] (SSO string, 24 bytes total: ptr+len+cap) char name_sso[24]; // [+0x08] SSO buffer // std::string tab_name at [+0x20] char tab_name_sso[24]; // [+0x20] secondary name / tab label (SSO) u8 enabled; // [+0x28] ON/OFF flag (BYTE) u8 _pad[7]; // [+0x29..+0x2F] // module-specific fields follow at [+0x30] };
// BaseModule vtable layout (from factory stubs RVA 0x9B660–0x9B7A0): // [0] +0x00 copy-ctor / factory() — placement-new ctor, writes vtable, returns this // [1] +0x08 copy-ctor / factory() — same as [0] // [2] +0x10 Init() / RegisterTab() — jmp stub → actual RegisterTab fn // [3] +0x18 Render() — per-frame UI + game-state dispatch // [4] +0x20 ~BaseModule() — dtor: frees name string, optional delete // [5] +0x28 getNamePtr() — returns &this->name_string (+0x08) // [6] +0x30 onHotkey() — pure virtual (sentinel value = 1) // [7] +0x38 getLinkedModuleFactory() — returns paired module factory ptr
// ============================================================================ // SECTION 6 — MODULE STATE STRUCTS // ============================================================================
// --- NoClip --- // Singleton base: [.data+0x27B0] (referenced by RegisterTab / Render calls) // Object size: ~0x38 bytes struct NoClipModule : BaseModule { // [+0x28] u8 enabled (ON/OFF checkbox) i32 move_speed; // [+0x30] DragInt range [1, 10], default unknown }; // NoClip function table: // RegisterTab 0x081300 — one-time init // Render 0x0813D0 — ImGui panel (checkbox + Move Speed slider) // Update 0x089B50 — per-frame CharacterController toggle // Update stub 0x089B00 — tab destructor/cleanup wrapper // Update stub2 0x089B40 — tab #2 setup (lea rdx, panel_callback → jmp 0x89060)
// --- FreeCam --- // Singleton base: [.data+0x2200] (0xD8 bytes, zeroed by RegisterMainTab) struct FreeCamModule : BaseModule { // [+0x28] u8 enabled f32 move_speed; // [+0x30] SliderFloat max=500.0f default=30.0f f32 roll_speed; // [+0x34] SliderFloat max=100.0f f32 fov_speed; // [+0x38] (Look Sensitivity slider) u8 _pad2[0x28]; // [+0x3C..+0x63] void* active_cam_ptr; // [+0x68] cached active camera GameObject* void* override_cam_ptr; // [+0x70] override camera ptr (cleared on disable) u8 _pad3[0x40]; // [+0x78..+0xB7] u8 cam_override_active; // [+0xB8] // Key bindings written at RegisterMainTab to [.data+0x2230..0x225E]: // [+0x2230] movdqa block1 = 0x1803B34F0 (WASD + misc keys) // [+0x2240] movdqa block2 = 0x1803B35C0 // [+0x2250] 0x3F800000 = 1.0f (FOV multiplier default) // [+0x2254] 0x44415357 = 'WASD' key code mask // [+0x2258] 0x6D6BA220 = additional keybind // [+0x225C] 0x2725 = two-byte keybind // [+0x225E] 0x60 = backtick key code // Accumulator floats [+0x2260..0x22A8] pitch/yaw/roll/FOV — zeroed on init }; // FreeCam function table: // RegisterFpsTab 0x0814C0 — registers FPS Monitor overlay tab // RegisterMainTab 0x081590 — zeroes 0xD8 state, writes key defaults // FpsUpdate stub 0x087150 — FPS overlay destructor wrapper // Update 0x0871A0 — per-frame camera override (WASD+mouse)
// --- FpsUnlocker --- // Singleton base: [.data+0x21E8] // Object size: 0x38 bytes struct FpsUnlockerModule : BaseModule { // [+0x28] u8 enabled i32 fps_target; // [+0x30] DragInt max=500, min=30, default=300 }; // FpsUnlocker function table: // RegisterTab 0x081730 — registers tab, writes fps_target default = 300 // Render 0x085B90 — ImGui panel + Application.set_targetFrameRate call // Update stub 0x085B40 — destructor wrapper, size 0x38
// --- SetDither --- // Singleton base: referenced from registrar at RVA 0x001C41 // Object size: 0x38 bytes (shared stub with SkillHack) struct SetDitherModule : BaseModule { // [+0x28] u8 enabled (unused — no per-frame write) }; // SetDither function table: // RegisterTab/Render 0x081810 — registers tab only; no ImGui panel body // Update stub 0x083DC0 — shared no-op: frees name string, optional delete
// --- PlayerProfile --- // Singleton base: referenced from registrar at RVA 0x001E20 // Object size: 0x78 bytes struct PlayerProfileModule : BaseModule { // [+0x28] u8 enabled u8 _pad3[7]; // [+0x30] std::string uid_str (wstring buffer for UID display text) char uid_str_sso[24]; // [+0x30] u8 _pad4[8]; // [+0x48..+0x4F] // [+0x50] std::string name_str (wstring buffer for ManagerName text) char name_str_sso[24]; // [+0x50] u8 _pad5[8]; // [+0x68..+0x6F] u8 name_changer_enabled; // [+0x70] }; // PlayerProfile function table: // RegisterTab/Render 0x0818E0 — zeroes uid_str, name_str; stores IL2CPP fn ptrs // Update 0x08A4F0 — per-frame UI path walk + SetText on TMP labels // Update stub 0x08A4A0 — dtor: frees [+0x50],[+0x30],[+0x08], delete(0x78) // UI paths used: // UID: "/UINode/UIRoot/UIDPanelPanel/Main/TextNode/Text" (RVA 0x3AFED0, len 0x2F) // Name: "/UINode/WorldUIRoot/WatchPanel/Content/WatchNode/canvas_watch/ // LeftBottomNode/PlayInfoPosNode/PlayInfoLifengCell(Clone)/PlayerInfo/ManagerName" // (RVA 0x3AFFD0, len 0x8D)
// --- Vacuum --- // Singleton base: [.data+0x05D0] fn-ptr slot; obj referenced from registrar 0x001FC0 // Object size: 0x38 bytes struct VacuumModule : BaseModule { // [+0x28] u8 vacuum_on ('Vacuum' main checkbox) u8 _pad3[7]; u8 monster_on; // [+0x30] 'Monster' sub-checkbox }; // Vacuum function table: // RegisterTab 0x081A20 — stores update fn ptr 0x1803B0680 → 0x085B40 stub // Render 0x093CA0 — 'Vacuum' + 'Monster' checkboxes // PhysicsLoop 0x093F10 — per-frame Rigidbody.AddForce attraction // Update stub 0x085B40 — shared destructor wrapper (frees [+0x08], delete 0x38) // Attraction constant: (float)0x1803B32B4
// --- SkillHack --- // Singleton base: referenced from registrar at RVA 0x001D50 // Object size: ~0x38 bytes struct SkillHackModule : BaseModule { // [+0x28] u8 enabled — read by all 6 hook callbacks // No per-frame Update; all work done by IL2CPP hook callbacks }; // SkillHack function table: // Render 0x08D1F0 — hook installer only (installs 6 hooks, tail-jmps to 0x8D8A0) // RenderPanel 0x08D240 — actual ImGui panel ('Free Skill' + ON/OFF toggle) // Update stub 0x083DC0 — shared no-op (same as SetDither) // Dispatcher 0x08D4B0 — BOOL callback: returns 1 when enabled // CooldownBypass 0x08D500 — float callback: returns 100.0f when enabled // AvailBypass 0x08D640 — BOOL callback: returns 1 when enabled // CostBypass 0x08D780 — void callback: early-return (skip cost deduction)
// --- ESPModule --- // Singleton base: [.data+0x1F70] VA 0x1803C6F70 // Object size: 0x100 bytes (12 RGBA color slots × 16 bytes = 0xC0, starts at +0x40) struct ESPModule : BaseModule { // [+0x28] u8 enabled u8 _pad3[7]; i32 max_draw_distance; // [+0x30] default 300 (0x12C) u8 show_monsters; // [+0x34] default 1 u8 show_npc; // [+0x35] default 1 u8 show_friendly; // [+0x36] default 1 u8 show_puzzles; // [+0x37] default 1 u8 show_all; // [+0x38] default 0 u8 show_distance; // [+0x39] default 1 u8 show_name; // [+0x3A] default 1 u8 show_type; // [+0x3B] default 0 (reserved, unused) u8 _reserved; // [+0x3C] u8 _pad4[3]; // [+0x3D..+0x3F] float color[12][4]; // [+0x40] 12 × RGBA float4, 16-byte aligned // Color slot defaults (RGBA): // [0] +0x40 enemy RED (1.0, 0.0, 0.0, 1.0) // [1] +0x50 interactive ORANGE (1.0, 0.65, 0.0, 1.0) // [2] +0x60 slot2 YELLOW (1.0, 1.0, 0.0, 1.0) // [3] +0x70 friendly GREEN (0.0, 1.0, 0.0, 1.0) // [4] +0x80 npc BLUE (0.0, 0.0, 1.0, 1.0) // [5] +0x90 slot5 CYAN (0.0, 1.0, 1.0, 1.0) // [6] +0xA0 slot6 PURPLE (0.58, 0.0, 0.83, 1.0) // [7] +0xB0 default WHITE (1.0, 1.0, 1.0, 1.0) // [8] +0xC0 slot8 PINK (1.0, 0.08, 0.58, 1.0) // [9] +0xD0 slot9 LPINK (1.0, 0.75, 0.80, 1.0) // [10] +0xE0 slot10 BLACK (0.0, 0.0, 0.0, 1.0) // [11] +0xF0 slot11 GRAY (0.502, 0.502, 0.502, 1.0) }; // ESPModule function table: // Singleton init 0x083E00 — lazy init via MSVC thread-safe static // RenderOverlay 0x083FA0 — ImGui 'ESP Features' panel (large, 0x83FA0–0x8499E) // Update 0x085C00 — per-frame world-space entity label loop (approx) // Entity type dispatch in Update (byte code → color slot): // 0=enemy, 1=interactive, 2=friendly, 3=npc, 4=puzzle, default=slot7(white)
// --- FPSModule (FpsOverlay) --- // Singleton base: [.data+0x22E0] VA 0x1803C72E0 // Object size: 0xD8 bytes struct FPSModule : BaseModule { // [+0x28] u8 enabled u8 _pad3[7]; u8 show_fps_overlay; // [+0x30] 'Show FPS Overlay' checkbox u8 _pad4[0x2F]; // [+0x31..+0x5F] float overlay_pos[4]; // [+0x60] XMMWORD (position/size, zeroed on init) }; // FPSModule function table: // RegisterTab 0x081810 — shared with SetDither registrar // Render [via FpsOverlay chain]
// --- PreventScreenshot --- // Singleton base: [.data+0x2358] VA 0x1803C7358 // Object size: 0x48 bytes struct PreventScreenshotModule : BaseModule { // [+0x28] u8 enabled — drives SetWindowDisplayAffinity arg u8 _pad3[7]; u8 state_dirty; // [+0x30] 1 = affinity applied, guard re-apply u8 _pad4[7]; u8 second_flag; // [+0x38] purpose unclear, zeroed on init };
// ============================================================================ // SECTION 7 — HOOK MANAGER // ============================================================================
// Singleton: [.data+0x2470] VA 0x1803C7470 // Object size: 0x90 bytes struct HookManager { void* hook_array; // [+0x00] flat array of HookEntry (0x38 bytes each) u32 hook_capacity; // [+0x08] allocated slot count (initial 0x80) u32 hook_count; // [+0x0C] active hook count void* hash_buckets; // [+0x10] hash table bucket array (linked list heads) u32 bucket_count; // [+0x18] power of 2, initial 8 u32 bucket_mask; // [+0x1C] = bucket_count * 2 - 1 void* free_list_head; // [+0x20] freed/recycled slot free list head u8 _pad[4]; // [+0x28..+0x2B] f32 load_factor; // [+0x28] hash load factor threshold (1.0f = 0x3F800000) u8 initialized; // [+0x30] 0 after init (prevents double-init) // Global spinlock: [.data+0x1E88] (DWORD, separate from struct) };
// Each hook entry in hook_array is 0x38 bytes: struct HookEntry { u64 target_va; // [+0x00] VA of hooked IL2CPP function u64 callback_va; // [+0x08] VA of replacement/detour function u64 trampoline_va; // [+0x10] VirtualAlloc'd trampoline (orig bytes + JMP back) u32 orig_bytes_0_3; // [+0x18] saved original bytes 0-3 u16 orig_bytes_4_5; // [+0x1C] saved original bytes 4-5 u8 orig_byte_6; // [+0x1E] saved original byte 6 u8 flags; // [+0x20] bit0=has_far_jmp, bit1=enabled, bit2=suspended u32 flags2; // [+0x24] lower nibble: hook type (0=near JMP, 1=far) u64 hash_next; // [+0x28] next ptr in hash bucket chain // [+0x30..+0x37] additional chain/bookkeeping fields };
// HookManager API (all acquire spinlock at [.data+0x1E88]): // CreateHook RVA 0x0A9CC8 — install new hook (FNV-1a hash lookup, trampoline alloc) // RemoveHook RVA 0x0A9FA0 — remove and free hook // EnableHook RVA 0x0AA140 — enable suspended hook // GetHookInfo RVA 0x0AA2C0 — query hook by target VA // Spinlock acq RVA 0x0A9C88 — acquire [.data+0x1E88] // Spinlock rel inline — mov [.data+0x1E88], 0
// ============================================================================ // SECTION 8 — MODULE MANAGER // ============================================================================
// Singleton: [.data+0x2398] // Registrar array: [.data+0x23B8]..[.data+0x23C0] (stride 0x60 bytes/slot) struct ModuleManager { u8 _pad[0x18]; // [+0x00..+0x17] u8 initialized; // [+0x18] double-init guard u8 _pad2[7]; // [+0x19..+0x1F] // [+0x20..+0x57] registrar list (vector — 0x60-byte stride) };
// ModuleManager API: // AddRegistrar RVA 0x09B2C0 — push registrar slot (name str + factory fn) // Grow helper RVA 0x09B3C0 — expand registrar vector // Init RVA 0x09AC10 — called once from startup (RVA 0xA9190) // Dispatch loops (each wraps vtable call in __try/__except via CxxFrameHandler4): // Update loop RVA 0x09AE80 — calls vtable[+0x18] on each module // Render loop RVA 0x09AEF0 — calls vtable[+0x20] on each module // Hotkey loop RVA 0x09AF60 — calls vtable[+0x28] on each module // Exception handlers (log + resume, do not propagate): // Update catch RVA 0x0AEBC0 — logs "[ERROR] Failed to update module ''" // Render catch RVA 0x0AEC50 — logs "[ERROR] Failed to render overlay for module ''" // Hotkey catch RVA 0x0AECE0 — logs "[ERROR] Failed to process hotkeys for module ''"
// Registration order (DLL init lambdas, before ModuleManager::Init): // 1. SetDither (RVA 0x001C41) vtable 0x3B0D58 // 2. FreeCam FPS (RVA 0x001C80) vtable 0x3B0E70 // 3. SkillHack (RVA 0x001D50) vtable 0x3B0EE0 // 4. PlayerProfile (RVA 0x001E20) vtable 0x3B0D90 // 5. NoClip (RVA 0x001EF0) vtable 0x3B0DC8 // 6. Vacuum (RVA 0x001FC0) vtable 0x3B0E38 // 7. UnityExplorer (RVA 0x002090) vtable 0x3B0D28 // 8. FpsUnlocker (RVA 0x001B80) vtable 0x3B0E00 // 9. FreeCam main (RVA 0x001AB0) vtable 0x3B0E70 // 10. ESPModule (RVA 0x001980)
// ============================================================================ // SECTION 9 — KEY FUNCTION RVA REFERENCE // ============================================================================ // All RVAs relative to binary base 0x180000000. // Add 0x180000000 to get VA; add file raw offset base for file seek.
namespace RVA { // Startup / init constexpr u32 DllMain_entry = 0x0AC840; // CRT DllMain thunk constexpr u32 Startup_sequence = 0x0A9190; // main init: GABypass + ModMgr constexpr u32 GABypass_Patch = 0x0A9120; // writes 71 IL2CPP fn ptrs constexpr u32 ModuleManager_Init = 0x09AC10;
// D3D11 / overlay
constexpr u32 D3D11_Hook_Install = 0x0827A0; // hooks IDXGISwapChain::Present
constexpr u32 D3D11_Present_Hook = 0x082820; // Present detour entry
constexpr u32 D3D11_CreateBuffers = 0x0551F0; // post-shader vertex/index buffer init
constexpr u32 ImGui_EndFrame = 0x001C2D0; // D3D11/ImGui EndFrame boundary
// ImGui wrappers (cheat-side)
constexpr u32 ImGui_Toggle = 0x070820; // TabManager::BeginTab
constexpr u32 CheckboxToggle = 0x085320; // flip enabled flag
constexpr u32 ImGui_DragInt = 0x066750; // move_speed DragInt
constexpr u32 ImGui_SliderFloat = 0x065570; // move_speed SliderFloat (max 500)
constexpr u32 ImGui_InputText_ws = 0x08AC20; // InputText wstring wrapper
// Config I/O
constexpr u32 ConfigSerialize = 0x012050; // serialize config to string
constexpr u32 BuildFilePath = 0x030A90; // build config file path
constexpr u32 ConfigFileIO = 0x011EA0; // UTF-8→wide fopen helper
constexpr u32 ConfigWrite = 0x0170D6; // fwrite config to file (approx)
// Hook manager
constexpr u32 HookMgr_singleton = 0x081B00; // thread-safe static accessor
constexpr u32 HookMgr_CreateHook = 0x0A9CC8;
constexpr u32 HookMgr_RemoveHook = 0x0A9FA0;
constexpr u32 HookMgr_EnableHook = 0x0AA140;
constexpr u32 HookMgr_Spinlock = 0x0A9C88;
constexpr u32 Trampoline_Alloc = 0x0AA478; // GetSystemInfo+VirtualQuery sub
// IL2CPP infrastructure
constexpr u32 IL2CPP_FindByPath = 0x09BCB0; // resolve Unity path to object
constexpr u32 WideToString = 0x00EB10; // UTF-8 → wstring
constexpr u32 BaseModule_Dtor = 0x00FA60; // shared dtor
// ModuleManager dispatch
constexpr u32 ModMgr_UpdateLoop = 0x09AE80;
constexpr u32 ModMgr_RenderLoop = 0x09AEF0;
constexpr u32 ModMgr_HotkeyLoop = 0x09AF60;
constexpr u32 ModMgr_AddRegistrar = 0x09B2C0;
// Theme / config preset writers (Ch.17 / Ch.28)
constexpr u32 Theme_Writer_Preset0 = 0x094890; // writes 52 color slots
constexpr u32 Theme_Writer_Preset1 = 0x096770;
constexpr u32 Theme_Writer_Preset2 = 0x098650;
constexpr u32 ColorApplicator = 0x094190; // shared helper: hex→RGBA×159 calls
// Settings / NameChanger (Ch.19)
constexpr u32 Settings_RenderOverlay = 0x09A4F0; // Settings panel render
constexpr u32 Settings_end = 0x09AB98; // (end of Settings body)
// UnityExplorer (Ch.16)
constexpr u32 UE_RegisterTab = 0x090060;
constexpr u32 UE_Render = 0x090250;
constexpr u32 UE_RefreshScenes = 0x090D40;
}
// ============================================================================ // SECTION 10 — CONFIG PRESET NAMES & STRINGS // ============================================================================ // Preset name string: [.data+0x00E0] (std::string, set during Settings load) // Preset index: [.data+0x00EC] (DWORD, 0-3) // Config file path: built by BuildFilePath (RVA 0x030A90) from [.data+0x0050]+0x50 // Config strings (RVA): // "Preset0" 0x3B0680 // "Preset1" 0x3B0688 // "Preset2" 0x3B0690 // "Preset3" 0x3B0698 // "EF-Cheeto.dll" 0x3B0358 (used by GABypass file scan) // "gatmp.tmp" 0x3B0338 (temp file for bypass) // "testyip" 0x3B0328 (test bypass marker) // Source path embedded: "E:\git\Endfield_Cheeto\libraries\pipeline..."
// ============================================================================ // SECTION 11 — KNOWN GAME API SIGNATURES (inferred from call sites) // ============================================================================ // These are IL2CPP managed method signatures inferred from cheat call sites. // Calling convention: __fastcall (RCX=this/arg0, RDX=arg1, R8=arg2, etc.) // Return in RAX (ptr/int) or XMM0 (float).
// Transform methods using fn_get_position = void*()(void transform); // returns vec3* using fn_set_position = void ()(void transform, void* vec3); using fn_get_rotation = void*()(void transform); // returns Quaternion* using fn_set_rotation = void ()(void transform, void* quaternion); using fn_get_localPos = void*()(void transform); using fn_set_localPos = void ()(void transform, void* vec3); using fn_get_localScale= void*()(void transform); using fn_set_localScale= void ()(void transform, void* vec3);
// GameObject methods using fn_get_transform = void*()(void gameObject); using fn_SetActive = void ()(void gameObject, bool active); using fn_get_name_go = void*()(void gameObject); // returns System.String*
// Rigidbody methods using fn_AddForce = void ()(void rigidbody, void* vec3, int forceMode); using fn_get_velocity = void*()(void rigidbody); using fn_set_velocity = void ()(void rigidbody, void* vec3);
// Application using fn_setTargetFPS = void (*)(int targetFrameRate);
// TMPro / UI using fn_set_text = void ()(void textComponent, int zero, void* wstring_ptr);
// CharacterController using fn_setEnabled = void ()(void ctrl, bool enabled, int zero);
// Camera using fn_Camera_main = void*()(void zero); // Camera.get_main using fn_get_fov = float()(void camera);
// SkillHack hook callbacks (return types match hooked method signatures): using fn_BOOL_bypass = BOOL ()(void); // Dispatcher / AvailBypass using fn_float_bypass = float()(void); // CooldownBypass → returns 100.0f using fn_void_bypass = void (*)(void); // CostBypass → early return
// ============================================================================ // END OF RECONSTRUCTION HEADERS // ============================================================================
// ============================================================================ // SECTION 12 — IL2CPP TABLE ACCESSOR MACROS // ============================================================================ // Usage: CALL_IL2CPP(slot_name, RetType, arg0, ...) // All slots live at fixed .data offsets from binary base 0x1803C5000. // At runtime: ptr = (void*)([.data + slot_offset]) // // Direct call helpers — use after GABypass has patched the table:
#define IL2CPP_BASE_VA ((uintptr_t)0x1803C5000) #define IL2CPP_SLOT(off) (*(void**)(IL2CPP_BASE_VA + (off)))
// Transform #define IL2_Transform_get_position(t) ((fn_get_position) IL2CPP_SLOT(0x1C88))(t) #define IL2_Transform_set_position(t,v) ((fn_set_position) IL2CPP_SLOT(0x1D88))(t,v) #define IL2_Transform_get_localPos(t) ((fn_get_localPos) IL2CPP_SLOT(0x1C80))(t) #define IL2_Transform_set_localPos(t,v) ((fn_set_localPos)IL2CPP_SLOT(0x1C90))(t,v) #define IL2_Transform_get_rotation(t) ((fn_get_rotation)IL2CPP_SLOT(0x1C68))(t) #define IL2_Transform_set_rotation(t,q) ((fn_set_rotation)IL2CPP_SLOT(0x1CA8))(t,q) #define IL2_Transform_get_localScale(t) ((fn_get_localScale)IL2CPP_SLOT(0x1C60))(t) #define IL2_Transform_set_localScale(t,v) ((fn_set_localScale)IL2CPP_SLOT(0x1D68))(t,v)
// GameObject #define IL2_GO_get_transform(go) ((fn_get_transform)IL2CPP_SLOT(0x1CA0))(go) #define IL2_GO_SetActive(go,a) ((fn_SetActive) IL2CPP_SLOT(0x1C98))(go,a) #define IL2_GO_get_name(go) ((fn_get_name_go) IL2CPP_SLOT(0x1CC0))(go)
// Rigidbody #define IL2_RB_AddForce(rb,v,fm) ((fn_AddForce) IL2CPP_SLOT(0x1E00))(rb,v,fm) #define IL2_RB_get_velocity(rb) ((fn_get_velocity) IL2CPP_SLOT(0x1D70))(rb) #define IL2_RB_set_velocity(rb,v) ((fn_set_velocity) IL2CPP_SLOT(0x1D78))(rb,v)
// Application #define IL2_App_setTargetFPS(fps) ((fn_setTargetFPS) IL2CPP_SLOT(0x1D48))(fps)
// Camera #define IL2_Camera_main() ((fn_Camera_main) IL2CPP_SLOT(0x1DC0))(nullptr) #define IL2_Camera_get_fov(cam) ((fn_get_fov) IL2CPP_SLOT(0x1DE8))(cam)
// UI #define IL2_TMPro_set_text(comp,ws) ((fn_set_text) IL2CPP_SLOT(0x1E28))(comp,0,ws) #define IL2_UI_Text_set_text(comp,ws) ((fn_set_text) IL2CPP_SLOT(0x1E30))(comp,0,ws)
// CharacterController #define IL2_CharCtrl_setEnabled(c,en) ((fn_setEnabled) IL2CPP_SLOT(0x1E08))(c,en,0)
// ============================================================================ // END // ============================================================================
// ============================================================================ // SECTION 13 — STARTUP / LOADER CHAIN // ============================================================================ // DLL entry and initialization sequence (Ch.11 / Ch.29)
namespace RVA { // Entry point chain constexpr u32 DllMain_entry_real = 0x01000; // CRT DllMain (spawns loader thread) constexpr u32 LoaderThread = 0x05000; // main init thread: IL2CPP + window + hooks constexpr u32 Startup_main = 0x0A9190; // step-by-step startup (steps 1-11) constexpr u32 ModMgr_RegisterAll = 0x09AE00; // 11 modules registered via stubs constexpr u32 ModMgr_MainLoop = 0x082000; // Present hook + ImGui render loop (0x82000-0x82300) constexpr u32 D3D11Init_Shaders = 0x054DC0; // D3DCompile vertex+pixel shader (x2: 0x54DC0, 0x551E8) constexpr u32 D3D11Init_Setup = 0x082500; // ImGui Win32+D3D11 backend init, WndProc subclass
// Startup step addresses (from Ch.11.4):
// 1 0x0A91CE AllocConsole — 'il2cpp Game Console'
// 2 0x0A9267 SetConsoleCP(0xFDE9) — UTF-8
// 3 0x0A92F7 FindWindowA(NULL,'UnityWndClass') — poll until game window present
// 4 0x0A93CC HookInstallerWrapper(EnumProcessModules) — module scanner install
// 5 0x0A93E6 Log 'Initializing..' (source: main.cpp:53)
// 6 0x0A942F Call [g_Config+0x1E80] — IL2CPP domain resolver
// 7 0x0A945A Log 'IL2CPP Domain Found: ' (if domain non-null)
// 8 0x0A94C4 Log 'IL2CPP Thread Attached Successfully: '
// 9 0x0A9506 Error: Log 'Failed to Attach IL2CPP Thread!'
// 10 0x0A9545 Error: Log 'IL2CPP Domain Not Found!'
// 11 0x0A959F Success: Log 'Initialized' → then launch overlay window thread (0x827A0)
// D3D11 overlay window subsystem (Ch.29)
constexpr u32 OverlayWindowInit = 0x0827A0; // create layered window + D3D11 device (0x827A0-0x8375C)
constexpr u32 FindGameWindow = 0x0835D0; // EnumWindows callback — locate Unity window
constexpr u32 GetOverlayRect = 0x0836A0; // compute overlay rect from game window bounds
constexpr u32 D3D11_Setup_sub = 0x0825B0; // D3D11::Reinit — recreate RT + ImGui D3D11 backend
constexpr u32 WndProc = 0x0826A0; // Win32 WndProc (HWND,UINT,WPARAM,LPARAM)→LRESULT
constexpr u32 ImGui_Win32_Handler = 0x057720; // ImGui_ImplWin32_WndProcHandler — all kb/mouse
constexpr u32 PresentHook_callsite = 0x082F00; // IDXGISwapChain::Present hook call site (inside msg loop)
constexpr u32 RenderFrame = 0x082FC0; // ImGui NewFrame + per-module Render dispatch
constexpr u32 ImGui_Begin_wrapper = 0x0937D0; // ImGui::Begin wrapper (Unity Explorer Window title)
constexpr u32 ImGui_Selectable = 0x0708D0; // ImGui::Selectable (preset selector, Ch.17)
// Thread suspension for hook install (Ch.3)
constexpr u32 CollectProcessThreads = 0x0A96B0; // Toolhelp32 snapshot → thread ID array (0xA96B0-0xA9A1C)
constexpr u32 SuspendOrResumeThreads= 0x0A9A20; // OpenThread + Suspend/Resume all (0xA9A20-0xA9A98)
constexpr u32 PatchCode = 0x0A9A9C; // VirtualProtect + write hook bytes (0xA9A9C-0xA9BC3)
// Hook manager detailed RVAs (Ch.8)
constexpr u32 HookMgr_Install = 0x0A9CC8; // alloc trampoline + FNV hash (= CreateHook)
constexpr u32 HookMgr_Remove = 0x0A9E8C; // remove + restore original bytes
constexpr u32 HookMgr_Enable_fn = 0x0A9A9C; // toggle enabled bit + patch
constexpr u32 HookMgr_AllocTramp = 0x0A960C; // allocate trampoline slot near target VA
constexpr u32 HookMgr_FreeSlot = 0x0AA684; // free trampoline + compact hook array
constexpr u32 HookInstaller_Wrapper = 0x08BAF0; // wrapper called at 0xA93CC during startup
// Module scanner (Ch.11.2)
constexpr u32 ModulePathScanner = 0x08B650; // scan loaded modules for testyip/gatmp/EF-Cheeto
constexpr u32 ModPathScanner_EF = 0x08B937; // wcsstr branch: search for 'EF-Cheeto.dll'
// String helpers
constexpr u32 UTF8ToWide = 0x08B4E0; // MultiByteToWideChar CP_UTF8(0xFDE9) wrapper
constexpr u32 WideStr_wcsstr = 0x0AB6A0; // custom wcsstr — returns iterator, -1 if not found
constexpr u32 WideStr_Dtor = 0x0AB758; // wstring destructor (used in path scanner)
// Module-specific helpers
constexpr u32 NoClip_RegisterTab = 0x00FCB0; // one-time NoClip tab init
constexpr u32 FreeCam_RegisterTab = 0x00F7D0; // one-time FreeCam tab init
constexpr u32 ManagerName_Init = 0x00FFF0; // zero std::string fields for ModuleManager name
constexpr u32 NoClip_EntityIter = 0x089DC0; // entity iterator inner loop (NoClip::Update)
constexpr u32 SetDither_Render = 0x08C490; // SetDither::Render — graphics dither toggle
constexpr u32 SkillHack_PatchFloat = 0x08E220; // installs FloatReturn hook on [g_Config+0x1E50]
constexpr u32 SkillHack_PatchBool = 0x08EBC0; // installs BoolTrue hook on [g_Config+0x1E58]
constexpr u32 SkillHack_PatchVoid = 0x08F560; // installs VoidReturn hook on [g_Config+0x1E40]
constexpr u32 SkillHack_Trampoline = 0x08FF00; // common trampoline dispatcher (calls original fn)
constexpr u32 UE_GuardReturn = 0x0901D8; // early return after once_flag sealed (UE::RegisterTab)
constexpr u32 UE_AutoRefresh = 0x093B10; // auto-refresh timer check for scene list
constexpr u32 UE_Memset_block = 0x0AC86A; // memset 0xD8 bytes at [.data+0x2200] (FreeCam init)
constexpr u32 PreventSS_Init = 0x08AD70; // once_flag guarded PreventScreenshot init
constexpr u32 PreventSS_Render = 0x08AE60; // ImGui single checkbox 'Prevent Screenshot'
constexpr u32 PreventSS_Update = 0x08AFC0; // SetWindowDisplayAffinity dispatch (per-frame)
constexpr u32 PreventSS_OsCheck = 0x08B220; // Win10 build check + affinity setter
constexpr u32 TabMgr_BeginTab_full = 0x09D7D0; // full BeginTab with state+title resolution
constexpr u32 GABypass_Init = 0x09D1E0; // 71 IL2CPP stub patch sequence
constexpr u32 Std_once_flag_Execute = 0x0AFF60; // MSVC _Execute_once (once_flag)
constexpr u32 Sidebar_Settings = 0x080770; // sidebar settings section (0x80770-0x80B50)
// ImGui_EndFrame alias: see RVA::ImGui_EndFrame (0x001C2D0) defined in Section 9
}
// ============================================================================ // SECTION 14 — D3D11 OVERLAY WINDOW INIT (Ch.29 summary) // ============================================================================ // OverlayWindowInit (RVA 0x827A0) sequence: // // 29.1 DPI setup (0x827FF-0x82923): // Try SetThreadDpiAwarenessContext(DPI_AWARENESS_CONTEXT_PER_MONITOR_AWARE_V2) // Fallback: SetProcessDpiAwareness(2) // Final fallback: SetProcessDPIAware() // Guard: [.data+0x3C7440] / [.data+0x3C7448] // // 29.2 Game window location + class registration (0x82924-0x82A28): // EnumWindows(FindGameWindow@0x835D0) → locate Unity game HWND // WNDCLASSEX: CreateSolidBrush(0x7F00), LoadCursorW, LoadIconW×2 // RegisterClassExW // GetSystemMetrics(SM_CXSCREEN/SM_CYSCREEN) // // 29.3 Overlay window + D3D11 device (0x82A29-0x82BFF): // CreateWindowExW(WS_EX_LAYERED|WS_EX_TRANSPARENT) // SetLayeredWindowAttributes // DwmExtendFrameIntoClientArea (full glass) // D3D11CreateDeviceAndSwapChain — attempt 1: DXGI_FORMAT_R8G8B8A8_UNORM // on failure: attempt 2: DXGI_FORMAT_B8G8R8A8_UNORM // D3D11::Reinit (0x825B0) — set up ImGui D3D11 backend // ShowWindow / UpdateWindow // CreateMutexA — prevent duplicate instances // // 29.4 Message loop (0x82C01-0x8352F): // Log 'Initialized' (source: UI.cpp, RVA 0x3AF610) // Loop: PeekMessageW / TranslateMessage / DispatchMessageW // Each iter: FindWindowA('UnityWndClass',NULL) — exit if game gone // IsWindow, GetWindowThreadProcessId, GetWindowRect // SetWindowPos to track game window
// WndProc (RVA 0x826A0) — pseudocode: // LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) { // if (g_ImGuiCtx) { // LRESULT r = ImGui_ImplWin32_WndProcHandler(hwnd, msg, wParam, lParam); // if (r) return 1; // } // switch (msg) { // case WM_DESTROY: PostQuitMessage(0); return 0; // case WM_SIZE: // if (g_pSwapChain && wParam != SIZE_MINIMIZED) { // if (g_pRenderTargetView) { g_pRenderTargetView->Release(); g_pRenderTargetView=NULL; } // g_pSwapChain->ResizeBuffers(0,LOWORD(lParam),HIWORD(lParam),DXGI_FORMAT_UNKNOWN,0); // D3D11_Setup_sub(); // 0x825B0 — recreate RT + shaders // } // return 0; // case WM_SYSCOMMAND: // if ((wParam & 0xFFF0) == SC_KEYMENU) return 0; // break; // default: // return ImGui_ImplWin32_WndProcHandler(hwnd, msg, wParam, lParam); // } // return 0; // }
// ============================================================================ // SECTION 15 — MODULE PATH SCANNER (Ch.11.2) // ============================================================================ // ModulePathScanner (RVA 0x8B650): // Args: HANDLE process, void** module_array, DWORD count // For each module path: // UTF8ToWide(path) → wpath // wcsstr(wpath, L"testyip") → if found: found_count++ // wcsstr(wpath, L"gatmp.tmp") → if found: found_count++ // if not found: ModPathScanner_EF (0x8B937): // wcsstr(wpath, L"EF-Cheeto.dll") → if found: found_count++ // Returns found_count // // Injection identity strings (.data): // L"testyip" [.data+0x0318] alternate temp-file loader name // L"gatmp.tmp" [.data+0x0338] primary temp-file loader name // L"EF-Cheeto.dll" [.data+0x0358] published DLL name (fallback)
// ============================================================================ // SECTION 16 — THREAD SUSPENSION SUBSYSTEM (Ch.3) // ============================================================================ // CollectProcessThreads (RVA 0xA96B0): // CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD,0) → hSnapshot // THREADENTRY32 te32; te32.dwSize = sizeof(THREADENTRY32); // Thread32First(hSnapshot, &te32) // while Thread32Next: if te32.th32OwnerProcessID==GetCurrentProcessId() // AND te32.th32ThreadID != calling_thread: append to array // // SuspendOrResumeThreads (RVA 0xA9A20): // For each collected thread ID: // hThread = OpenThread(THREAD_SUSPEND_RESUME, FALSE, tid) // if suspend: SuspendThread(hThread) // if resume: ResumeThread(hThread) // CloseHandle(hThread) // // PatchCode (RVA 0xA9A9C): // VirtualProtect(target, size, PAGE_EXECUTE_READWRITE, &oldProt) // memcpy(target, patch_bytes, size) // VirtualProtect(target, size, oldProt, &oldProt) // FlushInstructionCache(GetCurrentProcess(), target, size)
// ============================================================================ // SECTION 17 — PREVENT SCREENSHOT MODULE (Ch.21 supplement) // ============================================================================ // PreventScreenshot::Initialize (RVA 0x8AD70): // Guarded by once_flag at [.data+0x2390] // Allocates module object (0x48 bytes) // Sets vtable: 0x3AFA38 → 0x3B0110 after init // Zeroes: enabled, state_dirty, second_flag // // PreventScreenshot::Update (RVA 0x8AFC0): // 1. Call GetInstance (0x8AD70) // 2. Check enabled [module+0x28] // 3. If enabled && !state_dirty: call OsCheck (0x8B220) // 4. Build HWND list at [.data+0x24D0] // 5. For each HWND node [rbx+0x10]: call OsCheck affinity setter // 6. Call HookMgr_singleton (0x81B00) to update hook state // // PreventScreenshot::OsCheck (RVA 0x8B220): // Checks Windows 10 build version // Calls SetWindowDisplayAffinity(hwnd, WDA_MONITOR) via IAT[0xB1460] // On disable: SetWindowDisplayAffinity(hwnd, WDA_NONE)
// ============================================================================ // SECTION 18 — COMPLETE FUNCTION INDEX (all 91 named functions) // ============================================================================ // Cross-reference: function name → RVA (use RVA:: namespace above for most) // This table captures every named entry from the doc cross-reference (Ch.24/25).
// Name RVA Chapter // DllMain 0x001000 Entry // LoaderThread 0x005000 Ch.11 // FreeCam::RegisterTab 0x00F7D0 Ch.12.3 // FreeCam::RegisterFpsTab 0x0814C0 Ch.12.3 // NoClip::RegisterTab 0x00FCB0 Ch.12.2 // ManagerName::Init 0x00FFF0 Ch.15 // ImGui::EndFrame 0x01C2D0 Ch.15 // ConfigSerialize 0x012050 Ch.6 // ConfigFileIO (UTF8→wide fopen) 0x011EA0 Ch.6 // BuildFilePath 0x030A90 Ch.6 // D3D11Init_Shaders A 0x054DC0 Ch.5 // D3D11Init_Shaders B 0x0551E8 Ch.5 // D3D11::CreateBuffers 0x0551F0 Ch.5 // ImGui_ImplWin32_WndProcHandler 0x057720 Ch.7 // ImGui::Toggle (TabMgr) 0x070820 Ch.12 // ImGui::Selectable 0x0708D0 Ch.17 // TabMgr::BeginTabFull 0x09D7D0 Ch.12 // Sidebar_Settings entry 0x080770 Ch.25 // D3D11::Setup (ImGui backend init) 0x082500 Ch.29 // D3D11::Reinit 0x0825B0 Ch.7/29 // WndProc 0x0826A0 Ch.7 // OverlayWindowInit 0x0827A0 Ch.29 // FindGameWindow 0x0835D0 Ch.29 // GetOverlayRect 0x0836A0 Ch.29 // PresentHook callsite 0x082F00 Ch.15.5 // RenderFrame 0x082FC0 Ch.15 // HookMgr_singleton 0x081B00 Ch.8 // ESPModule singleton init 0x083E00 Ch.9 // ESPModule::RenderOverlay 0x083FA0 Ch.22 // SetDither::Render 0x08C490 Ch.12.5 // CheckboxToggle 0x085320 Ch.12 // ImGui::SliderFloat 0x065570 Ch.12.3 // ImGui::DragInt 0x066750 Ch.12.2 // NoClip::Render 0x0813D0 Ch.12.2 // NoClip::Update 0x089B50 Ch.12.2 // NoClip::EntityIterator 0x089DC0 Ch.12.2 // FreeCam::Update 0x0871A0 Ch.12.3 // FpsUnlocker::Render 0x085B90 Ch.12.4 // PlayerProfile::Update 0x08A4F0 Ch.12.6 // Vacuum::Render 0x093CA0 Ch.12.7 // Vacuum::PhysicsLoop 0x093F10 Ch.12.7 // Vacuum::EntityIterator 0x094000 Ch.12.7 // SkillHack::Render (hook install) 0x08D1F0 Ch.12.8 // SkillHack::RenderPanel 0x08D240 Ch.12.8 // SkillHack::Dispatcher 0x08D4B0 Ch.10 // SkillHack::CooldownBypass 0x08D500 Ch.10 // SkillHack::AvailBypass 0x08D640 Ch.10 // SkillHack::CostBypass 0x08D780 Ch.10 // SkillHack::PatchFloat 0x08E220 Ch.10 // SkillHack::PatchBool 0x08EBC0 Ch.10 // SkillHack::PatchVoid 0x08F560 Ch.10 // SkillHack::TrampolineDispatch 0x08FF00 Ch.10 // PreventScreenshot::Initialize 0x08AD70 Ch.21 // PreventScreenshot::Render 0x08AE60 Ch.21 // PreventScreenshot::Update 0x08AFC0 Ch.21 // PreventScreenshot::OsCheck 0x08B220 Ch.21 // UTF8ToWide 0x08B4E0 Ch.11 // ModulePathScanner 0x08B650 Ch.11.2 // ModulePathScanner::EFSearch 0x08B937 Ch.11.2 // HookInstallerWrapper 0x08BAF0 Ch.11.3 // ImGui::InputText_ws 0x08AC20 Ch.12.6 // HookInstaller inner 0x08BAF0 Ch.11.3 // ColorApplicator 0x094190 Ch.28.2.1 // Theme_Writer_Preset0 0x094890 Ch.17/28 // Theme_Writer_Preset1 0x096770 Ch.17/28 // Theme_Writer_Preset2 0x098650 Ch.17/28 // Settings::RenderOverlay 0x09A4F0 Ch.19.8 // UnityExplorer::RegisterTab 0x090060 Ch.16 // UnityExplorer::Render 0x090250 Ch.16 // UnityExplorer::RefreshScenes 0x090D40 Ch.16 // UnityExplorer::GuardReturn 0x0901D8 Ch.16 // UnityExplorer::AutoRefresh 0x093B10 Ch.16 // ImGui::Begin wrapper 0x0937D0 Ch.16 // ModuleManager::AddRegistrar 0x09B2C0 Ch.15 // ModuleManager::Grow 0x09B3C0 Ch.15 // ModuleManager::Init 0x09AC10 Ch.15 // ModuleManager::UpdateLoop 0x09AE80 Ch.15 // ModuleManager::RenderLoop 0x09AEF0 Ch.15 // ModuleManager::HotkeyLoop 0x09AF60 Ch.15 // ModuleManager::RegisterAll 0x09AE00 Ch.15 // DispatchLoop_UpdateCatch 0x0AEBC0 Ch.15.4.1 // DispatchLoop_RenderCatch 0x0AEC50 Ch.15.4.1 // DispatchLoop_HotkeyCatch 0x0AECE0 Ch.15.4.1 // IL2CPP_FindByPath 0x09BCB0 Ch.16/19 // GABypass::Init 0x09D1E0 Ch.18 // CollectProcessThreads 0x0A96B0 Ch.3 // SuspendOrResumeThreads 0x0A9A20 Ch.3 // PatchCode 0x0A9A9C Ch.3 // Startup_main 0x0A9190 Ch.11.4 // HookMgr_AllocTrampoline 0x0A960C Ch.8 // HookMgr_CreateHook 0x0A9CC8 Ch.8 // HookMgr_RemoveHook 0x0A9FA0 Ch.8 // HookMgr_EnableHook 0x0AA140 Ch.8 // HookMgr_FreeSlot 0x0AA684 Ch.8 // HookMgr_Spinlock 0x0A9C88 Ch.8 // WideStr::wcsstr 0x0AB6A0 Ch.11 // WideStr::Dtor 0x0AB758 Ch.11 // Memset_block 0x0AC86A (alloc+memset 0xD8 bytes) // BaseModule::Dtor 0x00FA60 Ch.12 // WideToString 0x00EB10 Ch.11 // PreventScreenshot::SetAffinity 0x08B490 Ch.21 (SetWindowDisplayAffinity call site) // Vacuum::Render (alt addr) 0x093C90 Ch.12.7 (one-byte offset alias for 0x93CA0)
// ============================================================================ // END OF RECONSTRUCTION HEADERS // ============================================================================
// ============================================================================ // SECTION 19 — CONFIG I/O FUNCTIONS (Ch.6 complete) // ============================================================================
namespace RVA { // Config I/O constexpr u32 ReadConfig = 0x0302D2; // fread JSON config on startup → populate g_Config constexpr u32 ReadConfig_end = 0x030348; // ReadConfig range end constexpr u32 SaveConfig = 0x030620; // fwrite g_Config state to JSON file (0x30620-0x307A0) constexpr u32 SaveConfig_end = 0x0307A0; constexpr u32 ImGuiSaveIni = 0x017078; // fwrite ImGui window layout to .ini (0x17078-0x172CA) constexpr u32 ImGuiSaveIni_end = 0x0172CA; constexpr u32 ConsoleDebugWrite = 0x00EA1B; // fwrite to stdout/console (debug output, size=1)
// SaveConfig (RVA 0x30620) pseudocode:
// Check state->enabled_flag [rbx+0x2900]
// Load state->file_path ptr [rbx+0x50]
// Call BuildFilePath (0x30A90)
// Call OpenConfigFile(path, "wt") → FILE* fp
// Serialize via ConfigSerialize (0x12050) → string
// fwrite(string, 1, len, fp); fclose(fp)
// Auto-save timer: xmm0=[rbx+0x2904], timer -= delta; on expire: re-save
//
// Config field written by language selector:
// [g_Config+0x2764] content ref-count (DWORD, decremented on lang change)
constexpr u32 LangSelector_refcount_off = 0x2764; // g_Config+0x2764 = content ref-count
}
// ============================================================================ // SECTION 20 — LOG / PRINT / CRC32 / REGISTRY (Ch.15 / Ch.26 helpers) // ============================================================================
namespace RVA { constexpr u32 Log_Print = 0x00FDA0; // shared logging helper (called by all 3 dispatch catchers) constexpr u32 ImGui_PushStyleColor = 0x010840; // ImGui::PushStyleColor — theme system (159 calls) constexpr u32 CRC32_Lookup = 0x011DF0; // CRC32 of module key string (e.g. "Sidebar", "Content") constexpr u32 Module_RegistryLookup = 0x03D1A0; // registry lookup by CRC32 hash → module ptr constexpr u32 Module_Notify = 0x01D2B0; // module notify/update (called after lang change) constexpr u32 ImGui_Epilogue = 0x023E20; // ImGui epilogue tail-call target (Sidebar tail-jmps here) constexpr u32 I18n_Refresh = 0x02A530; // i18n content refresh — reload translations on lang change constexpr u32 Locale_ContextInit = 0x09D660; // locale context init — selects "en" or "zh_cn" based on flag constexpr u32 Label_Formatter = 0x05FB60; // sprintf-style: build "Key Name: %s" label strings constexpr u32 ImGui_Combo = 0x064220; // ImGui::Combo (language dropdown, 2-item list) constexpr u32 FPS_StringBuild = 0x07F5C0; // build "FPS: NNN" string for FPS overlay }
// i18n language flag: [.data+0x3C77B0] (VA 0x1803C77B0) // 0 = English (RVA 0x3AF310) // 1 = 简体中文 (RVA 0x3AF318) // Language tab label: " Language" (RVA 0x3AF328, 5-space indent) // Combo widget ID: "##Language" (RVA 0x3AF338)
// ============================================================================ // SECTION 21 — SIDEBAR / MAIN PANEL (Ch.25 complete) // ============================================================================
namespace RVA { constexpr u32 Sidebar_Render = 0x07F8F0; // top-level overlay panel (0x7F8F0, ~0x146E bytes) // Sidebar_Render calls: // CRC32_Lookup(0x11DF0) on "Sidebar" key (RVA 0x3AF2C8) // Module_RegistryLookup(0x3D1A0) // Module_Notify(0x1D2B0) // Language selector sub-panel (0x80770-0x80B50) unconditionally // Jump-table dispatch for all tab bodies // Tail-jmp to ImGui_Epilogue (0x23E20) at 0x80D5E // Stack frame: 0x380 bytes; saves xmm6–xmm8; single rcx arg (ModuleManager ptr) // // Key strings: // Banner: "EF - Cheeto Press F12 to show panel" (RVA 0x3AF258) // Disclaimer: "This is free, if you spend money, then you have been deceived" (RVA 0x3AF288) // Window key: "Sidebar" (RVA 0x3AF2C8) — ImGui::Begin not called inside 0x7F8F0 itself // Active tab index written to [.data+0x1F68] on click, read by jump table
constexpr u32 Lang_Selector_start = 0x080770; // language selector sub-panel start (unconditional)
constexpr u32 Lang_Selector_end = 0x080B50; // language selector sub-panel end
}
// Language selector execution flow (Ch.26.2): // 0x80895 call Locale_ContextInit(0x9D660) // 0x808DD lea rsi, "English" (RVA 0x3AF310) // 0x808E3 lea rbx, "简体中文" (RVA 0x3AF318) // 0x809A1 lea rdx, " Language" (RVA 0x3AF328) // 0x809C6 call TabMgr::BeginTab(0x9D7D0) // 0x80A03 call ImGui::Combo(0x64220) → al=1 if changed // 0x80A2F if English: mov [.data+0x3C77B0], 0 // 0x80A5D if ZH-CN: mov [.data+0x3C77B0], 1 // 0x80A6E call I18n_Refresh(0x2A530) // 0x80A73 dec [g_Config+0x2764] (content ref-count) // 0x80A80 rax = [g_Config+0x15D8] (active config preset ptr) // 0x80A87 [rax+0x103] = 1 (dirty flag → triggers config save) // 0x80B0B lea rcx, "Content" (RVA 0x3ADFC8) // 0x80B12 call CRC32_Lookup(0x11DF0) // 0x80B33 call Module_RegistryLookup(0x3D1A0) // 0x80B4D call Module_Notify(0x1D2B0)
// ============================================================================ // SECTION 22 — ESPMODULE COMPLETE FUNCTION TABLE (Ch.22) // ============================================================================
namespace RVA { constexpr u32 ESPModule_Init = 0x083E00; // lazy singleton init (thread-safe static) constexpr u32 ESPModule_Render = 0x083F60; // Ch.22 §22.1 — "ESP Features" collapsing header constexpr u32 ESPModule_DrawOverlay = 0x083000; // Ch.22 §22.2 — world-space entity label overlay constexpr u32 ESPModule_Update = 0x084A00; // per-frame entity label draw loop start constexpr u32 ESPModule_Update_loop = 0x0852A5; // entity label loop body } // ESPModule::RenderOverlay (0x83FA0–0x8499E): large monolithic ImGui panel // ESPModule::Update entity type dispatch: 0=enemy, 1=interactive, 2=friendly, 3=npc, 4=puzzle
// ============================================================================ // SECTION 23 — FPSMODULE COMPLETE (Ch.20) // ============================================================================
namespace RVA { constexpr u32 FPSModule_Initialize = 0x0814C0; // once_flag guarded init (once_flag at [.data+0x2310]) constexpr u32 FPSModule_RenderPanel = 0x085660; // panel render (two checkboxes: FPS Monitor + Show FPS Overlay) constexpr u32 FPSModule_RenderPanel_branch = 0x0856F0; // inner ImGui branch of panel render constexpr u32 FPSModule_RenderOverlay = 0x085700; // FPS counter overlay start constexpr u32 FPSModule_RenderOverlay_end = 0x085900; // FPS counter overlay end constexpr u32 FPSModule_RenderOverlay_counter = 0x0858D0; // "##Foreground" frameless window (FPS display) } // FPSModule::Initialize (0x814C0): // Guarded by once_flag at [.data+0x2310] // Alloc 0xD8 bytes (via 0xAC86A), store ptr at [.data+0x22E0] // vtable: 0x3AFA38 → 0x3AFAC0 after init // name: "FPS Monitor" (RVA 0x3AFA88) at [.data+0x22E8] // enabled = 0 at [.data+0x2308] // // FPSModule overlay color thresholds (RVA of XMMWORD constants): // fps >= 60: 0x1803B3530 (green) // 30 <= fps < 60: 0x1803B3540 (yellow) // fps < 30: 0x1803B3510 (red) // FPS display string built by FPS_StringBuild (0x7F5C0): "FPS: " + integer
// ============================================================================ // SECTION 24 — SETDITHER COMPLETE (Ch.12.5.1) // ============================================================================
namespace RVA { constexpr u32 SetDither_RenderOverlay = 0x08C4A0; // SetDither::RenderOverlay — distinct from RegisterTab // SetDither::RenderOverlay is invoked by the tab-callback pointer chain // (not directly from RegisterTab at 0x81810) // Implements the graphics dither toggle panel body }
// ============================================================================ // SECTION 25 — FREECAM KEY BINDING DISPLAY (Ch.27.3) // ============================================================================ // Key display sub-panel inside FreeCam tab (when enabled): // Each row uses: MakeString(0xFCB0) → Label_Formatter(0x5FB60) → TabMgr::BeginTab(0x9D7D0) // Key binding state array: [rip + ...] # 0x1803C6E98 ("Pu;" RTTI sentinel in .data) // Key label format strings (RVAs): // "Forward Key: %s" 0x3AFD08 VA 0x180087A87 // "Backward Key: %s" 0x3AFD18 VA 0x180087B1A (approx) // "Left Key: %s" 0x3AFD30 // "Right Key: %s" 0x3AFD40 // "Up Key: %s" 0x3AFD50 // "Down Key: %s" 0x3AFD60 // "IncFOV Key: %s" 0x3AFD70 // "DecFOV Key: %s" 0x3AFD80 // "LeftRoll Key: %s" 0x3AFD90 // "RightRoll Key: %s" 0x3AFDA8 // "ResetRoll Key: %s" 0x3AFDC0 // "NONE" 0x3AF820 — displayed for any unbound key
namespace RVA { constexpr u32 FreeCam_KeyDisplay = 0x087A87; // FreeCam key binding display panel start }
// ============================================================================ // SECTION 26 — SKILLHACK INTERNALS (Ch.10 complete) // ============================================================================
namespace RVA { constexpr u32 SkillHack_FNV_hash = 0x08D555; // FNV-1a 64-bit hash (unrolled, 8-byte XOR/MUL loop) // FNV constants: prime=0x100000001B3, offset=0xCBF29CE484222325 constexpr u32 SkillHack_HashMiss = 0x08D770; // hash miss fallback: xor al,al → ret 0 constexpr u32 SkillHack_CallOrig = 0x08D891; // call-original trampoline: call r8 (original fn) constexpr u32 SkillHack_SkipRet = 0x08D894; // skip-to-ret jmp target (cost bypass early exit) constexpr u32 Vacuum_Monster_subss = 0x093EAC; // Vacuum::Render Monster sub-checkbox subss sequence }
// ============================================================================ // SECTION 27 — CRT SECURITY FUNCTIONS (Ch.4) // ============================================================================
namespace RVA { constexpr u32 CRT_SecurityInit = 0x0AC580; // __security_check_cookie + SEH init (0xAC580-0xAC6CA) constexpr u32 CRT_SecurityInit_end = 0x0AC6CA; constexpr u32 CRT_SecurityCookie = 0x0AC6CC; // __security_check_cookie verifier (0xAC6CC-0xAC77B) constexpr u32 CRT_SecurityCookie_end= 0x0AC77B; } // CRT_SecurityInit pseudocode (called at DllMain + first-chance exception dispatch): // call IsProcessorFeaturePresent(0x17) → if supported: int 29h (fast fail) // call __security_check_cookie helper (sub_0x1800AC574) // RtlCaptureContext / RtlLookupFunctionEntry / RtlVirtualUnwind // Build EXCEPTION_RECORD: code=0x40000015 (STATUS_FATAL_APP_EXIT), flags=NONCONTINUABLE // call IsDebuggerPresent → save eax // call SetUnhandledExceptionFilter(NULL) // call UnhandledExceptionFilter(&record) // if !result && !debugger: call TerminateProcess(handle, code) [via int 29h at 0xAC628]
// ============================================================================ // SECTION 28 — THREAD ENUMERATION DETAIL (Ch.3 call-site map) // ============================================================================ // All CollectProcessThreads (0xA96B0) internal call sites: // 0xA9701 TH32CS_SNAPTHREAD = 4 (lea ecx,[rbx+4]) // 0xA970B CreateToolhelp32Snapshot(4, pid) // 0xA971E sizeof(THREADENTRY32) = 28 = 0x1C // 0xA972F Thread32First(hSnapshot, &te32) // [loop body] // 0xA9740 check te32.th32OwnerProcessID offset (0x10) // 0xA974B GetCurrentProcessId() // 0xA9751 cmp te32.th32OwnerProcessID, eax // 0xA9757 GetCurrentThreadId() // 0xA975D cmp te32.th32ThreadID, eax // 0xA9761 je skip (exclude caller thread) // 0xA9763 get vector data ptr // 0xA9778 VirtualAlloc/HeapReAlloc if vector full // 0xA97CA store thread ID: [rdx+rcx*4] = eax // 0xA97CD inc [rdi+0xC] (vector count++) // 0xA97DD Thread32Next(hSnapshot, &te32) // 0xA97E3 test eax,eax → jne loop // 0xA97EB GetLastError → cmp 0x12 (ERROR_NO_MORE_FILES) // 0xA9815 CloseHandle(hSnapshot) // // SuspendOrResumeThreads (0xA9A20) call sites: // 0xA9849 OpenThread(THREAD_SUSPEND_RESUME, FALSE, tid) // 0xA9861 SuspendThread(hThread) // 0xA9964 ResumeThread(hThread) [×37 total resume calls] // 0xA988B GetThreadContext(hThread, &ctx) // 0xA993C CreateToolhelp32Snapshot (secondary snapshot) // // PatchCode (0xA9A9C) call sites: // 0xA9AFC VirtualProtect(target, size, PAGE_EXECUTE_READWRITE, &old) // 0xA9B6C VirtualProtect(target, size, old, &old) (restore) // 0xA9B72 GetCurrentProcess() // 0xA9B81 FlushInstructionCache(hProc, target, size)
// ============================================================================ // SECTION 29 — IAT CALL SITE MAP (Ch.2 complete) // ============================================================================ // All Win32 IAT entries with RVAs and call sites: // SuspendThread IAT 0xB1050 call site 0xA9861 // ResumeThread IAT 0xB1058 call site 0xA9964 (×37) // GetThreadContext IAT 0xB1068 call site 0xA988B // FlushInstructionCache IAT 0xB1070 call site 0xA9B81 // SetThreadContext IAT 0xB1078 call site 0xA993C // GetProcAddress IAT 0xB1088 call sites 0x55F7E, 0x55F92 (×7) // LoadLibraryA IAT 0xB10E0 call sites 0x55F57, 0x585AE (×4) // AllocConsole IAT 0xB1108 // GetConsoleMode IAT 0xB1120 // SetConsoleMode IAT 0xB1128 // SetConsoleTitleA IAT 0xB12A0 // GetCurrentProcess IAT 0xB1270 call site 0xA9B72 // VirtualFree IAT 0xB1278 call sites 0x81D5B, 0xAA6E1 // VirtualProtect IAT 0xB1288 call sites 0xA9AFC, 0xA9B6C // VirtualAlloc IAT 0xB11A0 call sites 0xAA566, 0xAA607 // IsDebuggerPresent IAT 0xB11E8 call site 0xAC67B // IsProcessorFeaturePresent IAT 0xB11F0 call site 0xAC5A2 // TerminateProcess IAT 0xB11F8 call site 0xAC628 (via int 29h) // SetUnhandledExceptionFilter IAT 0xB1200 call site 0xAC698 // UnhandledExceptionFilter IAT 0xB1208 call site 0xAC6A3 // RtlVirtualUnwind IAT 0xB1210 // RtlLookupFunctionEntry IAT 0xB1218 // RtlCaptureContext IAT 0xB1220 // OpenThread IAT 0xB11D0 call site 0xA9849 (×38) // Thread32Next IAT 0xB11A8 call site 0xA97DD // Thread32First IAT 0xB11B0 call site 0xA972F // CreateToolhelp32Snapshot IAT 0xB1160 call site 0xA970B // SetWindowDisplayAffinity IAT 0xB1460 call site 0x8B48F // FindWindowA IAT 0xB14A8 call site 0x8301F // EnumWindows IAT 0xB14A0 // GetWindowRect IAT 0xB1488 // GetWindowThreadProcessId IAT 0xB1498 // IsWindow IAT 0xB1468 // GetSystemMetrics IAT 0xB14E0 // LoadIconW IAT 0xB14E8 // GetAsyncKeyState IAT 0xB???? call site 0x8301A // ShowWindow IAT 0xB1628 // UpdateWindow IAT 0xB14D8 // RegisterClassExW IAT 0xB1638 // CreateWindowExW IAT 0xB1650 // SetLayeredWindowAttributes IAT 0xB15E0 // SetProcessDPIAware IAT 0xB15A0 // LoadCursorW IAT 0xB15C8 // PeekMessageW IAT 0xB14D0 // TranslateMessage IAT 0xB14C8 // DispatchMessageW IAT 0xB14C0 // PostQuitMessage IAT 0xB???? (WndProc WM_DESTROY) // SetWindowPos IAT 0xB???? (overlay alignment) // CreateSolidBrush IAT 0xB1018 // CreateMutexA IAT 0xB1720 // DwmExtendFrameIntoClientArea IAT 0xB1918 // D3D11CreateDeviceAndSwapChain IAT 0xB1908 // D3DCompile IAT 0xB1000 call sites 0x54E77, 0x55069 // _wfopen IAT 0xB1888 call site 0x11F93 // fwrite IAT 0xB1868 call sites 0xEA1B, 0x170D6, 0x3033B, 0x3076D // fread IAT 0xB1870 (via 0x11EA0 helper) // fclose IAT 0xB1878 call sites 0x170DF, 0x30776
// ============================================================================ // END OF RECONSTRUCTION HEADERS // ============================================================================
// ============================================================================ // SECTION 30 — REMAINING CALL-SITE ADDRESSES (final gap closure) // ============================================================================ // These are internal addresses referenced in the doc that complete coverage. // They are instruction-level addresses, not function entry points.
namespace RVA { // Config I/O range markers constexpr u32 OpenConfigFile_end = 0x012043; // OpenConfigFile range end (0x11EA0–0x12043) constexpr u32 ImGuiSaveIni_caller = 0x0170B9; // caller VA of ImGuiSaveIni (fopen 'wt' for .ini) constexpr u32 SaveConfig_iniwrite = 0x030750; // SaveConfig: write ImGui ini section call site
// FpsUnlocker alt address (function table ref)
constexpr u32 FpsUnlocker_Render_alt = 0x085B80; // FpsUnlocker::Render alt ref addr (one-byte offset)
// FreeCam key display
constexpr u32 FreeCam_BackwardKey = 0x087B1A; // "Backward Key: %s" display address (approx)
// ModuleManager::DispatchRegistrarInit call site
constexpr u32 DispatchRegInit_callsite = 0x083348; // called at 0x83348 — init ImGui panel layout after first Present
// ModulePathScanner skip-on-failure
constexpr u32 ModPathScanner_skip = 0x08BA41; // je target: skip module on GetModuleFileNameW failure
// CollectProcessThreads instruction-level addresses (within 0xA96B0 body)
// 0xA96E7 xor ebx,ebx — thread count = 0
// 0xA96F8 init empty vector — mov [rcx],rbx; mov [rcx+8],rbx
// 0xA9711 mov r14,rax — hSnapshot = CreateToolhelp32Snapshot result
// 0xA9714 cmp rax,-1 — INVALID_HANDLE_VALUE check
// 0xA9725 lea rdx,[rsp+0x30] — THREADENTRY32 buffer ptr
// 0xA972A mov [rsp+0x30],r12d — te32.dwSize = 28
// 0xA9751 cmp [rsp+0x3C],eax — te32.th32OwnerProcessID == GetCurrentProcessId
// 0xA9755 jne skip — skip threads from other processes
// (All within CollectProcessThreads body at 0xA96B0; see Section 28 for full map)
}
// ============================================================================ // END // ============================================================================
// ============================================================================ // SECTION 19 — SIDEBAR / MAIN PANEL (Ch.25) // ============================================================================ // Top-level overlay panel function: RVA 0x7F8F0 (~0x146E bytes) // Called every Present() frame from ModuleManager render loop. // Stack frame: 0x380 bytes; saves xmm6-xmm8; single rcx arg (global ctx ptr) // // Key strings: // "Sidebar" RVA 0x3AF2C8 — window lookup key (CRC32 0x11DF0, reg 0x3D1A0/0x1D2B0) // "EF - Cheeto Press F12 to show panel" RVA 0x3AF258 // "This is free, if you spend money, then you have been deceived" RVA 0x3AF288 // Active tab index: [.data+0x1F68] VA 0x1803C6F68 (written on click, read at 0x80B52) // // Six tabs (jump-table dispatch at 0x80B52, case bodies): // Tab 0 "About" RVA 0x3AF2D0 — banner + disclaimer + About sub-fn (0x80E80) // Tab 1 "Player" RVA 0x3AF2DC — NoClip, SkillHack // Tab 2 "ESP" RVA 0x3AF2E8 — ESPModule overlay // Tab 3 "World" RVA 0x3AF2F0 — Vacuum // Tab 4 "Visual" RVA 0x3AF2FC — FPSMonitor, FreeCam, SetDither, FpsUnlocker, PlayerProfile // Tab 5 "Settings" RVA 0x3ADFD8 — Settings::RenderOverlay (case 5 at 0x80D25) // // i18n label dispatcher: 0x9D660 (translates label string per language toggle) // Sidebar function tail-calls into ImGui epilogue at 0x23E20 via jmp at 0x80D5E
namespace RVA { constexpr u32 Sidebar_Main = 0x07F8F0; // top-level sidebar render constexpr u32 Sidebar_About = 0x080E80; // About tab sub-function constexpr u32 Sidebar_JumpTable = 0x080B52; // tab jump table (reads [.data+0x1F68]) constexpr u32 Sidebar_Case5 = 0x080D25; // Settings tab case entry constexpr u32 i18n_Dispatcher = 0x09D660; // translation dispatcher (en/zh_cn) // ImGui_Combo = 0x064220 (already defined in Section 9 RVA namespace) // ImGui_Epilogue = 0x023E20 (already defined in Section 9 RVA namespace) constexpr u32 CRC32_fn = 0x011DF0; // CRC32 hash (window key) constexpr u32 Registry_lookup = 0x03D1A0; // registry lookup by CRC32 constexpr u32 Registry_lookup2 = 0x01D2B0; // secondary registry lookup }
// ============================================================================ // SECTION 20 — FREECAM KEY BINDING DISPLAY PANEL (Ch.27) // ============================================================================ // Sub-section of FreeCam::Update (RVA 0x871A0), begins at ~0x87A70, ends 0x88606 // (FreeCam::Update is 0x14C6 bytes total) // // Float sliders (ImGui variant 0x65570): // "Free Camera" RVA 0x3AFCB0 — sub-panel BeginTab label // "ON / OFF" RVA 0x3AF848 — toggle checkbox // "Move Speed" RVA 0x3AFCC0 — DragFloat fmt "%.3f" (0x3ADFB0) // "Look Sensitivity" RVA 0x3AFCD0 — DragFloat fmt "%.3f" // "Roll Speed" RVA 0x3AFCE8 — DragFloat fmt "%.3f" // "FOV Speed" RVA 0x3AFCF8 — DragFloat fmt "%.3f" // "FOV" RVA 0x3AFD04 — DragFloat fmt "%.1f" (0x3ADFEC) // // Key binding rows (11 total) — each row: // MakeString(0xFCB0) → sprintf(0x5FB60, "Key: %s", key_name) → TabLabel(0x9D7D0) // "NONE" RVA 0x3AF820 — displayed for unbound keys // Key-binding state array: [rip+...] 0x1803C6E98 // Rows: // "Forward Key: %s" RVA 0x3AFD08 (VA 0x180087A87) // "Backward Key: %s" RVA 0x3AFD18 // "Left Key: %s" RVA 0x3AFD30 // "Right Key: %s" RVA 0x3AFD40 // "Up Key: %s" RVA 0x3AFD50 // "Down Key: %s" RVA 0x3AFD60 // "IncFOV Key: %s" RVA 0x3AFD70 // "DecFOV Key: %s" RVA 0x3AFD80 // "LeftRoll Key: %s" RVA 0x3AFD90 // "RightRoll Key: %s" RVA 0x3AFDA8 // "ResetRoll Key: %s" RVA 0x3AFDC0
namespace RVA { constexpr u32 FreeCam_KeyBindPanel = 0x087A70; // key binding display section start constexpr u32 FreeCam_KeyBind_end = 0x088606; // end of FreeCam::Update constexpr u32 Sprintf_label = 0x05FB60; // sprintf-style label formatter }
// ============================================================================ // SECTION 21 — SETTINGS TAB (Ch.28) // ============================================================================ // Settings::RenderOverlay RVA 0x9A4F0 (source: SettingsTAB.cpp RVA 0x3B0B30) // Called from sidebar case 5 (0x80D25). Ends at ~0x9AB31. // // 28.1 Theme selector: // ImGui::Combo("Theme", ...) via 0x64220 // Four themes → four applicator functions: // "Default" RVA 0x3B0AF8 → applicator 0x941F0 (restores ImGui defaults) // "Evangelion Unit 01" RVA 0x3B06D0 → applicator 0x94890 (52 color writes) // "Evangelion Unit 02" RVA 0x3B0AE0 → applicator 0x96770 // "Matrix" RVA 0x3B0B10 → applicator 0x98650 // Each non-default applicator uses per-slot helper RVA 0x94190 (159 calls total): // reads RRGGBBAA hex string → __stdio_common_vsscanf → ImGui::PushStyleColor (0x10840) // // Evangelion Unit 01 colors (RVA 0x94890, in write order): // #FFFFFFFF #7857A7FF #19171CFF #2A282EFF #2A282EE6 #4DE6A5FF // #00000000 #4A455240 #A38CCF80 #7857A780 #4A4552FF // // Evangelion Unit 02 colors (RVA 0x96770): // #FFFFFFFF #D9293BFF #1E1E1EFF #3A3A3AFF #3A3A3AE6 #F7B302FF // #00000000 #4A455240 #F7465880 #D9293B80 #4A4552FF // // Matrix colors (RVA 0x98650): // #00FF41FF #00AA2CFF #000000FF #0A0A0AFF #0A0A0AE6 #004400FF // #00000000 #00440040 #00881EFF #00FF4180 // // 28.3 Console toggle: // CheckboxToggle(0x85320) with label "Toggle Console" (RVA 0x3B0B00) // Enabled branch: AllocConsole (IAT 0xB1178) / GetStdHandle → display "Console {}" // Disabled branch: FreeConsole
namespace RVA { constexpr u32 Theme_Default = 0x0941F0; // restores ImGui default palette constexpr u32 StyleColor_push = 0x010840; // ImGui::PushStyleColor wrapper // Settings_end 0x09AB31 — see also RVA::Settings_end 0x09AB98 in Section 9 }
// ============================================================================ // SECTION 22 — CONFIG / IMGUI .INI SYSTEM (Ch.19) // ============================================================================ // ImGui .ini filename: "imgui.ini" RVA 0x3ABB60 // Set at RVA 0x1117A into ImGuiIO+0x20 (IniFilename field) // // Config save/load: // Load path (startup): RVA 0x30661 → ConfigSerialize (0x12050) // → ftell (0x120A0) → fseek (0x120BC, 0x120E7) → ftell → fread → fclose // Manual save trigger: RVA 0x17072 // Sets [ImGuiContext+0x2900]=1, [ImGuiContext+0x2904]=0 → forces immediate write // fwrite calls: 0x3076D (config body), also 0x170D6 // fclose: 0x30776 // // Module settings handler struct (ImGuiContext+0x2920 array, 0x48 bytes each): // +0x00 TypeName (const char*) — .ini section name // +0x08 TypeHash (u32) — CRC32 of TypeName (computed 0x3079C–0x30803) // +0x18 ReadOpenFn — called on section header encounter // +0x38 WriteAllFn — called during save to emit key=value lines // 11 registered modules (RTTI .data+0x0590–0x0E60): // ESPModule, FPSModule, FpsUnlocker, FreeCam, NoClip, PlayerProfile, // PreventScreenshot, SetDither, SkillHack, Vacuum, UnityExplorerModule // // i18n blob: RVA 0x3B10E8 (0xEED bytes, nlohmann JSON, en→zh_cn map) // Copied to [.data+0x1EB8] at startup RVA 0x2164 // Loader: RVA 0x9D660 — selects en or zh_cn based on language flag // nlohmann version: v3.12.0 (statically linked; error strings at 0x3B3010–0x3B30D8)
namespace RVA { constexpr u32 ImGuiIni_set = 0x01117A; // IniFilename = "imgui.ini" write constexpr u32 Config_save_trigger = 0x017072; // manual save: set ImGuiCtx+0x2900 constexpr u32 Config_load_entry = 0x030661; // config file load entry constexpr u32 Config_ftell = 0x0120A0; // ftell in config read constexpr u32 Config_fseek_A = 0x0120BC; // fseek in config read constexpr u32 Config_fseek_B = 0x0120E7; // fseek in config read constexpr u32 Config_fwrite = 0x03076D; // config body fwrite constexpr u32 Config_fclose = 0x030776; // config fclose constexpr u32 ImGui_handler_CRC = 0x03079C; // CRC32 of TypeName (start) constexpr u32 ImGui_handler_CRC_end = 0x030803; // CRC32 of TypeName (end) constexpr u32 i18n_blob_rva = 0x3B10E8; // JSON localization blob (.rdata) constexpr u32 i18n_loader = 0x09D660; // translation dispatcher constexpr u32 i18n_copy_site = 0x02164; // startup: copies blob to [.data+0x1EB8] constexpr u32 Registrar_name_str = 0x01B71; // registrar constructor name string RVA ref }
// ============================================================================ // SECTION 23 — UNITY EXPLORER MODULE (Ch.16 supplement) // ============================================================================ // UE draw body: RVA 0x0902E0 (per-frame inspector UI, called from UE::Render 0x90250) // Window title: "Unity Explorer Window" RVA 0x3B02E0 (via ImGui::Begin wrapper 0x937D0) // // Scene panel (pseudocode): // if (scene_list empty) { // ImGui::Text("No scenes available. Click 'Refresh Scenes' to load."); // } else { // ImGui::Text("Select Scene:"); // ImGui::Combo("##SceneCombo", &selected_scene_idx, scene_list, n_scenes); // if (changed) LoadScene(selected_scene_idx); // } // // When scene panel active: g_Config->overlay_flags |= 1; overlay_scale = 300.0f // // ([g_Config+0x1F78], [g_Config+0x1F90]) // // Auto-refresh (RVA 0x090250): // if (enabled && auto_refresh) { // now = GetTime(); // 0x93B10 // if ((now - last_refresh_time) * SCALE >= refresh_interval) // RefreshScenes(this); last_refresh_time = now; // } // // Scene list storage: vector at [this+0x58]..[this+0x60] // GameObject list: vector at [this+0x40]..[this+0x48] // Search filter: [this+?] char[0x100] buffer "##SearchFilter" // // Inspector panel (when object selected via 'Ins' button): // 'Active' checkbox → GameObject.SetActive via IL2CPP // Transform: Position, LocalPosition, Rotation, Scale (float3 inputs) // 'Components' section via IL2CPP GetComponents(UnityEngine.Component) // Per component: "%s.%s" (namespace.classname) // Failure strings: "Unknown Component", "Unable to get GameObject class information." // // Key strings (Ch.16.4): // "No scenes available. Click 'Refresh Scenes' to load." // "Select Scene:" "No GameObjects found in this scene." "DontDestroyOnLoad" // "No GameObject selected." "Active" "Components" "All Components:"
namespace RVA { constexpr u32 UE_DrawBody = 0x0902E0; // main per-frame inspector draw constexpr u32 UE_AutoRefresh_fn = 0x093B10; // auto-refresh timer check }
// ============================================================================ // SECTION 24 — ADDITIONAL IAT ENTRIES (referenced in doc but not in Ch.2 table) // ============================================================================ // IAT base: RVA 0xB1000 (file raw offset 0xAF600) // These slots appear in inline code references throughout the doc:
// IAT[0xB1148] SwitchToThread — spinlock backoff (if backoff<32: SwitchToThread else Sleep(1)) // IAT[0xB1168] GetModuleFileNameExW — module path scanner, get full path of each module // IAT[0xB1178] AllocConsole — Settings console toggle enable branch // IAT[0xB1290] GetModuleHandleW — GABypass: GetModuleHandleW(L"GameAssembly.dll") // also: PreventScreenshot::OsCheck loads ntdll for RtlGetVersion
// ============================================================================ // SECTION 25 — MODULEMANGER INIT VARIANT ADDRESS (Ch.19.7) // ============================================================================ // Two RVAs for ModuleManager::Init appear in the doc: // RVA 0x09AC10 — from Ch.15 (primary reference) // RVA 0x09ACA4 — from Ch.19.7 (alternate call site / body continuation) // Both refer to the same function; 0x9AC10 is entry, 0x9ACA4 is within body. // Body action (Ch.19.7): // Iterates module registry [.data+0x23B8], calls vtable[+0x10] → module instance, // then vtable[+0x18] (Render dispatch) per registered module. // Source: ModuleManager.cpp lines 34 and 52 (assert strings in binary).
// Vacuum::RegisterTab stub at RVA 0x9B650 resolves via jmp to // UnityExplorerModule::RegisterTab at RVA 0x090060. // (Vacuum and UE share a registrar stub due to module ordering in init sequence)
// GABypass::Patch call site in startup: RVA 0x0A942A // Called exactly once from LoaderThread, immediately after 'Initializing..' log (0xA93E6) // and before any module Update()/Render() calls.
// ============================================================================ // SECTION 26 — COMPLETE ADDRESS COVERAGE INDEX // ============================================================================ // All 282 unique cheat-range addresses extracted from the doc, organized by subsystem. // Addresses not in RVA:: namespace appear inline below with descriptions.
// -- Config / i18n / .ini system -- // 0x01B71 registrar constructor name string ref // 0x02164 i18n blob copy to [.data+0x1EB8] at startup // 0x1117A ImGuiIO.IniFilename = "imgui.ini" write site // 0x17072 manual config save trigger (sets ImGuiCtx+0x2900=1) // 0x30661 config file load entry (calls ConfigSerialize 0x12050) // 0x30904 ImGui handler struct layout base (from CRC32 compute chain)
// -- Sidebar / UI -- // 0x80B52 sidebar tab jump table (reads active_tab_idx [.data+0x1F68])
// -- D3D11 overlay window (detailed call sites Ch.29) -- // 0x8298B EnumWindows → FindGameWindow, end of DPI section // 0x82A60 DwmExtendFrameIntoClientArea call site // 0x82B24 D3D11CreateDeviceAndSwapChain attempt 1 (R8G8B8A8) // 0x82B7E D3D11CreateDeviceAndSwapChain attempt 2 (B8G8R8A8 fallback) // 0x82C0D CreateMutexA — duplicate-instance guard // 0x82F5F Log "Initialized" (source UI.cpp, before message loop) // 0x83386 DispatchRegistrarInit once_flag — install registrar hooks // 0x8348A SwitchToThread yield site (game out of focus)
// -- FreeCam -- // 0x87A70 FreeCam key binding display panel start (inside FreeCam::Update) // 0x88606 FreeCam::Update end
// -- UnityExplorer -- // 0x902E0 UE main draw body (scene panel + GO inspector)
// -- Settings / Theme -- // 0x941F0 Default theme applicator (restores ImGui defaults) // 0x9AB31 Settings::RenderOverlay approximate end
// -- ModuleManager -- // 0x9ACA4 ModuleManager::Init body (alt addr, iterates registry vtable[+0x10]/[+0x18]) // 0x9B650 Vacuum/UE RegisterTab shared stub (resolves to UE::RegisterTab 0x90060)
// -- Startup -- // 0xA942A GABypass::Patch call site in LoaderThread (after 'Initializing..' log)
// -- IAT slots (additional, not in main IAT table) -- // 0xB1148 SwitchToThread // 0xB1168 GetModuleFileNameExW // 0xB1178 AllocConsole // 0xB1290 GetModuleHandleW (GameAssembly + ntdll RtlGetVersion)
// ============================================================================ // SECTION 27 — COMPLETE .RDATA STRING TABLE // ============================================================================ // All 189 .rdata string RVAs from the document, grouped by subsystem. // Format: RVA — "string content" — usage
// --- ImGui / config filenames --- // 0x3ABB60 "imgui.ini" ImGuiIO+0x20 IniFilename (written at RVA 0x1117A) // 0x3ABB70 "imgui_log.txt" ImGuiIO+0x28 LogFilename (written at same site) // 0x3ABF10 "##Foreground" FPS overlay frameless window label // 0x3AC160 "Calling EndDisabled() too many times!" ImGui assert string
// --- D3D11 shaders (HLSL source, compiled at runtime) --- // 0x3AE660 Vertex shader HLSL source length=0x2DD (733 bytes) // entry="main" target="vs_4_0" // cbuffer vertexBuffer:b0 { float4x4 ProjectionMatrix } // VS_INPUT{float2 pos:POSITION, float4 col:COLOR0, float2 uv:TEXCOORD0} // PS_INPUT main: output.pos = mul(ProjectionMatrix, float4(pos.xy,0,1)) // 0x3AE940 Pixel shader HLSL source length=0x191 (401 bytes) // entry="main" target="ps_4_0" // sampler sampler0; Texture2D texture0; // float4 main: return input.col * texture0.Sample(sampler0, input.uv)
// --- PreventScreenshot --- // 0x3AEC70 dynamic import string for SetWindowDisplayAffinity (from user32.dll, RVA 0x3C34A6) // 0x3B00B8 module name "PreventScreenshot" (registrar)
// --- About page (Tab 0, sub-fn 0x80E80) --- // 0x3AF350 "%s Game: Endfield CTB3" format string // 0x3AF368 "Version: " label // 0x3AF374 "1.0.0" version value // 0x3AF380 "Author: " label // 0x3AF38C "gktwo" author value // (All direct string literals, not i18n-dispatched)
// --- Window class detection --- // 0x3AF658 "UnityWndClass" FindWindowA arg / string-compare (0xACA12)
// --- ESP module (ESPModule::RenderOverlay RVA 0x83FA0) --- // 0x3AF828 "ESPModule" module name // 0x3AF838 "ESP Features" CollapsingHeader title → state [.data+0x27B0] // 0x3AF848 "ON / OFF" checkbox label → [module+0x28] // 0x3AF858 "Display Types" CollapsingHeader sub-header (via 0x6EC20) // 0x3AF868 "Show Monsters" checkbox → [rsi+0x34] show_monsters // 0x3AF878 "Show NPC" checkbox → [rsi+0x35] show_npc // 0x3AF888 "Show Friendly" checkbox → [rsi+0x36] show_friendly // 0x3AF898 "Show Puzzles" checkbox → [rsi+0x37] show_puzzles // 0x3AF8A8 "Show All" checkbox → [rsi+0x38] show_all // 0x3AF8B8 "Display Info" CollapsingHeader sub-header // 0x3AF8C8 "Show Distance" checkbox → [rsi+0x39] show_distance // 0x3AF8D8 "Show Name" checkbox → [rsi+0x3A] show_name // 0x3AF8E8 "Show Type" checkbox → [rsi+0x3C] show_type // 0x3AF8F4 (entity label separator string, used in Update DrawOverlay) // 0x3AF900 (entity label buffer string) // 0x3AF908 entity type dispatch table start (type→name pairs) // 0x3AF920 entity type dispatch table continued (0xFFFFFFFF sentinel) // 0x3AF9E0 vtable ptr value (0x3AF9E0 = post-init vtable for ESPModule)
// --- FPS overlay (FPSModule) --- // 0x3AFA98 FPSModule vtable block start // 0x3AFAAC "FPS: " prefix for FPS display string (via 0x7F5C0) // Color thresholds for FPS display (XMMWORD constants, already in .rdata): // fps >= 60: color at 0x1803B3530 (green 0.0, 1.0, 0.0, 1.0) // 30<=fps<60: color at 0x1803B3540 (yellow 1.0, 1.0, 0.0, 1.0) // fps < 30: color at 0x1803B3510 (red 1.0, 0.0, 0.0, 1.0)
// --- FreeCam --- // 0x3AF820 "NONE" unbound key display in key binding rows
// --- PlayerProfile UI paths --- // 0x3AFED0 "/UINode/UIRoot/UIDPanelPanel/Main/TextNode/Text" (len 0x2F) // 0x3AFFD0 "/UINode/WorldUIRoot/WatchPanel/Content/WatchNode/canvas_watch/ // LeftBottomNode/PlayInfoPosNode/PlayInfoLifengCell(Clone)/PlayerInfo/ManagerName" // (len 0x8D)
// --- FreeCam key binding panel (Ch.27) --- // 0x3AFCB0 "Free Camera" // 0x3AFCC0 "Move Speed" // 0x3AFCD0 "Look Sensitivity" // 0x3AFCE8 "Roll Speed" // 0x3AFCF8 "FOV Speed" // 0x3AFD04 "FOV" // 0x3AFD08 "Forward Key: %s" // 0x3AFD18 "Backward Key: %s" // 0x3AFD30 "Left Key: %s" // 0x3AFD40 "Right Key: %s" // 0x3AFD50 "Up Key: %s" // 0x3AFD60 "Down Key: %s" // 0x3AFD70 "IncFOV Key: %s" // 0x3AFD80 "DecFOV Key: %s" // 0x3AFD90 "LeftRoll Key: %s" // 0x3AFDA8 "RightRoll Key: %s" // 0x3AFDC0 "ResetRoll Key: %s"
// --- UE module string table (Ch.16.4) --- // 0x3B02D0 "Unity Explorer" tab label / ImGui::Begin title // 0x3B02E0 "Unity Explorer Window" ImGui window title // 0x3B02F8 "Search Filter:" label above search input // 0x3B0308 "##SearchFilter" ImGui InputText widget ID // 0x3B0318 "Inspector" inspector sub-panel label // 0x3B0328 "GameObjectHierarchy" hierarchy sub-panel label // 0x3B0340 "No scenes loaded. Click Refresh..." // 0x3B0390 "Scene: " scene prefix label // 0x3B0398 "No GameObjects found in this scene." // 0x3B03C0 "DontDestroyOnLoad" special DDOL scene label // 0x3B03D8 "DontDestroyOnLoad (Not Found)" // 0x3B03F8 "Refresh" button label // 0x3B0400 "Auto Refresh" checkbox label // 0x3B0410 "Interval (s)" refresh interval slider // 0x3B0420 "Scenes found: %d" // 0x3B0438 "No scenes available. Click 'Refresh Scenes' to load." // 0x3B0470 "Select Scene:" // 0x3B0480 "Select Scene" combo default text // 0x3B0490 "##SceneCombo" ImGui Combo widget ID // 0x3B04A0 "]: " object list entry separator // 0x3B04A8 "Ins##" inspect button label prefix // 0x3B04B8 "No GameObject selected." // 0x3B04D0 "Click 'Ins' button..." inspector hint // 0x3B0508 "Active" active checkbox label // 0x3B0510 "Transform" section header // 0x3B0520 "Position" // 0x3B0530 "Local Position" // 0x3B0540 "Rotation" // 0x3B054C "Scale" // 0x3B0558 "No Transform component found." // 0x3B0578 "Components" section header // 0x3B0588 "GameObject Class: %s.%s" // 0x3B05A0 "All Components:" // 0x3B05B0 "UnityEngine.Component, UnityEngine.CoreModule" (GetComponents type arg) // 0x3B05E0 "%s.%s" component name format // 0x3B05E8 "Unknown Component" // 0x3B0600 "No components found or failed to get components." // 0x3B0638 "Unable to get GameObject class information." // 0x3B0D28 "UnityExplorerModule" module name (registrar) // UE auto-refresh state: bool at [.data+0x2640], float at [.data+0x2644]
// --- Settings tab (Ch.28) --- // 0x3B0AD4 "Theme" combo label // 0x3B0AF8 "Default" theme name // 0x3B06D0 "Evangelion Unit 01" theme name // 0x3B0AE0 "Evangelion Unit 02" theme name // 0x3B0B10 "Matrix" theme name // 0x3B0B00 "Toggle Console" checkbox label // 0x3B0B18 (Settings key address for enabled state) // 0x3B0B28 "enabled" UI label for module on/off state (not JSON key) // 0x3B0B78 "Console {}" console enabled display format // 0x3B0B30 SettingsTAB.cpp source file path string
// Theme color string RVAs (Evangelion Unit 01): // 0x3B06E8 0x3B06F8 0x3B0708 0x3B0718 0x3B0728 0x3B0738 // 0x3B0748 0x3B0758 0x3B0768 0x3B0778 0x3B0798 // Theme color string RVAs (Evangelion Unit 02): // 0x3B0888 0x3B0898 0x3B08A8 0x3B08B8 0x3B08C8 0x3B08D8 0x3B08F8 // Theme color string RVAs (Matrix): // 0x3B09A8 0x3B09B8 0x3B09C8 0x3B09D8 0x3B09E8 0x3B09F8 // 0x3B0A08 0x3B0A18 0x3B0A38
// --- ModuleManager log strings (Ch.15.7) --- // 0x3B0B88 "[WARNING] ModuleManager already initialized" // 0x3B0BC0 ModuleManager.cpp assert source file path // 0x3B0C08 "Initializing ModuleManager" // 0x3B0C28 "Failed to initialize module {}" // 0x3B0C48 "Module {} initialized" // 0x3B0C60 "ModuleManager initialization complete" // 0x3B0C90 "[ERROR] Failed to update module " // 0x3B0CB8 "[ERROR] Failed to render overlay for module " // 0x3B0CE8 "[ERROR] Failed to process hotkeys for module "
// --- Config file mode strings --- // 0x3AD590 "rb" Config READ - binary read mode // 0x3AD594 "wt" Config WRITE - text write mode (ImGui ini)
// --- DamageHack ghost keys (Ch.23) --- // 0x3B1484 i18n table — four keys with no RTTI class (ghost/unimplemented feature)
// --- Locale --- // 0x3B2020 "en" locale string passed to string-construct at 0x9D890
// --- Startup / project identity --- // 0x3B3148 "E:\git\Endfield_Cheeto\user\main.cpp" (confirms project name)
// --- ESP color constant addresses in .data (ESP Update type dispatch) --- // 0x3B3224 drawlist color source (XMMWORD, type-selected RGBA) // 0x3B3308 100.0f constant (SkillHack CooldownBypass return value) // ESP color table .rdata bases (correspond to ESPModule::color[] slots): // 0x3B3500 color[10] BLACK (0.0,0.0,0.0,1.0) // 0x3B3510 color[0] RED (1.0,0.0,0.0,1.0) also FPS<30 threshold // 0x3B3520 color[1] ORANGE (1.0,0.647,0.0,1.0) // 0x3B3530 color[3] GREEN (0.0,1.0,0.0,1.0) also FPS>=60 threshold // 0x3B3540 color[2] YELLOW (1.0,1.0,0.0,1.0) also FPS 30-60 threshold // 0x3B3550 color[11] GRAY (0.502,0.502,0.502,1.0) // 0x3B3560 color[8] PINK (1.0,0.078,0.576,1.0) // 0x3B3570 color[9] LPINK (1.0,0.753,0.796,1.0) // 0x3B3580 color[6] PURPLE (0.58,0.0,0.827,1.0) // 0x3B3590 color[4] BLUE (0.0,0.0,1.0,1.0) // 0x3B35A0 color[5] CYAN (0.0,1.0,1.0,1.0) // 0x3B35B0 color[7] WHITE (1.0,1.0,1.0,1.0)
// --- Preset/config JSON keys (Ch.17/19) --- // 0x3B06F8 "Default" preset name (also used as JSON key, via 0x3B0AF8)
// --- FPS Overlay / PreventScreenshot extra --- // 0x3B0198 "FPSMonitor" / FPS module registrar tab label (inside main cheat overlay)
// ============================================================================ // SECTION 28 — COMPLETE IAT TABLE (all 75 entries) // ============================================================================ // IAT base: RVA 0xB1000 (file raw 0xAF600). Format: IAT[RVA] = function (DLL)
// Previously documented entries (Sections 9/24) plus newly added: // 0xB1148 SwitchToThread KERNEL32 spinlock backoff (if backoff<32) // 0xB1168 GetModuleFileNameExW PSAPI module path scanner full-path retrieval // 0xB1178 AllocConsole KERNEL32 Settings console toggle enable // 0xB1268 GetCurrentThreadId KERNEL32 stack cookie check (RVA 0xAC709) // 0xB1290 GetModuleHandleW KERNEL32 GABypass: L"GameAssembly.dll"; OsCheck: ntdll // 0xB1470 GetWindowLongPtrW USER32 overlay: read GWL_STYLE, GWL_EXSTYLE // 0xB1480 IsWindowVisible USER32 overlay: check game window visible // 0xB1490 GetClassNameA USER32 overlay: detect foreground window class (×3) // 0xB1510 IsIconic USER32 overlay: check not minimized // 0xB1518 SetForegroundWindow USER32 overlay: bring game to front on match // 0xB1570 DestroyWindow USER32 overlay: cleanup on loop exit // 0xB1588 SetWindowPos USER32 overlay: reposition to match game window // 0xB15A8 GetClientRect USER32 overlay: get inner client area // 0xB15B0 SetWindowLongW USER32 overlay: update window style ×2 // 0xB15F0 GetForegroundWindow USER32 overlay: check active foreground window // 0xB1640 UnregisterClassW USER32 overlay: cleanup window class on exit // 0xB1858 fread CRT config file read (called ONLY from 0x12121) // 0xB1880 __stdio_common_vsscanf CRT theme color parser (RRGGBBAA hex→RGBA) // 0xB1890 _wfopen CRT config file open (called ONLY from 0x11F93) // 0xB1898 fseek CRT config seek (from 0x120BC, 0x120E7) // 0xB1920 DwmGetWindowAttribute DWMAPI overlay: DWMWA_EXTENDED_FRAME_BOUNDS rect
// ============================================================================ // SECTION 29 — IMGUI HELPER RVAs (inline functions used throughout modules) // ============================================================================ // ImGui wrapper functions used by module Render() bodies (not in main RVA namespace)
namespace RVA { constexpr u32 ImGui_CollapsingHeader = 0x06EC20; // lightweight wrapper; checks ImGuiCtx+0x106 locked flag constexpr u32 ImGui_Checkbox_commit = 0x061FE0; // checkbox state commit helper constexpr u32 ImGui_Separator_cursor = 0x070630; // Separator + cursor Y adjust constexpr u32 ImGui_AddText_colored = 0x051580; // drawlist AddText with explicit color constexpr u32 FPS_string_builder = 0x07F5C0; // "FPS: " + int → display string constexpr u32 Str_compare_helper = 0x0ACA12; // internal string compare (wchar/char) constexpr u32 ImGui_EndDisabled_path = 0x0ACA1F; // EndDisabled via ImGuiCtx+0x27F0 decrement }
// ImGuiContext field offsets referenced in cheat code: // [ImGuiContext+0x106] locked_input_flag (BYTE) — CollapsingHeader disabled check // [ImGuiContext+0x15D8] foreground_drawlist — FPS overlay drawlist ptr (+0x40 = draw cmds) // [ImGuiContext+0x27F0] EndDisabled_counter (WORD) — decremented on EndDisabled call // [ImGuiContext+0x2900] save_to_disk_flag (set=1 by manual save trigger 0x17072) // [ImGuiContext+0x2904] save_timer (set=0 by manual save trigger) // [ImGuiContext+0x2910] custom IniFilename (ptr; config save path source) // [ImGuiContext+0x2920] settings_handlers (dynamically-grown array of 0x48-byte structs)
// ============================================================================ // SECTION 30 — D3D11 SHADER SOURCE (Ch.5) // ============================================================================ // Both shaders are stored as raw HLSL text in .rdata and compiled at runtime // via D3DCompile (IAT[0xB1000]) during D3D11Init (RVA 0x54DC0/0x551E8).
// Vertex shader (RVA 0x3AE660, 733 bytes, "main"/"vs_4_0"): static const char* VS_HLSL_SOURCE_RVA = "0x3AE660"; // marker only — see comment // cbuffer vertexBuffer : register(b0) { float4x4 ProjectionMatrix; }; // struct VS_INPUT { float2 pos:POSITION; float4 col:COLOR0; float2 uv:TEXCOORD0; }; // struct PS_INPUT { float4 pos:SV_POSITION; float4 col:COLOR0; float2 uv:TEXCOORD0; }; // PS_INPUT main(VS_INPUT input) { // PS_INPUT output; // output.pos = mul(ProjectionMatrix, float4(input.pos.xy, 0.f, 1.f)); // output.col = input.col; output.uv = input.uv; // return output; }
// Pixel shader (RVA 0x3AE940, 401 bytes, "main"/"ps_4_0"): static const char* PS_HLSL_SOURCE_RVA = "0x3AE940"; // marker only — see comment // struct PS_INPUT { float4 pos:SV_POSITION; float4 col:COLOR0; float2 uv:TEXCOORD0; }; // sampler sampler0; Texture2D texture0; // float4 main(PS_INPUT input) : SV_Target { // return input.col * texture0.Sample(sampler0, input.uv); }
// Shader init sequence (RVA 0x54DC0): // load g_D3DState from [g_Config+0xD8] → R14 // check already-init: cmp (*r14), null; je skip // call 0x551F0 (create vertex/index buffers) // D3DCompile(0x3AE660, 0x2DD, NULL,NULL,NULL, "main","vs_4_0",0,0,...) → vertex blob // D3DCompile(0x3AE940, 0x191, NULL,NULL,NULL, "main","ps_4_0",0,0,...) → pixel blob
// ============================================================================ // END OF RECONSTRUCTION HEADERS // ============================================================================
// ============================================================================ // SECTION 31 — COMPLETE .DATA ADDRESS MAP (SUPPLEMENTAL) // ============================================================================ // All 97 .data offsets documented across all chapters, with absolute VAs and // semantic descriptions. Base: .data = 0x1803C5000 (RVA 0x3C5000)
// --- Module dispatch fn ptr state blocks (vtable[+0x18] accessor targets) --- // Each module's vtable[+0x18] stub returns the module's .data state block. // At offset [+0x00] of that block is the actual Render/Update fn ptr written // by RegisterTab. The ModuleManager dispatch loop calls stub → gets this ptr → calls it. // // [.data+0x0530] FpsOverlay state block → fn ptr (overlay render) // [.data+0x0580] PlayerProfile state block → fn ptr // [.data+0x0630] SetDither state block → fn ptr (no-op stub 0x83DC0) // [.data+0x06D0] NoClip state block → fn ptr // [.data+0x0770] SkillHack state block → fn ptr (hook installer) // [.data+0x07D0] FreeCam state block → fn ptr
// --- RTTI / module name strings (.data) --- // [.data+0x0590]–[.data+0x0E60] 11 module RTTI class descriptors // (ESPModule, FPSModule, FpsUnlocker, FreeCam, NoClip, PlayerProfile, // PreventScreenshot, SetDither, SkillHack, Vacuum, UnityExplorerModule)
// --- Panel state init config block (.data, written by DispatchRegistrarInit) --- // [.data+0x1F08] panel_config_src_A (16 bytes) — source for movups xmm0 // [.data+0x1F18] panel_config_src_B (16 bytes) — source for movups xmm1 // [.data+0x1F28] panel_config_dst_A (16 bytes) — dest: initial panel state copy // [.data+0x1F38] panel_config_dst_B (16 bytes) — dest: initial panel state copy
// --- ESPModule singleton — absolute .data field addresses --- // Base: [.data+0x1F70] VA 0x1803C6F70 // // [.data+0x1F70] QWORD vtable ptr (pre-init: 0x3AFA38; post-init: 0x3AF9E0) // [.data+0x1F78] STRING name = "ESPModule" (SSO std::string, RVA 0x3AF828) // [.data+0x1F98] BYTE enabled = 0 // [.data+0x1FA0] DWORD max_draw_distance = 300 (0x12C) // [.data+0x1FA4] BYTE show_monsters = 1 // [.data+0x1FA5] BYTE show_npc = 1 // [.data+0x1FA6] BYTE show_friendly = 1 // [.data+0x1FA7] BYTE show_puzzles = 1 // [.data+0x1FA8] BYTE show_all = 0 // [.data+0x1FA9] BYTE show_distance = 1 // [.data+0x1FAA] BYTE show_name = 1 // [.data+0x1FAB] BYTE reserved = 0 // [.data+0x1FAC] BYTE show_type = 0 // [.data+0x1FB0] XMMWD color[0] RED (1.00, 0.00, 0.00, 1.00) — Enemies // [.data+0x1FC0] XMMWD color[1] ORANGE (1.00, 0.65, 0.00, 1.00) — Interactive/NPC // [.data+0x1FD0] XMMWD color[2] YELLOW (1.00, 1.00, 0.00, 1.00) — spare // [.data+0x1FE0] XMMWD color[3] GREEN (0.00, 1.00, 0.00, 1.00) — Friendly // [.data+0x1FF0] XMMWD color[4] BLUE (0.00, 0.00, 1.00, 1.00) — NPC/spare // [.data+0x2000] XMMWD color[5] CYAN (0.00, 1.00, 1.00, 1.00) — spare // [.data+0x2010] XMMWD color[6] PURPLE (0.58, 0.00, 0.83, 1.00) — spare // [.data+0x2020] XMMWD color[7] WHITE (1.00, 1.00, 1.00, 1.00) — spare // [.data+0x2030] XMMWD color[8] PINK (1.00, 0.08, 0.58, 1.00) — spare // [.data+0x2040] XMMWD color[9] LPINK (1.00, 0.75, 0.80, 1.00) — spare // (color[10] BLACK and color[11] GRAY not stored separately; loaded from .rdata at runtime) // Note: Color slots 2,5,6,8,9 are spare palette entries with no current entity type mapping. // Slots 0,1,3,4 map to Enemies/Interactive/Friendly/NPC respectively.
// --- FPSModule singleton --- // [.data+0x22E0] QWORD FPSModule singleton ptr VA 0x1803C72E0 // [.data+0x22E8] STRING name = "FPS Monitor" (SSO std::string) // [.data+0x2308] BYTE enabled = 0 // [.data+0x2310] QWORD once_flag (std::once_flag, guards Initialize RVA 0x814C0)
// --- PreventScreenshot singleton --- // [.data+0x2358] QWORD PreventScreenshot singleton ptr VA 0x1803C7358 // [.data+0x2360] STRING name = "Prevent Screenshot" (SSO std::string) // [.data+0x2380] BYTE enabled = 0 // [.data+0x2388] BYTE second_toggle_flag = 0 // [.data+0x2390] QWORD once_flag (guards Initialize RVA 0x8AD70) // [.data+0x24D0] QWORD hook/window list head (linked list; nodes have HWND at [+0x10]) // [.data+0x24F0] DWORD cached OSVERSIONINFOEXW.dwBuildNumber (from memcpy of RtlGetVersion) // [.data+0x24FC] DWORD cached OS build number (same value, second copy for comparison)
// --- UnityExplorer module --- // [.data+0x260C] QWORD once_flag (guards RegisterTab RVA 0x90060) // [.data+0x2610] QWORD update_fn_ptr = 0x083DC0 (shared no-op stub) // [.data+0x2618] STRING tab_string = "Unity Explorer" (std::string) // [.data+0x2638] BYTE enabled = 0 // [.data+0x2640] BOOL auto_refresh = 0 // [.data+0x2644] float refresh_interval = 3.0f (0x40400000) // [.data+0x2648] QWORD* scene_list_begin = NULL // [.data+0x2650] QWORD* scene_list_end = NULL // [.data+0x2660] QWORD* scene_list_cap = NULL // [.data+0x2670] DWORD selected_scene_idx = 0 // [.data+0x2680] DWORD selected_obj_idx = 0 // [.data+0x2684] char[0x100] search_filter = "" (zero-filled) // [.data+0x2784] BOOL inspector_active = 0 // [.data+0x2788] QWORD inspected_obj_ptr = 0 // [.data+0x2790] STRING inspected_obj_name = "" (std::string)
// ============================================================================ // SECTION 32 — MAGIC CONSTANTS AND IEEE 754 VALUES // ============================================================================
// --- IEEE 754 float constants --- static_assert(sizeof(float) == 4, "float must be 32-bit");
// 0x41F00000 = 30.0f — FreeCam Move Speed default // 0x3DCCCCCD = 0.1f — FreeCam Move Speed / Roll Speed / FOV Speed step // 0x42C80000 = 100.0f — FreeCam Roll Speed max; SkillHack CooldownBypass return value // 0x43FA0000 = 500.0f — FreeCam Move Speed max // 0x40400000 = 3.0f — UnityExplorer auto-refresh interval default // 0x3F800000 = 1.0f — HookManager load factor threshold; FreeCam FOV multiplier default // 0x42960000 = 75.0f — FreeCam Look Sensitivity default // 0x44415357 = (reinterpret: packed 'WASD' ASCII) — FreeCam default key binding word
// --- FreeCam default key binding block --- // Written to [.data+0x2230..0x225E] by FreeCam::RegisterMainTab: // [+0x2230..0x223F] = [0x1803B34F0] (key config block 1, 16 bytes) // [+0x2240..0x224F] = [0x1803B35C0] (key config block 2, 16 bytes) // [+0x2250] = 0x3F800000 (1.0f — FOV multiplier) // [+0x2254] = 0x44415357 ('WASD' key mask) // [+0x2258] = 0x6D6BA220 (additional keybind data) // [+0x225C] = 0x2725 (two-byte keybind word) // [+0x225E] = 0x60 (backtick key — FreeCam toggle)
// --- Security cookie --- // Stack canary magic value (lower 48 bits): 0x2B992DDFA232 // Full XOR combination of: GetSystemTimeAsFileTime, GetCurrentThreadId, // GetCurrentProcessId, QueryPerformanceCounter (see Ch.4 / Section 4) // Checked at RVA 0x0AC6CC by __security_check_cookie (CRT standard)
// --- Windows version constants --- // 0x4A61 = 19041 decimal — Windows 10 Build 19041 (20H1) // Used in PreventScreenshot::OsCheck to select WDA_MONITOR vs WDA_EXCLUDEFROMCAPTURE: // build < 19041: SetWindowDisplayAffinity(..., 1) // WDA_MONITOR // build >= 19041: SetWindowDisplayAffinity(..., 0x11) // WDA_EXCLUDEFROMCAPTURE
// --- Hash constants --- // FNV-1a 64-bit (used in HookManager hash table): // Offset basis: 0xCBF29CE484222325ULL // Prime: 0x00000100000001B3ULL // (See Section 8 / Ch.8.7 for unrolled implementation at RVA 0x8D555)
// --- CP_UTF8 --- // 0xFDE9 = 65001 = CP_UTF8 // Used in: MultiByteToWideChar calls in OpenConfigFile (0x11EA0), // SetConsoleOutputCP (startup), UTF8ToWide helper (0x8B4E0)
// --- Module object sizes --- // BaseModule object size: 0x30 bytes (used by operator delete in NoOpUpdateStub) // FPSModule object size: 0xD8 bytes (zeroed by memset 0xAC86A in Initialize) // PreventScreenshot object size: 0x48 bytes (from vtable dtor stub size arg) // UnityExplorer state block size: 0x190 bytes (zero-filled in RegisterTab) // FreeCam state block size: 0xD8 bytes (zeroed in RegisterMainTab) // HookEntry size: 0x38 bytes (stride in hook_array) // HookManager singleton size: 0x90 bytes // ModuleManager registrar stride: 0x60 bytes per slot // ImGui settings handler size: 0x48 bytes per handler struct // THREADENTRY32 size: 28 (sizeof: written as r12d = [rbx+0x1C]) // OSVERSIONINFOEXW size: 0x11C bytes (stack-allocated in OsCheck)
// --- HookManager array constants --- // Initial hook array capacity: 0x80 slots // Shrink threshold: count <= capacity/2 AND count > 0x20 // Load factor threshold: 1.0f (0x3F800000) — triggers hash table rehash
// --- SkillHack callback return constants --- // 0x42C80000 = 100.0f returned by Callback_CooldownBypass (RVA 0x8D500) // stored at .rdata RVA 0x3B3308 // Note: prior summary incorrectly stated 0.0; doc confirms 100.0f
// ============================================================================ // SECTION 33 — IAT SUPPLEMENTAL ENTRIES (Ch.19 / final resolution) // ============================================================================ // Additional IAT entries resolved in Ch.19 not previously in header: // IAT[0xB1278] VirtualFree KERNEL32 hook manager cleanup // IAT[0xB1288] VirtualProtect KERNEL32 hook patcher (Ch.8.6) // IAT[0xB1628] ShowWindow USER32 Settings console toggle visibility // IAT[0xB1868] fwrite CRT config body (0xEA1B, 0x170D6, 0x3033B, 0x3076D) // IAT[0xB1870] fclose CRT (0xEAB0, 0x1212F, 0x121A9, 0x170DF)
// ============================================================================ // END SUPPLEMENTAL SECTIONS // ============================================================================
// ============================================================================ // SECTION 34 — FINAL FIVE .DATA ADDRESSES // ============================================================================
// [.data+0x2180] QWORD SetDither update fn ptr = 0x1803B01B0 → 0x83DC0 (no-op stub) // Written by SetDither::RegisterTab (RVA 0x181810)
// [.data+0x2307] BYTE End of FPSModule name std::string SSO buffer // Name "FPS Monitor" occupies [.data+0x22E8]..[.data+0x2307] // (19 chars + null = 20 bytes; SSO inline storage)
// [.data+0x237F] BYTE End of PreventScreenshot name std::string SSO buffer // Name "Prevent Screenshot" occupies [.data+0x2360]..[.data+0x237F] // +0x28 field = enabled BYTE (checkbox state; drives affinity arg)
// [.data+0x245C] BYTE g_showPanel — overlay panel visibility flag // 0 = hidden, 1 = visible // Toggled by VK_F12 (0x7B) poll at RVA 0x8301A (GetAsyncKeyState) // Banner shown when hidden: "EF - Cheeto ... Press F12" (RVA 0x3AF258)
// [.data+0x24D8] QWORD PreventScreenshot HWND list count / tracked window count // Companion to [.data+0x24D0] (linked list head) // Used in Update affinity application loop (RVA 0x8AFC0)
COMPLETE IMPORT TABLE — EF-Cheeto.dll
All imported DLLs and functions needed for Visual Studio .def / linker
These must ALL be linked in the VS project
KERNEL32.dll (76 functions)
VirtualAlloc VirtualFree VirtualProtect VirtualQuery GetCurrentProcess GetCurrentProcessId GetCurrentThreadId CreateThread TerminateThread SuspendThread ResumeThread OpenThread CloseHandle GetLastError GetProcAddress LoadLibraryA FreeLibrary GetModuleHandleA GetModuleHandleW FlushInstructionCache SetThreadContext GetThreadContext MultiByteToWideChar WideCharToMultiByte GlobalAlloc GlobalFree GlobalLock GlobalUnlock HeapCreate HeapAlloc HeapFree HeapReAlloc HeapDestroy AllocConsole FreeConsole GetConsoleMode SetConsoleMode GetConsoleWindow GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleOutputCP SetConsoleTitleA GetStdHandle CreateToolhelp32Snapshot Thread32First Thread32Next K32EnumProcessModules K32GetModuleFileNameExW Sleep OutputDebugStringA GetSystemInfo DisableThreadLibraryCalls QueryPerformanceCounter QueryPerformanceFrequency GetLocaleInfoA IsDBCSLeadByte VerSetConditionMask GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind LocalFree FormatMessageA GetLocaleInfoEx AreFileApisANSI ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WakeAllConditionVariable InitializeSListHead memmove
USER32.dll (67 functions)
CreateWindowExW DestroyWindow RegisterClassExW UnregisterClassW DefWindowProcW PeekMessageW TranslateMessage DispatchMessageW PostQuitMessage UpdateWindow GetClientRect GetWindowRect GetWindowLongW GetWindowLongPtrW SetWindowLongW SetWindowLongPtrW SetWindowPos ShowWindow BringWindowToTop IsIconic IsWindow IsWindowVisible IsWindowUnicode IsChild FindWindowA EnumWindows GetForegroundWindow SetForegroundWindow SetFocus GetCursorPos SetCursorPos GetCapture SetCapture ReleaseCapture GetAsyncKeyState GetKeyState GetKeyboardLayout GetMessageExtraInfo TrackMouseEvent ClientToScreen ScreenToClient WindowFromPoint GetDC ReleaseDC GetDeviceCaps CreateSolidBrush LoadCursorW LoadIconW SetCursor EnumDisplayMonitors GetMonitorInfoW MonitorFromWindow GetSystemMetrics GetClassNameA GetWindowThreadProcessId AdjustWindowRectEx OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetPropA SetPropA SetLayeredWindowAttributes SetWindowDisplayAffinity GetWindowDisplayAffinity SetProcessDPIAware
GDI32.dll/SHELL32.dll (1 functions)
ShellExecuteW
imm32.dll (4 functions)
ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow
d3d11.dll (1 functions)
D3D11CreateDeviceAndSwapChain
d3dcompiler_47.dll (1 functions)
D3DCompile
dwmapi.dll (2 functions)
DwmExtendFrameIntoClientArea DwmGetWindowAttribute
xinput1_4.dll (2 functions)
XInputGetState XInputGetCapabilities
ntdll.dll (2 functions)
RtlGetVersion RtlVerifyVersionInfo
shcore.dll (3 functions)
SetThreadDpiAwarenessContext SetProcessDpiAwareness GetDpiForMonitor
api-ms-win-crt-*.dll (CRT) (62 functions)
malloc calloc free realloc memcmp memcpy memset memchr memmove strcmp strncmp strncpy strchr strtod strtoll strtoull atof tolower fopen fclose fread fwrite ftell fseek fflush freopen_s _wfopen qsort localeconv __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __acrt_iob_func ___lc_codepage_func _errno _localtime64_s acosf ceilf cosf fmodf logf powf sinf sqrtf _dclass _dsign _fdclass _fdsign _ldclass _ldsign _callnewh _seh_filter_dll _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _initterm _initterm_e terminate
vcruntime140.dll / vcruntime140_1.dll (11 functions)
__CxxFrameHandler4 __C_specific_handler _CxxThrowException __std_terminate __std_exception_copy __std_exception_destroy __current_exception __current_exception_context __std_type_info_destroy_list _invoke_watson _purecall
msvcp140.dll (5 functions)
_Mtx_lock _Mtx_unlock _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency