www

2026-03-08 16:19:24 -06:00
1 parent 3933cd1901
commit 0aa65c433d
@@ -0,0 +1,266 @@
+# COMPLETE IMPORT TABLE — EF-Cheeto.dll
+# All imported DLLs and functions needed for Visual Studio .def / linker
+# These must ALL be linked in the VS project
+
+## KERNEL32.dll  (76 functions)
+  VirtualAlloc
+  VirtualFree
+  VirtualProtect
+  VirtualQuery
+  GetCurrentProcess
+  GetCurrentProcessId
+  GetCurrentThreadId
+  CreateThread
+  TerminateThread
+  SuspendThread
+  ResumeThread
+  OpenThread
+  CloseHandle
+  GetLastError
+  GetProcAddress
+  LoadLibraryA
+  FreeLibrary
+  GetModuleHandleA
+  GetModuleHandleW
+  FlushInstructionCache
+  SetThreadContext
+  GetThreadContext
+  MultiByteToWideChar
+  WideCharToMultiByte
+  GlobalAlloc
+  GlobalFree
+  GlobalLock
+  GlobalUnlock
+  HeapCreate
+  HeapAlloc
+  HeapFree
+  HeapReAlloc
+  HeapDestroy
+  AllocConsole
+  FreeConsole
+  GetConsoleMode
+  SetConsoleMode
+  GetConsoleWindow
+  GetConsoleScreenBufferInfo
+  SetConsoleTextAttribute
+  SetConsoleOutputCP
+  SetConsoleTitleA
+  GetStdHandle
+  CreateToolhelp32Snapshot
+  Thread32First
+  Thread32Next
+  K32EnumProcessModules
+  K32GetModuleFileNameExW
+  Sleep
+  OutputDebugStringA
+  GetSystemInfo
+  DisableThreadLibraryCalls
+  QueryPerformanceCounter
+  QueryPerformanceFrequency
+  GetLocaleInfoA
+  IsDBCSLeadByte
+  VerSetConditionMask
+  GetSystemTimeAsFileTime
+  IsDebuggerPresent
+  IsProcessorFeaturePresent
+  TerminateProcess
+  UnhandledExceptionFilter
+  SetUnhandledExceptionFilter
+  RtlCaptureContext
+  RtlLookupFunctionEntry
+  RtlVirtualUnwind
+  LocalFree
+  FormatMessageA
+  GetLocaleInfoEx
+  AreFileApisANSI
+  ReleaseSRWLockExclusive
+  AcquireSRWLockExclusive
+  SleepConditionVariableSRW
+  WakeAllConditionVariable
+  InitializeSListHead
+  memmove
+
+## USER32.dll  (67 functions)
+  CreateWindowExW
+  DestroyWindow
+  RegisterClassExW
+  UnregisterClassW
+  DefWindowProcW
+  PeekMessageW
+  TranslateMessage
+  DispatchMessageW
+  PostQuitMessage
+  UpdateWindow
+  GetClientRect
+  GetWindowRect
+  GetWindowLongW
+  GetWindowLongPtrW
+  SetWindowLongW
+  SetWindowLongPtrW
+  SetWindowPos
+  ShowWindow
+  BringWindowToTop
+  IsIconic
+  IsWindow
+  IsWindowVisible
+  IsWindowUnicode
+  IsChild
+  FindWindowA
+  EnumWindows
+  GetForegroundWindow
+  SetForegroundWindow
+  SetFocus
+  GetCursorPos
+  SetCursorPos
+  GetCapture
+  SetCapture
+  ReleaseCapture
+  GetAsyncKeyState
+  GetKeyState
+  GetKeyboardLayout
+  GetMessageExtraInfo
+  TrackMouseEvent
+  ClientToScreen
+  ScreenToClient
+  WindowFromPoint
+  GetDC
+  ReleaseDC
+  GetDeviceCaps
+  CreateSolidBrush
+  LoadCursorW
+  LoadIconW
+  SetCursor
+  EnumDisplayMonitors
+  GetMonitorInfoW
+  MonitorFromWindow
+  GetSystemMetrics
+  GetClassNameA
+  GetWindowThreadProcessId
+  AdjustWindowRectEx
+  OpenClipboard
+  CloseClipboard
+  EmptyClipboard
+  GetClipboardData
+  SetClipboardData
+  GetPropA
+  SetPropA
+  SetLayeredWindowAttributes
+  SetWindowDisplayAffinity
+  GetWindowDisplayAffinity
+  SetProcessDPIAware
+
+## GDI32.dll/SHELL32.dll  (1 functions)
+  ShellExecuteW
+
+## imm32.dll  (4 functions)
+  ImmGetContext
+  ImmReleaseContext
+  ImmSetCandidateWindow
+  ImmSetCompositionWindow
+
+## d3d11.dll  (1 functions)
+  D3D11CreateDeviceAndSwapChain
+
+## d3dcompiler_47.dll  (1 functions)
+  D3DCompile
+
+## dwmapi.dll  (2 functions)
+  DwmExtendFrameIntoClientArea
+  DwmGetWindowAttribute
+
+## xinput1_4.dll  (2 functions)
+  XInputGetState
+  XInputGetCapabilities
+
+## ntdll.dll  (2 functions)
+  RtlGetVersion
+  RtlVerifyVersionInfo
+
+## shcore.dll  (3 functions)
+  SetThreadDpiAwarenessContext
+  SetProcessDpiAwareness
+  GetDpiForMonitor
+
+## api-ms-win-crt-*.dll (CRT)  (62 functions)
+  malloc
+  calloc
+  free
+  realloc
+  memcmp
+  memcpy
+  memset
+  memchr
+  memmove
+  strcmp
+  strncmp
+  strncpy
+  strchr
+  strtod
+  strtoll
+  strtoull
+  atof
+  tolower
+  fopen
+  fclose
+  fread
+  fwrite
+  ftell
+  fseek
+  fflush
+  freopen_s
+  _wfopen
+  qsort
+  localeconv
+  __stdio_common_vfprintf
+  __stdio_common_vsprintf
+  __stdio_common_vsscanf
+  __acrt_iob_func
+  ___lc_codepage_func
+  _errno
+  _localtime64_s
+  acosf
+  ceilf
+  cosf
+  fmodf
+  logf
+  powf
+  sinf
+  sqrtf
+  _dclass
+  _dsign
+  _fdclass
+  _fdsign
+  _ldclass
+  _ldsign
+  _callnewh
+  _seh_filter_dll
+  _configure_narrow_argv
+  _initialize_narrow_environment
+  _initialize_onexit_table
+  _register_onexit_function
+  _execute_onexit_table
+  _crt_atexit
+  _cexit
+  _initterm
+  _initterm_e
+  terminate
+
+## vcruntime140.dll / vcruntime140_1.dll  (11 functions)
+  __CxxFrameHandler4
+  __C_specific_handler
+  _CxxThrowException
+  __std_terminate
+  __std_exception_copy
+  __std_exception_destroy
+  __current_exception
+  __current_exception_context
+  __std_type_info_destroy_list
+  _invoke_watson
+  _purecall
+
+## msvcp140.dll  (5 functions)
+  _Mtx_lock
+  _Mtx_unlock
+  _Xtime_get_ticks
+  _Query_perf_counter
+  _Query_perf_frequency
@@ -0,0 +1,122 @@
+# EF-Cheeto Reconstruction System Prompt
+# Give this + the feed document to an AI for perfect reconstruction.
+
+You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto 
+game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete 
+analysis document covering all 29 chapters of binary analysis plus a full 
+reconstruction header file. Use these to answer any reconstruction question.
+
+## Binary Identity
+- File: EF-Cheeto.dll  
+- Size: 3,956,736 bytes (0x3CE000)
+- Base VA: 0x180000000
+- .data base: 0x1803C5000 (RVA 0x3C5000)
+- .rdata strings base: ~0x3A0000–0x3B4000
+- IAT base: RVA 0xB1000
+- Architecture: x86-64 Windows DLL (PE32+)
+- Compiler: MSVC (x64 Release, C++17)
+- Project path: E:\git\Endfield_Cheeto\
+
+## What You Know (Summary)
+
+### Module System (10 active modules + 1 ghost)
+1. ESPModule       — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
+2. FPSModule       — FPS counter overlay + FPS cap unlocker  
+3. NoClip          — CharacterController.enabled toggle + move speed
+4. FreeCam         — CinemachineBrain camera override with WASD+mouse
+5. FpsUnlocker     — Application.set_targetFrameRate bypass (default 300fps)
+6. SetDither       — graphics dither toggle (stub, no per-frame effect)
+7. PlayerProfile   — Unity UI TextMeshPro text injection (UID + name changer)
+8. Vacuum          — Rigidbody.AddForce attraction loop
+9. SkillHack       — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
+10. UnityExplorer  — runtime Unity scene browser + GO/component inspector
+11. DamageHack     — GHOST FEATURE: i18n keys exist, zero code
+
+### Key Subsystems
+- GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
+- HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
+- ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
+- D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
+- Config: ImGui .ini persistence (no separate JSON config file)
+- i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
+- Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
+- Thread safety: Toolhelp32 snapshot suspension around all code patches
+
+### Critical Addresses (quick reference)
+- DllMain:             RVA 0x01000
+- LoaderThread:        RVA 0x05000  
+- Startup_main:        RVA 0x0A9190
+- GABypass::Patch:     RVA 0x09D1E0
+- ModuleManager::Init: RVA 0x09AC10
+- HookMgr::CreateHook: RVA 0x0A9CC8
+- OverlayWindowInit:   RVA 0x0827A0
+- WndProc:             RVA 0x0826A0
+- ESPModule singleton: VA 0x1803C6F70
+- HookManager single:  VA 0x1803C7470
+- IL2CPP table start:  [.data+0x1C48]
+- g_Config base:       [.data+0x1C00]
+
+## How to Use This Document
+- PART A contains all pseudocode, behavioral descriptions, and data tables
+- PART B contains the compilable reconstruction header with all addresses
+- For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
+- For any struct: PART B has the layout; PART A has the behavioral context
+- For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
+- For string RVAs: PART B Section 27 has all 189 .rdata strings
+
+Answer reconstruction questions by citing specific RVAs, field offsets, and 
+pseudocode from the document. When writing reconstructed C++, use the exact 
+struct layouts and address constants from PART B.
+
+
+================================================================================
+CONFIRMED IMGUI BUILD INFORMATION
+================================================================================
+
+## ImGui Version
+- Repository: https://github.com/ocornut/imgui (docking branch)
+- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
+- Version: Dear ImGui 1.92.6 WIP (19253)
+- Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)
+
+## Source Files Compiled Into Binary
+- imgui.cpp
+- imgui_draw.cpp
+- imgui_tables.cpp
+- imgui_widgets.cpp
+- imgui_demo.cpp — NOT compiled in (absent from binary)
+- backends/imgui_impl_win32.cpp
+- backends/imgui_impl_dx11.cpp
+
+## Build Configuration
+- NDEBUG defined (release build — zero IM_ASSERT strings in binary)
+- MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
+- PE compile timestamp: 2025-12-10 12:27:05 UTC
+- No custom imconfig.h overrides detected
+- Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
+- No imgui_freetype, no imgui_demo
+
+## ImGui Code Footprint in Binary
+- .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
+- Cheat-specific code begins at approximately RVA 0x7F000
+- Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
+- DX11 backend shader init: RVA 0x54DC0
+- DX11 backend resource creation: RVA 0x551F0
+- ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
+- IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A
+
+## Project Source Tree (from MSVC __FILE__ embeds)
+- E:\git\Endfield_Cheeto\framework\helpers.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
+- E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
+- E:\git\Endfield_Cheeto\user\main.cpp
+
+## To Reproduce Build
+  git clone https://github.com/ocornut/imgui
+  git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0
+  # Compile with MSVC 14.44, /O2, NDEBUG, x64
+  # Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp
+  # Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp
+  # No custom imconfig.h needed