www

2026-03-08 16:19:24 -06:00
1 parent 3933cd1901
commit 0aa65c433d
@@ -0,0 +1,6 @@
+# EF-Cheeto PE headers (DOS+PE+COFF+Optional+SectionTable)
+# Size: 1024 bytes
+# ImageBase: 0x180000000
+# To decode: import base64; data = base64.b64decode(open(this).read().split('\n',5)[-1])
+
+TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA+AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAADPDnkji28XcItvF3CLbxdwgheEcJ9vF3AM5hRxj28XcAzmE3GDbxdwDOYScZVvF3AM5hZxg28XcPLuFnGabxdwi28WcA5uF3Ae5h5xu28XcB7m6HCKbxdwHuYVcYpvF3BSaWNoi28XcAAAAAAAAAAAAAAAAAAAAABQRQAAZIYIABlnOWkAAAAAAAAAAPAAIiALAg4sAPIKAAD8MQAAAAAAxMEKAAAQAAAAAACAAQAAAAAQAAAAAgAABgAAAAAAAAAGAAAAAAAAAABQPQAABAAAAAAAAAIAYAEAABAAAAAAAAAQAAAAAAAAAAAQAAAAAAAAEAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAsITwAuAEAAAAwPQD4AAAAAIA8AGhtAAAAAAAAAAAAAABAPQBsCQAAcDc7ADgAAAAAAAAAAAAAAAAAAAAAAAAAADg7ACgAAAAwNjsAQAEAAAAAAAAAAAAAABALADAJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAAKfxCgAAEAAAAPIKAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAAC0NTEAABALAAA2MQAA9goAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAA8CcAAABQPAAAFgAAACw8AAAAAAAAAAAAAAAAAEAAAMAucGRhdGEAAGhtAAAAgDwAAG4AAABCPAAAAAAAAAAAAAAAAABAAABALmRldG91cmPAIQAAAPA8AAAiAAAAsDwAAAAAAAAAAAAAAAAAQAAAQC5kZXRvdXJkGAAAAAAgPQAAAgAAANI8AAAAAAAAAAAAAAAAAEAAAMAucnNyYwAAAPgAAAAAMD0AAAIAAADUPAAAAAAAAAAAAAAAAABAAABALnJlbG9jAABsCQAAAEA9AAAKAAAA1jwAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
@@ -0,0 +1,122 @@
+# EF-Cheeto Reconstruction System Prompt
+# Give this + the feed document to an AI for perfect reconstruction.
+
+You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto 
+game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete 
+analysis document covering all 29 chapters of binary analysis plus a full 
+reconstruction header file. Use these to answer any reconstruction question.
+
+## Binary Identity
+- File: EF-Cheeto.dll  
+- Size: 3,956,736 bytes (0x3CE000)
+- Base VA: 0x180000000
+- .data base: 0x1803C5000 (RVA 0x3C5000)
+- .rdata strings base: ~0x3A0000–0x3B4000
+- IAT base: RVA 0xB1000
+- Architecture: x86-64 Windows DLL (PE32+)
+- Compiler: MSVC (x64 Release, C++17)
+- Project path: E:\git\Endfield_Cheeto\
+
+## What You Know (Summary)
+
+### Module System (10 active modules + 1 ghost)
+1. ESPModule       — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
+2. FPSModule       — FPS counter overlay + FPS cap unlocker  
+3. NoClip          — CharacterController.enabled toggle + move speed
+4. FreeCam         — CinemachineBrain camera override with WASD+mouse
+5. FpsUnlocker     — Application.set_targetFrameRate bypass (default 300fps)
+6. SetDither       — graphics dither toggle (stub, no per-frame effect)
+7. PlayerProfile   — Unity UI TextMeshPro text injection (UID + name changer)
+8. Vacuum          — Rigidbody.AddForce attraction loop
+9. SkillHack       — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
+10. UnityExplorer  — runtime Unity scene browser + GO/component inspector
+11. DamageHack     — GHOST FEATURE: i18n keys exist, zero code
+
+### Key Subsystems
+- GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
+- HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
+- ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
+- D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
+- Config: ImGui .ini persistence (no separate JSON config file)
+- i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
+- Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
+- Thread safety: Toolhelp32 snapshot suspension around all code patches
+
+### Critical Addresses (quick reference)
+- DllMain:             RVA 0x01000
+- LoaderThread:        RVA 0x05000  
+- Startup_main:        RVA 0x0A9190
+- GABypass::Patch:     RVA 0x09D1E0
+- ModuleManager::Init: RVA 0x09AC10
+- HookMgr::CreateHook: RVA 0x0A9CC8
+- OverlayWindowInit:   RVA 0x0827A0
+- WndProc:             RVA 0x0826A0
+- ESPModule singleton: VA 0x1803C6F70
+- HookManager single:  VA 0x1803C7470
+- IL2CPP table start:  [.data+0x1C48]
+- g_Config base:       [.data+0x1C00]
+
+## How to Use This Document
+- PART A contains all pseudocode, behavioral descriptions, and data tables
+- PART B contains the compilable reconstruction header with all addresses
+- For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
+- For any struct: PART B has the layout; PART A has the behavioral context
+- For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
+- For string RVAs: PART B Section 27 has all 189 .rdata strings
+
+Answer reconstruction questions by citing specific RVAs, field offsets, and 
+pseudocode from the document. When writing reconstructed C++, use the exact 
+struct layouts and address constants from PART B.
+
+
+================================================================================
+CONFIRMED IMGUI BUILD INFORMATION
+================================================================================
+
+## ImGui Version
+- Repository: https://github.com/ocornut/imgui (docking branch)
+- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
+- Version: Dear ImGui 1.92.6 WIP (19253)
+- Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)
+
+## Source Files Compiled Into Binary
+- imgui.cpp
+- imgui_draw.cpp
+- imgui_tables.cpp
+- imgui_widgets.cpp
+- imgui_demo.cpp — NOT compiled in (absent from binary)
+- backends/imgui_impl_win32.cpp
+- backends/imgui_impl_dx11.cpp
+
+## Build Configuration
+- NDEBUG defined (release build — zero IM_ASSERT strings in binary)
+- MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
+- PE compile timestamp: 2025-12-10 12:27:05 UTC
+- No custom imconfig.h overrides detected
+- Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
+- No imgui_freetype, no imgui_demo
+
+## ImGui Code Footprint in Binary
+- .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
+- Cheat-specific code begins at approximately RVA 0x7F000
+- Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
+- DX11 backend shader init: RVA 0x54DC0
+- DX11 backend resource creation: RVA 0x551F0
+- ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
+- IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A
+
+## Project Source Tree (from MSVC __FILE__ embeds)
+- E:\git\Endfield_Cheeto\framework\helpers.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
+- E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
+- E:\git\Endfield_Cheeto\user\main.cpp
+
+## To Reproduce Build
+  git clone https://github.com/ocornut/imgui
+  git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0
+  # Compile with MSVC 14.44, /O2, NDEBUG, x64
+  # Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp
+  # Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp
+  # No custom imconfig.h needed
@@ -0,0 +1,9 @@
+# EF-Cheeto binary section: .data
+# RVA: 0x3c5000
+# Size: 5,632 bytes
+# Raw offset in original DLL: 0x3c2c00
+# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__data.b64').read().split('\n',5)[-1])
+# ImageBase: 0x180000000
+# VA = ImageBase + RVA
+
+AAAAgP////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADKi3y2ZKwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADNXSDSZtT/////////////AQAAAAIAAAAAAAgAAAAAAAAAAAIAAAAAdZgAAAAAAAABAAAAAAAAACBEDYABAAAAAwAAAAAAAABYRA2AAQAAAAcAAAAAAAAAAAAAAAAAAADQBjuAAQAAAAABAQABAAAAAAAAAAAAAAAAAAAAAAAAAKWqpbilqqWqpbiluKW4pbjAwMDAwMDAwKzAzMChoaGhsaWlpsDA19rgwOTA6urg4JjI7vGl06WloeqewMDCwOYDfxF/AX8BPwEBq4uQZFtbW1tbkltbdpCSkltbW1tbW1tbW1tbW2pzkFtSUlJSW1tbW3d8d4VbW3Bbeq92dltbW1tbW1tbW1tbhgEDAQQD1QPVA8wBvAPwAwMEAFBQUFD/ICAgIAEBAQHEAhD///8BAAMR/wPExsgCEAD/zAEBAQAAAAABAQMB///AwhARAgMBAQH///8AAAD/AAD/////EBAQEAIQAADGyAICAgIGAAQAAv8AwMIBAQMDA8pAAAoABAAAAAB/ADMBAAAAAAAA/7///wAAAAAHAAD/AAAAAAAAAAAAAAAAAAD//wAAAL8AAAAAAAAAAH8AAP9AQEBAQUlAQEBATEJAQEBAQEBAQE9EU0BAQERXQ1xAYEBAQEBAQEBAQEBAQEBAZGZua0BAakZAQERGQEBbREBAAAAAAAYGBgYBBgYCBgYABgAKCgAAAAIHBwYCDQYGBg4FBQICAAAEBAQEBQYGBgAAAA4AAAgAEAAYACAAKAAwAIABggGGAPbP/j+rALAAsQCzALr4uwDAAMEAx79i/wCN/wDE/wDF/wD//+sB/w4SCAATCQAWCAAXCQArCQCu/wey/wC0/wC1/wDDAQDH/7/nCADwAgAAAAAAAAAAdGVzdHlpcAAAAAAAAAAAAAcAAAAAAAAADwAAAAAAAABnYXRtcC50bXAAAAAAAAAACQAAAAAAAAAPAAAAAAAAAEVGLUNoZWV0by5kbGwAAAANAAAAAAAAAA8AAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVmZvcm1hdF9lcnJvckBzdGRAQAAAaBENgAEAAAAAAAAAAAAAAC4/QVZiYWRfY2FzdEBzdGRAQAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWc3lzdGVtX2Vycm9yQHN0ZEBAAABoEQ2AAQAAAAAAAAAAAAAALj9BVl9TeXN0ZW1fZXJyb3JAc3RkQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZydW50aW1lX2Vycm9yQHN0ZEBAAGgRDYABAAAAAAAAAAAAAAAuP0FWYmFkX2FycmF5X25ld19sZW5ndGhAc3RkQEAAAGgRDYABAAAAAAAAAAAAAAAuP0FWYmFkX2FsbG9jQHN0ZEBAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVmV4Y2VwdGlvbkBzdGRAQAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wRnBzVW5sb2NrZXJSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wU2V0RGl0aGVyUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPGxhbWJkYV8xPkA/MT8/PzBOb0NsaXBSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY8bGFtYmRhXzE+QD8xPz8/MFVuaXR5RXhwbG9yZXJNb2R1bGVSZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY8bGFtYmRhXzE+QD8xPz8/MEZyZWVDYW1SZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wRVNQTW9kdWxlUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPGxhbWJkYV8xPkA/MT8/PzBWYWN1dW1SZWdpc3RyYXJAP0EweGUxYjRjOTA5QEBRRUFBQFhaQAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY8bGFtYmRhXzE+QD8xPz8/MEZQU01vZHVsZVJlZ2lzdHJhckA/QTB4ZTFiNGM5MDlAQFFFQUFAWFpAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wUGxheWVyUHJvZmlsZVJlZ2lzdHJhckA/QTB4ZTFiNGM5MDlAQFFFQUFAWFpAAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVjxsYW1iZGFfMT5APzE/Pz8wU2tpbGxIYWNrUmVnaXN0cmFyQD9BMHhlMWI0YzkwOUBAUUVBQUBYWkAAAGgRDYABAAAAAAAAAAAAAAAuP0FWcmFuZ2VfZXJyb3JAc3RkQEAAAAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWb3RoZXJfZXJyb3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZleGNlcHRpb25AZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVmludmFsaWRfaXRlcmF0b3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWcGFyc2VfZXJyb3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZvdXRfb2ZfcmFuZ2VAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVnR5cGVfZXJyb3JAZGV0YWlsQGpzb25fYWJpX3YzXzEyXzBAbmxvaG1hbm5AQAAAAAAAAAAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWdHlwZV9pbmZvQEAAaBENgAEAAAAAAAAAAAAAAC4/QVVfRm10X2J1ZmZlcl90cmFpdHNAc3RkQEAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JF9GbXRfaXRlcmF0b3JfYnVmZmVyQFY/JGJhY2tfaW5zZXJ0X2l0ZXJhdG9yQFY/JGJhc2ljX3N0cmluZ0BEVT8kY2hhcl90cmFpdHNAREBzdGRAQFY/JGFsbG9jYXRvckBEQDJAQHN0ZEBAQHN0ZEBARFVfRm10X2J1ZmZlcl90cmFpdHNAMkBAc3RkQEAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JF9GbXRfYnVmZmVyQERAc3RkQEAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVY/JG51bXB1bmN0QERAc3RkQEAAAGgRDYABAAAAAAAAAAAAAAAuP0FWZmFjZXRAbG9jYWxlQHN0ZEBAAABoEQ2AAQAAAAAAAAAAAAAALj9BVl9GYWNldF9iYXNlQHN0ZEBAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVVfQ3J0X25ld19kZWxldGVAc3RkQEAAAAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZfU3lzdGVtX2Vycm9yX2NhdGVnb3J5QHN0ZEBAAAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVl9HZW5lcmljX2Vycm9yX2NhdGVnb3J5QHN0ZEBAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWZXJyb3JfY2F0ZWdvcnlAc3RkQEAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWRVNQTW9kdWxlQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZCYXNlTW9kdWxlQEAAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWRlBTTW9kdWxlQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZGcHNVbmxvY2tlckBAAAAAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWRnJlZUNhbUBAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZOb0NsaXBAQAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVlBsYXllclByb2ZpbGVAQAAAAAAAaBENgAEAAAAAAAAAAAAAAC4/QVZQcmV2ZW50U2NyZWVuc2hvdEBAAGgRDYABAAAAAAAAAAAAAAAuP0FWU2V0RGl0aGVyQEAAaBENgAEAAAAAAAAAAAAAAC4/QVZTa2lsbEhhY2tAQABoEQ2AAQAAAAAAAAAAAAAALj9BVlVuaXR5RXhwbG9yZXJNb2R1bGVAQAAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVlZhY3V1bUBAAAAAAGgRDYABAAAAAAAAAAAAAAAuP0FWPyRfRnVuY19iYXNlQEFFQVZCYXNlTW9kdWxlQEAkJFZAc3RkQEAAAAAAAABoEQ2AAQAAAAAAAAAAAAAALj9BVj8Line truncated
@@ -0,0 +1,9 @@
+# EF-Cheeto binary section: .detourc
+# RVA: 0x3cf000
+# Size: 8,704 bytes
+# Raw offset in original DLL: 0x3cb000
+# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__detourc.b64').read().split('\n',5)[-1])
+# ImageBase: 0x180000000
+# VA = ImageBase + RVA
+
+/yIBAAAAAAAQAQGAAQAAAPYzAQEAAAAAEAEBgAEAAAD3RgEEAAAAABABAYABAAAAeCIBAAAAAAAQAQGAAQAAAAAAAAARJAAAAAAAABEkAAAAAAAAESQAAAAAAAARJAAAAAAAABEkAAAAAAAAESQAAAAAAAARJAAAAAAAABEkAAABAQEBAgEBAQEBAQECAQEBAQEBAQIBAQEBAQEBAgEBAQEBAQECAQEBAQEBAQIBAQEBAQEBAgEBAQEBAQECAQEBBAQEBAUEBAQEBAQEBQQEBAQEBAQFBAQEBAQEBAUEBAQEBAQEBQQEBAQEBAQFBAQEBAQEBAUEBAQEBAQEBQQEBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIgEAAAAAABABAYABAAAAASIBAAAAAAAQAQGAAQAAAAIiAQAAAAAAEAEBgAEAAAADIgEAAAAAABABAYABAAAABAAAAAAAAACABAGAAQAAAAURAAAAAAAAEAEBgAEAAAAGEQAAAAAAABABAYABAAAABxEAAAAAAAAQAQGAAQAAAAgRAAAAAAAAEAEBgAEAAAAJEQAAAAAAABABAYABAAAACgAAAAAAAACABAGAAQAAAAsRAAAAAAAAEAEBgAEAAAAMAAAAAAAAAIAEAYABAAAADSIBAAAAAAAQAQGAAQAAAA4RAAAAAAAAEAEBgAEAAAAPMwEBAAAAABABAYABAAAAECIBAAAAAAAQAQGAAQAAABEiAQAAAAAAEAEBgAEAAAASIgEAAAAAABABAYABAAAAEyIBAAAAAAAQAQGAAQAAABQiAQAAAAAAEAEBgAEAAAAVIgEAAAAAABABAYABAAAAFiIBAAAAAAAQAQGAAQAAABciAQAAAAAAEAEBgAEAAAAYIgEAAAAAABABAYABAAAAGSIBAAAAAAAQAQGAAQAAABoiAQAAAAAAEAEBgAEAAAAbIgEAAAAAABABAYABAAAAHCIBAAAAAAAQAQGAAQAAAB0iAQAAAAAAEAEBgAEAAAAeIgEAAAAAABABAYABAAAAHyIBAAAAAAAQAQGAAQAAACAiAQAAAAAAEAEBgAEAAAAhIgEAAAAAABABAYABAAAAIiIBAAAAAAAQAQGAAQAAACMiAQAAAAAAEAEBgAEAAAAkAAAAAAAAAIAEAYABAAAAJQAAAAAAAACABAGAAQAAACYAAAAAAAAAgAQBgAEAAAAnAAAAAAAAAIAEAYABAAAAKCIBAAAAAAAQAQGAAQAAACkiAQAAAAAAEAEBgAEAAAAqIgEAAAAAABABAYABAAAAKyIBAAAAAAAQAQGAAQAAACwiAQAAAAAAEAEBgAEAAAAtIgEAAAAAABABAYABAAAALiIBAAAAAAAQAQGAAQAAAC8iAQAAAAAAEAEBgAEAAAAwEQAAAAAAABABAYABAAAAMREAAAAAAAAQAQGAAQAAADIRAAAAAAAAEAEBgAEAAAAzEQAAAAAAABABAYABAAAANBEAAAAAAAAQAQGAAQAAADURAAAAAAAAEAEBgAEAAAA2AAAAAAAAAIAEAYABAAAANxEAAAAAAAAQAQGAAQAAADgzAgAAAAAAEAEBgAEAAAA5AAAAAAAAAIAEAYABAAAAOkQCAQAAAAAQAQGAAQAAADsAAAAAAAAAgAQBgAEAAAA8AAAAAAAAAIAEAYABAAAAPQAAAAAAAACABAGAAQAAAD4AAAAAAAAAgAQBgAEAAAA/AAAAAAAAAIAEAYABAAAAQCIBAAAAAAAQAQGAAQAAAEEiAQAAAAAAEAEBgAEAAABCIgEAAAAAABABAYABAAAAQyIBAAAAAAAQAQGAAQAAAEQiAQAAAAAAEAEBgAEAAABFIgEAAAAAABABAYABAAAARiIBAAAAAAAQAQGAAQAAAEciAQAAAAAAEAEBgAEAAABIIgEAAAAAABABAYABAAAASSIBAAAAAAAQAQGAAQAAAEoiAQAAAAAAEAEBgAEAAABLIgEAAAAAABABAYABAAAATCIBAAAAAAAQAQGAAQAAAE0iAQAAAAAAEAEBgAEAAABOIgEAAAAAABABAYABAAAATyIBAAAAAAAQAQGAAQAAAFAiAQAAAAAAEAEBgAEAAABRIgEAAAAAABABAYABAAAAUiIBAAAAAAAQAQGAAQAAAFMiAQAAAAAAEAEBgAEAAABUIgEAAAAAABABAYABAAAAVSIBAAAAAAAQAQGAAQAAAFYiAQAAAAAAEAEBgAEAAABXIgEAAAAAABABAYABAAAAWCIBAAAAAAAQAQGAAQAAAFkiAQAAAAAAEAEBgAEAAABaIgEAAAAAABABAYABAAAAWyIBAAAAAAAQAQGAAQAAAFwiAQAAAAAAEAEBgAEAAABdIgEAAAAAABABAYABAAAAXiIBAAAAAAAQAQGAAQAAAF8iAQAAAAAAEAEBgAEAAABgIgEAAAAAABABAYABAAAAYSIBAAAAAAAQAQGAAQAAAGIiAQAAAAAAEAEBgAEAAABjIgEAAAAAABABAYABAAAAZCIBAAAAAAAQAQGAAQAAAGUiAQAAAAAAEAEBgAEAAABmIgEAAAAAABABAYABAAAAZyIBAAAAAAAQAQGAAQAAAGgiAQAAAAAAEAEBgAEAAABpIgEAAAAAABABAYABAAAAaiIBAAAAAAAQAQGAAQAAAGsiAQAAAAAAEAEBgAEAAABsIgEAAAAAABABAYABAAAAbSIBAAAAAAAQAQGAAQAAAG4iAQAAAAAAEAEBgAEAAABvIgEAAAAAABABAYABAAAAcDMBAQAAAAAQAQGAAQAAAHEzAQEAAAAAEAEBgAEAAAByMwEBAAAAABABAYABAAAAczMBAQAAAAAQAQGAAQAAAHQiAQAAAAAAEAEBgAEAAAB1IgEAAAAAABABAYABAAAAdiIBAAAAAAAQAQGAAQAAAHcRAAAAAAAAEAEBgAEAAAB4AAAAAAAAAMAEAYABAAAAeSIBAAAAAAAQAQGAAQAAAHoAAAAAAAAAgAQBgAEAAAB7AAAAAAAAAIAEAYABAAAAfCIBAAAAAAAQAQGAAQAAAH0iAQAAAAAAEAEBgAEAAAB+IgEAAAAAABABAYABAAAAfyIBAAAAAAAQAQGAAQAAAIBVEAAAAAAAEAEBgAEAAACBVRAAAAAAABABAYABAAAAglUQAAAAAAAQAQGAAQAAAINVEAAAAAAAEAEBgAEAAACEVRAAAAAAABABAYABAAAAhVUQAAAAAAAQAQGAAQAAAIZVEAAAAAAAEAEBgAEAAACHVRAAAAAAABABAYABAAAAiFUQAAAAAAAQAQGAAQAAAIlVEAAAAAAAEAEBgAEAAACKVRAAAAAAABABAYABAAAAi1UQAAAAAAAQAQGAAQAAAIxVEAAAAAAAEAEBgAEAAACNVRAAAAAAABABAYABAAAAjlUQAAAAAAAQAQGAAQAAAI9VEAAAAAAAEAEBgAEAAACQIgEAAAAAABABAYABAAAAkSIBAAAAAAAQAQGAAQAAAJIiAQAAAAAAEAEBgAEAAACTIgEAAAAAABABAYABAAAAlCIBAAAAAAAQAQGAAQAAAJUiAQAAAAAAEAEBgAEAAACWIgEAAAAAABABAYABAAAAlyIBAAAAAAAQAQGAAQAAAJgiAQAAAAAAEAEBgAEAAACZIgEAAAAAABABAYABAAAAmiIBAAAAAAAQAQGAAQAAAJsiAQAAAAAAEAEBgAEAAACcIgEAAAAAABABAYABAAAAnSIBAAAAAAAQAQGAAQAAAJ4iAQAAAAAAEAEBgAEAAACfIgEAAAAAABABAYABAAAAoBEAAAAAAAAQAQGAAQAAAKERAAAAAAAAEAEBgAEAAACiEQAAAAAAABABAYABAAAAoyIBAAAAAAAQAQGAAQAAAKQzAQEAAAAAEAEBgAEAAAClIgEAAAAAABABAYABAAAApiIBAAAAAAAQAQGAAQAAAKciAQAAAAAAEAEBgAEAAACoEQAAAAAAABABAYABAAAAqREAAAAAAAAQAQGAAQAAAKoRAAAAAAAAEAEBgAEAAACrIgEAAAAAABABAYABAAAArDMBAQAAAAAQAQGAAQAAAK0iAQAAAAAAEAEBgAEAAACuIgEAAAAAABABAYABAAAAryIBAAAAAAAQAQGAAQAAALAiAQAAAAAAEAEBgAEAAACxIgEAAAAAABABAYABAAAAsiIBAAAAAAAQAQGAAQAAALMiAQAAAAAAEAEBgAEAAAC0IgEAAAAAABABAYABAAAAtSIBAAAAAAAQAQGAAQAAALYiAQAAAAAAEAEBgAEAAAC3IgEAAAAAABABAYABAAAAuCIBAAAAAAAQAQGAAQAAALkAAAAAAAAAgAQBgAEAAAC6MwEBAAAAABABAYABAAAAuyIBAAAAAAAQAQGAAQAAALwiAQAAAAAAEAEBgAEAAAC9IgEAAAAAABABAYABAAAAviIBAAAAAAAQAQGAAQAAAL8iAQAAAAAAEAEBgAEAAADAIgEAAAAAABABAYABAAAAwSIBAAAAAAAQAQGAAQAAAMIzAQEAAAAAEAEBgAEAAADDIgEAAAAAABABAYABAAAAxDMBAQAAAAAQAQGAAQAAAMUzAQEAAAAAEAEBgAEAAADGMwEBAAAAABABAYABAAAAxyIBAAAAAAAQAQGAAQAAAMgRAAAAAAAAEAEBgAEAAADJEQAAAAAAABABAYABAAAAyhEAAAAAAAAQAQGAAQAAAMsRAAAAAAAAEAEBgAEAAADMEQAAAAAAABABAYABAAAAzREAAAAAAAAQAQGAAQAAAM4RAAAAAAAAEAEBgAEAAADPEQAAAAAAABABAYABAAAA0CIBAAAAAAAQAQGAAQAAANEiAQAAAAAAEAEBgAEAAADSIgEAAAAAABABAYABAAAA0yIBAAAAAAAQAQGAAQAAANQiAQAAAAAAEAEBgAEAAADVIgEAAAAAABABAYABAAAA1iIBAAALine truncated
@@ -0,0 +1,9 @@
+# EF-Cheeto binary section: .pdata
+# RVA: 0x3c8000
+# Size: 28,160 bytes
+# Raw offset in original DLL: 0x3c4200
+# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__pdata.b64').read().split('\n',5)[-1])
+# ImageBase: 0x180000000
+# VA = ImageBase + RVA
+
+EBAAAOYYAAA86TsA8BgAABwZAADMWDsAQBkAAAwaAABEATwAEBoAANwaAABEATwA4BoAAKwbAABEATwAsBsAAHwcAABEATwAgBwAAEwdAABEATwAUB0AABweAABEATwAIB4AAOweAABEATwA8B4AALwfAABEATwAwB8AAIwgAABEATwAkCAAAFwhAABEATwAYCEAAI0hAADMWDsAoCEAAJYiAABgVjsAoCIAAHokAAD0VjsAgCQAAKAkAABIVzsAoCQAAMclAABUVzsAxyUAANElAAB0VzsA0SUAAN4lAACEVzsA4CUAAFImAACkVzsAYCYAAH8mAADAVzsAfyYAALsmAADIVzsAuyYAAMEmAADcVzsA0CYAAD0nAADsVzsAPScAAE4nAAAIWDsATicAAJknAAAcWDsAmScAAKonAAAwWDsAqicAAOgpAABAWDsA8CkAAD0sAABQWDsAPSwAAG0tAABkWDsAbS0AACwuAAB8WDsAMC4AAAgvAACMWDsAEC8AADw2AACoWDsAQDYAALw3AADMWDsAwDcAAPI3AADUWDsA8jcAAA07AADoWDsADTsAACI7AAAIWTsAIjsAAGM7AAAYWTsAYzsAAGg7AAAIWTsAaDsAANA7AAAYWTsA0DsAAO47AAA4WTsA8DsAAJQ+AADMWDsAoD4AAFdAAABAWTsAYEAAAOpAAACQWTsA8EAAAFdHAACgWTsAYEcAAKpKAAD4WTsAsEoAAAdRAAA0WjsAEFEAAGdXAAA0WjsAcFcAAJFXAAB4WjsAkVcAAKVXAACQWjsApVcAAOVXAACkWjsA5VcAAPNXAAC4WjsA81cAAHBYAADIWjsAcFgAAP5YAADYWjsA/lgAAHtaAAD0WjsAe1oAAJ1aAAAIWzsAoFoAANlaAAAYWzsA2VoAAHJbAAAoWzsAclsAAJ5bAABAWzsAoFsAAAZdAABQWzsAEF0AAKpeAABQWzsAsF4AAJhiAABcWzsAoGIAAJdkAACsWzsAoGQAAOhoAADcWzsA8GgAABdrAAAwXDsAIGsAAFhvAABgXDsAYG8AAKhzAACgXDsAsHMAANd1AADgXDsA4HUAABh6AAAQXTsAIHoAAN96AABQXTsA33oAAJl7AABoXTsAmXsAALZ7AAB8XTsAwHsAAN57AACMXTsA3nsAADl8AACcXTsAOXwAAE18AACwXTsAUHwAAH18AADAXTsAfXwAAIJ9AADcXTsAgn0AAPl9AAD0XTsAAH4AADx+AAAEXjsAPH4AAKZ/AAAkXjsApn8AACSAAAA4XjsAJIAAAEiAAABIXjsAUIAAABeCAABcXjsAIIIAAFyCAACAXjsAXIIAAJqDAACQXjsAmoMAAKCDAACwXjsAoIMAAM2DAADAXTsAzYMAANKEAADAXjsA0oQAAEmFAADYXjsAUIUAAH2FAADAXTsAfYUAAIKGAADoXjsAgoYAAPmGAAAAXzsAAIcAAC2HAADAXTsALYcAADKIAAAQXzsAMogAAKmIAAAoXzsAsIgAAAqMAAA4XzsAEIwAACSNAABcXzsAMI0AAEGNAADMWDsAUI0AAGSOAABcXzsAcI4AAIGOAADMWDsAkI4AAKeQAABkXzsAsJAAAP6QAAB8XzsA/pAAAKKSAACQXzsAopIAAP+SAACkXzsAAJMAAE2TAAC0XzsATZMAAM6UAADIXzsAzpQAACuVAADcXzsAMJUAAEuXAADsXzsAUJcAALOXAAAEYDsAs5cAALuXAAAcYDsAu5cAACeZAAAwYDsAJ5kAAK+ZAABQYDsAr5kAALyZAABkYDsAvJkAAFeaAAB0YDsAV5oAAHaaAACQYDsAgJoAAGCcAACgYDsAYJwAANmcAAC4YDsA2ZwAAFadAADEYDsAVp0AAH6dAADYYDsAfp0AADSeAADsYDsAQJ4AALKeAAD8YDsAsp4AAC+fAAAIYTsAL58AAFefAAAcYTsAV58AAKOgAAAwYTsAsKAAAK+mAABAYTsAsKYAAByoAABcYTsAHKgAAGitAABwYTsAcK0AAAWuAACEYTsABa4AAFiuAACQYTsAWK4AADCvAACkYTsAMK8AAKGvAAC4YDsAoa8AAB2wAAC4YTsAHbAAAEWwAADMYTsARbAAAHCwAADgYTsAcLAAAFm1AADwYTsAYLUAADW2AAAIYjsAQLYAAEi2AAAcYjsASLYAAFu2AAAkYjsAW7YAAK62AAA4YjsArrYAALi2AABQYjsAuLYAAOC2AABgYjsA4LYAAOW3AABwYjsA8LcAAIu/AACAYjsAkL8AAPO/AACcYjsA878AAPu/AAC0YjsA+78AACfBAADIYjsAJ8EAAK/BAADoYjsAr8EAALvBAAD8YjsAu8EAAFbCAAAMYzsAVsIAAHXCAAAoYzsAgMIAANjDAAA4YzsA2MMAAPjDAABMYzsA+MMAADDEAABgYzsAMMQAAI3EAAC4YDsAjcQAAAfFAABwYzsAB8UAAC/FAACEYzsAL8UAAO3FAACYYzsA8MUAAPvHAACoYzsAAMgAAFrIAADAYzsAWsgAANfIAADMYzsA18gAAAPJAADgYzsAA8kAADnKAAD0YzsAQMoAAM7PAAAEZDsAQNAAAEHRAABwYjsAUNEAAOrRAAAcZDsA8NEAAHXSAAAoZDsAddIAAC/TAABEZDsAL9MAACbUAABYZDsAMNQAANLXAABoZDsA4NcAAEvYAAB8ZDsAS9gAANHYAACMZDsA0dgAAOXYAACkZDsA8NgAADjZAAC0ZDsAONkAAMLZAADAZDsAwtkAAOnZAADUZDsA6dkAAHLaAADoZDsAgNoAAODaAAAAZTsAANsAAD7bAAAMZTsAQNsAAH7bAAAMZTsAgNsAAL7bAAAMZTsAwNsAAPjbAAAUZTsAANwAAPfdAAAcZTsAAN4AAAXfAAB4ZTsAEN8AADzfAAC4ZTsAPN8AAJbfAADAZTsAlt8AANPfAADUZTsA098AAPHfAADUZTsA8d8AAJjgAADoZTsAmOAAAKjgAAAEZjsAqOAAAMTgAADUZTsA0OAAADThAAAgZjsAYOEAAKPhAAAAZTsAsOEAAO3hAAAUZTsA8OEAABPiAAAwZjsAIOIAAHLjAAA4ZjsAgOMAAJ/jAADAVzsAn+MAAMrjAABsZjsAyuMAANzjAACAZjsA4OMAAE3kAAAMZTsAUOQAAHDmAAC4ZjsAcOYAAMPnAADwZjsA0OcAAOLnAADMWDsA8OcAAGfoAAAgZzsAoOgAAN3oAAAUZTsA4OgAAADpAAAwZjsAIOkAAFLpAADMWDsAYOkAAJXpAACQWTsAlekAAPTpAAAwZzsA9OkAADPqAABEZzsAM+oAAEjqAABYZzsAUOoAAG/qAABoZzsAb+oAAMXqAAB0ZzsAxeoAAATrAACIZzsAEOsAAHzrAACYZzsAfOsAALrrAACoZzsAuusAAOrrAAC8ZzsAEOwAAEfsAADMZzsAUOwAAIDsAADUZzsAgOwAAJPtAADkZzsAk+0AAJntAAAEaDsAoO0AAFPuAAAUaDsAYO4AAJnuAADMZzsAoO4AALzuAAAoaDsAvO4AAKzvAAA0aDsArO8AALXvAABQaDsAte8AALvvAABgaDsAwO8AAATwAAB4aDsABPAAACjwAACIaDsAKPAAAIHwAACgaDsAgfAAAAfxAAC0aDsAB/EAAA3xAADEaDsAIPIAAE7yAADYaDsATvIAAIXzAADoaDsAhfMAAIvzAAAEaTsAi/MAAJHzAAAUaTsAoPMAAMHzAAAUZTsA8PMAAIf0AAAsaTsAoPQAAO70AAAMZTsA8PQAAGP1AABcaTsAoPUAAN/1AAAMZTsAAPYAADj2AAB4aTsAOPYAAEj3AACIaTsASPcAAE73AACkaTsAUPcAAHP3AAC0aTsAc/cAALL3AADAaTsAsvcAAND3AADUaTsA0PcAAI/4AACMXTsAkPgAANP4AAAAZTsA4PgAADj5AAAAZTsAQPkAAI75AAAAZTsAkPkAAM35AAAUZTsA0PkAAEP6AAAMZTsAYPoAANL6AAAMZTsA8PoAAAL7AADMWDsAQPsAAH37AAAUZTsAgPsAAL37AAAUZTsA4PsAABP8AAAUZTsAIPwAAED8AAAwZjsAQPwAAKb8AAA4WTsAsPwAAPr8AADkaTsA+vwAAE/9AAD0aTsAT/0AAFX9AAAIajsAYP0AAJf9AAAUZTsAoP0AAHb/AAAYajsAgP8AAL7/AAB8ajsAwP8AAOT/AACYajsA8P8AAE8AAQCwajsATwABAOwAAQDAajsA7AABAAYBAQDUajsABgEBAAwBAQDoajsAEAEBAGEDAQD4ajsA4AUBAF0GAQAAZTsAcAcBAI0HAQAUZTsAjQcBAAoIAQAUazsACggBABAIAQAoazsAEAgBACwIAQA4azsAUAgBAKIIAQBQazsAsAgBAAIJAQBcazsAEAkBAJYJAQBoazsAsAkBADQLAQCEazsAQAsBAIYMAQC0azsAkAwBAC0OAQDUazsAUA4BAP4QAQAUZTsAABEBADwTAQAAZTsAQBMBAPoTAQDoazsAABQBALwUAQDwazsAwBQBAEsVAQAUZTsAUBUBAHQVAQAwZjsAdBUBAEQXAQAAbDsARBcBAEkXAQAYbDsAUBcBAHYXAQAwZjsAdhcBAMIYAQAobDsAwhgBAMcYAQA8bDsA0BgBAPgYAQBMbDsA+BgBANkaAQBYbDsA2RoBAOQaAQB0bDsA8BoBAMEbAQCEbDsA0BsBAEccAQCMbDsAUBwBAG0cAQCcbDsAcBwBADwdAQCkbDsAPB0BAJodAQC0bDsAmh0BAMgdAQDQbDsAyB0BAOEdAQDobDsA8B0BAJgeAQD4bDsAoB4BAEQgAQAAbTsAUCABAOIhAQBEbTsA8CEBAJwjAQBcbTsAECUBAGQlAQB4bTsAZCUBALAmAQCIbTsAsCYBAMgmAQCcbTsA0CYBAFsnAQCsbTsAYCcBANEnAQD4bDsA4CcBAIcLine truncated
@@ -0,0 +1,9 @@
+# EF-Cheeto binary section: .rdata_cheat
+# RVA: 0x3A0000
+# Size: 81,920 bytes
+# Raw offset in original DLL: 0x39e600
+# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__rdata_cheat.b64').read().split('\n',5)[-1])
+# ImageBase: 0x180000000
+# VA = ImageBase + RVA
+
+qWsACqp6AAqriAAKrOMACq4bAAqvAYIDJ80ACrDZAAqygo8kswMACrSCqzC1yAAKt7oACrkcAAq6QQAKvIIDIL2Cxzi+PgAKvycACsCHAArB0gAKw/wACsTzAArFgncox1QACsiTAArKgjMsyyQACsxRAArNRwAKzoJzNM+nAArQ/wAK0hEACtNXAArUhgAK1YK3LNbBAArXnQAK2L8ACtqCGzTb9gAK3hQACuAHAArhYgAK4zkACuSCLzDlwwAK5t0ACuiDAArqWAAK64I7CFTtXwAK7jMACu98AArwywAK8gIACvOaAAr1CAAK9jQACvcXAAr4iQAK+mcACvx1AAr90QALAGkACwHcAAsC1QALBB4ACwVzAAsHJQALCF0ACwm1AAsLgh8xDKcACw3LAAsQKQALEaQACxMOggMIJ/0ACxYJAAsX7AALGiQACxtJAAsc2AALHskACyBqAAsiSAALI/UACyWCHwgwKBcACylHAAsqxwALLRQACy4zAAsvcQALMIoACzKDAAszlAALNKoACzZmAAs4AAALOYIrLDqrAAs8DgALPbMACz+CFyBAgp88QuQAC0QHAAtGLQALSBAAC0myAAtLQgALTSgAC06CBzBPjQALUaUAC1NSAAtUxQALVoIzIFmCQyxadAALW+8AC14DAAtfgsMkYNQAC2KC1wg4ZNYAC2aiAAtn8AALaVQAC2uQAAtufAALcQYAC3OCAAt0VgALdV4AC3ZAAAt3NwALeEIAC3lVAAt6gjsse7kAC3zpAAt+IgALf4J3JIC/AAuBgg8gg4LHMIS3AAuGPgALh10AC4iMAAuJghssixMAC4xaAAuOLAALj4JjIJGCwwhEko8AC5PjAAuV0AALl1gAC5lBAAubDAALnJYAC50bAAueGAALnwEAC6A1AAuhFwALoh0AC6MlAAukpgALpeUAC6bAAAungjcsp9oAC6haAAupTAALqoK7IKuCKymr7gALrRIAC64yggMv0wALr4YAC7BOAAuxiQALsoLTJLNmAAu0gk8ktWQAC7aCwyy3hwALuC4AC7lxAAu6gr8ou6IAC7zcAAu+gis4v7IAC8C0AAvBrAALwrUAC8OdAAvEwQALxYJ3JccOAAvIGoIDJ+gAC8o7AAvLgn8wzEsAC805AAvOeQAL0CEAC9GCgwgk0gUAC9NMAAvU0QAL1bwAC9b5AAvX3QAL2TAAC9okAAvboQAL3IJDLN29AAvelAAL33wAC+CCmwg04TgAC+JlAAvj2wAL5KcAC+VwAAvmdQAL554AC+hhAAvpVwAL6n4AC+tsAAvsQwAL7WoAC+6CJwgh72YAC/A+AAvxfwAL8xEAC/SkAAv1wwAL9qsAC/fUAAv5EoIDCCTkAAv6sQAL+9kAC/1EAAv+kwAL/7UADACbAAwBrgAMAwYADAQYggMIM/YADAZBAAwHFQAMCFUADAk/AAwKYwAMC1kADAy5AAwN6wAMDwoADBBnAAwRTwAMEk4ADBOCHwhMFC0ADBV3AAwWyAAMGAAADBkuAAwaoQAMHDsADB3WAAwe8wAMIEkADCF+AAwinAAMJFEADCU8AAwmeQAMJ70ADCkTAAwqIAAMK3sADC2CPwgwLf4ADC8iAAwwXQAMMaIADDLAAAw0QgAMNXgADDZWAAw3cgAMOLMADDmkAAw6rAAMPIJ/MD2+AAw+pgAMP8kADEClAAxBglcgQoLPIESCdyhFdQAMRpAADEeCwzRJQwAMSnwADEvlAAxNCQAMTjoADE+C6zhQtgAMUbQADFLFAAxT/QAMVXMADFcmAAxYgnM8WY4ADFrVAAxcMQAMXcEADF9MAAxgMwAMYUcADGKCsyBjghswZSUADGYqAAxnBwAMaGoADGmC5yhq4QAMbCkADG2CVyhvEgAMcEEADHGC+zRy2wAMc8QADHU0AAx2ugAMeA4ADHmCBzB7PAAMfR4ADH4TAAx/gwAMgILHKIIsAAyDgQAMhYJXIIaCyyyHywAMiTAADIqSAAyMgr8ojR0ADI4UAAyPgmckkCsADJGCAwggkrsADJPWAAyVAAAMlkUADJeGAAyZAQAMmm4ADJvTAAydgksIIJ4ZAAyfqgAMoO4ADKICAAyjqQAMpJsADKXlAAyndgAMqYIjIKqCLwhcrCcADK5tAAyvyAAMsNQADLI7AAyzmgAMtLcADLYYAAy3YAAMuMcADLoLAAy7VQAMvPcADL6TAAzAlgAMwe0ADMPmAAzE+wAMxk8ADMdnAAzIxQAMylIADMvOAAzNgusgzoL3CDjQGgAM0jkADNNZAAzUvgAM1e8ADNc4AAzYygAM2jEADNvnAAzdWAAM3qEADOBwAAzh8AAM4y4ADOSCZyzmNAAM59EADOjkAAzqgj8g64KbOOzZAAzuTQAM8B0ADPFlAAzzNwAM9QkADPaCewiY+LkADPpGAAz70gAM/YAADP7lAA0APwANAgsADQNLAA0E3AANBhwADQfHAA0J6AANC50ADQ0lAA0PRgANEMMADRI8AA0UIgANFZEADRc1AA0YwQANGiMADRtmAA0c/QANHnUADSCgAA0iIQANI4sADSTnAA0mpAANJ+wADSnfAA0rEQANLFUADS4gAA0vjAANMMUADTJ+AA0zgncwNaIADTdHAA04uAANOh8ADTyCIyQ+GwANQIKPKEGaAA1DBAANRYILCDBHQwANSL0ADUqnAA1MSgANTmMADVADAA1RcAANU8wADVXAAA1XeQANWWUADVtaAA1dgn8oX1YADWDTAA1igjcoZOMADWapAA1ogtsgaoL7IGyCRwgtbrEADXAtAA1yOAANdNkADXafAA15EAANe1AADX0AAA1/HgANgPIADYGJAA2CF4IDgqMkg5AADYSC9zCFQQANhhUADYdAAA2IJwANiYIvLIpMAA2LWAANjEYADY2CSzyPLAANkEkADZGRAA2SpgANlAsADZVyAA2W3QANmIIzIJmCXySaWQANm4KXPJ0TAA2eVwANn9sADaEaAA2iMQANo5MADaU9AA2mgsMgqIJvJKoqAA2qgus5q9EADa0YAA2uSAANryUADbAdAA2xxQANs3OCAyPVAA20gtcsth8ADbd7AA24nQANuYK3CCS6MAANusQADbuyAA28pQANvXEADb5iAA2/agANwGsADcGuAA3Cghs4xQUADcXHAA3HEAANyL8ADcn9AA3LeQANzYKrKM5zAA3P2QAN0YJzJNJfAA3Ugs801WAADddRAA3ZBAAN2lIADdsrAA3cgtMh3KiCByj7AA3dZAAN3jiCA4JzJN9cAA3ggisg4YInLeJGAA3iwAAN4zwADeQBggMkoAAN5RSCAyfLAA3m1AAN54I/Keh+AA3pewAN6jGCAzD0AA3reAAN7FUADe0kAA3uKoIDgiMk71sADfCCPyTw5AAN8YIvJPI/AA3zgrsp86wADfQ1AA31PYIDJ+sADfZlAA33gq8g+IJjKfk+AA36XQAN+xqCAyOuAA39gi8l/fUADf9FggMIP+sADgDQAA4BxQAOAroADgQ7AA4FcgAOBkcADgcaAA4IDAAOCVcADgosAA4LfwAODIkADg2qAA4OUwAOD2wADhCCGygRJwAOEj8ADhOCIwgpFBsADhTRAA4V5QAOFtsADhfiAA4Y+AAOGdQADhrxAA4b8AAOHOYADh4ZggMj5wAOIII7MCESAA4iBgAOI2UADiTVAA4mgkskJ1kADiiCWwg0KZIADiquAA4sHAAOLQ0ADi4vAA4vNAAOMKgADjKjAA4zqgAONSEADjZwAA435QAOOVgADjuCIyU8kwAOPqCCAyvqAA4/cQAOQGsADkGCVwglQjEADkL1AA5D2AAORL8ADkWHAA5GdwAOR3UADkh0AA5JfAAOSh2CAyPTAA5MglcwTUgADk6dAA5PxwAOUPoADlKCqyBTghcgVIJjLVU1AA5WVgAOWCkADlotggMkjQAOWwKCA4JrIFuCiyVcvgAOXUmCAyPWAA5egscgX4J7KWAFAA5hCAAOYhaCAyPjAA5jgoclZUQADmYsggM3yAAOZ9EADmikAA5pyQAOapEADmsjAA5sglMwbOYADm3pAA5u5AAOb3MADnCCrwgkcRAADnGaAA5ytgAOc34ADnSxAA51jAAOdn8ADnemAA54WwAOeYKfKXoGAA56rAAOe0qCAyf4AA58/QAOfoJ/JH8wAA6Agnc1gTgADoI5AA6DVwAOhGUADoUBAA6GH4IDJOoADogdggMz4AAOidwADorCAA6LZgAOjE8ADo2C1zSODgAOjvsADpA6AA6RbgAOkkIADpOCdziUxgAOlf4ADpayAA6XdwAOmGAADplTAA6agqMkm7QADpyCpzGd0wAOnt0ADp/XAA6giQAOoTWCAzPwAA6jOwAOpLwADqXRAA6mlgAOp4KTOagTAA6ouAAOqZ0ADqpGAA6rQAAOrGEADq0JggOCPyCugnMIKK+GAA6wjgAOsUcADrJ2AA6zmAAOtHoADrV7AA629gAOuFsADrlrAA66ghcgu4JHJbzyAA6+G4IDI+wADr+CAyDAgnMIJMHkAA7CvgAOw9YADsSlAA7FZQAOxnMADsciAA7IiAAOyW8ADsqCYwghy88ADsyVAA7NzAAOzrUADs+6AA7Q6gAO0eYADtMEAA7UAYIDLK4ADtYvAA7XlwAO2UOCAyvpAA7bAwAO3B0ADt2CDyjd9AAO3sUADt+CPyDhghc44b8ADuJxAA7jJgAO5F8ADuUrAA7mtwAO54I/NOhqAA7plAAO6rIADuv9AA7s+wAO7YKzCEHuyAAO7/UADvFEAA7yZgAO87UADvVUAA72WAAO94kADvjGAA75lgAO+mQADvuBAA78vQAO/hMADv8MAA8ADgAPARWCAz/aAA8C+wAPBFgADwWiAA8HGAAPCJ0ADwoGAA8LCQAPDIIjCEANKQAPDjgADw+IAA8QqgAPEfwADxLxAA8UFwAPFXkADxbGAA8X0AAPGMIADxo7AA8Line truncated
@@ -0,0 +1,9 @@
+# EF-Cheeto binary section: .rdata_iat
+# RVA: 0xB1000
+# Size: 4,096 bytes
+# Raw offset in original DLL: 0xaf600
+# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__rdata_iat.b64').read().split('\n',5)[-1])
+# ImageBase: 0x180000000
+# VA = ImageBase + RVA
+
+Vj48AAAAAAAAAAAAAAAAAPY0PAAAAAAABjU8AAAAAAAAAAAAAAAAAPY9PAAAAAAAKD48AAAAAAA8PjwAAAAAAA4+PAAAAAAAAAAAAAAAAACwLDwAAAAAAMAsPAAAAAAA0Cw8AAAAAADgLDwAAAAAAPQsPAAAAAAADC08AAAAAAAgLTwAAAAAADAtPAAAAAAAQi08AAAAAABQLTwAAAAAAGYtPAAAAAAAfC08AAAAAACKLTwAAAAAAJgtPAAAAAAApi08AAAAAAC8LTwAAAAAAMwtPAAAAAAA4C08AAAAAADyLTwAAAAAAAIuPAAAAAAAHi48AAAAAAAwLjwAAAAAAEYuPAAAAAAAYC48AAAAAABwLjwAAAAAAIYuPAAAAAAAli48AAAAAACoLjwAAAAAALouPAAAAAAAyC48AAAAAADmLjwAAAAAAAAvPAAAAAAACC88AAAAAAAYLzwAAAAAAC4vPAAAAAAASi88AAAAAABkLzwAAAAAAHwvPAAAAAAAkC88AAAAAACsLzwAAAAAAL4vPAAAAAAA4C88AAAAAACKLDwAAAAAAPovPAAAAAAACjA8AAAAAAAaMDwAAAAAACgwPAAAAAAANDA8AAAAAABCMDwAAAAAAFAwPAAAAAAAAkU8AAAAAADuRDwAAAAAANJEPAAAAAAAvkQ8AAAAAACgRDwAAAAAAIREPAAAAAAAcEQ8AAAAAABWRDwAAAAAAEJEPAAAAAAAJkQ8AAAAAAAKRDwAAAAAAPBDPAAAAAAA1kM8AAAAAADEQzwAAAAAALJDPAAAAAAAoEM8AAAAAACUQzwAAAAAAJosPAAAAAAAdiw8AAAAAABoLDwAAAAAAO4vPAAAAAAAViw8AAAAAABCLDwAAAAAABxFPAAAAAAAzC88AAAAAAAAAAAAAAAAAJA8PAAAAAAAajw8AAAAAAAyPDwAAAAAANw7PAAAAAAAxDs8AAAAAACuOzwAAAAAAFo7PAAAAAAA6jw8AAAAAABCPTwAAAAAAJg9PAAAAAAAvDw8AAAAAAAWOzwAAAAAANo6PAAAAAAAQDU8AAAAAABiNTwAAAAAAII1PAAAAAAAoDU8AAAAAADCNTwAAAAAAAI2PAAAAAAATjY8AAAAAACENjwAAAAAAKo2PAAAAAAAxjY8AAAAAADgNjwAAAAAAAA3PAAAAAAAHDc8AAAAAAA8NzwAAAAAAF43PAAAAAAAkjc8AAAAAACwNzwAAAAAANw3PAAAAAAAAjg8AAAAAAAcODwAAAAAAEI4PAAAAAAAbjg8AAAAAACcODwAAAAAAMI4PAAAAAAAAjk8AAAAAAA+OTwAAAAAAIA5PAAAAAAAojk8AAAAAADCOTwAAAAAAAA6PAAAAAAARDo8AAAAAACMOjwAAAAAAKw6PAAAAAAAuDo8AAAAAADGOjwAAAAAAAAAAAAAAAAA/js8AAAAAAAAAAAAAAAAACQ1PAAAAAAAAAAAAAAAAADANDwAAAAAAKQ0PAAAAAAAmDQ8AAAAAACENDwAAAAAANw0PAAAAAAAcjQ8AAAAAABiNDwAAAAAAFI0PAAAAAAANjQ8AAAAAAAoNDwAAAAAABQ0PAAAAAAAljA8AAAAAAC6MDwAAAAAAAA0PAAAAAAA7DM8AAAAAADcMzwAAAAAAMwzPAAAAAAAuDM8AAAAAACsMzwAAAAAAJozPAAAAAAAyjA8AAAAAADaMDwAAAAAAOYwPAAAAAAA9jA8AAAAAAACMTwAAAAAABgxPAAAAAAAKjE8AAAAAACoMDwAAAAAAIgzPAAAAAAAdjM8AAAAAABgMzwAAAAAAG4wPAAAAAAAUjM8AAAAAAA8MzwAAAAAADAzPAAAAAAAIDM8AAAAAAAYMzwAAAAAAIIwPAAAAAAACDM8AAAAAAD0MjwAAAAAAOAyPAAAAAAAPDE8AAAAAABSMTwAAAAAAGIxPAAAAAAAdDE8AAAAAACAMTwAAAAAAI4xPAAAAAAAnDE8AAAAAACwMTwAAAAAALwxPAAAAAAA2jE8AAAAAADmMTwAAAAAAPwxPAAAAAAAEDI8AAAAAAAiMjwAAAAAACwyPAAAAAAAPjI8AAAAAABQMjwAAAAAAF4yPAAAAAAAbDI8AAAAAAB+MjwAAAAAAJIyPAAAAAAApjI8AAAAAAC4MjwAAAAAAMoyPAAAAAAAAAAAAAAAAACgPzwAAAAAAII/PAAAAAAAYj88AAAAAABYPzwAAAAAAE4/PAAAAAAARD88AAAAAAA6PzwAAAAAACI/PAAAAAAAFj88AAAAAAAyRTwAAAAAAPw+PAAAAAAA5D48AAAAAADSPjwAAAAAALY/PAAAAAAAbD88AAAAAAAAAAAAAAAAALw+PAAAAAAAAAAAAAAAAABKQTwAAAAAAGJBPAAAAAAAPkE8AAAAAAAEQTwAAAAAAAAAAAAAAAAAZEA8AAAAAACCQTwAAAAAADxAPAAAAAAAIkA8AAAAAAAAAAAAAAAAAFRBPAAAAAAAbEE8AAAAAAAAAAAAAAAAAEZAPAAAAAAAWkA8AAAAAACMRTwAAAAAAH5FPAAAAAAAhEU8AAAAAAB2RTwAAAAAAFJFPAAAAAAAkkU8AAAAAABGRTwAAAAAADxFPAAAAAAAUEA8AAAAAABmRTwAAAAAAKJFPAAAAAAAbkU8AAAAAACaRTwAAAAAAF5FPAAAAAAAAAAAAAAAAACgQTwAAAAAALpBPAAAAAAA3EE8AAAAAACOQTwAAAAAADRBPAAAAAAA+EE8AAAAAAAUQjwAAAAAAFxCPAAAAAAAUEI8AAAAAABEQjwAAAAAADpCPAAAAAAA/D88AAAAAAAsQjwAAAAAAAAAAAAAAAAANEA8AAAAAAAqQDwAAAAAABhAPAAAAAAADkA8AAAAAAAMQTwAAAAAAOpAPAAAAAAAxkA8AAAAAACSQDwAAAAAAHhAPAAAAAAAgEA8AAAAAACaQDwAAAAAANBAPAAAAAAAAAAAAAAAAAC8QDwAAAAAAG5APAAAAAAAqkU8AAAAAAAqQTwAAAAAAAAAAAAAAAAAGEE8AAAAAAAAAAAAAAAAALRAPAAAAAAAAAAAAAAAAAAYLDwAAAAAAAAAAAAAAAAAeD48AAAAAACYPjwAAAAAAAAAAAAAAAAAYAcBgAEAAABgBwGAAQAAADDKCoABAAAAUMoKgAEAAABQygqAAQAAAAAAAAAAAAAAZMgKgAEAAAAAAAAAAAAAAJAhAIABAAAAABAAgAEAAAAQEACAAQAAAPAYAIABAAAAIBkAgAEAAAAwGQCAAQAAAEAZAIABAAAAEBoAgAEAAADgGgCAAQAAALAbAIABAAAAgBwAgAEAAABQHQCAAQAAACAeAIABAAAA8B4AgAEAAADAHwCAAQAAAJAgAIABAAAAYCEAgAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAABAQAAAQAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIQB4AC0AcwB5AHMALQBkAGUAZgBhAHUAbAB0AC0AbABvAGMAYQBsAGUAAAAAAAAAAAECAwQFBgcBAgMEBQYHBwACAwQFBgcHAgMEBQYHBgcAAQMEBQYHBwEDBAUGBwYHAAMEBQYHBgcDBAUGBwUGBwABAgQFBgcHAQIEBQYHBgcAAgQFBgcGBwIEBQYHBQYHAAEEBQYHBgcBBAUGBwUGBwAEBQYHBQYHBAUGBwQFBgcAAQIDBQYHBwECAwUGBwYHAAIDBQYHBgcCAwUGBwUGBwABAwUGBwYHAQMFBgcFBgcAAwUGBwUGBwMFBgcEBQYHAAECBQYHBgcBAgUGBwUGBwACBQYHBQYHAgUGBwQFBgcAAQUGBwUGBwEFBgcEBQYHAAUGBwQFBgcFBgcDBAUGBwABAgMEBgcHAQIDBAYHBgcAAgMEBgcGBwIDBAYHBQYHAAEDBAYHBgcBAwQGBwUGBwADBAYHBQYHAwQGBwQFBgcAAQIEBgcGBwECBAYHBQYHAAIEBgcFBgcCBAYHBAUGBwABBAYHBQYHAQQGBwQFBgcABAYHBAUGBwQGBwMEBQYHAAECAwYHBgcBAgMGBwUGBwACAwYHBQYHAgMGBwQFBgcAAQMGBwUGBwEDBgcEBQYHAAMGBwQFBgcDBgcDBAUGBwABAgYHBQYHAQIGBwQFBgcAAgYHBAUGBwIGBwMEBQYHAAEGBwQFBgcBBgcDBAUGBwAGBwMEBQYHBgcCAwQFBgcAAQIDBAUHBwECAwQFBwYHAAIDBAUHBgcCAwQFBwUGBwABAwQFBwYHAQMEBQcFBgcAAwQFBwUGBwMEBQcEBQYHAAECBAUHBgcBAgQFBwUGBwACBAUHBQYHAgQFBwQFBgcAAQQFBwUGBwEEBQcEBQYHAAQFBwQFBgcEBQcDBAUGBwABAgMFBwYHAQIDBQcFBgcAAgMFBwUGBwIDBQcEBQYHAAEDBQcFBgcBAwUHBAUGBwADBQcEBQYHAwUHAwQFBgcAAQIFBwUGBwECBQcEBQYHAAIFBwQFBgcCBQcDBAUGBwABBQcEBQYHAQUHAwQFBgcABQcDBAUGBwUHAgMEBQYHAAECAwQHBgcBAgMEBwUGBwACAwQHBQYHAgMEBwQFBgcAAQMEBwUGBwEDBAcEBQYHAAMEBwQLine truncated
@@ -0,0 +1,9 @@
+# EF-Cheeto binary section: .reloc
+# RVA: 0x3d4000
+# Size: 2,560 bytes
+# Raw offset in original DLL: 0x3cd600
+# To decode: import base64; data = base64.b64decode(open('ef_cheeto_section__reloc.b64').read().split('\n',5)[-1])
+# ImageBase: 0x180000000
+# VA = ImageBase + RVA
+
+ABALADgAAAAwqTipQKlIqVCpYKlwqXipgKmIqZCpmKmgqaipsKm4qcCpyKnQqdip4KnoqfCpAAAAEA0AJAAAAGChaKFwoXihiKGQoZihoKGoobChyKHQodihAAAAQA0AuAAAADCjOKNAo0ijUKNYo2CjaKNwo4ijkKOYo6CjqKPIo9Cj2KMYpCCkKKQwpDikQKRIpFCkWKRgpGikcKR4pICkkKSYpKCkqKSwpLikwKTIpNCkGKkoqTipSKlYqWipeKmIqZipqKm4qcip2KlQqvCu+K4ArwivEK8YryCvKK8wrzivQK9Ir1CvWK9gr2ivcK94r4CviK+Qr5ivoK+or7CvuK/Ar8iv0K/Yr+Cv6K/wr/ivAFANAPwAAAAAoAigEKAYoCCgKKAwoDigQKBIoFCgWKBgoGigcKB4oICgiKCQoJigoKCooLCguKDAoMig0KDYoOCg6KDwoPigAKEIoRChGKEgoSihMKE4oUChSKFQoVihYKFooXCheKGAoYihkKGYoaChqKGwobihwKHIodCh2KHgoeih8KH4oQCiCKIQohiiIKIoojCiOKJAokiiUKJYomCiaKJwoniigKKIopCimKKgoqiisKK4osCiyKLQotii4KLoovCi+KIAowijEKMYoyCjKKMwozijQKNIo1CjWKNgo2ijcKN4o4CjiKOQo5ijoKOoo7CjuKPAo8ijAIANAFAAAADYp+Cn6Kf4pwCoCKgYqCCoKKg4qECoSKhYqGCoaKh4qICoiKiYqKCoqKi4qMCoyKjYqOCo6Kj4qACpCKkYqSCpKKk4qUCpSKkA8DoAtAAAAKCjsKPAo9Cj4KPwowCkEKQgpDCkQKRQpGCkcKQgqTCpQKlQqWCpcKnYqeCp6KnwqfipAKoIqhCqGKogqiiqMKo4qkCqSKpQqliqYKpoqnCqeKqAqriqwKrIqtCq2Krgquiq8Kr4qgCrCKtQrFisYKxorHCseKyArIiskKyYrKCsCK4QrhiuIK4orjCuOK5ArkiuUK5YrmiucK54roCuiK6QrpiuoK6orrCuuK4AADsAIAEAAGCgaKBwoHiggKCIoJCgmKCgoKigsKAIoRChGKEgoSihMKE4oUChSKFQoVihqKGwobihwKHIodCh2KHgoeih8KH4oSCiKKIwojiiQKJIolCiWKJgomiicKJ4ooCiiKKQopiioKKoorCiuKLAosiieKaApoimkKaYpqCmqKawprimwKbIplCtWK1grWitcK14rYCtiK2QrZitoK2orbCtuK3Arcit0K3YreCt6K3wrfitAK4IrhCuGK4griiuMK44rkCuSK5QrliuYK5ornCueK6AroiukK6YrqCuqK6wrriuwK7IrtCu2K7gruiu8K74rgCvCK8QrxivIK8orzCvOK9Ar0ivUK9Yr2CvaK9wr3iv4K/or/Cv+K8AEDsALAAAAACgCKAQoBigIKAooDCgOKBAoEigUKBYoLigwKDIoNCg2KDgoAAgOwAQAAAA2K3greitAAAAMDsANAAAADCgOKBAoGigcKB4oICgiKCQoIimoKaopjCnSKdQp1inYKdopwCoCKgQqBioAFA8AHgAAAC4oMig4KCAo6ij0KP4oyCkSKR4pKCk0KQwpYCl0KUwpoCm0KYgp3Cn0KcgqFCooKjwqECpkKngqTCqUKqAqiirWKuAq6ir0KsArDiscKygrMCs6KwIrTCtUK1wrZitwK3grQCuMK5QrpCuEK+QrwAAAGA8ACAAAAAgoKCgIKGwoUCiwKJAo8CjAKQwpLCkAAAA8DwA6AEAAAigGKAooDigSKFYoWiheKGIoZihqKG4ocih2KHoofihCKIYoiiiOKJIoliiaKJ4ooiimKKooriiyKLYouii+KIIoxijKKM4o0ijWKNoo3ijiKOYo6ijuKPIo9ij6KP4owikGKQopDikSKRYpGikeKSIpJikqKS4pMik2KTopPikCKUYpSilOKVIpVilaKV4pYilmKWopbilyKXYpeil+KUIphimKKY4pkimWKZopnimiKaYpqimuKbIptim6Kb4pginGKcopzinSKdYp2ineKeIp5inqKe4p8in2Kfop/inCKgYqCioOKhIqFioaKh4qIiomKioqLioyKjYqOio+KgIqRipKKk4qUipWKloqXipiKmYqaipuKnIqdip6Kn4qQiqGKooqjiqSKpYqmiqeKqIqpiqqKq4qsiq2KroqviqCKsYqyirOKtIq1iraKt4q4irmKuoq7iryKvYq+ir+KsIrBisKKw4rEisWKxorHisiKyYrKisuKzIrNis6Kz4rAitGK0orTitSK1YrWiteK2IrZitqK24rcit2K3orfitCK4YriiuOK5IrliuaK54roiumK6orriuyK7Yruiu+K4IrxivKK84r0ivWK9or3iviK+Yr6ivuK/Ir9iv6K/4rwAAPQAIAgAACKAYoCigOKBIoFigaKB4oIigmKCooLigyKDYoOig+KAIoRihKKE4oVihaKF4oYihmKGoobihyKHYoeih+KEIohiiKKI4okiiWKJooniiiKKYoqiiuKLIotii6KL4ogijGKMoozijSKNYo2ijeKOIo5ijqKO4o8ij2KPoo/ijCKQYpCikOKRIpFikaKR4pIikmKSopLikyKTYpOik+KQIpRilKKU4pUilWKVopXiliKWYpailuKXIpdil6KX4pQimGKYopjimSKZYpmimeKaIppimqKa4psim2KbopvimCKcYpyinOKdIp1inaKd4p4inmKeop7inyKfYp+in+KcIqBioKKg4qEioWKhoqHioiKiYqKiouKjIqNio6Kj4qAipGKkoqTipSKlYqWipeKmIqZipqKm4qcip2KnoqfipCKoYqiiqOKpIqliqaKp4qoiqmKqoqriqyKrYquiq+KoIqxirKKs4q0irWKtoq3iriKuYq6iruKvIq9ir6Kv4qwisGKworDisSKxYrGiseKyIrJisqKy4rMis2KzorPisCK0YrSitOK1IrVitaK14rYitmK2orbityK3Yreit+K0IrhiuKK44rkiuWK5orniuiK6YrqiuuK7Irtiu6K74rgivGK8orzivSK9Yr2iveK+Ir5ivqK+4r8iv2K/or/ivAAAAED0AQAAAAAigGKAooDigSKBYoGigeKCIoJigqKC4oMig2KDooPigCKEYoSihOKFIoWiheKGIoZihqKG4oQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
@@ -0,0 +1,7 @@
+# EF-Cheeto .text section — chunk 1/4
+# RVA range: 0x01000–0x2CF20
+# Size: 180,000 bytes / ~60,000 tokens
+# ImageBase: 0x180000000  VA = 0x0180001000
+# To decode: import base64; data = base64.b64decode(open(this).read().split('\n',6)[-1])
+
+SI0Nie0KAOnYqwoAzMzMzEiJXCQISIl0JBBIiXwkGEyJZCQgVUFWQVdIjawkcPr//0iB7JAGAADGRCRAAkiNBVTmOgBIiUQkSMZEJFAESI0FS+Y6AEiJRCRYxkQkYAVIjQVC5joASIlEJGjGRCRwBkiNBTnmOgBIiUQkeMZFgAhIjQUx5joASIlFiMZFkAlIjQUu5joASIlFmMZFoAxIjQUj5joASIlFqMZFsA1IjQUc5joASIlFuMZFwBBIjQUV5joASIlFyMZF0BFIjQUO5joASIlF2MZF4BJIjQUH5joASIlF6MZF8BNIjQX85ToASIlF+MZFABRIjQX55ToASIlFCMZFEBtIjQX25ToASIlFGMZFICBIjQXr5ToASIlFKMZFMCFIjQXk5ToASIlFOMZFQCJIjQXd5ToASIlFSMZFUCNIjQXW5ToASIlFWMZFYCRIjQXL5ToASIlFaMZFcCVIjQXE5ToASIlFeMaFgAAAACZIjQW65ToASImFiAAAAMaFkAAAACdIjQWp5ToASImFmAAAAMaFoAAAAChIjQWc5ToASImFqAAAAMaFsAAAAC1IjQWP5ToASImFuAAAAMaFwAAAAC5IjQV+5ToASImFyAAAAMaF0AAAACxIjQVt5ToASImF2AAAAMaF4AAAADBIjQXsAw0ASImF6AAAAMaF8AAAADFIjQUnsToASImF+AAAAMaFAAEAADJIjQUWsToASImFCAEAAMaFEAEAADNIjQUFsToASImFGAEAAMaFIAEAADRIjQX0sDoASImFKAEAAMaFMAEAADVIjQXjsDoASImFOAEAAMaFQAEAADZIjQXSsDoASImFSAEAAMaFUAEAADdIjQXBsDoASImFWAEAAMaFYAEAADhIjQWwsDoASImFaAEAAMaFcAEAADlIjQWfsDoASImFeAEAAMaFgAEAAEFIjQWOsDoASImFiAEAAMaFkAEAAEJIjQV9sDoASImFmAEAAMaFoAEAAENIjQVssDoASImFqAEAAMaFsAEAAERIjQVbsDoASImFuAEAAMaFwAEAAEVIjQVKsDoASImFyAEAAMaF0AEAAEZIjQU5sDoASImF2AEAAMaF4AEAAEdIjQUosDoASImF6AEAAMaF8AEAAEhIjQUXsDoASImF+AEAAMaFAAIAAElIjQUGsDoASImFCAIAAMaFEAIAAEpIjQX1rzoASImFGAIAAMaFIAIAAEtIjQXkrzoASImFKAIAAMaFMAIAAExIjQXTrzoASImFOAIAAMaFQAIAAE1IjQXCrzoASImFSAIAAMaFUAIAAE5IjQWxrzoASImFWAIAAMaFYAIAAE9IjQWgrzoASImFaAIAAMaFcAIAAFBIjQWPrzoASImFeAIAAMaFgAIAAFFIjQV+rzoASImFiAIAAMaFkAIAAFJIjQVtrzoASImFmAIAAMaFoAIAAFNIjQVcrzoASImFqAIAAMaFsAIAAFRIjQVLrzoASImFuAIAAMaFwAIAAFVIjQU6rzoASImFyAIAAMaF0AIAAFZIjQUprzoASImF2AIAAMaF4AIAAFdIjQUYrzoASImF6AIAAMaF8AIAAFhIjQUHrzoASImF+AIAAMaFAAMAAFlIjQX2rjoASImFCAMAAMaFEAMAAFpIjQXlrjoASImFGAMAAMaFIAMAAFtIjQVs4joASImFKAMAAMaFMAMAAFxIiYU4AwAAxoVAAwAAYEiNBVHiOgBIiYVIAwAAxoVQAwAAYUiNBUTiOgBIiYVYAwAAxoVgAwAAYkiNBTfiOgBIiYVoAwAAxoVwAwAAY0iNBSriOgBIiYV4AwAAxoWAAwAAZEiNBR3iOgBIiYWIAwAAxoWQAwAAZUiNBRDiOgBIiYWYAwAAxoWgAwAAZkiNBQPiOgBIiYWoAwAAxoWwAwAAZ0iNBfbhOgBIiYW4AwAAxoXAAwAAaEiNBenhOgBIiYXIAwAAxoXQAwAAaUiNBdzhOgBIiYXYAwAAxoXgAwAAakiNBc/hOgBIiYXoAwAAxoXwAwAAa0iNBcbhOgBIiYX4AwAAxoUABAAAbEiNBbXhOgBIiYUIBAAAxoUQBAAAbUiNBbDhOgBIiYUYBAAAxoUgBAAAbkiNBavhOgBIiYUoBAAAxoUwBAAAb0iNBZ7hOgBIiYU4BAAAxoVABAAAcEiNBWGtOgBIiYVIBAAAxoVQBAAAcUiNBVCtOgBIiYVYBAAAxoVgBAAAckiNBT+tOgBIiYVoBAAAxoVwBAAAc0iNBS6tOgBIiYV4BAAAxoWABAAAdEiNBR2tOgBIiYWIBAAAxoWQBAAAdUiNBQytOgBIiYWYBAAAxoWgBAAAdkiNBfusOgBIiYWoBAAAxoWwBAAAd0iNBeqsOgBIiYW4BAAAxoXABAAAeEiNBdmsOgBIiYXIBAAAxoXQBAAAeUiNBcisOgBIiYXYBAAAxoXgBAAAekiNBbesOgBIiYXoBAAAxoXwBAAAe0iNBaasOgBIiYX4BAAAxoUABQAAoEiNBZXgOgBIiYUIBQAAxoUQBQAAoUiNBYjgOgBIiYUYBQAAxoUgBQAAokiNBXvgOgBIiYUoBQAAxoUwBQAAo0iNBW7gOgBIiYU4BQAAxoVABQAApEiNBWHgOgBIiYVIBQAAxoVQBQAApUiNBVTgOgBIiYVYBQAAuTAAAADoG58KAEiL8EiJAEiJQAhIiUAQZsdAGAEBSIkFqFY8AEiNXCRASbxVVVVVVVVVBUyNNZJWPABFM/8PH4AAAAAATIvLTIvGSI2VeAUAAOieIAgADxAADxFEJCDyDxBAEPIPEYVwBQAAgL1wBQAAAHVgTDklWVY8AA+EkwAAAEiLPURWPABMiXQkMEyJfCQ4uTAAAADoiJ4KAJAPEAMPEUAgSIk4SIl4CEiJeBBmx0AYAABMiXwkOA8QRCQgDylEJCBMi8BIjVQkIEmLzuiQIggASIPDEEiNhWAFAABIO9gPhVz///9IjQ2l5QoATI2cJJAGAABJi1sgSYtzKEmLezBNi2M4SYvjQV9BXl3pBKMKAOh7HggAkMzMzMzMzMzMzMxIg+wouRgAAADo8p0KAEiNDdvlCgBIiQBIiUAISIkFvVs8AEiDxCjpyKIKAMzMzMxIjQ0Z5goA6biiCgDMzMzMSI0NGeYKAOmoogoAzMzMzEiB7IgAAACLDY9RPABlSIsEJVgAAAC6BAAAAEiLBMiLDAI5DWhaPAB+LUiNDV9aPADomp4KAIM9U1o8AP91GEiNDQrmCgDoWaIKAEiNDT5aPADoDZ4KAEiNRCRASImEJJAAAABIjQX99DoASIlEJEBIjUQkQEiJRCR4D1fADxFEJCAPV8nzD39MJDBBuAsAAABIjRVA8zoASI1MJCDozuIAAJBMjUQkQEiNVCQgSI0NxFk8AOjHmAkAkEiNTCQg6FzgAABIgcSIAAAAw8zMzMxIgeyIAAAAiw2/UDwAZUiLBCVYAAAAugQAAABIiwTIiwwCOQ2YWTwAfi1IjQ2PWTwA6MqdCgCDPYNZPAD/dRhIjQ065QoA6ImhCgBIjQ1uWTwA6D2dCgBIjUQkQEiJhCSQAAAASI0FnfQ6AEiJRCRASI1EJEBIiUQkeA9XwA8RRCQgD1fJ8w9/TCQwQbgJAAAASI0VgN06AEiNTCQg6P7hAACQTI1EJEBIjVQkIEiNDfRYPADo95cJAJBIjUwkIOiM3wAASIHEiAAAAMPMzMzMSIHsiAAAAIsN7088AGVIiwQlWAAAALoEAAAASIsEyIsMAjkNyFg8AH4tSI0Nv1g8AOj6nAoAgz2zWDwA/3UYSI0NauQKAOi5oAoASI0Nnlg8AOhtnAoASI1EJEBIiYQkkAAAAEiNBQX0OgBIiUQkQEiNRCRASIlEJHgPV8APEUQkIA9XyfMPf0wkMEG4CQAAAEiNFcjxOgBIjUwkIOgu4QAAkEyNRCRASI1UJCBIjQ0kWDwA6CeXCQCQSI1MJCDovN4AAEiBxIgAAADDzMzMzEiB7IgAAACLDR9PPABlSIsEJVgAAAC6BAAAAEiLBMiLDAI5DfhXPAB+LUiNDe9XPADoKpwKAIM941c8AP91GEiNDZrjCgDo6Z8KAEiNDc5XPADonZsKAEiNRCRASImEJJAAAABIjQXl8ToASIlEJEBIjUQkQEiJRCR4D1fADxFEJCAPV8nzD39MJDBBuAkAAABIjRVA5ToASI1MJCDoXuAAAJBMjUQkQEiNVCQgSI0NVFc8AOhXlgkAkEiNTCQg6OzdAABIgcSIAAAAw8zMzMxIgeyIAAAAiw1PTjwAZUiLBCVYAAAAugQAAABIiwTIiwwCOQ0oVzwAfi1IjQ0fVzwA6FqbCgCDPRNXPAD/dRhIjQ3K4goA6BmfCgBIjQ3+VjwA6M2aCgBIjUQkQEiJhCSQAAAASI0FbfA6AEiJRCRASI1EJEBIiUQkeA9XwA8RRCQgD1fJ8w9/TCQwQbgHAAAASI0VkN86AEiNTCQg6I7fAACQTI1EJEBIjVQkIEiNDYRWPADoh5UJAJBIjUwkIOgc3QAASIHEiAAAAMPMzMzMSIHsiAAAAIsNf008AGVIiwQlWAAAALoEAAAASIsEyIsMAjkNWFY8AH4tSI0NT1Y8AOiKmgoAgz1DVjwA/3UYSI0N+uEKAOhJngoASI0NLlY8AOj9mQoASI1EJEBIiYQkkAAAAEiNBbXwOgBIiUQkQEiNRCRASIlEJHgPV8APEUQkIA9XyfMPf0wkMEG4CQAAAEiNFRjkOgBIjUwkIOi+3gAAkEyNRCRASI1UJCBIjQ20VTwA6LeUCQCQSI1MJCDoTNwAAEiBxIgAAADDzMzMzEiB7IgAAACLDa9MPABlSIsEJVgAAAC6BAAAAEiLBMiLDAI5DYhVPAB+LUiNDX9VPADoupkKAIM9c1U8AP91GEiNDSrhCgDoeZ0KAEiNDV5VPADoLZkKAEiNRCRASImEJJAAAABIjQVV8DoASIlEJEBIjUQkQEiJRCR4D1fADxFEJCAPV8nLine truncated
@@ -0,0 +1,7 @@
+# EF-Cheeto .text section — chunk 2/4
+# RVA range: 0x2CF20–0x58E40
+# Size: 180,000 bytes / ~60,000 tokens
+# ImageBase: 0x180000000  VA = 0x018002CF20
+# To decode: import base64; data = base64.b64decode(open(this).read().split('\n',6)[-1])
+
+EoO/lBwAAP91CUAPttXrBUUywDLSi4tMFgAAhcl1HUWEyXQgi4O4IQAAiYPQIQAAx4PcIQAAAgAAAOsIO4u4IQAAdTiE0nQSi4O4IQAAiYPQIQAAiavcIQAAhcl0CDuLuCEAAHUWQIT2dQVFhMB0DIuDuCEAAImD1CEAAIuDTBYAAIXAdAg7g7ghAAB1JUWEyXUEhNJ0HIuDuCEAAImD2CEAAImH8CEAAMeH9CEAAM3MzD0z9kiLg8AhAABIhcB0EvdAFAAAAQB0CcaDtCEAAADrFoB7fwB0EIC7ECIAAAB1B0CIq7QhAADzDxCL9CEAAA8vznYXDyjBD1fJ8w9cQ0jzD1/I8w8Ri/QhAAAPLs56CHUGibPwIQAAi4P4IQAAhcB0HomD2CEAAImD1CEAAImD0CEAAIuD/CEAAImD3CEAAImz+CEAAOgDBAAAg7tgIgAA/0iLPYWbOQAPhT8BAABMi4/AIQAATYXJD4QvAQAASIO/mCMAAAAPhSEBAABB90EUAAABAA+FEwEAAIC/QAEAAAAPhAYBAADzDxCHRAEAAA8v8A+H9QAAAA8uxkyLx3oCdCvzDxCPqAAAAA8vwQ+G2gAAAPMPEJesAAAAuQACAADoqID//4XAD47AAAAAQYC4ZB8AAAB0DkGDuEwWAAD/D4WoAAAAQYO4xBYAAP8PhZoAAACAvzgBAAAAD4WNAAAAgL86AQAAAA+FgAAAAA+2hzkBAABAhG8wdCGEwHQHvf/////rLoC/tCEAAAB1JYO/TBYAAAB1HIvu6xiEwHQHvf/////rDYO/TBYAAACL7kAPlcWJr5AiAAC4IQAAAEGAuQgBAAAAuf////9BuAAUAABED0Xwwf0fRYvOjVUD6Crw///Hh5QiAAD/////gL9RIgAAAEyLtCTAAAAASIusJLAAAAB1DYC/EiIAAAB1BDLA6wKwAYiHESIAAEiLi8AhAADGg7chAAAASIXJD4TEAQAA90EUAAABAA+FtwEAAEiDu5gjAAAAD4WpAQAAZoO5rAEAAADzDxCBEAMAAPMPWQXQYDgAi5NgIgAA8w8QFR5gOADzD1lDSPMPWAXRXzgA8w8swGYPbtgPW9sPhY4AAACAubIBAAAAD4SBAAAAg/r/dHzzDxAN6mA4AIXSdAqD+gF1Mw8owusDDyjB8w9Zw4mx5AAAAImx7AAAAPMPWIHMAAAA8w8swGYPbsAPW8DzDxGB3AAAAIP6AnQIg/oDdS4PKMrzD1nLibHoAAAAibHwAAAA8w9YidAAAADzDyzBZg9uwA9bwPMPEYHgAAAARYTtD4TOAAAAgL9gCQAAAEiLx/MPEI/8CQAA8w8Qh9wJAADzD1yP7AkAAPMPXIfMCQAAdBOAv+QcAAAAdQrzDxAVrF44AOsagLhwCQAAAHQRgLjwHAAAAHUI8w8QFXRfOAAPLsZ6AnQ4gLn8AAAAAHQv8w9Zw4mx5AAAAImx7AAAAPMPWcLzD1iBzAAAAPMPLMBmD27AD1vA8w8RgdwAAAAPLs56AnQv8w9Zy4mx6AAAAImx8AAAAPMPWcrzD1iJ0AAAAPMPLMFmD27AD1vA8w8RgeAAAAAPKHQkcEWE5EyLpCS4AAAAdRBFhO11C2bHg7QhAAAAAOtWRYT/dFGAe3oAdEv2QzQEdEVIjUwkIOja8f//8w8QAPMPEEgE8w8Rh/QKAADzDxGP+AoAAPMPEYcYAQAA8w8RjxwBAABIx4cEAQAAAAAAAMaH6wAAAAGJs4wiAABIi0wkaEgzzOh84gcASIHEgAAAAEFfQV1fXlvDzMzMzMzMzMzMzMzMzEiJXCQYSIlsJCBWV0FXSIHsoAAAAEiLPXSXOQBEDylcJEBIi99EDylsJDCLbzBIi7fAIQAAQPbFAnQL9kc0AXQFQbEB6wNFMslAgOUBDym0JJAAAABFM/8PKbwkgAAAAEQ4v1IiAAB0L0iF9nQq9odUKgAAEHQZi5dgIgAASI0NHP43AOh3+AAASIs9AJc5AA9X9unwAwAAx4dgIgAA/////w9X9kyJv1QiAABIhfYPhJoDAABMOb+YIwAAD4WNAwAA90YUAAABAA+FgAMAAESLl2AfAADzDxAt8lw4APMPED32XDgAQfbCAQ+FzgAAAEWEyXRVRDi/IAkAAHRM8w8QhyQJAAAPL/B3Pw8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2GLl+AgAA6PR7//+FwH4KQYO4rBwAAP90bUCE7XRvRDi/UAEAAHRm8w8Qh1QBAAAPL/B3WQ8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2MrkBAgAA6Jp7//+FwH4kRTi4ZB8AAHQKQYO4TBYAAP91EUGDuNAWAAD/dQdEib9gIgAAQfbCAg+F0QAAAEWEyXRVRDi/MAkAAHRM8w8QhzQJAAAPL/B3Pw8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2GLl/AgAA6Bx7//+FwH4KQYO4uBwAAP90bUCE7XRyRDi/YAEAAHRp8w8Qh2QBAAAPL/B3XA8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2NbkCAgAA6MJ6//+FwH4nRTi4ZB8AAHQKQYO4TBYAAP91FEGDuNwWAAD/dQrHh2AiAAABAAAAQfbCBA+F0QAAAEWEyXRVRDi/QAkAAHRM8w8Qh0QJAAAPL/B3Pw8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2GLmAAgAA6EF6//+FwH4KQYO4xBwAAP90bUCE7XRyRDi/cAEAAHRp8w8Qh3QBAAAPL/B3XA8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2NbkDAgAA6Od5//+FwH4nRTi4ZB8AAHQKQYO4TBYAAP91FEGDuOgWAAD/dQrHh2AiAAACAAAAQfbCCA+F0QAAAEWEyXRVRDi/UAkAAHRM8w8Qh1QJAAAPL/B3Pw8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2GLmBAgAA6GZ5//+FwH4KQYO40BwAAP90bUCE7XRyRDi/gAEAAHRp8w8Qh4QBAAAPL/B3XA8uxkyLx3oCdCvzDxCPqAAAAPMPEJesAAAA8w9ZzfMPWdcPL8F2NbkEAgAA6Ax5//+FwH4nRTi4ZB8AAHQKQYO4TBYAAP91FEGDuPQWAAD/dQrHh2AiAAADAAAAi4dgIgAAiYdoIgAAx4d8IgAA//9/f8eHgCIAAP//f3/Hh4QiAAD//3//x4eIIgAA//9//0iF9nQdg7tgIgAA/3UUQITtdA/otQwAAEiLPe6SOQAPKPCLi2AiAABEiLtSIgAAg/n/dBlEi4tYIgAARIuDVCIAAIuTaCIAAOig6P//RDi7UCIAAHRbRDm7uCEAAHVS9oNUKgAAEHQsSIX2dAZIi1YI6wdIjRUz9zcARIuDzCEAAEiNDbX5NwDo8PMAAEiLPXmSOQBmx4MSIgAAAQFEibsgIgAARDh7fnQHxoO0IQAAAfNEDxAdn1k4APNEDxAtrlg4AEyJtCTIAAAARA8pRCRwRA8pTCRgRA8pVCRQRDi7UCIAAA+EGQIAAIO7ACIAAAMPhQwCAABEObvMIQAAD4X/AQAASIX2D4T2AQAAi6tUIgAASI2MJMAAAADzDxCGYAEAAESL9fMPEI5kAQAASIvW8w8QvnACAACD5QrzRA8QhnQCAADzQQ9c/fNEDxCWeAIAAPNFD1zF80QPEI58AgAA80UPWNXzRQ9YzfMPXPjzRA9cwfNED1zQ80QPXMnoyrv///MPEADzDxBIBPMPXIbMAAAA8w9cjtAAAADzD1j480QPWMHzRA9Y0PNED1jJQYPmBXQIhe0PhUYBAABIY4PMIQAASIPARUgDwPMPEATGDy/HciDzDxBExgRBDy/AchREDy9UxghyDEQPL0zGDA+DDgEAAPaDVCoAABB0E0iNDXD4NwDoc/IAAEiLPfyQOQDzDxCGEAMAAEEPKMrzD1kFDFc4AEEPKNHzDxAdZFg4APMPXM/zQQ9c0PMPXcjzD13QRYX2dQvzD1j580QPXNHrBw8o+0UPKNOF7XUM80QPWMLzRA9cyusIRA8ow0UPKMtIY4PMIQAASIPARUgDwPMPEETGBEQPL8B2BkEPKMjrCEEPKMnzD13I8w8QFMYPL/p2BQ8ox+sIQQ8owvMPXcLzDxEExvMPEUzGBPMPEETGDEQPL8B3CUUPKMHzRA9dwPMPEETGCA8v+HcIQQ8o+vMPXfjzDxF8xgjzRA8RRMYMRIm7uCEAAESJfCQkRIl8JCzrEQ9XwA8RRCQgSIX2D4QPAgAASGODzCEAAEiDwEVIA8DzDxAExg8vRMYIdxPzDxBExgQPL0TGDHcGDxAkxusDD1fk8w8QjmQBAAAPKMTzDxC+YAEAAA8o2YuDVCIAAA8o1w/GxFXzD1jU8w9Y2A8oxA/GxKoPxuT/8w9Y+PMPWMzzDxFUJCDzDxFcJCTzDxF8JCjzDxFMJCwPuuALD4OZAAAADy+WcAIAAHIsDy+edAIAAHIj8w8QhngCAAAPL8dyFvMPEIZ8AgAADy/BcgmDyCCJg1QiAAAPEEQkIPMPWN4PL8LzD1jO8w8RXCQkDxGDfCIAAPMPEUwkLHYI8w8Rk3wiAADzDxCDgCIAAA8vw3YI8w8Rm4AiAAAPL7uEIgAAdgjzDxG7hCIAAA8vi4giAAB2CPMPEYuIIgAARDi7UCIAAA+E2QAAAPaDVCIAAIBIi4fAIQAARIuDYCIAAEhji8whAABIi5YwBAAA8w8QoGABAADzDxCoZAEAAHVR8w8QhMpwBAAAQQ8uw3oYdRbzQQ9Y1fMPXdfzD1zU8w8RlMpwBAAA8w8QhMp0BAAAQQ8uw3obdRnzD1jL8w9ZDW5UOADzD1zN8w8RjMp0BAAAQY1Line truncated
@@ -0,0 +1,7 @@
+# EF-Cheeto .text section — chunk 3/4
+# RVA range: 0x58E40–0x84D60
+# Size: 180,000 bytes / ~60,000 tokens
+# ImageBase: 0x180000000  VA = 0x0180058E40
+# To decode: import base64; data = base64.b64decode(open(this).read().split('\n',6)[-1])
+
+QFNIg+wgSItZUEiLC/8VfYcFAEiLC/8VvIYFAEiLC0iDxCBbSP8lbYcFAMzMzMzMQFNIg+wgSItZUP8VcIcFAEg7Aw+UwEiDxCBbw8zMzMxIg+woSItJUEiLCf8Vb4YFAIXAD5XASIPEKMPMzMzMzEiJXCQISIlsJBBIiXQkGEiJfCQgQVZIg+xASIvyTItxUDPtiWwkKEiJbCQgQbn/////TIvCM9K56f0AAP8VroEFAIv4SIlsJDCL3UiJXCQ4hcB+HovQuAgAAAA70A9M0IXSfg5IY8pIA8nocf/7/0iL2Il8JChIiVwkIEG5/////0yLxjPSuen9AAD/FV+BBQBMi8tFM8C6DAAAAEmLDv8V64UFAJBIhdt0ckyLBZ7cNgBNhcB0XEWLSARJD7+QHCsAAEmNiCArAABIjQzRRDkJdDWNSgG4q6qqKvfpi8LB6B8D0I0EUgPAK8hmQYmIHCsAAEgPv8lIgcFkBQAASY0MyESJCYlpBGb/QQZB/4AYKwAASIvL/xVshwUAkEiLXCRQSItsJFhIi3QkYEiLfCRoSIPEQEFew8zMzMzMzMzMQFNIg+wwSItZULrs////8w8QBV2iNQAPKXQkIA8o8Q8vxkiLC3ZE/xUbhQUASIsLuuz///8PuugTRIvA/xV+hQUA8w9ZNeKiNQAz0kiLC0G5AgAAAPNEDyzGDyh0JCBIg8QwW0j/JYWFBQD/FdeEBQBIiwu67P///w+68BNEi8APKHQkIEiDxDBbSP8lL4UFAMzMzMzMzMzMzMzMzMzMzEiD7ChIi0lQugIAAABIiwn/FeqEBQBIi8hIg8Qo6X70///MzMzMzMzMzMzMzMzMzEiJXCQISIlsJBBIiXQkGEiJfCQgQVZIg+wwi/JJi+lIjRXaWjUATYvwSIvZ/xX2hAUATIvNTYvGSIv4i9ZIi8tIhcAPhKgAAABIg8AwSIlEJCDoCeb//0iFwHQKuAEAAADpkQAAAEiLj4gNAABIY4eADQAASI0UwUg7ynRpDx8ASIsBSDlYWHQLSIPBCEg7ynXu61KLzoPpA3RHg+kCdDyD6Qt0L4PpEXQUg/ljdTf2QASAdDFIx8D/////6zmLSASD4UCLwffYSBvAg+ADhcl1JesSxkBrATPA6xvGQGoB6wTGQGkBTIvNTYvGi9ZIi8v/FYmDBQBIi1wkQEiLbCRISIt0JFBIi3wkWEiDxDBBXsPMzMzMzMzMzMzMzMzMzEiJXCQISIl0JBBXSIHskAAAAEiLBUe+NgBIM8RIiYQkgAAAAEiNBbX+///HRCQwUAAAADP2SIlEJDgzyUiJdCRAx0QkNAMAAAD/FWGABQBmD28NaaE1AEiNTCQwSIlEJEgPV8BIjQWtWjUAZg9/RCRQSIlEJHBmD39MJGBIiXQkeP8V0YMFAEiLBZLZNgBIhcB0CUiLuNAAAADrA0iL/kiNmGANAACLSwSFyXkYi8GZK8KL1tH4A8iFyQ9P0UiLy+hLAgAARTPJiTNMjQWf2f//M9Izyf8VnYMFAEiLDT7ZNgBIjQWn8///QIh3MEiJgZgMAABIjQWl9f//SImBoAwAAEiNBbf2//9IiYGoDAAASI0FOfn//0iJgbAMAABIjQW7+P//SImBuAwAAEiNBV36//9IiYHADAAASI0F3/n//0iJgcgMAABIjQUR+///SImB2AwAAEiNBTP7//9IiYHgDAAASI0FRfv//0iJgegMAABIjQVX+///SImB8AwAAEiNBYn8//9IiYH4DAAASI0Fm/b//0iJgQANAABIjQUN/f//SImBGA0AAEiNBc9z+/9IiYEgDQAASIuBQCEAAEiLudAAAAC5IAAAAEiLGP8VbIMFAEyLFUXYNgBMi8BNhdJ0W0kPv5IcKwAASY2CICsAAEWLSgRIjQTQRDkIdDSNSgG4q6qqKvfpi8LB6B8D0I0EUgPAK8hmQYmKHCsAAEgPv8FIBWQFAABJjQTCRIkIiXAEZv9ABEH/ghQrAABNhcB0EUmJcAhJiTBBiHAQSYlwFOsDTIvGSIsHSYkAQYhwEEyJQ1BIi4wkgAAAAEgzzOh7IgUATI2cJJAAAABJi1sQSYtzGEmL41/DzMzMzMzMSIlcJAhXSIPsIESLQQRIi9mLCUiL+kE7yHUo/8FFhcB0DUGLwJkrwtH4QQPA6wW4CAAAADvBD0/Ii9FIi8voPQAAAEhjAw8QB0iNDEBIi0MISAPJDxEEyA8QTxAPEUzIEA8QRyAPEUTIIP8DSItcJDBIg8QgX8PMzMzMzMzMzMxIiVwkEFdIg+wgSGP6SIvZO3kED469AAAASI0Mf0iJdCQwSMHhBOh1+fv/SItTCEiL8EiF0g+EjwAAAEhjC0yNBElIi8hJweAE6CYzBQBMi0sITYXJdGpMiwWy1jYATYXAdF5JD7+QHCsAAEmNiCArAABFi1AESI0M0UQ5EXQ3jUoBuKuqqir36YvCwegfA9CNBFIDwCvIZkGJiBwrAABID7/JSIHBZAUAAEmNDMgzwESJEYlBBGb/QQZB/4AYKwAASYvJ/xV+gQUASIlzCEiLdCQwiXsESItcJDhIg8QgX8PMzMzMzMzMzMzMzMzMzMxIiVwkCItBBEyLyiUA4AAATIvRuwgAAAA9ACAAAHQKRIvDPQBAAAB1BkG4EAAAAEmLyUi4R1juaYTlnkZJK0oYSPfpuQAAAgBIwfoFSIvCSMHoP0gD0LgAAAEAhdJBD7ZRcQ9EyEGLwIPIIEH2QgQBQcZBcgBBD0XAgOIDC8hBiFFxQYsBJQAAAA8LyEGJCUGLSgSEy3RXD7rhG0HGQXIJuGAAAABBuHAAAABED0PAuAwAAAAPQ8NECsBECsJmQYN5Xv9FiEFxdCVBD7bQi8LB6gSD4AMPo8JyFEGA4PxBgPABRYhBcUHGgjoCAAABSItcJAjDzMzMzMzMzMzMzMzMSIvEVVNXSI1o2EiB7BABAACLeQRIi9lIiXAQgecA4AAASIs1+NQ2ADPSTIlgGEUz5EyJaCBMiXDgTIl42A8pcMgPKXi4RA8pSJhEDymgaP///0QPKahY////i0Fsg8AfxoFAAgAAAcH4BUxjwGZEiaECAgAASItJUEnB4AJIiXQkWIl8JDDo/zAFAItDbDPSSItLSIPAH8H4BUxjwEnB4ALo5DAFAPNEDxAt1Zo1ALr/////i0tsRTLSQQ8oxWaJkxwCAADzD1+G3A0AAEUy/0SJZCQoRIlUJCRFi8xFi+yL8kUPV+QPV/bzDxGDuAAAAA9X5EWL9IXJD45RAgAAkEiLQyhJD788BEE7/nQHxoNAAgAAAExr33RMA1sYZjm7BgIAAH8vSYvTSIvL6M/9//9Ei0wkKLr/////RItUJCRmQYlTVEHHQzQAAAAAQcdDIAAAgL/2QwQEdAZB9gOAdAVBxkNoAUEPtkNoQThDZ3QLQYhDZ8aDPwIAAAFBgHtnAHQKQfYDAXUEsAHrAjLAZkGDe17/QYhDZnQLhMB1B8aDOgIAAAFmQYN7XgB+EPdDBAAAAAR1B8aDOgIAAAFB9gMQdAdFDy9jEOsFRQ8vYxwPl8CEwHQHZkHHQ28HB0GAe2YAdQpmQYlTWOlHAQAAZkGJc1pmQYlTXIP+/3QSSGPGSGvIdEiLQxhmiXwBXOsHZom7HAIAAA+3iwICAABMi8dJwfgFi/eNQQFmiYMCAgAAZkGJS1iLz0iLU1CD4R9CiwSCD6vIQokEgk0Pv0NWSItLSEmL0EjB+gVBg+AfiwSRRA+rwIkEkUGAe20AdV9mg3t4AHVY80EPEEtE80EPX0tI80EPEFM4QYsD8w9cyg+64A1yDvNBDxBDUPMPXMLzD1/IqBB0GfNBDxBDIEEPL8R2DfZDBAF0BKggdAMPKMjzD1+LuAAAAPNBDxFLFEGLC0G4AQAAAIvBRQ+20oPgIEUPRNBEiVQkJPbBEHQW80EPEEMgQQ8vxHYKhcB0BvNBDxFDFEGAe28Auv/////zQQ8QQxRFD7b/RQ9F+PbBCHQJ8w9Y8EH/xesMQf/B8w9f4ESJTCQoi0tsQf/GSYPEAkQ78Q+Mt/3//4t8JDBFM+SLQwSoCHQXZoO7AAIAAAB1DQ+64BtyB8aDOgIAAAFmibMeAgAARYT/dCFIi4OIAQAASDmDgAEAAHQKxoAGAQAAAItLbMaDPwIAAAHHgyACAAD/////QQ8o1EEPKOxFi9SFyQ+OpwEAAPMPEB0QmDUASItDUEGL0k1jwoPiH0mLyEjB+QWLDIgPo9EPg3ABAABMi0sYTWvAdEOLBAiLyIPhIKgQD4SDAAAA80MPEEwIFIH/AEAAAHUPQ4B8CG8AdQSFyXQDDyjMQw+2RAhvhMB0PPNDDxFMCBA8AXZEgLs5AgAAAHQ7Q4B8CG0AdTPzDxCDuAAAAPMPWcPzD1/I80MPEUwIEPMPWNHp3QAAAIXJdA9DgHwIawB0B/NDDxFMCBDzQw9YVAgQ6b4AAABDgHwIbwB1EfNDDxBMCBxEDy/hdwSFyXRL80MPEEwIIEEPL8x2CfNDDxFMCBzrNYH/AGAAAHUg80MPEEwIFPMPXs5mQQ9uxQ9bwPMPWcjzQw8RTAgc6w1Dx0QIHAAAgD9BDyjNSA+/gyACAADzD1jpZoP4/3QVSItLGEhr0HRDD7dECFZmOUQKVn4IZkSJkyACAABID7+DIgIAAGaD+P90FUiLSxhIa9B0Qw+3RAhWZjlEClZ9CGZEiZMiAgAAQ8ZECG0A8w8Qg8AAAADzD1jA8w9Y0ItLbEH/wkQ70Q+MYf7//4C7SAIAAACLRCQoD7+TAgIAAPMPEJvIAAAA8w9Ym8QAAADzDxCLvAAAAA8QsxABAABmiYMEAgAAjUL/Zg9uwPMPWMkPW8DzDxGr2AAAAPMPWdgPEXQkaPMPWNl0H0iLg4gBAACAuP0AAAAAdQ9Ii3wkWPMPEI8UDgAA6wlIi3wkWEEPKMyLQwQPuuAYcyLzDxCDzAAAAEEPLsR6FHUS8w8QgygBAADLine truncated
@@ -0,0 +1,7 @@
+# EF-Cheeto .text section — chunk 4/4
+# RVA range: 0x84D60–0xB0200
+# Size: 177,312 bytes / ~59,104 tokens
+# ImageBase: 0x180000000  VA = 0x0180084D60
+# To decode: import base64; data = base64.b64decode(open(this).read().split('\n',6)[-1])
+
+D1fJ8w9/TahBuAEAAABIjRV/qzIASI1NmOgyr/j/kEyNRZhIjZWAAAAASI0NHyo0AOg6igEASIvYSIN4GA92A0iLGPMPLNdIjU0w6BCo//+QScfA/////w8fhAAAAAAASf/AQoA8AwB19kiL00iNTTDoeqn4/w8QAA8RhaAAAAAPEEgQDxGNsAAAAMYAAEyJcBBIx0AYDwAAAEiNlaAAAABmSA9+wWYPb8FmD3PYCGZID37ASIP4D0gPR9FmSQ9+yEiNjcAAAADoI6n4/0iNlcAAAABIjU0Q6JOp+P9IjU0Q6Bqs+P+QSI2NoAAAAOgNrPj/kEiNTTDoA6z4/5BIjY2AAAAA6Par+P+QSI1NmOjsq/j/gH86AA+ELgEAAA9XwA8RhaAAAABMibWwAAAATIm1uAAAAEG4BwAAAEiNFVWqMgBIjY2gAAAA6AGu+P+QSIsFKR40ADPSSYvP/9BIhcB0dkiL0EiNTZjooWsBAEiLlbgAAABIg/oPdjRI/8JIi42gAAAASIvBSIH6ABAAAHIZSIPCJ0iLSfhIK8FIg+gISIP4Hw+H+AMAAOhIaAIADxBFmA8RhaAAAAAPEE2oDxGNsAAAAPNED39NqMZFmABIjU2Y6Cer+P9Ig73QAAAAAHQZQbgDAAAASI0VsKkyAEiNjcAAAADo9Kf4/0iNlaAAAABIg724AAAAD0gPR5WgAAAATIuFsAAAAEiNjcAAAADoyqf4/0iNlcAAAABIjU0Q6Dqo+P9IjU0Q6MGq+P+QSI2NoAAAAOi0qvj/gH88AA+E3gAAAEmLxkiNDUCw9/85tIEI+ToAdBVI/8BIg/gGcu5IjRULpjIATYvG6x5IA8APEIzBIPk6AGYPb8FmD3PYCGZJD37AZkgPfsoPV8APEYWgAAAATIm1sAAAAEyJtbgAAABIjY2gAAAA6JCs+P+QSIO90AAAAAB0GUG4AwAAAEiNFcioMgBIjY3AAAAA6Ayn+P9IjZWgAAAASIO9uAAAAA9ID0eVoAAAAEyLhbAAAABIjY3AAAAA6OKm+P9IjZXAAAAASI1NEOhSp/j/SI1NEOjZqfj/kEiNjaAAAADozKn4/0iDvdAAAAAAD4TWAQAA8w8QRfDzDxFEJGhmQQ9uzA9byfMPXE308w8RTCRsSIsdORs0AEiLc3BIhfZ0B/MPEHYc6wtBDyjwSIuz4BIAAEiLg+ASAABIiUUA8w8Qg/QSAADzDxFFCPMPEIvwEgAA8w8RTQxIjYvIIAAASI1VAOgZjvv/QQ8u8HoKdQjzDxCz9BIAAEEPKNAPKM5Ii87o+vj5/0iLBcMaNABIi4jYFQAATI0FxW0yALoBAAAASItJQOjXPfn/TIvQTI2FwAAAAEiDvdgAAAAPTA9HhcAAAABIjUwkdOjj0vj/i/CpAAAA/3RSTYXAdE1BgDgAdEdBDxBCYA8RRCRwSYtKOESJdCRI80QPEUQkQEyJdCQ4TIlEJDBIjUQkcEiJRCQoiXQkIEyNTCRoQQ8o0kmL0kiLSRjoqMP8/0iLHSEaNABIY4PIIAAAhcB/DkiNDe9vMgDoOjD6/+smSAPASIuL0CAAAPMPEFTB/PMPEEzB+EiLTMHw6Bj4+f//i8ggAABIiwXbGTQASIuI2BUAAEyNBd1sMgC6AQAAAEiLSUDo7zz5/0iLyEGLxZkrwtH4Zg9uwA9bwPMPEUWIx0WMAAAAAPNEDxFcJCBEi85MjUQkaEiNVYjoqUX8/5BIjY3AAAAA6Nyn+P9Ii1wkWEj/w0iJXCRYTIt9kEmDxwhMiX2QSGNEJFBIO9gPgoX4//9Ii43gAAAASDPM6BZkAgBMjZwkcAIAAEmLWzBJi3M4SYt7QEEPKHPwQQ8oe+BFDyhD0EUPKEvARQ8oU7BFDyhboEUPKGOQRQ8oa4BJi+NBX0FeQV1BXF3DTIl0JCBFM8lFM8Az0jPJ/xUoxQIAzMzMzMzMzMxMi9xJiVsYSYlrIFZXQVZIgeygAAAATIsFwxg0AEyL8UEPKXPYSIv6QQ8pe8jzDxA9h98yAEmLgNgVAABFDylDuEUPKVOoQcdDEAAAIELGgAMBAAABSYuI2BUAAEHHQxQAAKBB8g8QgVABAABIi7EYAwAA8kEPEUMI6OL4+f9Iiw1bGDQAi9BIi5nYFQAASIvL6Fr5+f9IgcNAAQAAi+hEi0MEiwtBO8h1KP/BRYXAdA1Bi8CZK8LR+EEDwOsFuAgAAAA7wQ9PyIvRSIvL6H6d+/9IYwtIjZQkyAAAAEiLQwiJLIj/A+hFuP3/RTPAM9Izyei5B/r/hMB0FzPJ6L4z+f+EwHQMgD8AswEPlMCIB+sCMtvzDxCEJMQAAABMjYQkyAAAAIA/APMPWMfzRA8QhCTAAAAASI2UJMAAAADzRA8QFWHeMgBBDyjw8w9YNYHeMgC4ZMhk/0G5yFBQ/0QPRcjzDxGEJMwAAAAz7UiLzolsJCjzDxG0JMgAAADzRA8RVCQg6MdF/P9AOC90CvMPEAWu3TIA6wMPV8DzDxAVAd4yAPNFD1jC8w9Zx0iNlCTIAAAARTPJx0QkIDAAAABIi87zQQ9YwPMPEYQkyAAAAPMPEIQkxAAAAPNBD1jC8w8RhCTMAAAA6OQ1/P//TlBBuf////9Ei0ZQSIvOSItWWOg7MPz/8w8QLTveMgAPV8APKM2JblDoNTj6/0iLFb4WNADzDxCi8BIAAE2F9nRN8w8QHfXdMgBIjYwkyAAAAEiLkuASAAAPKNSJbCRQSIlsJEBIiWwkOEiJbCQwTIl0JCjzDxFsJCDoxLn8//MPEKQkzAAAAEiLFWQWNABIi4LYFQAA8w9c/PMPWDUN3TIAQbgBAAAASYvOxoADAQAAAUiLgtgVAAAz0vMPWT1U3DIA8w8RsFABAADzD1i8JMQAAADGgJEBAAAB8w8RuFQBAADoW539/0iLDQQWNABIi5HYFQAAi4JAAQAAg/gBfw5IjQ3zazIA6BYs+v/rCP/IiYJAAQAATI2cJKAAAAAPtsNJi1swSYtrOEEPKHPwQQ8oe+BFDyhD0EUPKFPASYvjQV5fXsPMzMzMzMzMzMzMzMzMSIlcJAhIiXQkEEiJfCQYQVZIg+xgSIvxixVeFDQAZUiLBCVYAAAAQb4EAAAASIs80EKLBDc5BREhNAB+TUiNDQghNADoZ2ECAIM9/CA0AP91OMcF9CA0AAAAAAAz0kiNDfMgNADoxi8CAJDokH8BAJBIjQ1YqgIA6AdlAgCQSI0NxyA0AOi6YAIAD1fADxFEJCAPV8nzD39MJDBBuAsAAABIjRWAozIASI1MJCDonqX4/5BMjUQkIEiNVCRASI0NjCA0AOingAEAkEiDeBgPdgNIiwAz0kiLyOjisP7/D7bYSI1MJEDoFaP4/5BIjUwkIOgKo/j/hNsPhFcBAABIiw2bFDQASIuB2BUAAMaAAwEAAAFIi4HYFQAA8w8QgQwOAADzD1iAlAEAAPMPEYCUAQAA8w9YQFjzD1iAmAEAAPMPEYBQAQAAQosENzkF+x80AH5NSI0N8h80AOhRYAIAgz3mHzQA/3U4xwXeHzQAAAAAADPSSI0N3R80AOiwLgIAkOh6fgEAkEiNDUKpAgDo8WMCAJBIjQ2xHzQA6KRfAgAPV8APEUQkIA9XyfMPf0wkMEG4EAAAAEiNFXqiMgBIjUwkIOiIpPj/kEyNRCQgSI1UJEBIjQ12HzQA6JF/AQCQSIN4GA92A0iLAEiNVihIi8joyvr//5BIjUwkQOj/ofj/kEiNTCQg6PSh+P9Iiw2NEzQASIuB2BUAAMaAAwEAAAFIi4HYFQAA8w8QgJQBAADzD1yBDA4AAPMPEYCUAQAA8w9YQFjzD1iAmAEAAPMPEYBQAQAASItcJHBIi3QkeEiLvCSAAAAASIPEYEFew8zMSIvESIlYEEiJeBhVSI1ooUiB7PAAAAAPKXDoM/9AOHkoD4QmAgAASIsFOhQ0ADPJ/9DzDxA1WtkyAPMPXvDHRWcAACBBx0VrAAAgQkiLBd0SNABIi4jYFQAATI0F32UyALoBAAAASItJQOjxNfn/SIvY8w8s1kiNTQfocZz//5CLFYYRNABlSIsMJVgAAAC4BAAAAEiLDNGLFAg5FTseNAB+SUiNDTIeNADokV4CAIM9Jh40AP91NIk9Ih40ADPSSI0NIR40AOj0LAIAkOi+fAEAkEiNDYanAgDoNWICAJBIjQ31HTQA6OhdAgAPV8APEUXnD1fJ8w9/TfdBuAUAAABIjRXUoDIASI1N5+jPovj/kEyNRedIjVUnSI0Nvx00AOjafQEAkEiDeBgPdgNIiwBJx8H/////Dx+EAAAAAABJ/8FCgDwIAHX2TIvAM9JIjU0H6HgA+P8PV8APEUXHD1fJ8w9/TdcPEAAPEUXHDxBIEA8RTdfGAABIiXgQSMdAGA8AAABMjUXHSIN93w9MD0dFxw8vNZLYMgByCmYPbwW82jIA6xsPLzVr2DIAcgpmD28FudoyAOsIZg9vBX/aMgAPEUW3SI1Nt+jCyfj/SItTOEiLShipAAAA/3RJTYXAdERBgDgAdD4PEENgDxFFt4l8JEgPV8nzDxFMJEBIiXwkOEyJRCQwTI1Ft0yJRCQoiUQkIEyNTWfzDxBSIEiL0+iLuvz/kEiNTcfoYZ/4/5BIjU0n6Fef+P+QSI1N5+hNn/j/kEiNTQfoQ5/4/0yNnCTwAAAASYtbGEmLeyBBDyhz8EmL413DzMzMzMzMzMzMSIlcJAhXSIPsIEiL+YvaSIPBCOgIn/j/9sMBdA26OAAAAEiLz+juWwIASItcJDBIi8dIg8QgX8PMzMzMzMzMzEiNFSkEAADpdAQAAMzMzMxIiVwkEEiJdCQYVVdBVEFWQVdIjWwkyUiB7LAAAABMi/GLFSUPNABlSIsEJVgAAABBvAQAAABIizTQRTP/QosEJjkF1Rs0AH5KSI0NzBs0AOgrXAIAgz3AGzQA/3U1RIk9uxs0ADPSSI0Nuhs0AOiNKgIAkOhLine truncated
@@ -0,0 +1,266 @@
+# COMPLETE IMPORT TABLE — EF-Cheeto.dll
+# All imported DLLs and functions needed for Visual Studio .def / linker
+# These must ALL be linked in the VS project
+
+## KERNEL32.dll  (76 functions)
+  VirtualAlloc
+  VirtualFree
+  VirtualProtect
+  VirtualQuery
+  GetCurrentProcess
+  GetCurrentProcessId
+  GetCurrentThreadId
+  CreateThread
+  TerminateThread
+  SuspendThread
+  ResumeThread
+  OpenThread
+  CloseHandle
+  GetLastError
+  GetProcAddress
+  LoadLibraryA
+  FreeLibrary
+  GetModuleHandleA
+  GetModuleHandleW
+  FlushInstructionCache
+  SetThreadContext
+  GetThreadContext
+  MultiByteToWideChar
+  WideCharToMultiByte
+  GlobalAlloc
+  GlobalFree
+  GlobalLock
+  GlobalUnlock
+  HeapCreate
+  HeapAlloc
+  HeapFree
+  HeapReAlloc
+  HeapDestroy
+  AllocConsole
+  FreeConsole
+  GetConsoleMode
+  SetConsoleMode
+  GetConsoleWindow
+  GetConsoleScreenBufferInfo
+  SetConsoleTextAttribute
+  SetConsoleOutputCP
+  SetConsoleTitleA
+  GetStdHandle
+  CreateToolhelp32Snapshot
+  Thread32First
+  Thread32Next
+  K32EnumProcessModules
+  K32GetModuleFileNameExW
+  Sleep
+  OutputDebugStringA
+  GetSystemInfo
+  DisableThreadLibraryCalls
+  QueryPerformanceCounter
+  QueryPerformanceFrequency
+  GetLocaleInfoA
+  IsDBCSLeadByte
+  VerSetConditionMask
+  GetSystemTimeAsFileTime
+  IsDebuggerPresent
+  IsProcessorFeaturePresent
+  TerminateProcess
+  UnhandledExceptionFilter
+  SetUnhandledExceptionFilter
+  RtlCaptureContext
+  RtlLookupFunctionEntry
+  RtlVirtualUnwind
+  LocalFree
+  FormatMessageA
+  GetLocaleInfoEx
+  AreFileApisANSI
+  ReleaseSRWLockExclusive
+  AcquireSRWLockExclusive
+  SleepConditionVariableSRW
+  WakeAllConditionVariable
+  InitializeSListHead
+  memmove
+
+## USER32.dll  (67 functions)
+  CreateWindowExW
+  DestroyWindow
+  RegisterClassExW
+  UnregisterClassW
+  DefWindowProcW
+  PeekMessageW
+  TranslateMessage
+  DispatchMessageW
+  PostQuitMessage
+  UpdateWindow
+  GetClientRect
+  GetWindowRect
+  GetWindowLongW
+  GetWindowLongPtrW
+  SetWindowLongW
+  SetWindowLongPtrW
+  SetWindowPos
+  ShowWindow
+  BringWindowToTop
+  IsIconic
+  IsWindow
+  IsWindowVisible
+  IsWindowUnicode
+  IsChild
+  FindWindowA
+  EnumWindows
+  GetForegroundWindow
+  SetForegroundWindow
+  SetFocus
+  GetCursorPos
+  SetCursorPos
+  GetCapture
+  SetCapture
+  ReleaseCapture
+  GetAsyncKeyState
+  GetKeyState
+  GetKeyboardLayout
+  GetMessageExtraInfo
+  TrackMouseEvent
+  ClientToScreen
+  ScreenToClient
+  WindowFromPoint
+  GetDC
+  ReleaseDC
+  GetDeviceCaps
+  CreateSolidBrush
+  LoadCursorW
+  LoadIconW
+  SetCursor
+  EnumDisplayMonitors
+  GetMonitorInfoW
+  MonitorFromWindow
+  GetSystemMetrics
+  GetClassNameA
+  GetWindowThreadProcessId
+  AdjustWindowRectEx
+  OpenClipboard
+  CloseClipboard
+  EmptyClipboard
+  GetClipboardData
+  SetClipboardData
+  GetPropA
+  SetPropA
+  SetLayeredWindowAttributes
+  SetWindowDisplayAffinity
+  GetWindowDisplayAffinity
+  SetProcessDPIAware
+
+## GDI32.dll/SHELL32.dll  (1 functions)
+  ShellExecuteW
+
+## imm32.dll  (4 functions)
+  ImmGetContext
+  ImmReleaseContext
+  ImmSetCandidateWindow
+  ImmSetCompositionWindow
+
+## d3d11.dll  (1 functions)
+  D3D11CreateDeviceAndSwapChain
+
+## d3dcompiler_47.dll  (1 functions)
+  D3DCompile
+
+## dwmapi.dll  (2 functions)
+  DwmExtendFrameIntoClientArea
+  DwmGetWindowAttribute
+
+## xinput1_4.dll  (2 functions)
+  XInputGetState
+  XInputGetCapabilities
+
+## ntdll.dll  (2 functions)
+  RtlGetVersion
+  RtlVerifyVersionInfo
+
+## shcore.dll  (3 functions)
+  SetThreadDpiAwarenessContext
+  SetProcessDpiAwareness
+  GetDpiForMonitor
+
+## api-ms-win-crt-*.dll (CRT)  (62 functions)
+  malloc
+  calloc
+  free
+  realloc
+  memcmp
+  memcpy
+  memset
+  memchr
+  memmove
+  strcmp
+  strncmp
+  strncpy
+  strchr
+  strtod
+  strtoll
+  strtoull
+  atof
+  tolower
+  fopen
+  fclose
+  fread
+  fwrite
+  ftell
+  fseek
+  fflush
+  freopen_s
+  _wfopen
+  qsort
+  localeconv
+  __stdio_common_vfprintf
+  __stdio_common_vsprintf
+  __stdio_common_vsscanf
+  __acrt_iob_func
+  ___lc_codepage_func
+  _errno
+  _localtime64_s
+  acosf
+  ceilf
+  cosf
+  fmodf
+  logf
+  powf
+  sinf
+  sqrtf
+  _dclass
+  _dsign
+  _fdclass
+  _fdsign
+  _ldclass
+  _ldsign
+  _callnewh
+  _seh_filter_dll
+  _configure_narrow_argv
+  _initialize_narrow_environment
+  _initialize_onexit_table
+  _register_onexit_function
+  _execute_onexit_table
+  _crt_atexit
+  _cexit
+  _initterm
+  _initterm_e
+  terminate
+
+## vcruntime140.dll / vcruntime140_1.dll  (11 functions)
+  __CxxFrameHandler4
+  __C_specific_handler
+  _CxxThrowException
+  __std_terminate
+  __std_exception_copy
+  __std_exception_destroy
+  __current_exception
+  __current_exception_context
+  __std_type_info_destroy_list
+  _invoke_watson
+  _purecall
+
+## msvcp140.dll  (5 functions)
+  _Mtx_lock
+  _Mtx_unlock
+  _Xtime_get_ticks
+  _Query_perf_counter
+  _Query_perf_frequency
@@ -0,0 +1,122 @@
+# EF-Cheeto Reconstruction System Prompt
+# Give this + the feed document to an AI for perfect reconstruction.
+
+You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto 
+game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete 
+analysis document covering all 29 chapters of binary analysis plus a full 
+reconstruction header file. Use these to answer any reconstruction question.
+
+## Binary Identity
+- File: EF-Cheeto.dll  
+- Size: 3,956,736 bytes (0x3CE000)
+- Base VA: 0x180000000
+- .data base: 0x1803C5000 (RVA 0x3C5000)
+- .rdata strings base: ~0x3A0000–0x3B4000
+- IAT base: RVA 0xB1000
+- Architecture: x86-64 Windows DLL (PE32+)
+- Compiler: MSVC (x64 Release, C++17)
+- Project path: E:\git\Endfield_Cheeto\
+
+## What You Know (Summary)
+
+### Module System (10 active modules + 1 ghost)
+1. ESPModule       — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
+2. FPSModule       — FPS counter overlay + FPS cap unlocker  
+3. NoClip          — CharacterController.enabled toggle + move speed
+4. FreeCam         — CinemachineBrain camera override with WASD+mouse
+5. FpsUnlocker     — Application.set_targetFrameRate bypass (default 300fps)
+6. SetDither       — graphics dither toggle (stub, no per-frame effect)
+7. PlayerProfile   — Unity UI TextMeshPro text injection (UID + name changer)
+8. Vacuum          — Rigidbody.AddForce attraction loop
+9. SkillHack       — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
+10. UnityExplorer  — runtime Unity scene browser + GO/component inspector
+11. DamageHack     — GHOST FEATURE: i18n keys exist, zero code
+
+### Key Subsystems
+- GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
+- HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
+- ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
+- D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
+- Config: ImGui .ini persistence (no separate JSON config file)
+- i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
+- Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
+- Thread safety: Toolhelp32 snapshot suspension around all code patches
+
+### Critical Addresses (quick reference)
+- DllMain:             RVA 0x01000
+- LoaderThread:        RVA 0x05000  
+- Startup_main:        RVA 0x0A9190
+- GABypass::Patch:     RVA 0x09D1E0
+- ModuleManager::Init: RVA 0x09AC10
+- HookMgr::CreateHook: RVA 0x0A9CC8
+- OverlayWindowInit:   RVA 0x0827A0
+- WndProc:             RVA 0x0826A0
+- ESPModule singleton: VA 0x1803C6F70
+- HookManager single:  VA 0x1803C7470
+- IL2CPP table start:  [.data+0x1C48]
+- g_Config base:       [.data+0x1C00]
+
+## How to Use This Document
+- PART A contains all pseudocode, behavioral descriptions, and data tables
+- PART B contains the compilable reconstruction header with all addresses
+- For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
+- For any struct: PART B has the layout; PART A has the behavioral context
+- For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
+- For string RVAs: PART B Section 27 has all 189 .rdata strings
+
+Answer reconstruction questions by citing specific RVAs, field offsets, and 
+pseudocode from the document. When writing reconstructed C++, use the exact 
+struct layouts and address constants from PART B.
+
+
+================================================================================
+CONFIRMED IMGUI BUILD INFORMATION
+================================================================================
+
+## ImGui Version
+- Repository: https://github.com/ocornut/imgui (docking branch)
+- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
+- Version: Dear ImGui 1.92.6 WIP (19253)
+- Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)
+
+## Source Files Compiled Into Binary
+- imgui.cpp
+- imgui_draw.cpp
+- imgui_tables.cpp
+- imgui_widgets.cpp
+- imgui_demo.cpp — NOT compiled in (absent from binary)
+- backends/imgui_impl_win32.cpp
+- backends/imgui_impl_dx11.cpp
+
+## Build Configuration
+- NDEBUG defined (release build — zero IM_ASSERT strings in binary)
+- MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
+- PE compile timestamp: 2025-12-10 12:27:05 UTC
+- No custom imconfig.h overrides detected
+- Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
+- No imgui_freetype, no imgui_demo
+
+## ImGui Code Footprint in Binary
+- .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
+- Cheat-specific code begins at approximately RVA 0x7F000
+- Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
+- DX11 backend shader init: RVA 0x54DC0
+- DX11 backend resource creation: RVA 0x551F0
+- ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
+- IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A
+
+## Project Source Tree (from MSVC __FILE__ embeds)
+- E:\git\Endfield_Cheeto\framework\helpers.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
+- E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
+- E:\git\Endfield_Cheeto\user\main.cpp
+
+## To Reproduce Build
+  git clone https://github.com/ocornut/imgui
+  git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0
+  # Compile with MSVC 14.44, /O2, NDEBUG, x64
+  # Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp
+  # Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp
+  # No custom imconfig.h needed
@@ -0,0 +1,266 @@
+# COMPLETE IMPORT TABLE — EF-Cheeto.dll
+# All imported DLLs and functions needed for Visual Studio .def / linker
+# These must ALL be linked in the VS project
+
+## KERNEL32.dll  (76 functions)
+  VirtualAlloc
+  VirtualFree
+  VirtualProtect
+  VirtualQuery
+  GetCurrentProcess
+  GetCurrentProcessId
+  GetCurrentThreadId
+  CreateThread
+  TerminateThread
+  SuspendThread
+  ResumeThread
+  OpenThread
+  CloseHandle
+  GetLastError
+  GetProcAddress
+  LoadLibraryA
+  FreeLibrary
+  GetModuleHandleA
+  GetModuleHandleW
+  FlushInstructionCache
+  SetThreadContext
+  GetThreadContext
+  MultiByteToWideChar
+  WideCharToMultiByte
+  GlobalAlloc
+  GlobalFree
+  GlobalLock
+  GlobalUnlock
+  HeapCreate
+  HeapAlloc
+  HeapFree
+  HeapReAlloc
+  HeapDestroy
+  AllocConsole
+  FreeConsole
+  GetConsoleMode
+  SetConsoleMode
+  GetConsoleWindow
+  GetConsoleScreenBufferInfo
+  SetConsoleTextAttribute
+  SetConsoleOutputCP
+  SetConsoleTitleA
+  GetStdHandle
+  CreateToolhelp32Snapshot
+  Thread32First
+  Thread32Next
+  K32EnumProcessModules
+  K32GetModuleFileNameExW
+  Sleep
+  OutputDebugStringA
+  GetSystemInfo
+  DisableThreadLibraryCalls
+  QueryPerformanceCounter
+  QueryPerformanceFrequency
+  GetLocaleInfoA
+  IsDBCSLeadByte
+  VerSetConditionMask
+  GetSystemTimeAsFileTime
+  IsDebuggerPresent
+  IsProcessorFeaturePresent
+  TerminateProcess
+  UnhandledExceptionFilter
+  SetUnhandledExceptionFilter
+  RtlCaptureContext
+  RtlLookupFunctionEntry
+  RtlVirtualUnwind
+  LocalFree
+  FormatMessageA
+  GetLocaleInfoEx
+  AreFileApisANSI
+  ReleaseSRWLockExclusive
+  AcquireSRWLockExclusive
+  SleepConditionVariableSRW
+  WakeAllConditionVariable
+  InitializeSListHead
+  memmove
+
+## USER32.dll  (67 functions)
+  CreateWindowExW
+  DestroyWindow
+  RegisterClassExW
+  UnregisterClassW
+  DefWindowProcW
+  PeekMessageW
+  TranslateMessage
+  DispatchMessageW
+  PostQuitMessage
+  UpdateWindow
+  GetClientRect
+  GetWindowRect
+  GetWindowLongW
+  GetWindowLongPtrW
+  SetWindowLongW
+  SetWindowLongPtrW
+  SetWindowPos
+  ShowWindow
+  BringWindowToTop
+  IsIconic
+  IsWindow
+  IsWindowVisible
+  IsWindowUnicode
+  IsChild
+  FindWindowA
+  EnumWindows
+  GetForegroundWindow
+  SetForegroundWindow
+  SetFocus
+  GetCursorPos
+  SetCursorPos
+  GetCapture
+  SetCapture
+  ReleaseCapture
+  GetAsyncKeyState
+  GetKeyState
+  GetKeyboardLayout
+  GetMessageExtraInfo
+  TrackMouseEvent
+  ClientToScreen
+  ScreenToClient
+  WindowFromPoint
+  GetDC
+  ReleaseDC
+  GetDeviceCaps
+  CreateSolidBrush
+  LoadCursorW
+  LoadIconW
+  SetCursor
+  EnumDisplayMonitors
+  GetMonitorInfoW
+  MonitorFromWindow
+  GetSystemMetrics
+  GetClassNameA
+  GetWindowThreadProcessId
+  AdjustWindowRectEx
+  OpenClipboard
+  CloseClipboard
+  EmptyClipboard
+  GetClipboardData
+  SetClipboardData
+  GetPropA
+  SetPropA
+  SetLayeredWindowAttributes
+  SetWindowDisplayAffinity
+  GetWindowDisplayAffinity
+  SetProcessDPIAware
+
+## GDI32.dll/SHELL32.dll  (1 functions)
+  ShellExecuteW
+
+## imm32.dll  (4 functions)
+  ImmGetContext
+  ImmReleaseContext
+  ImmSetCandidateWindow
+  ImmSetCompositionWindow
+
+## d3d11.dll  (1 functions)
+  D3D11CreateDeviceAndSwapChain
+
+## d3dcompiler_47.dll  (1 functions)
+  D3DCompile
+
+## dwmapi.dll  (2 functions)
+  DwmExtendFrameIntoClientArea
+  DwmGetWindowAttribute
+
+## xinput1_4.dll  (2 functions)
+  XInputGetState
+  XInputGetCapabilities
+
+## ntdll.dll  (2 functions)
+  RtlGetVersion
+  RtlVerifyVersionInfo
+
+## shcore.dll  (3 functions)
+  SetThreadDpiAwarenessContext
+  SetProcessDpiAwareness
+  GetDpiForMonitor
+
+## api-ms-win-crt-*.dll (CRT)  (62 functions)
+  malloc
+  calloc
+  free
+  realloc
+  memcmp
+  memcpy
+  memset
+  memchr
+  memmove
+  strcmp
+  strncmp
+  strncpy
+  strchr
+  strtod
+  strtoll
+  strtoull
+  atof
+  tolower
+  fopen
+  fclose
+  fread
+  fwrite
+  ftell
+  fseek
+  fflush
+  freopen_s
+  _wfopen
+  qsort
+  localeconv
+  __stdio_common_vfprintf
+  __stdio_common_vsprintf
+  __stdio_common_vsscanf
+  __acrt_iob_func
+  ___lc_codepage_func
+  _errno
+  _localtime64_s
+  acosf
+  ceilf
+  cosf
+  fmodf
+  logf
+  powf
+  sinf
+  sqrtf
+  _dclass
+  _dsign
+  _fdclass
+  _fdsign
+  _ldclass
+  _ldsign
+  _callnewh
+  _seh_filter_dll
+  _configure_narrow_argv
+  _initialize_narrow_environment
+  _initialize_onexit_table
+  _register_onexit_function
+  _execute_onexit_table
+  _crt_atexit
+  _cexit
+  _initterm
+  _initterm_e
+  terminate
+
+## vcruntime140.dll / vcruntime140_1.dll  (11 functions)
+  __CxxFrameHandler4
+  __C_specific_handler
+  _CxxThrowException
+  __std_terminate
+  __std_exception_copy
+  __std_exception_destroy
+  __current_exception
+  __current_exception_context
+  __std_type_info_destroy_list
+  _invoke_watson
+  _purecall
+
+## msvcp140.dll  (5 functions)
+  _Mtx_lock
+  _Mtx_unlock
+  _Xtime_get_ticks
+  _Query_perf_counter
+  _Query_perf_frequency
@@ -0,0 +1,166 @@
+# EF-Cheeto Reconstruction System Prompt
+# Give this + the feed document to an AI for perfect reconstruction.
+
+You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto 
+game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete 
+analysis document covering all 29 chapters of binary analysis plus a full 
+reconstruction header file. Use these to answer any reconstruction question.
+
+## Binary Identity
+- File: EF-Cheeto.dll  
+- Size: 3,956,736 bytes (0x3CE000)
+- Base VA: 0x180000000
+- .data base: 0x1803C5000 (RVA 0x3C5000)
+- .rdata strings base: ~0x3A0000–0x3B4000
+- IAT base: RVA 0xB1000
+- Architecture: x86-64 Windows DLL (PE32+)
+- Compiler: MSVC (x64 Release, C++17)
+- Project path: E:\git\Endfield_Cheeto\
+
+## What You Know (Summary)
+
+### Module System (10 active modules + 1 ghost)
+1. ESPModule       — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
+2. FPSModule       — FPS counter overlay + FPS cap unlocker  
+3. NoClip          — CharacterController.enabled toggle + move speed
+4. FreeCam         — CinemachineBrain camera override with WASD+mouse
+5. FpsUnlocker     — Application.set_targetFrameRate bypass (default 300fps)
+6. SetDither       — graphics dither toggle (stub, no per-frame effect)
+7. PlayerProfile   — Unity UI TextMeshPro text injection (UID + name changer)
+8. Vacuum          — Rigidbody.AddForce attraction loop
+9. SkillHack       — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
+10. UnityExplorer  — runtime Unity scene browser + GO/component inspector
+11. DamageHack     — GHOST FEATURE: i18n keys exist, zero code
+
+### Key Subsystems
+- GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
+- HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
+- ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
+- D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
+- Config: ImGui .ini persistence (no separate JSON config file)
+- i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
+- Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
+- Thread safety: Toolhelp32 snapshot suspension around all code patches
+
+### Critical Addresses (quick reference)
+- DllMain:             RVA 0x01000
+- LoaderThread:        RVA 0x05000  
+- Startup_main:        RVA 0x0A9190
+- GABypass::Patch:     RVA 0x09D1E0
+- ModuleManager::Init: RVA 0x09AC10
+- HookMgr::CreateHook: RVA 0x0A9CC8
+- OverlayWindowInit:   RVA 0x0827A0
+- WndProc:             RVA 0x0826A0
+- ESPModule singleton: VA 0x1803C6F70
+- HookManager single:  VA 0x1803C7470
+- IL2CPP table start:  [.data+0x1C48]
+- g_Config base:       [.data+0x1C00]
+
+## How to Use This Document
+- PART A contains all pseudocode, behavioral descriptions, and data tables
+- PART B contains the compilable reconstruction header with all addresses
+- For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
+- For any struct: PART B has the layout; PART A has the behavioral context
+- For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
+- For string RVAs: PART B Section 27 has all 189 .rdata strings
+
+Answer reconstruction questions by citing specific RVAs, field offsets, and 
+pseudocode from the document. When writing reconstructed C++, use the exact 
+struct layouts and address constants from PART B.
+
+
+================================================================================
+CONFIRMED IMGUI BUILD INFORMATION
+================================================================================
+
+## ImGui Version
+- Repository: https://github.com/ocornut/imgui (docking branch)
+- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
+- Version: Dear ImGui 1.92.6 WIP (19253)
+- Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)
+
+## Source Files Compiled Into Binary
+- imgui.cpp
+- imgui_draw.cpp
+- imgui_tables.cpp
+- imgui_widgets.cpp
+- imgui_demo.cpp — NOT compiled in (absent from binary)
+- backends/imgui_impl_win32.cpp
+- backends/imgui_impl_dx11.cpp
+
+## Build Configuration
+- NDEBUG defined (release build — zero IM_ASSERT strings in binary)
+- MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
+- PE compile timestamp: 2025-12-10 12:27:05 UTC
+- No custom imconfig.h overrides detected
+- Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
+- No imgui_freetype, no imgui_demo
+
+## ImGui Code Footprint in Binary
+- .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
+- Cheat-specific code begins at approximately RVA 0x7F000
+- Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
+- DX11 backend shader init: RVA 0x54DC0
+- DX11 backend resource creation: RVA 0x551F0
+- ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
+- IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A
+
+## Project Source Tree (from MSVC __FILE__ embeds)
+- E:\git\Endfield_Cheeto\framework\helpers.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
+- E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
+- E:\git\Endfield_Cheeto\user\main.cpp
+
+## To Reproduce Build
+  git clone https://github.com/ocornut/imgui
+  git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0
+  # Compile with MSVC 14.44, /O2, NDEBUG, x64
+  # Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp
+  # Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp
+  # No custom imconfig.h needed
+
+================================================================================
+CONFIRMED THIRD-PARTY LIBRARY VERSIONS (extracted from binary)
+================================================================================
+
+## 1. Dear ImGui
+- Repo:    https://github.com/ocornut/imgui
+- Branch:  docking
+- Commit:  fa4b47c5e2b53dba5093384562440bd9a6bba2a0
+- Version: 1.92.6 WIP (19253)
+- Files to compile:
+    imgui.cpp
+    imgui_draw.cpp
+    imgui_tables.cpp
+    imgui_widgets.cpp
+    backends/imgui_impl_win32.cpp
+    backends/imgui_impl_dx11.cpp
+- Config: NDEBUG, no custom imconfig.h, default ImDrawIdx (uint16_t)
+
+## 2. nlohmann/json
+- Repo:    https://github.com/nlohmann/json
+- Version: v3.12.0
+- Commit:  961c151d2e87f2686a955a9be24d316f1362bf21
+- Usage:   Header-only (single-file json.hpp) — used ONLY for i18n translation table
+- Include: #include "nlohmann/json.hpp" or #include "json.hpp"
+- Note:    The ABI namespace in this binary is nlohmann_json_abi_v3_12_0
+
+## 3. Microsoft Detours — NOT USED
+- .detourc/.detourd sections are MSVC thread-safe static init sections, NOT Detours
+- The hook system is 100% custom (documented in HookManager chapters)
+
+## Visual Studio Project Settings
+- Platform:       x64
+- Configuration:  Release
+- Toolset:        MSVC v143 (VS2022), toolchain version 14.44
+- Subsystem:      DLL (/LD)
+- Runtime:        /MD (Multi-threaded DLL — uses msvcp140.dll, vcruntime140.dll)
+- Optimization:   /O2 (maximize speed) — inferred from release build
+- C++ Standard:   /std:c++17 (confirmed from RTTI and STL usage)
+- Character set:  Unicode
+- Additional libs to link:
+    kernel32.lib  user32.lib    gdi32.lib     shell32.lib
+    d3d11.lib     d3dcompiler.lib  dwmapi.lib  imm32.lib
+    shcore.lib    xinput.lib    ntdll.lib
@@ -0,0 +1,122 @@
+# EF-Cheeto Reconstruction System Prompt
+# Give this + the feed document to an AI for perfect reconstruction.
+
+You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto 
+game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete 
+analysis document covering all 29 chapters of binary analysis plus a full 
+reconstruction header file. Use these to answer any reconstruction question.
+
+## Binary Identity
+- File: EF-Cheeto.dll  
+- Size: 3,956,736 bytes (0x3CE000)
+- Base VA: 0x180000000
+- .data base: 0x1803C5000 (RVA 0x3C5000)
+- .rdata strings base: ~0x3A0000–0x3B4000
+- IAT base: RVA 0xB1000
+- Architecture: x86-64 Windows DLL (PE32+)
+- Compiler: MSVC (x64 Release, C++17)
+- Project path: E:\git\Endfield_Cheeto\
+
+## What You Know (Summary)
+
+### Module System (10 active modules + 1 ghost)
+1. ESPModule       — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
+2. FPSModule       — FPS counter overlay + FPS cap unlocker  
+3. NoClip          — CharacterController.enabled toggle + move speed
+4. FreeCam         — CinemachineBrain camera override with WASD+mouse
+5. FpsUnlocker     — Application.set_targetFrameRate bypass (default 300fps)
+6. SetDither       — graphics dither toggle (stub, no per-frame effect)
+7. PlayerProfile   — Unity UI TextMeshPro text injection (UID + name changer)
+8. Vacuum          — Rigidbody.AddForce attraction loop
+9. SkillHack       — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
+10. UnityExplorer  — runtime Unity scene browser + GO/component inspector
+11. DamageHack     — GHOST FEATURE: i18n keys exist, zero code
+
+### Key Subsystems
+- GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
+- HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
+- ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
+- D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
+- Config: ImGui .ini persistence (no separate JSON config file)
+- i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
+- Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
+- Thread safety: Toolhelp32 snapshot suspension around all code patches
+
+### Critical Addresses (quick reference)
+- DllMain:             RVA 0x01000
+- LoaderThread:        RVA 0x05000  
+- Startup_main:        RVA 0x0A9190
+- GABypass::Patch:     RVA 0x09D1E0
+- ModuleManager::Init: RVA 0x09AC10
+- HookMgr::CreateHook: RVA 0x0A9CC8
+- OverlayWindowInit:   RVA 0x0827A0
+- WndProc:             RVA 0x0826A0
+- ESPModule singleton: VA 0x1803C6F70
+- HookManager single:  VA 0x1803C7470
+- IL2CPP table start:  [.data+0x1C48]
+- g_Config base:       [.data+0x1C00]
+
+## How to Use This Document
+- PART A contains all pseudocode, behavioral descriptions, and data tables
+- PART B contains the compilable reconstruction header with all addresses
+- For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
+- For any struct: PART B has the layout; PART A has the behavioral context
+- For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
+- For string RVAs: PART B Section 27 has all 189 .rdata strings
+
+Answer reconstruction questions by citing specific RVAs, field offsets, and 
+pseudocode from the document. When writing reconstructed C++, use the exact 
+struct layouts and address constants from PART B.
+
+
+================================================================================
+CONFIRMED IMGUI BUILD INFORMATION
+================================================================================
+
+## ImGui Version
+- Repository: https://github.com/ocornut/imgui (docking branch)
+- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
+- Version: Dear ImGui 1.92.6 WIP (19253)
+- Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)
+
+## Source Files Compiled Into Binary
+- imgui.cpp
+- imgui_draw.cpp
+- imgui_tables.cpp
+- imgui_widgets.cpp
+- imgui_demo.cpp — NOT compiled in (absent from binary)
+- backends/imgui_impl_win32.cpp
+- backends/imgui_impl_dx11.cpp
+
+## Build Configuration
+- NDEBUG defined (release build — zero IM_ASSERT strings in binary)
+- MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
+- PE compile timestamp: 2025-12-10 12:27:05 UTC
+- No custom imconfig.h overrides detected
+- Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
+- No imgui_freetype, no imgui_demo
+
+## ImGui Code Footprint in Binary
+- .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
+- Cheat-specific code begins at approximately RVA 0x7F000
+- Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
+- DX11 backend shader init: RVA 0x54DC0
+- DX11 backend resource creation: RVA 0x551F0
+- ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
+- IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A
+
+## Project Source Tree (from MSVC __FILE__ embeds)
+- E:\git\Endfield_Cheeto\framework\helpers.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
+- E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
+- E:\git\Endfield_Cheeto\user\main.cpp
+
+## To Reproduce Build
+  git clone https://github.com/ocornut/imgui
+  git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0
+  # Compile with MSVC 14.44, /O2, NDEBUG, x64
+  # Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp
+  # Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp
+  # No custom imconfig.h needed