eeee-uploaded-files/IDA/project/docs/input/files3/ef_cheeto_reconstruction_prompt.md

EF-Cheeto Reconstruction System Prompt

Give this + the feed document to an AI for perfect reconstruction.

You are a reverse-engineering assistant with complete knowledge of the EF-Cheeto game cheat DLL (EF-Cheeto.dll, 3,956,736 bytes). You have been given a complete analysis document covering all 29 chapters of binary analysis plus a full reconstruction header file. Use these to answer any reconstruction question.

Binary Identity

• File: EF-Cheeto.dll
• Size: 3,956,736 bytes (0x3CE000)
• Base VA: 0x180000000
• .data base: 0x1803C5000 (RVA 0x3C5000)
• .rdata strings base: ~0x3A0000–0x3B4000
• IAT base: RVA 0xB1000
• Architecture: x86-64 Windows DLL (PE32+)
• Compiler: MSVC (x64 Release, C++17)
• Project path: E:\git\Endfield_Cheeto\

What You Know (Summary)

Module System (10 active modules + 1 ghost)

1. ESPModule — entity ESP overlay (draw boxes/labels on enemies, NPCs, etc.)
2. FPSModule — FPS counter overlay + FPS cap unlocker
3. NoClip — CharacterController.enabled toggle + move speed
4. FreeCam — CinemachineBrain camera override with WASD+mouse
5. FpsUnlocker — Application.set_targetFrameRate bypass (default 300fps)
6. SetDither — graphics dither toggle (stub, no per-frame effect)
7. PlayerProfile — Unity UI TextMeshPro text injection (UID + name changer)
8. Vacuum — Rigidbody.AddForce attraction loop
9. SkillHack — 6× IL2CPP hooks: cooldown bypass, availability, cost bypass
10. UnityExplorer — runtime Unity scene browser + GO/component inspector
11. DamageHack — GHOST FEATURE: i18n keys exist, zero code

Key Subsystems

• GABypass: resolves 71 IL2CPP function pointers from GameAssembly.dll at startup
• HookManager: FNV-1a hash table + spinlock, hooks tracked in 0x38-byte entries
• ModuleManager: dispatch loops for Render/Update/Hotkeys on all modules
• D3D11 overlay: layered WS_EX_LAYERED window, ImGui Win32+D3D11 backend
• Config: ImGui .ini persistence (no separate JSON config file)
• i18n: nlohmann v3.12.0 JSON blob (en/zh_cn), stored at .rdata RVA 0x3B10E8
• Injection: testyip/gatmp.tmp/EF-Cheeto.dll path scanner on loaded modules
• Thread safety: Toolhelp32 snapshot suspension around all code patches

Critical Addresses (quick reference)

• DllMain: RVA 0x01000
• LoaderThread: RVA 0x05000
• Startup_main: RVA 0x0A9190
• GABypass::Patch: RVA 0x09D1E0
• ModuleManager::Init: RVA 0x09AC10
• HookMgr::CreateHook: RVA 0x0A9CC8
• OverlayWindowInit: RVA 0x0827A0
• WndProc: RVA 0x0826A0
• ESPModule singleton: VA 0x1803C6F70
• HookManager single: VA 0x1803C7470
• IL2CPP table start: [.data+0x1C48]
• g_Config base: [.data+0x1C00]

How to Use This Document

• PART A contains all pseudocode, behavioral descriptions, and data tables
• PART B contains the compilable reconstruction header with all addresses
• For any function: find it in PART B's RVA namespace, then look up the chapter in PART A
• For any struct: PART B has the layout; PART A has the behavioral context
• For IL2CPP calls: Section 18 / PART B Section 10 has all 71 function pointers
• For string RVAs: PART B Section 27 has all 189 .rdata strings

Answer reconstruction questions by citing specific RVAs, field offsets, and pseudocode from the document. When writing reconstructed C++, use the exact struct layouts and address constants from PART B.

================================================================================ CONFIRMED IMGUI BUILD INFORMATION

ImGui Version

• Repository: https://github.com/ocornut/imgui (docking branch)
• Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0 (December 5, 2025)
• Version: Dear ImGui 1.92.6 WIP (19253)
• Branch: DOCKING (confirmed — viewport/DockSpace strings present in binary)

Source Files Compiled Into Binary

• imgui.cpp
• imgui_draw.cpp
• imgui_tables.cpp
• imgui_widgets.cpp
• imgui_demo.cpp — NOT compiled in (absent from binary)
• backends/imgui_impl_win32.cpp
• backends/imgui_impl_dx11.cpp

Build Configuration

• NDEBUG defined (release build — zero IM_ASSERT strings in binary)
• MSVC linker 14.44 = Visual Studio 2022 v17.14 (December 2025 toolchain)
• PE compile timestamp: 2025-12-10 12:27:05 UTC
• No custom imconfig.h overrides detected
• Standard ImDrawIdx = uint16_t (16-bit, default, not overridden)
• No imgui_freetype, no imgui_demo

ImGui Code Footprint in Binary

• .text section: RVA 0x1000–0x7F000 (~457KB) is entirely ImGui library code
• Cheat-specific code begins at approximately RVA 0x7F000
• Win32 backend WndProc handler: RVA 0x57720 (ImGui_ImplWin32_WndProcHandler)
• DX11 backend shader init: RVA 0x54DC0
• DX11 backend resource creation: RVA 0x551F0
• ImGuiContext accessed via [g_Config+0x15D8] in all cheat code
• IniFilename "imgui.ini" set into ImGuiIO+0x20 at RVA 0x1117A

Project Source Tree (from MSVC FILE embeds)

• E:\git\Endfield_Cheeto\framework\helpers.cpp
• E:\git\Endfield_Cheeto\libraries\pipeline\HookManager.h
• E:\git\Endfield_Cheeto\libraries\pipeline\gui\tabs\SettingsTAB.cpp
• E:\git\Endfield_Cheeto\libraries\pipeline\hooks\UI.cpp
• E:\git\Endfield_Cheeto\libraries\pipeline\modules\ModuleManager.cpp
• E:\git\Endfield_Cheeto\user\main.cpp

To Reproduce Build

git clone https://github.com/ocornut/imgui git checkout fa4b47c5e2b53dba5093384562440bd9a6bba2a0

Compile with MSVC 14.44, /O2, NDEBUG, x64

Include: imgui.cpp, imgui_draw.cpp, imgui_tables.cpp, imgui_widgets.cpp

Include: backends/imgui_impl_win32.cpp, backends/imgui_impl_dx11.cpp

No custom imconfig.h needed

================================================================================ CONFIRMED THIRD-PARTY LIBRARY VERSIONS (extracted from binary)

1. Dear ImGui

• Repo: https://github.com/ocornut/imgui
• Branch: docking
• Commit: fa4b47c5e2b53dba5093384562440bd9a6bba2a0
• Version: 1.92.6 WIP (19253)
• Files to compile: imgui.cpp imgui_draw.cpp imgui_tables.cpp imgui_widgets.cpp backends/imgui_impl_win32.cpp backends/imgui_impl_dx11.cpp
• Config: NDEBUG, no custom imconfig.h, default ImDrawIdx (uint16_t)

2. nlohmann/json

• Repo: https://github.com/nlohmann/json
• Version: v3.12.0
• Commit: 961c151d2e87f2686a955a9be24d316f1362bf21
• Usage: Header-only (single-file json.hpp) — used ONLY for i18n translation table
• Include: #include "nlohmann/json.hpp" or #include "json.hpp"
• Note: The ABI namespace in this binary is nlohmann_json_abi_v3_12_0

3. Microsoft Detours — NOT USED

• .detourc/.detourd sections are MSVC thread-safe static init sections, NOT Detours
• The hook system is 100% custom (documented in HookManager chapters)

Visual Studio Project Settings

• Platform: x64
• Configuration: Release
• Toolset: MSVC v143 (VS2022), toolchain version 14.44
• Subsystem: DLL (/LD)
• Runtime: /MD (Multi-threaded DLL — uses msvcp140.dll, vcruntime140.dll)
• Optimization: /O2 (maximize speed) — inferred from release build
• C++ Standard: /std:c++17 (confirmed from RTTI and STL usage)
• Character set: Unicode
• Additional libs to link: kernel32.lib user32.lib gdi32.lib shell32.lib d3d11.lib d3dcompiler.lib dwmapi.lib imm32.lib shcore.lib xinput.lib ntdll.lib