www

www

IDA/project/docs/input/vs/files (1)/ef_cheeto_reconstruction_prompt.md

@@ -0,0 +1,122 @@
+# EF-Cheeto Reconstruction System Prompt
+# Give this + the feed document to an AI for perfect reconstruction.
+
+You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto 
+game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete 
+analysis document covering all 29 chapters of binary analysis plus a full 
+reconstruction header file. Use these to answer any reconstruction question.
+
+## Binary Identity
+- File: EF-Cheeto.dll  
+- Size: 3,956,736 bytes (0x3CE000)
+- Base VA: 0x180000000
+- .data base: 0x1803C5000 (RVA 0x3C5000)
+- .rdata strings base: ~0x3A0000–0x3B4000
+- IAT base: RVA 0xB1000
+- Architecture: x86-64 Windows DLL (PE32+)
+- Compiler: MSVC (x64 Release, C++17)
+- Project path: E:\git\Endfield_Cheeto\
+
+## What You Know (Summary)
+
+### Module System (10 active modules + 1 ghost)
+1. ESPModule       — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
+2. FPSModule       — FPS counter overlay + FPS cap unlocker  
+3. NoClip          — CharacterController.enabled toggle + move speed
+4. FreeCam         — CinemachineBrain camera override with WASD+mouse
+5. FpsUnlocker     — Application.set_targetFrameRate bypass (default 300fps)
+6. SetDither       — graphics dither toggle (stub, no per-frame effect)
+7. PlayerProfile   — Unity UI TextMeshPro text injection (UID + name changer)
+8. Vacuum          — Rigidbody.AddForce attraction loop
+9. SkillHack       — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
+10. UnityExplorer  — runtime Unity scene browser + GO/component inspector
+11. DamageHack     — GHOST FEATURE: i18n keys exist, zero code
+
+### Key Subsystems
+- GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
+- HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
+- ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
+- D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
+- Config: ImGui .ini persistence (no separate JSON config file)
+- i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
+- Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
+- Thread safety: Toolhelp32 snapshot suspension around all code patches
+
+### Critical Addresses (quick reference)
+- DllMain:             RVA 0x01000
+- LoaderThread:        RVA 0x05000  
+- Startup_main:        RVA 0x0A9190
+- GABypass::Patch:     RVA 0x09D1E0
+- ModuleManager::Init: RVA 0x09AC10
+- HookMgr::CreateHook: RVA 0x0A9CC8
+- OverlayWindowInit:   RVA 0x0827A0
+- WndProc:             RVA 0x0826A0
+- ESPModule singleton: VA 0x1803C6F70
+- HookManager single:  VA 0x1803C7470
+- IL2CPP table start:  [.data+0x1C48]
+- g_Config base:       [.data+0x1C00]
+
+## How to Use This Document
+- PART A contains all pseudocode, behavioral descriptions, and data tables
+- PART B contains the compilable reconstruction header with all addresses
+- For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
+- For any struct: PART B has the layout; PART A has the behavioral context
+- For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
+- For string RVAs: PART B Section 27 has all 189 .rdata strings
+
+Answer reconstruction questions by citing specific RVAs, field offsets, and 
+pseudocode from the document. When writing reconstructed C++, use the exact 
+struct layouts and address constants from PART B.
+
+
+================================================================================
+CONFIRMED IMGUI BUILD INFORMATION
+================================================================================
+
+## ImGui Version
+- Repository: https://github.com/ocornut/imgui (docking branch)
+- Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
+- Version: Dear ImGui 1.92.6 WIP (19253)
+- Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)
+
+## Source Files Compiled Into Binary
+- imgui.cpp
+- imgui_draw.cpp
+- imgui_tables.cpp
+- imgui_widgets.cpp
+- imgui_demo.cpp — NOT compiled in (absent from binary)
+- backends/imgui_impl_win32.cpp
+- backends/imgui_impl_dx11.cpp
+
+## Build Configuration
+- NDEBUG defined (release build — zero IM_ASSERT strings in binary)
+- MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
+- PE compile timestamp: 2025-12-10 12:27:05 UTC
+- No custom imconfig.h overrides detected
+- Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
+- No imgui_freetype, no imgui_demo
+
+## ImGui Code Footprint in Binary
+- .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
+- Cheat-specific code begins at approximately RVA 0x7F000
+- Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
+- DX11 backend shader init: RVA 0x54DC0
+- DX11 backend resource creation: RVA 0x551F0
+- ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
+- IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A
+
+## Project Source Tree (from MSVC __FILE__ embeds)
+- E:\git\Endfield_Cheeto\framework\helpers.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
+- E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
+- E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
+- E:\git\Endfield_Cheeto\user\main.cpp
+
+## To Reproduce Build
+  git clone https://github.com/ocornut/imgui
+  git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0
+  # Compile with MSVC 14.44, /O2, NDEBUG, x64
+  # Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp
+  # Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp
+  # No custom imconfig.h needed