cat/slinky
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add project files (part 1/2)

Browse Source 
Co-Authored-By: Claude Sonnet 5 <[email protected]>
This commit is contained in:
tonihaxandClaude Sonnet 5 committed 2026-11-05 19:45:34 +01:00
1 parent 3721eaecb2
commit 73baf8d02d
274 files changed
+83593
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

docs/aim_assist.md
+55
View File
@@ -0,0 +1,55 @@
# Aim Assist — extracted implementation
Aim Assist is the reference example for the logic layer. Its original
implementation is in `src/logic/combat/aim_assist.cpp` (5,024 bytes, six
functions), extracted byte-for-byte from `slinky2.decrypted.img`.
## Functions
| function | RVA | descriptor | what it does |
|---|---:|---|---|
| `aim_assist_frame` | `0x2b200` | `+0x58` | main tick: checks enabled state, acquires the local player/world, evaluates the selected mode and calls the rotation/target routines |
| `aim_assist_disable` | `0x2b5b0` | `+0x98` | disable/reset path: clears the module's runtime state and calls the engine cleanup callback |
| `aim_assist_on_rotation_update` | `0x2b610` | — | small state helper: sets the module's active flags |
| `aim_assist_tick` | `0x2b630` | — | condition/target pass: checks the configured requirements (target, line of sight, weapon, etc.) and iterates candidate entities |
| `aim_assist_apply_frame_rotation` | `0x2bf40` | — | rotation math: clamps yaw/pitch, applies smoothing, prediction and randomization, then applies the rotation |
| `aim_assist_test_entity_updating` | `0x2c3b0` | — | target selection/validation: range/FOV checks, visibility, invisibility, hitbox correction and target sorting |
The body of each function in the source file is the exact original
instruction stream. The disassembly above each block shows the same code with
RIP-relative targets resolved, so the actual aim logic (target acquisition,
angle clamping, interpolation, FOV/range checks, prediction) is visible rather
than hidden behind an opaque stub.
In total the six functions contain 1,137 instructions and 101 calls. Every
direct call targets another function in the client `.text` (the only indirect
call is the engine cleanup callback in the disable path); none of the aim logic
is stubbed out.
## How it is wired
The module descriptor for Aim Assist is at `0x2e8cc0`:
- `+0x00` → `"Aim Assist"`
- `+0x08` → description
- `+0x10` → category `0` (combat)
- `+0x58` → `0x2b200` (tick)
- `+0x98` → `0x2b5b0` (disable)
The settings block at `0x2e8eb8` starts with the three callbacks used by the
settings layer (`aim_assist_gui`, `aim_assist_register`, `aim_assist_status`) followed by the config
objects. The logic functions read those config objects directly, including the
current-value fields at `+0x18` (bools) and `+0x30` (numbers/enums).
## Runtime requirement
The extracted code is the real client implementation, not a placeholder. It
expects the original runtime context: the module manager calls `descriptor
+0x58` with the module state, and the code uses the world/player pointers in
that state plus the client helper functions in `.text`. The Aim Assist block
therefore behaves exactly like the original inside the original client image.
This repository is a source reconstruction/verification tree, not a runnable
Minecraft client. To execute the block outside the verifier, the host must
provide the same engine/module-manager context (or the logic has to be ported
to a high-level API against that context).
docs/engine.md
+50
View File
@@ -0,0 +1,50 @@
# Engine / module-manager notes
This is the result of looking for the remaining module logic in `.slinky0` and
in the client's own dispatcher.
## The module manager is in client `.text`
The manager is not in `.slinky0`. The constructor is at `0x28000` in the
client `.text`:
- it reads the descriptor table at `0x14f810`,
- stores the module count `0x43` (67 descriptors),
- groups modules by category (`descriptor+0x10`),
- builds callback lists for the event slots at
`descriptor +0x48, +0x58, …, +0x1F8`,
- writes `[descriptor+0x14] = 1` when a module is enabled.
The dispatcher at `0x285d0` walks the enabled modules, collects the callback
for the requested event slot, and calls it. This is why the descriptor
callbacks are the primary module logic: a module without a callback at any of
those slots has no client-side handler for that event.
## The six engine-only modules
The descriptors for these modules were checked through all event slots:
| module | client callback(s) | result |
|---|---|---|
| No Jump Delay | `0x35d50` (`+0x158`) | extracted |
| Ping Fix | `0x3e6d0` (`+0x68`), `0x3e700` (`+0x78`) | extracted |
| Instant Stop | `0x42650` (`+0x148`) | extracted |
| Item Use Fix | `0x42b80` (`+0x128`), `0x42be0` (`+0x138`) | extracted |
| Null Move | `0x46ac0` (`+0x148`) | extracted |
| No Hurt Cam | none | no client callback |
`No Hurt Cam` also has no RIP-relative reference anywhere in the client
`.text`, and its descriptor has no callback pointer in `+0x48 … +0x1F8`.
There is therefore no client-native implementation to copy. Its effect must
be applied by an engine/Java-side hook (or by code in the still-packed
`.slinky0` tail); the decrypted clean engine region contains no module names,
no descriptor references and no module-manager code.
## `.slinky0`
`.slinky0` is a raw native runtime blob, not a PE. The clean region contains
native code/data (a PE loader, CRT/RTTI data, networking/OpenGL support), but
none of the module names or the descriptor table. The module table is passed
to it at runtime, and the module dispatch is done by the client manager above.
The remaining engine tail (`slinky0+0xAB0000 …`) is still packed, so nothing
can be copied from it statically without defeating that transform.
docs/global-symbol-map.json
+7790
View File
File diff suppressed because it is too large. Load diff
docs/init.md
+108
View File
@@ -0,0 +1,108 @@
# Start-up, hooks and shutdown
How the client gets from "DLL loaded into the JVM" to "game calls into the modules", and back. Most of the original
start-up is protector-virtualised, so it could not be translated; it is written as new code
(`src/engine/protected/init.cpp`, `src/platform/win/entry.cpp`) from what the surrounding readable code expects.
Facts below come from the image unless marked **inferred**. The licence check is not part of this client.
## What was found where
| Piece | Function | State |
|---|---|---|
| Class-hook installer | `install_class_hooks` | **real code**, was missed by the first gap scan. Rewritten readably (tables are data), checked against the original by running both (`tools/emu_install.py`) |
| Class-hook remover | `remove_class_hooks` | real code, translated exactly |
| `ClassFileLoadHook` + class rewriter | `class_file_load_hook`, `rewrite_class_file`, `rewrite_instruction`, ... | real code, translated |
| `SlinkyChannelHandler.onPacket` native | `on_packet` | real code (also missed by the scan), translated |
| Key handlers for profile / module binds | `on_profile_bind`, `on_module_bind`, `bind_profile_to_key` | real code (missed), translated |
| `JNI_GetCreatedJavaVMs` lookup | `get_java_vm` | real code (missed), translated |
| Hooks on/off | `set_java_hooks` | virtualised -> `init.cpp` (**inferred**: GetEnv JVMTI, install or remove, log failure) |
| Start-up thread body | inside the original image's start-up routine at RVA 0x1000 | virtualised -> `slinky_setup` in `init.cpp` (**inferred** order) |
| First-frame GUI setup | inside `hook_get_mouse_over` | virtualised -> `gui_init` in `protected/hooks.cpp` (**inferred**) |
| Global teardown | DLL detach | virtualised -> `slinky_teardown` (**inferred**) |
The first gap scan only accepted a function that follows `0xcc/0x90/0xc3`, so functions after multi-byte NOP padding
or directly after a tail `jmp` were skipped; 33 real functions (7 KB) were found by fixing that
(`tools/extract_engine.py`). 43 protector stubs remain; `empty_placeholder` is still an empty placeholder (it has no callers).
## Entry (Windows)
`DllMain` (`src/platform/win/entry.cpp`) starts a thread on `DLL_PROCESS_ATTACH`; that thread runs `slinky_setup`.
On failure it prints `Initialization failed: <code>` and starts the unload thread (`start_unload_thread`).
## `slinky_setup` (init.cpp)
1. `get_java_vm`: JavaVM from `jvm.dll` -> `init_javavm`; attach the thread.
2. JNI ID table: `calloc(JIds)` -> `java_natives_world_cached_jni_ids`, `init_jni_ids` (game class loader, mapping detection, every class/method/field
ID). Mapping: `ids->variant` 0 = 1.7.10, 1 = 1.8.9; `ids->names` 0 = obfuscated, 1 = MCP, 2 = SRG.
3. Module manager: `create_module_manager(java_natives_world_module_manager, set_module_bind)` builds the lists from the static module list (67 descriptors);
`set_module_bind` is the key-bind setter it stores. Immediately afterwards `save_module_states` runs the modules' settings
visitors in "remember" mode, copying the static values from `.data` into each setting's saved slot. Those slots are what the
built-in Default profile restores and what a profile with missing fields uses as its fallback; the image's static `.data`
only contains the live values, so without this step both paths would reset settings to zero. This is part of the inferred
start-up order: the original's start-up lives in protector-virtualised code, so the call is not visible in `.text`.
4. State the frame and input code read: key table `java_natives_world_key_state_table_one_byte` (one byte per key), key map `java_natives_frame_profile_key_binds_key_profile`
(profile binds, handler `on_profile_bind`, items are strings freed with `free`), key map `java_natives_frame_module_key_binds_key_module` (module binds,
handler `on_module_bind`, several modules per key), profile list `init_profile_list` (`load_profiles` reads `~/.slinky/profiles`).
5. Chat commands `init_chat_commands`, GLFW entry points `init_glfw_entrypoints` (absent with LWJGL 2, not an error).
6. Saved settings `~/.slinky/settings` (**inferred**, mirror of `save_settings`): per-module state for global modules
through `load_module_settings`, `profile_binds` through `bind_profile_to_key`.
7. `input_input_handler_hooked_into_game = on_input_event`: the input handler the window hook (`hook_game_window`, installed lazily every frame) calls.
8. Java side: `install_packet_channel` defines `SlinkyChannelHandler` (class bytes in the image) and registers `onPacket = on_packet`.
9. `install_class_hooks`: define `SlinkyHooks13`, register its 23 natives, add the `can_retransform_classes` capability, set the
`ClassFileLoadHook` callback, enable the event, build the hook records for the detected mapping, retransform the 9
classes, disable the event again. Errors are `12000 + jvmtiError`.
The hooks go last: from the first retransformation on, the game calls the natives.
## First frame (`hook_get_mouse_over`, hooks.cpp)
The first `getMouseOver` runs `gui_init` once, on the render thread: GL entry points
(`slinky_load_gl` + `wglGetProcAddress`), NanoVG context (`nvgCreateGL3`), window object `frame_render_target` with the two
embedded fonts (Inter Medium = slot 0, Inter Bold = slot 1). NanoVG flags are **inferred** (antialias + stencil strokes).
## The class hooks
`SlinkyHooks13` (class file in the image, 1196 bytes) declares 23 `public static native` methods; their bodies are
`hook_get_mouse_over .. hook_update_controller` (`kNatives` in `src/engine/jni/hook_tables.inc`, same order as the class file). The game classes are
not detoured: through JVMTI `RetransformClasses` the `ClassFileLoadHook` (`class_file_load_hook`) rewrites matching call and field
instructions into `invokestatic SlinkyHooks13.<native>`, so the receiver becomes the first `Object` argument.
What is rewritten is data: for each mapping (1.7.10 / 1.8.9 x obfuscated / MCP / SRG) the 9 classes
(Minecraft, EntityRenderer, RenderManager, RendererLivingEntity, RenderPlayer, NetHandlerPlayClient, WorldClient, Entity,
EntityLivingBase), per class the natives it may call and per method the instructions to replace
(`src/engine/jni/hook_tables.inc`, generated by `tools/gen_hooks.py` from an emulated run of the original installer,
`tools/dump_hooks.py`). 16 method patterns, 23 sites per mapping.
Rewritten call sites, by native: `getMouseOver` (EntityRenderer.getMouseOver in updateCameraAndRender),
`updateDisplay` (Display.update), `clickMouse`/`rightClickMouse`/`updateEntities`/`updateController` (inside Minecraft.runTick
and the input tick), `postWorldClear_1_7/_1_8` (glClear / GlStateManager.clear), `orientCamera`, `updateActiveRenderInfo`,
`isDisplayActivePreRender`, `setRenderX/Y` (RenderManager fields), `canRenderName` (any method of RendererLivingEntity),
`renderPlayer`, `unloadChunk`, `setBlock_1_7/_1_8`, `invalidateChunk`, `shouldClipLedge` (Entity.isSneaking), `moveFlying`,
`sendPacket_1_7/_1_8`.
**Verification:** `tools/emu_install.py` loads the built `slinky.dll`, runs `install_class_hooks` under Unicorn for all six mappings and
compares the records it builds with the original's: identical (9 classes, 16 patterns, 23 sites, same 23 natives).
## Packets
`SlinkyChannelHandler` (netty `ChannelDuplexHandler`, class bytes in the image) is put in the connection's pipeline as
`slinky_handler` (`register_channel_class`, every frame). It queues packets and calls `onPacket(Object packet, boolean outbound,
long time, int id)` = `on_packet`: under the lock `frame_spinlock`, and unless shutting down (`java_natives_frame_client_shutting_down_natives_check`) it dispatches module
event 2 (inbound) or 3 (outbound) and returns the handlers' verdict.
## Shutdown
`hook_update_display` (the `updateDisplay` hook) unloads when the GUI's confirmation was given: saves settings, notifies and disables the
modules, removes the netty handler, `set_java_hooks(env, 0)` (hooks off), `restore_game_window` (window hook off), then `start_unload_thread` starts a
thread that waits one second, runs `slinky_teardown` and calls `FreeLibraryAndExitThread`.
`slinky_teardown` (**inferred**) drops the netty class and the cached class references and frees the manager, both key maps,
the profile list, the chat command table, the profile name, the mesh cache, the key table and the ID table.
GL objects (NanoVG context, framebuffer) are not destroyed: that needs the render thread's context.
## Not verified / open
* The whole start-up order and the object sizes (`KeyMap` 0x30, key table 0x100, profile list 0x20) are inferred from their readers;
nothing has run inside a game yet.
* `empty_placeholder` (decrypts a short string, only reached through `reset_key_state`, which nothing calls): empty placeholder.
* The NanoVG creation flags, JVMTI version (1.2) and the settings loader are inferred.
* Linux: no platform layer yet (JVMTI agent entry, input hook, file paths, GL loader).
docs/logic.md
+741
View File
@@ -0,0 +1,741 @@
# Logic layer by module
Generated by `tools/extract_logic.py`. Each entry lists the functions in
`src/asm/<category>/<module>.cpp` that were identified as reading the
module's settings object or stored in its descriptor. All functions are
byte-for-byte copies of the original `.text` (verified by
`tools/verify_logic.py`).
| module | category | file | functions | bytes |
|---|---|---|---:|---:|
| Aim Assist | combat | [aim_assist.cpp](../src/asm/combat/aim_assist.cpp) | 6 | 5040 |
| Anti Bot | utility | [anti_bot.cpp](../src/asm/utility/anti_bot.cpp) | 2 | 1408 |
| Anti Debuff | visual | [anti_debuff.cpp](../src/asm/visual/anti_debuff.cpp) | 1 | 128 |
| Auto Block | combat | [auto_block.cpp](../src/asm/combat/auto_block.cpp) | 5 | 1600 |
| Auto Clicker | combat | [auto_clicker.cpp](../src/asm/combat/auto_clicker.cpp) | 4 | 2272 |
| Auto Pot | utility | [auto_pot.cpp](../src/asm/utility/auto_pot.cpp) | 4 | 1264 |
| Auto Rod | utility | [auto_rod.cpp](../src/asm/utility/auto_rod.cpp) | 7 | 2624 |
| Auto Soup | utility | [auto_soup.cpp](../src/asm/utility/auto_soup.cpp) | 4 | 1856 |
| Auto Tool | block | [auto_tool.cpp](../src/asm/block/auto_tool.cpp) | 2 | 864 |
| Auto Weapon | combat | [auto_weapon.cpp](../src/asm/combat/auto_weapon.cpp) | 1 | 320 |
| Backtrack | combat | [backtrack.cpp](../src/asm/combat/backtrack.cpp) | 3 | 1904 |
| Blink | utility | [blink.cpp](../src/asm/utility/blink.cpp) | 5 | 464 |
| Block ESP | visual | [block_esp.cpp](../src/asm/visual/block_esp.cpp) | 5 | 1648 |
| Block In | block | [block_in.cpp](../src/asm/block/block_in.cpp) | 5 | 4048 |
| Bridge Assist | block | [bridge_assist.cpp](../src/asm/block/bridge_assist.cpp) | 5 | 2800 |
| Chams | visual | [chams.cpp](../src/asm/visual/chams.cpp) | 1 | 336 |
| Chest ESP | visual | [chest_esp.cpp](../src/asm/visual/chest_esp.cpp) | 2 | 976 |
| Chest Stealer | utility | [chest_stealer.cpp](../src/asm/utility/chest_stealer.cpp) | 1 | 240 |
| Clutch | block | [clutch.cpp](../src/asm/block/clutch.cpp) | 4 | 5904 |
| Criticals | combat | [criticals.cpp](../src/asm/combat/criticals.cpp) | 4 | 1024 |
| Debug | utility | [debug.cpp](../src/asm/utility/debug.cpp) | 4 | 800 |
| Fake Lag | utility | [fake_lag.cpp](../src/asm/utility/fake_lag.cpp) | 2 | 560 |
| Fast Accel | move | [fast_accel.cpp](../src/asm/move/fast_accel.cpp) | 1 | 608 |
| Fast Mine | block | [fast_mine.cpp](../src/asm/block/fast_mine.cpp) | 2 | 400 |
| Fast Place | block | [fast_place.cpp](../src/asm/block/fast_place.cpp) | 1 | 800 |
| Free Look | visual | [free_look.cpp](../src/asm/visual/free_look.cpp) | 2 | 256 |
| Friends | utility | [friends.cpp](../src/asm/utility/friends.cpp) | 4 | 960 |
| GUI | visual | [gui.cpp](../src/asm/visual/gui.cpp) | 7 | 752 |
| Ghost Hand | block | [ghost_hand.cpp](../src/asm/block/ghost_hand.cpp) | 2 | 304 |
| Hit Select | combat | [hit_select.cpp](../src/asm/combat/hit_select.cpp) | 3 | 1264 |
| Hitboxes | combat | [hitboxes.cpp](../src/asm/combat/hitboxes.cpp) | 1 | 32 |
| Indicators | visual | [indicators.cpp](../src/asm/visual/indicators.cpp) | 3 | 2144 |
| Inv Manager | utility | [inv_manager.cpp](../src/asm/utility/inv_manager.cpp) | 3 | 2288 |
| Inv Walk | move | [inv_walk.cpp](../src/asm/move/inv_walk.cpp) | 4 | 1808 |
| Item ESP | visual | [item_esp.cpp](../src/asm/visual/item_esp.cpp) | 3 | 2336 |
| Keep Sprint | move | [keep_sprint.cpp](../src/asm/move/keep_sprint.cpp) | 3 | 416 |
| Knockback Delay | combat | [knockback_delay.cpp](../src/asm/combat/knockback_delay.cpp) | 2 | 1008 |
| Knockback Displace | combat | [knockback_displace.cpp](../src/asm/combat/knockback_displace.cpp) | 6 | 1136 |
| Lag Range | combat | [lag_range.cpp](../src/asm/combat/lag_range.cpp) | 4 | 1856 |
| Mod Overlay | visual | [mod_overlay.cpp](../src/asm/visual/mod_overlay.cpp) | 8 | 3216 |
| Name Tags | visual | [name_tags.cpp](../src/asm/visual/name_tags.cpp) | 3 | 5024 |
| No Hit Delay | utility | [no_hit_delay.cpp](../src/asm/utility/no_hit_delay.cpp) | 1 | 160 |
| No Item Release | utility | [no_item_release.cpp](../src/asm/utility/no_item_release.cpp) | 1 | 256 |
| No Slow | move | [no_slow.cpp](../src/asm/move/no_slow.cpp) | 1 | 160 |
| No Use Delay | utility | [no_use_delay.cpp](../src/asm/utility/no_use_delay.cpp) | 1 | 256 |
| Notifications | visual | [notifications.cpp](../src/asm/visual/notifications.cpp) | 6 | 2992 |
| Piercing | combat | [piercing.cpp](../src/asm/combat/piercing.cpp) | 3 | 592 |
| Player ESP | visual | [player_esp.cpp](../src/asm/visual/player_esp.cpp) | 3 | 3152 |
| Pointers | visual | [pointers.cpp](../src/asm/visual/pointers.cpp) | 2 | 2128 |
| Reach | combat | [reach.cpp](../src/asm/combat/reach.cpp) | 1 | 176 |
| Refill | utility | [refill.cpp](../src/asm/utility/refill.cpp) | 3 | 2064 |
| Safe Walk | move | [safe_walk.cpp](../src/asm/move/safe_walk.cpp) | 1 | 288 |
| Sprint | move | [sprint.cpp](../src/asm/move/sprint.cpp) | 2 | 368 |
| Sprint Reset | combat | [sprint_reset.cpp](../src/asm/combat/sprint_reset.cpp) | 2 | 864 |
| Strafe | move | [strafe.cpp](../src/asm/move/strafe.cpp) | 2 | 624 |
| Teams | utility | [teams.cpp](../src/asm/utility/teams.cpp) | 3 | 720 |
| Timer | utility | [timer.cpp](../src/asm/utility/timer.cpp) | 2 | 272 |
| Timer Range | combat | [timer_range.cpp](../src/asm/combat/timer_range.cpp) | 5 | 3632 |
| Trajectories | visual | [trajectories.cpp](../src/asm/visual/trajectories.cpp) | 3 | 3968 |
| Velocity | combat | [velocity.cpp](../src/asm/combat/velocity.cpp) | 8 | 2512 |
| Weapons | combat | [weapons.cpp](../src/asm/combat/weapons.cpp) | 4 | 640 |
| No Jump Delay | move | [no_jump_delay.cpp](../src/asm/move/no_jump_delay.cpp) | 1 | 48 |
| Ping Fix | utility | [ping_fix.cpp](../src/asm/utility/ping_fix.cpp) | 2 | 96 |
| Instant Stop | move | [instant_stop.cpp](../src/asm/move/instant_stop.cpp) | 1 | 976 |
| Item Use Fix | utility | [item_use_fix.cpp](../src/asm/utility/item_use_fix.cpp) | 2 | 176 |
| Null Move | move | [null_move.cpp](../src/asm/move/null_move.cpp) | 1 | 592 |
## Functions
### Aim Assist
`src/asm/combat/aim_assist.cpp` - descriptor `0x2e8cc0`, settings block `0x2e8eb8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `aim_assist_frame` | `0x2b200` | 944 | descriptor +0x58 | `0x2e9020` config scalar, `0x2e9048` setting bool "silent_ignore_manual_aim" (current value +0x18) |
| `aim_assist_disable` | `0x2b5b0` | 96 | descriptor +0x98 | |
| `aim_assist_on_rotation_update` | `0x2b610` | 32 | descriptor +0x118 | `0x2e9068` setting bool "silent_move_correct" (current value +0x18) |
| `aim_assist_tick` | `0x2b630` | 1200 | descriptor +0x168 | `0x2e9020` config scalar, `0x2e90d8` setting bool "require_sprint" (current value +0x18), `0x2e90f8` setting bool "require_mouse_pressed" (current value +0x18), `0x2e9118` setting bool "disable_on_block_break" (current value +0x18), ... |
| `aim_assist_apply_frame_rotation` | `0x2bf40` | 1136 | settings logic | `0x2e8f50` setting num "hor_speed" (current value +0x30), `0x2e8f88` setting num "ver_speed" (current value +0x30), `0x2e8fa8` setting bool "lock_on_vertical" (current value +0x18), `0x2e8fc8` setting bool "require_mouse_moved" (current value +0x18), ... |
| `aim_assist_test_entity_updating` | `0x2c3b0` | 1632 | settings logic | `0x2e9180` config scalar, `0x2e91c0` setting num "predict" (current value +0x30), `0x2e91f8` setting num "hor_hitbox_correct" (current value +0x30), `0x2e9230` setting num "ver_hitbox_correct" (current value +0x30), ... |
### Anti Bot
`src/asm/utility/anti_bot.cpp` - descriptor `0x2eacd0`, settings block `0x2eaec8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `anti_bot_on_tick` | `0x30e70` | 1184 | descriptor +0x48 | `0x2eaf10` setting num "min_age" (current value +0x30), `0x2eaf30` setting bool "always_stationary" (current value +0x18), `0x2eaf88` setting enum "invalid_uuid" (current value +0x30), `0x2eafb0` setting bool "sleeping" (current value +0x18), ... |
| `anti_bot_on_toggle` | `0x31310` | 224 | descriptor +0x98 | |
### Anti Debuff
`src/asm/visual/anti_debuff.cpp` - descriptor `0x2f3860`, settings block `0x2f3a58`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `anti_debuff_on_late_tick` | `0x44940` | 128 | descriptor +0x168 | `0x2f3a88` setting bool "blindness" (current value +0x18), `0x2f3aa8` setting bool "nausea" (current value +0x18) |
### Auto Block
`src/asm/combat/auto_block.cpp` - descriptor `0x2eaff8`, settings block `0x2eb1f0`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `auto_block_on_tick` | `0x31570` | 1248 | descriptor +0x48 | `0x2eb238` setting num "max_hold_time" (current value +0x30), `0x2eb270` setting num "lag_chance" (current value +0x30), `0x2eb2a8` setting num "lag_duration" (current value +0x30), `0x2eb2e0` setting num "max_hurt_time" (current value +0x30), ... |
| `auto_block_on_packet_sent` | `0x31a50` | 32 | descriptor +0x78 | |
| `auto_block_on_toggle` | `0x31a70` | 144 | descriptor +0x98 | |
| `auto_block_on_attack` | `0x31b00` | 96 | descriptor +0x128 | |
| `auto_block_on_late_tick` | `0x31b60` | 80 | descriptor +0x168 | |
### Auto Clicker
`src/asm/combat/auto_clicker.cpp` - descriptor `0x2e9330`, settings block `0x2e9528`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `auto_clicker_tick` | `0x2ca10` | 128 | descriptor +0x48 | |
| `auto_clicker_on_frame` | `0x2ca90` | 1712 | descriptor +0x58 | `0x2e9560` config scalar, `0x2e9580` setting bool "inventory_randomize" (current value +0x18), `0x2e95a0` setting bool "allow_block_break" (current value +0x18), `0x2e95c0` setting bool "require_weapon" (current value +0x18), ... |
| `auto_clicker_on_player_update` | `0x2d140` | 80 | descriptor +0x158 | |
| `auto_clicker_extra_burst_clicks` | `0x2d3b0` | 352 | settings logic | `0x2e96a8` setting bool "exhaust" (current value +0x18) |
### Auto Pot
`src/asm/utility/auto_pot.cpp` - descriptor `0x2ef128`, settings block `0x2ef320`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `auto_pot_on_tick` | `0x391c0` | 784 | descriptor +0x48 | `0x2ef350` setting bool "use_non_health" (current value +0x18) |
| `auto_pot_on_input` | `0x394d0` | 80 | descriptor +0x88 | |
| `auto_pot_on_toggle` | `0x39520` | 224 | descriptor +0x98 | `0x2ef3a8` setting bool "prevent_waste" (current value +0x18), `0x2ef3c8` setting bool "double_splash" (current value +0x18) |
| `auto_pot_asm_r_pins` | `0x396e0` | 176 | settings logic | `0x2ef388` setting num "delay" (current value +0x30) |
### Auto Rod
`src/asm/utility/auto_rod.cpp` - descriptor `0x2f3520`, settings block `0x2f3718`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `auto_rod_on_tick` | `0x43d80` | 1472 | descriptor +0x48 | `0x2f3750` setting bool "require_not_mouse_over" (current value +0x18), `0x2f3770` setting bool "allow_throwables" (current value +0x18), `0x2f3790` setting bool "always_switch_to_weapon" (current value +0x18) |
| `auto_rod_on_input` | `0x44340` | 80 | descriptor +0x88 | |
| `auto_rod_on_toggle` | `0x44390` | 48 | descriptor +0x98 | |
| `auto_rod_on_attack` | `0x443c0` | 96 | descriptor +0x128 | |
| `auto_rod_randomised_throw_delay` | `0x445a0` | 192 | settings logic | `0x2f37c8` setting num "delay" (current value +0x30), `0x2f37e8` setting bool "randomize_delays" (current value +0x18) |
| `auto_rod_ticks_bobber_needs` | `0x44660` | 512 | settings logic | `0x2f3820` setting num "retract_speed" (current value +0x30) |
| `auto_rod_randomised_rod_pull` | `0x44860` | 224 | settings logic | `0x2f37e8` setting bool "randomize_delays" (current value +0x18), `0x2f3858` setting num "throw_speed" (current value +0x30) |
### Auto Soup
`src/asm/utility/auto_soup.cpp` - descriptor `0x2e96b0`, settings block `0x2e98a8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `auto_soup_on_tick` | `0x2d510` | 1488 | descriptor +0x48 | `0x2e98f0` config scalar, `0x2e9928` setting num "delay_before" (current value +0x30), `0x2e9960` config scalar, `0x2e9998` setting num "delay_between" (current value +0x30), ... |
| `auto_soup_input_hook` | `0x2dae0` | 48 | descriptor +0x88 | |
| `auto_soup_enable` | `0x2db10` | 64 | descriptor +0x98 | |
| `auto_soup_asm_pins_keep` | `0x2dd50` | 256 | settings logic | `0x2e9a08` setting num "randomization" (current value +0x30) |
### Auto Tool
`src/asm/block/auto_tool.cpp` - descriptor `0x2ee158`, settings block `0x2ee350`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `auto_tool_on_inventory_tick` | `0x37180` | 816 | descriptor +0x1d8 | `0x2ee3a0` setting num "activation_time" (current value +0x30), `0x2ee3c0` setting bool "allow_using_fists" (current value +0x18), `0x2ee3e0` setting bool "allow_using_sword" (current value +0x18), `0x2ee400` setting bool "allow_using_tools" (current value +0x18), ... |
| `auto_tool_on_shutdown` | `0x374b0` | 48 | descriptor +0x1e8 | |
### Auto Weapon
`src/asm/combat/auto_weapon.cpp` - descriptor `0x2f5af8`, settings block `0x2f5cf0`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `auto_weapon_on_inventory_tick` | `0x4a340` | 320 | descriptor +0x1d8 | `0x2f5d38` setting num "activation_time" (current value +0x30), `0x2f5d58` setting bool "require_mouse_pressed" (current value +0x18) |
### Backtrack
`src/asm/combat/backtrack.cpp` - descriptor `0x2edad0`, settings block `0x2edcc8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `backtrack_packet_hook_under` | `0x35fd0` | 320 | descriptor +0x68 | |
| `backtrack_render_box_held` | `0x36110` | 464 | descriptor +0xa8 | `0x2edd10` setting num "indicator_line_width" (current value +0x30), `0x2edd50` setting bool "indicator_rotate" (current value +0x18), `0x2edd70` setting bool "indicator_filled" (current value +0x18) |
| `backtrack_tick_decide_whether` | `0x362e0` | 1120 | descriptor +0x168 | `0x2edda8` setting num "max_hurt_time" (current value +0x30), `0x2ede30` config scalar, `0x2ede68` setting num "cooldown" (current value +0x30), `0x2ede88` setting bool "require_mouse_pressed" (current value +0x18), ... |
### Blink
`src/asm/utility/blink.cpp` - descriptor `0x2ec600`, settings block `0x2ec7f8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `blink_on_tick` | `0x33660` | 112 | descriptor +0x48 | `0x2ec828` setting bool "disable_on_attack" (current value +0x18) |
| `blink_on_packet_received` | `0x336d0` | 128 | descriptor +0x68 | |
| `blink_on_packet_sent` | `0x33750` | 32 | descriptor +0x78 | |
| `blink_on_toggle` | `0x33770` | 80 | descriptor +0x98 | `0x2ec860` setting num "max_duration" (current value +0x30), `0x2ec8b8` current value of setting "direction" (+0x30) |
| `blink_on_attack` | `0x337c0` | 112 | descriptor +0x128 | `0x2ec8e0` setting bool "disable_on_block_dig" (current value +0x18), `0x2ec900` setting bool "disable_on_block_interact" (current value +0x18) |
### Block ESP
`src/asm/visual/block_esp.cpp` - descriptor `0x2f1740`, settings block `0x2f1938`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `block_esp_on_tick` | `0x3f4c0` | 480 | descriptor +0x48 | |
| `block_esp_on_toggle` | `0x3f6a0` | 272 | descriptor +0x98 | |
| `block_esp_on_render_world` | `0x3f7b0` | 656 | descriptor +0xa8 | `0x2f19e8` setting num "line_width" (current value +0x30), `0x2f1a20` setting num "block_render_limit" (current value +0x30), `0x2f1a58` setting num "range" (current value +0x30), `0x2f1a78` config scalar |
| `block_esp_on_world_change` | `0x3fa40` | 16 | descriptor +0x188 | |
| `block_esp_on_shutdown` | `0x3fa50` | 224 | descriptor +0x1e8 | |
### Block In
`src/asm/block/block_in.cpp` - descriptor `0x2f6108`, settings block `0x2f6300`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `block_in_on_tick` | `0x4abf0` | 16 | descriptor +0x48 | |
| `block_in_enable_remember_facing` | `0x4ac00` | 336 | descriptor +0x98 | |
| `block_in_rotation_override_placement` | `0x4ad50` | 48 | descriptor +0x118 | |
| `block_in_tick_while_placing` | `0x4ad80` | 208 | descriptor +0x148 | |
| `block_in_tick` | `0x4ae50` | 3440 | descriptor +0x168 | `0x2f6330` setting bool "require_ground" (current value +0x18), `0x2f6368` setting num "speed" (current value +0x30) |
### Bridge Assist
`src/asm/block/bridge_assist.cpp` - descriptor `0x2e9ac0`, settings block `0x2e9cb8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `bridge_assist_disable` | `0x2de50` | 112 | descriptor +0x98 | |
| `bridge_assist_place` | `0x2dec0` | 928 | descriptor +0x128 | |
| `bridge_assist_tick` | `0x2e260` | 832 | descriptor +0x158 | `0x2e9ce8` setting bool "require_sneak" (current value +0x18), `0x2e9d08` setting bool "require_looking_down" (current value +0x18), `0x2e9d28` setting bool "require_not_forward" (current value +0x18), `0x2e9d78` setting enum "select_blocks" (current value +0x30), ... |
| `bridge_assist_on_late_tick` | `0x2e5a0` | 48 | descriptor +0x168 | `0x2e9d78` setting enum "select_blocks" (current value +0x30) |
| `bridge_assist_edge_check` | `0x2e7b0` | 880 | settings logic | `0x2e9df8` setting num "edge_offset" (current value +0x30), `0x2e9e18` setting bool "randomize" (current value +0x18) |
### Chams
`src/asm/visual/chams.cpp` - descriptor `0x2f0fe0`, settings block `0x2f11d8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `chams_render_living_entity` | `0x3e730` | 336 | settings logic | `0x2f1208` setting bool "hide_friendlies" (current value +0x18) |
### Chest ESP
`src/asm/visual/chest_esp.cpp` - descriptor `0x2ec908`, settings block `0x2ecb00`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `chest_esp_on_tick` | `0x33990` | 464 | descriptor +0x48 | `0x2ecb48` setting num "range" (current value +0x30), `0x2ecb68` config scalar, `0x2ecb88` config scalar, `0x2ecba8` config scalar, ... |
| `chest_esp_on_render_world` | `0x33b60` | 512 | descriptor +0xa8 | `0x2ecc00` setting num "line_width" (current value +0x30), `0x2ecca0` setting bool "filled" (current value +0x18) |
### Chest Stealer
`src/asm/utility/chest_stealer.cpp` - descriptor `0x2f5288`, settings block `0x2f5480`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `chest_stealer_on_tick` | `0x48600` | 240 | descriptor +0x1d8 | `0x2f54c8` setting num "delay_after_open" (current value +0x30), `0x2f54e8` setting bool "require_vanilla_title" (current value +0x18) |
### Clutch
`src/asm/block/clutch.cpp` - descriptor `0x2f5580`, settings block `0x2f5778`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `clutch_tick` | `0x488f0` | 320 | descriptor +0x48 | `0x2f57c0` setting num "click_speed" (current value +0x30) |
| `clutch_rotation_override_flag` | `0x48a30` | 32 | descriptor +0x118 | |
| `clutch_on_late_tick` | `0x48a50` | 4528 | descriptor +0x168 | `0x2f57f8` setting num "snapback_duration" (current value +0x30), `0x2f5830` setting num "snapback_delay" (current value +0x30), `0x2f5868` setting num "randomization" (current value +0x30), `0x2f58a0` setting num "aim_speed" (current value +0x30), ... |
| `clutch_pick_aim_target` | `0x49f40` | 1024 | settings logic | `0x2f5868` setting num "randomization" (current value +0x30), `0x2f5a78` setting bool "aim_multipoint" (current value +0x18) |
### Criticals
`src/asm/combat/criticals.cpp` - descriptor `0x2ec010`, settings block `0x2ec208`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `criticals_on_tick` | `0x32f10` | 368 | descriptor +0x48 | `0x2ec250` setting num "max_delay" (current value +0x30), `0x2ec288` setting num "chance" (current value +0x30), `0x2ec2a8` setting bool "require_mouse_pressed" (current value +0x18), `0x2ec2c8` setting bool "require_weapon" (current value +0x18), ... |
| `criticals_on_frame` | `0x33080` | 288 | descriptor +0x58 | `0x2ec350` setting num "timer_speed" (current value +0x30), `0x2ec388` setting num "boost" (current value +0x30) |
| `criticals_on_packet_sent` | `0x331a0` | 272 | descriptor +0x78 | |
| `criticals_on_toggle` | `0x332b0` | 96 | descriptor +0x98 | |
### Debug
`src/asm/utility/debug.cpp` - descriptor `0x2f4430`, settings block `0x2f4628`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `debug_on_tick` | `0x466e0` | 368 | descriptor +0x48 | `0x2f4658` setting bool "hurt_time" (current value +0x18), `0x2f4678` setting bool "item_use_state" (current value +0x18) |
| `debug_on_packet_sent` | `0x46850` | 112 | descriptor +0x78 | |
| `debug_on_attack_post` | `0x468c0` | 64 | descriptor +0x138 | `0x2f4698` setting bool "clicks" (current value +0x18) |
| `debug_on_late_tick` | `0x46900` | 256 | descriptor +0x168 | `0x2f4698` setting bool "clicks" (current value +0x18) |
### Fake Lag
`src/asm/utility/fake_lag.cpp` - descriptor `0x2ebcc0`, settings block `0x2ebeb8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `fake_lag_on_tick` | `0x32b30` | 384 | descriptor +0x48 | `0x2ebf00` setting num "inbound" (current value +0x30), `0x2ebf38` setting num "outbound" (current value +0x30), `0x2ebf58` setting bool "realtime_damage" (current value +0x18), `0x2ebfa0` current value of setting "mode" (+0x30), ... |
| `fake_lag_on_packet_sent` | `0x32cb0` | 176 | descriptor +0x78 | |
### Fast Accel
`src/asm/move/fast_accel.cpp` - descriptor `0x2f27f8`, settings block `0x2f29f0`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `fast_accel_on_move_flying` | `0x42320` | 608 | descriptor +0x1a8 | `0x2f2a38` setting num "acceleration" (current value +0x30), `0x2f2a58` setting bool "require_weapon" (current value +0x18), `0x2f2a78` setting bool "require_not_damaged" (current value +0x18) |
### Fast Mine
`src/asm/block/fast_mine.cpp` - descriptor `0x2f1d90`, settings block `0x2f1f88`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `fast_mine_on_tick` | `0x41a90` | 160 | descriptor +0x48 | `0x2f1fd0` setting num "break_delay" (current value +0x30), `0x2f1ff0` setting bool "decr_block_hit_delay" (current value +0x18) |
| `fast_mine_on_late_tick` | `0x41b30` | 240 | descriptor +0x168 | `0x2f2028` config scalar |
### Fast Place
`src/asm/block/fast_place.cpp` - descriptor `0x2ea2d0`, settings block `0x2ea4c8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `fast_place_tick` | `0x2fbc0` | 800 | descriptor +0x48 | `0x2ea510` config scalar, `0x2ea548` setting num "activate_delay" (current value +0x30) |
### Free Look
`src/asm/visual/free_look.cpp` - descriptor `0x2edef0`, settings block `0x2ee0e8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `free_look_on_module_toggle` | `0x37020` | 224 | descriptor +0x98 | `0x2ee148` setting enum "target_perspective" (current value +0x30) |
| `free_look_on_rotation_update` | `0x37100` | 32 | descriptor +0x118 | |
### Friends
`src/asm/utility/friends.cpp` - descriptor `0x2f0038`, settings block `0x2f0230`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `friends_on_middle_click_add` | `0x3b200` | 384 | settings logic | `0x2f0260` setting bool "middle_click_add" (current value +0x18) |
| `friends_on_tick` | `0x3b3c0` | 336 | descriptor +0x48 | |
| `friends_on_toggle` | `0x3b510` | 192 | descriptor +0x98 | |
| `friends_on_shutdown` | `0x3b5d0` | 48 | descriptor +0x1e8 | |
### GUI
`src/asm/visual/gui.cpp` - descriptor `0x2eb740`, settings block `0x2eb938`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `gui_get_scale` | `0x32490` | 32 | settings logic | `0x2eb9a0` setting enum "scale" (current value +0x30) |
| `gui_handle_input_event` | `0x324d0` | 192 | settings logic | `0x2eb9c8` setting bool "allow_input" (current value +0x18) |
| `gui_on_tick` | `0x325c0` | 64 | descriptor +0x48 | |
| `gui_on_toggle` | `0x32600` | 304 | descriptor +0x98 | |
| `gui_on_hud_tick` | `0x32730` | 16 | descriptor +0xd8 | |
| `gui_on_hud_render` | `0x32740` | 128 | descriptor +0xe8 | `0x2eb9e8` setting bool "compact" (current value +0x18), `0x2eba08` setting bool "wide" (current value +0x18) |
| `gui_on_shutdown` | `0x327c0` | 16 | descriptor +0x1e8 | |
### Ghost Hand
`src/asm/block/ghost_hand.cpp` - descriptor `0x2f48b0`, settings block `0x2f4aa8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `ghost_hand_should_ignore_entity` | `0x46d10` | 288 | settings logic | `0x2f4ad8` setting bool "require_mouse_pressed" (current value +0x18), `0x2f4af8` setting bool "allow_using_fists" (current value +0x18), `0x2f4b18` setting bool "allow_using_sword" (current value +0x18), `0x2f4b38` setting bool "allow_using_tools" (current value +0x18), ... |
| `ghost_hand_on_reach_query` | `0x46e30` | 16 | descriptor +0xc8 | |
### Hit Select
`src/asm/combat/hit_select.cpp` - descriptor `0x2ee4f0`, settings block `0x2ee6e8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `hit_select_on_tick` | `0x376c0` | 80 | descriptor +0x48 | |
| `hit_select_on_attack` | `0x37710` | 976 | descriptor +0x128 | `0x2ee730` setting num "cancel_rate_air" (current value +0x30), `0x2ee768` setting num "pause_dur" (current value +0x30), `0x2ee7a0` setting num "wait_for_damage_dur" (current value +0x30), `0x2ee7d8` setting num "trades_delay" (current value +0x30), ... |
| `hit_select_on_player_update` | `0x37ae0` | 208 | descriptor +0x158 | `0x2ee8c8` setting bool "use_server_time" (current value +0x18) |
### Hitboxes
`src/asm/combat/hitboxes.cpp` - descriptor `0x2ecca8`, settings block `0x2ecea0`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `hitboxes_on_reach_query` | `0x33fc0` | 32 | descriptor +0xc8 | `0x2ecee8` config scalar |
### Indicators
`src/asm/visual/indicators.cpp` - descriptor `0x2f1440`, settings block `0x2f1638`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `indicators_disable` | `0x3ea40` | 144 | descriptor +0x98 | |
| `indicators_render` | `0x3ead0` | 1104 | descriptor +0xb8 | `0x2f1680` setting num "scale" (current value +0x30), `0x2f16b8` setting num "radius" (current value +0x30) |
| `indicators_tick` | `0x3ef20` | 896 | descriptor +0x168 | `0x2f16d8` setting bool "show_arrow" (current value +0x18), `0x2f16f8` setting bool "show_fireball" (current value +0x18), `0x2f1718` setting bool "show_pearl" (current value +0x18), `0x2f1738` setting bool "require_coming_closer" (current value +0x18) |
### Inv Manager
`src/asm/utility/inv_manager.cpp` - descriptor `0x2f4c40`, settings block `0x2f4e38`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `inv_manager_tick` | `0x47090` | 1232 | descriptor +0x1d8 | `0x2f4e80` setting num "delay_after_open" (current value +0x30), `0x2f5228` setting bool "randomize" (current value +0x18), `0x2f5260` setting num "speed" (current value +0x30), `0x2f5280` setting bool "smart_speed" (current value +0x18) |
| `inv_manager_plan_step` | `0x479c0` | 816 | settings logic | `0x2f4fb0` config scalar |
| `inv_manager_score_item_stack` | `0x47f90` | 240 | settings logic | `0x2f5208` setting bool "sort_hotbar_fallback" (current value +0x18) |
### Inv Walk
`src/asm/move/inv_walk.cpp` - descriptor `0x2ef3d0`, settings block `0x2ef5c8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `inv_walk_on_toggle` | `0x39790` | 48 | descriptor +0x98 | |
| `inv_walk_tick_keep_movement` | `0x397c0` | 1312 | descriptor +0x158 | `0x2ef620` config scalar, `0x2ef678` config scalar, `0x2ef6b8` setting num "stop_duration" (current value +0x30), `0x2ef6f0` setting enum "stop_non_inv" (current value +0x30) |
| `inv_walk_on_gui_screen` | `0x39ce0` | 336 | descriptor +0x1b8 | `0x2ef620` config scalar |
| `inv_walk_on_inventory_tick` | `0x39e30` | 112 | descriptor +0x1d8 | |
### Item ESP
`src/asm/visual/item_esp.cpp` - descriptor `0x2f1a80`, settings block `0x2f1c78`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `item_esp_render` | `0x40de0` | 1136 | descriptor +0xa8 | `0x2f1ca8` setting bool "show_count" (current value +0x18) |
| `item_esp_tick` | `0x41250` | 1136 | descriptor +0x168 | `0x2f1ca8` setting bool "show_count" (current value +0x18), `0x2f1ce0` setting num "range" (current value +0x30), `0x2f1ce8` config scalar, `0x2f1d20` config scalar |
| `item_esp_shutdown` | `0x416c0` | 64 | descriptor +0x1e8 | |
### Keep Sprint
`src/asm/move/keep_sprint.cpp` - descriptor `0x2ef700`, settings block `0x2ef8f8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `keep_sprint_on_attack` | `0x3a0f0` | 128 | descriptor +0x128 | `0x2ef940` setting num "chance" (current value +0x30) |
| `keep_sprint_on_attack_post` | `0x3a170` | 240 | descriptor +0x138 | `0x2ef978` config scalar, `0x2ef998` setting bool "require_on_ground" (current value +0x18), `0x2ef9b8` setting bool "allow_reduce" (current value +0x18) |
| `keep_sprint_on_player_update` | `0x3a260` | 48 | descriptor +0x158 | |
### Knockback Delay
`src/asm/combat/knockback_delay.cpp` - descriptor `0x2f40f8`, settings block `0x2f42f0`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `knockback_delay_on_packet_received` | `0x46140` | 304 | descriptor +0x68 | |
| `knockback_delay_on_late_tick` | `0x46270` | 704 | descriptor +0x168 | `0x2f4338` config scalar, `0x2f4358` setting bool "require_air" (current value +0x18), `0x2f4390` setting num "range" (current value +0x30), `0x2f43b0` setting bool "require_weapon" (current value +0x18), ... |
### Knockback Displace
`src/asm/combat/knockback_displace.cpp` - descriptor `0x2f5d60`, settings block `0x2f5f58`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `knockback_displace_on_packet_sent` | `0x4a520` | 32 | descriptor +0x78 | |
| `knockback_displace_on_rotation_update` | `0x4a540` | 32 | descriptor +0x118 | |
| `knockback_displace_on_attack` | `0x4a560` | 624 | descriptor +0x128 | `0x2f5fa0` setting num "cooldown" (current value +0x30), `0x2f5fd8` config scalar, `0x2f5ff8` setting bool "require_no_kb" (current value +0x18), `0x2f6018` setting bool "require_weapon" (current value +0x18), ... |
| `knockback_displace_on_attack_post` | `0x4a7d0` | 48 | descriptor +0x138 | |
| `knockback_displace_on_late_tick` | `0x4a800` | 304 | descriptor +0x168 | `0x2f60e0` setting bool "hide_rotation" (current value +0x18), `0x2f6100` setting bool "use_last_strafe" (current value +0x18) |
| `knockback_displace_direction` | `0x4ab90` | 96 | settings logic | `0x2f60b8` config scalar |
### Lag Range
`src/asm/combat/lag_range.cpp` - descriptor `0x2ef9c0`, settings block `0x2efbb8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `lag_range_packet_hook_hold` | `0x3a3c0` | 592 | descriptor +0x78 | |
| `lag_range_render_box_interpolated` | `0x3a610` | 368 | descriptor +0xa8 | `0x2efc00` setting num "indicator_line_width" (current value +0x30), `0x2efc40` setting bool "indicator_filled" (current value +0x18) |
| `lag_range_attack_hook` | `0x3a780` | 80 | descriptor +0x138 | |
| `lag_range_tick_decide_whether` | `0x3a7d0` | 816 | descriptor +0x168 | `0x2efc78` config scalar, `0x2efc98` setting bool "require_weapon" (current value +0x18), `0x2efcb8` setting bool "flush_splash_potion" (current value +0x18), `0x2efcd8` setting bool "flush_sprint_reset" (current value +0x18), ... |
### Mod Overlay
`src/asm/visual/mod_overlay.cpp` - descriptor `0x2ecef0`, settings block `0x2ed0e8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `mod_overlay_tick` | `0x34080` | 528 | descriptor +0x48 | `0x2ed118` setting bool "show_combat" (current value +0x18), `0x2ed138` setting bool "show_move" (current value +0x18), `0x2ed158` setting bool "show_block" (current value +0x18), `0x2ed178` setting bool "show_visual" (current value +0x18), ... |
| `mod_overlay_module_toggled` | `0x34290` | 576 | descriptor +0x98 | `0x2ed118` setting bool "show_combat" (current value +0x18), `0x2ed138` setting bool "show_move" (current value +0x18), `0x2ed158` setting bool "show_block" (current value +0x18), `0x2ed178` setting bool "show_visual" (current value +0x18), ... |
| `mod_overlay_on_hud_tick` | `0x344d0` | 64 | descriptor +0xd8 | |
| `mod_overlay_render` | `0x34510` | 1248 | descriptor +0xe8 | `0x2ed230` setting num "text_size" (current value +0x30), `0x2ed268` setting key "name_color" (current value +0x30), `0x2ed2a8` setting num "bg_rounding" (current value +0x30), `0x2ed2e0` setting num "padding_x" (current value +0x30), ... |
| `mod_overlay_on_profile_event` | `0x349f0` | 32 | descriptor +0xf8 | |
| `mod_overlay_on_overlay_unload` | `0x34a10` | 48 | descriptor +0x1c8 | `0x2ed1b8` setting bool "require_bound" (current value +0x18) |
| `mod_overlay_rebuild_visibility` | `0x34ce0` | 432 | settings logic | `0x2ed118` setting bool "show_combat" (current value +0x18), `0x2ed138` setting bool "show_move" (current value +0x18), `0x2ed158` setting bool "show_block" (current value +0x18), `0x2ed178` setting bool "show_visual" (current value +0x18), ... |
| `mod_overlay_append_entry` | `0x34e90` | 288 | settings logic | `0x2ed1d8` setting bool "lowercase" (current value +0x18), `0x2ed1f8` setting bool "show_details" (current value +0x18) |
### Name Tags
`src/asm/visual/name_tags.cpp` - descriptor `0x2f02d0`, settings block `0x2f04c8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `name_tags_disable` | `0x3c210` | 112 | descriptor +0x98 | |
| `name_tags_render` | `0x3c280` | 1952 | descriptor +0xb8 | `0x2f0510` setting num "scale" (current value +0x30), `0x2f0530` setting bool "distance_scaling" (current value +0x18), `0x2f0550` setting bool "background" (current value +0x18), `0x2f0570` setting bool "text_shadow" (current value +0x18), ... |
| `name_tags_tick` | `0x3ca20` | 2960 | descriptor +0x168 | `0x2f05b0` setting bool "show_enchants" (current value +0x18), `0x2f05e8` setting num "range" (current value +0x30), `0x2f0608` setting bool "show_own_name_tag" (current value +0x18), `0x2f0628` setting bool "use_display_name" (current value +0x18), ... |
### No Hit Delay
`src/asm/utility/no_hit_delay.cpp` - descriptor `0x2f0b70`, settings block `0x2f0d68`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `no_hit_delay_on_attack` | `0x3e590` | 160 | descriptor +0x128 | `0x2f0dc0` current value of setting "mode" (+0x30) |
### No Item Release
`src/asm/utility/no_item_release.cpp` - descriptor `0x2ec390`, settings block `0x2ec588`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `no_item_release_on_packet_sent` | `0x334c0` | 256 | descriptor +0x78 | `0x2ec5e8` current value of setting "mode" (+0x30) |
### No Slow
`src/asm/move/no_slow.cpp` - descriptor `0x2f2c90`, settings block `0x2f2e88`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `no_slow_on_movement_input` | `0x42a20` | 160 | descriptor +0x198 | `0x2f2ed0` setting num "mult_bow" (current value +0x30), `0x2f2f08` setting num "mult_sword" (current value +0x30), `0x2f2f40` setting num "mult_consumables" (current value +0x30) |
### No Use Delay
`src/asm/utility/no_use_delay.cpp` - descriptor `0x2f1210`, settings block `0x2f1408`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `no_use_delay_on_late_tick` | `0x3e8e0` | 256 | descriptor +0x168 | `0x2f1438` setting bool "allow_desync" (current value +0x18) |
### Notifications
`src/asm/visual/notifications.cpp` - descriptor `0x2ed320`, settings block `0x2ed518`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `notifications_module_toggled_gui` | `0x35000` | 416 | descriptor +0x98 | `0x2ed548` setting bool "hide_bind_only" (current value +0x18), `0x2ed568` setting bool "hide_hold_notifs" (current value +0x18), `0x2ed588` setting bool "show_combat" (current value +0x18), `0x2ed5a8` setting bool "show_move" (current value +0x18), ... |
| `notifications_tick_age_messages` | `0x351a0` | 784 | descriptor +0xd8 | `0x2ed628` setting bool "hide_ingame" (current value +0x18) |
| `notifications_draw_slide_boxes` | `0x354b0` | 1200 | descriptor +0xe8 | `0x2ed628` setting bool "hide_ingame" (current value +0x18) |
| `notifications_profile_loaded_saved` | `0x35960` | 208 | descriptor +0xf8 | |
| `notifications_on_error_event` | `0x35a30` | 192 | descriptor +0x108 | |
| `notifications_on_friend_event` | `0x35af0` | 192 | descriptor +0x178 | |
### Piercing
`src/asm/combat/piercing.cpp` - descriptor `0x2f3ab0`, settings block `0x2f3ca8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `piercing_decide_which_entity` | `0x44a50` | 496 | settings logic | `0x2f3cd8` setting bool "require_inside_bb" (current value +0x18), `0x2f3cf8` setting bool "require_weapon" (current value +0x18), `0x2f3d18` setting bool "non_players" (current value +0x18), `0x2f3d38` setting bool "friendlies" (current value +0x18), ... |
| `piercing_should_pierce_blocks` | `0x44c40` | 80 | settings logic | `0x2f3cf8` setting bool "require_weapon" (current value +0x18), `0x2f3de8` setting bool "blocks" (current value +0x18) |
| `piercing_on_reach_query` | `0x44c90` | 16 | descriptor +0xc8 | |
### Player ESP
`src/asm/visual/player_esp.cpp` - descriptor `0x2e9e80`, settings block `0x2ea078`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `player_esp_render_mode_1` | `0x2eb20` | 896 | descriptor +0xa8 | `0x2ea0c0` setting num "line_width" (current value +0x30), `0x2ea110` current value of setting "mode" (+0x30), `0x2ea138` config scalar, `0x2ea158` setting bool "hurt_effect" (current value +0x18), ... |
| `player_esp_render_mode_0` | `0x2eea0` | 1360 | descriptor +0xb8 | `0x2ea0c0` setting num "line_width" (current value +0x30), `0x2ea110` current value of setting "mode" (+0x30), `0x2ea138` config scalar, `0x2ea158` setting bool "hurt_effect" (current value +0x18), ... |
| `player_esp_tick` | `0x2f3f0` | 896 | descriptor +0x168 | `0x2ea1d0` setting num "range" (current value +0x30), `0x2ea208` setting key "color_target" (current value +0x30), `0x2ea228` setting key "color_friendlies" (current value +0x30), `0x2ea250` config scalar, ... |
### Pointers
`src/asm/visual/pointers.cpp` - descriptor `0x2f06c0`, settings block `0x2f08b8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `pointers_render` | `0x3da80` | 1168 | descriptor +0xb8 | `0x2f0950` setting num "scale" (current value +0x30), `0x2f0988` setting num "radius" (current value +0x30), `0x2f09c0` setting key "color_near" (current value +0x30), `0x2f0a10` current value of setting "style" (+0x30), ... |
| `pointers_tick` | `0x3df10` | 960 | descriptor +0x168 | `0x2f0a88` config scalar, `0x2f0ac8` setting num "range" (current value +0x30), `0x2f0b00` setting num "ignore_fov" (current value +0x30), `0x2f0b38` setting key "color_friendlies" (current value +0x30), ... |
### Reach
`src/asm/combat/reach.cpp` - descriptor `0x2ea550`, settings block `0x2ea748`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `reach_on_reach_query` | `0x2ffb0` | 176 | descriptor +0xc8 | `0x2ea790` config scalar, `0x2ea7c8` setting num "activate_time" (current value +0x30), `0x2ea7e8` setting bool "require_sprint" (current value +0x18) |
### Refill
`src/asm/utility/refill.cpp` - descriptor `0x2eed90`, settings block `0x2eef88`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `refill_enable` | `0x384c0` | 48 | descriptor +0x98 | |
| `refill_on_inventory_tick` | `0x384f0` | 1744 | descriptor +0x1d8 | `0x2eefd0` setting num "delay_before_close" (current value +0x30), `0x2ef008` setting num "delay_after_open" (current value +0x30), `0x2ef040` setting num "speed" (current value +0x30), `0x2ef0c0` setting bool "smart_speed" (current value +0x18), ... |
| `refill_classify_27_main` | `0x38dc0` | 272 | settings logic | `0x2ef060` setting bool "refill_soup" (current value +0x18), `0x2ef080` config scalar, `0x2ef0a0` setting bool "refill_potion_non_health" (current value +0x18) |
### Safe Walk
`src/asm/move/safe_walk.cpp` - descriptor `0x2f2030`, settings block `0x2f2228`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `safe_walk_on_tick` | `0x41d30` | 288 | descriptor +0x48 | `0x2f2270` setting num "motion_multiplier" (current value +0x30), `0x2f2290` setting bool "require_looking_down" (current value +0x18), `0x2f22b0` setting bool "require_not_forward" (current value +0x18), `0x2f22d0` setting bool "require_holding_blocks" (current value +0x18) |
### Sprint
`src/asm/move/sprint.cpp` - descriptor `0x2ed840`, settings block `0x2eda38`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `sprint_on_player_update` | `0x35d80` | 176 | descriptor +0x158 | `0x2eda68` setting bool "while_in_gui" (current value +0x18) |
| `sprint_on_movement_input` | `0x35e30` | 192 | descriptor +0x198 | `0x2eda88` setting bool "while_using_item" (current value +0x18), `0x2edaa8` setting bool "while_backwards" (current value +0x18), `0x2edac8` setting bool "while_sideways" (current value +0x18) |
### Sprint Reset
`src/asm/combat/sprint_reset.cpp` - descriptor `0x2efd00`, settings block `0x2efef8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `sprint_reset_on_player_update` | `0x3ad10` | 688 | descriptor +0x158 | `0x2eff98` setting num "delay" (current value +0x30), `0x2effb8` setting bool "randomize" (current value +0x18), `0x2effd8` setting bool "wait_for_damage" (current value +0x18), `0x2efff8` setting bool "require_weapon" (current value +0x18), ... |
| `sprint_reset_press_key` | `0x3b150` | 176 | settings logic | `0x2eff58` current value of setting "mode" (+0x30) |
### Strafe
`src/asm/move/strafe.cpp` - descriptor `0x2f24e8`, settings block `0x2f26e0`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `strafe_on_movement_input` | `0x41f90` | 48 | descriptor +0x198 | |
| `strafe_on_move_flying` | `0x41fc0` | 576 | descriptor +0x1a8 | `0x2f2728` setting num "max_hurt_time" (current value +0x30), `0x2f2760` setting num "strength_air" (current value +0x30), `0x2f2798` setting num "strength_jump" (current value +0x30), `0x2f27d0` setting num "strength_ground" (current value +0x30), ... |
### Teams
`src/asm/utility/teams.cpp` - descriptor `0x2eb400`, settings block `0x2eb5f8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `teams_on_tick` | `0x31e10` | 480 | descriptor +0x48 | `0x2eb628` setting bool "match_self_color" (current value +0x18) |
| `teams_on_toggle` | `0x31ff0` | 192 | descriptor +0x98 | |
| `teams_on_shutdown` | `0x320b0` | 48 | descriptor +0x1e8 | |
### Timer
`src/asm/utility/timer.cpp` - descriptor `0x2eba10`, settings block `0x2ebc08`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `timer_on_frame` | `0x328f0` | 192 | descriptor +0x58 | `0x2ebc50` config scalar, `0x2ebc70` setting bool "require_mouse" (current value +0x18), `0x2ebc90` setting bool "require_falling" (current value +0x18), `0x2ebcb0` setting bool "require_damage" (current value +0x18) |
| `timer_on_toggle` | `0x329b0` | 80 | descriptor +0x98 | |
### Timer Range
`src/asm/combat/timer_range.cpp` - descriptor `0x2f3160`, settings block `0x2f3358`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `timer_range_tick` | `0x42c60` | 672 | descriptor +0x48 | `0x2f3388` setting bool "require_mouse_pressed" (current value +0x18), `0x2f33a8` setting bool "require_weapon" (current value +0x18), `0x2f33c8` setting bool "require_not_using_item" (current value +0x18), `0x2f3410` config scalar |
| `timer_range_render_tick` | `0x42f00` | 2640 | descriptor +0x58 | `0x2f3410` config scalar, `0x2f3438` setting bool "block_while_frozen" (current value +0x18), `0x2f3470` setting num "cooldown" (current value +0x30), `0x2f3478` config scalar, ... |
| `timer_range_on_packet_sent` | `0x43950` | 32 | descriptor +0x78 | |
| `timer_range_on_timer_phase` | `0x43970` | 112 | descriptor +0x98 | |
| `timer_range_hypot` | `0x43bf0` | 176 | settings logic | `0x2f3410` config scalar, `0x2f3438` setting bool "block_while_frozen" (current value +0x18) |
### Trajectories
`src/asm/visual/trajectories.cpp` - descriptor `0x2f3df0`, settings block `0x2f3fe8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `trajectories_disable` | `0x44e40` | 96 | descriptor +0x98 | |
| `trajectories_render` | `0x44ea0` | 1232 | descriptor +0xa8 | `0x2f4030` setting num "line_width" (current value +0x30), `0x2f4068` setting key "color_hit" (current value +0x30) |
| `trajectories_tick` | `0x45370` | 2640 | descriptor +0x168 | `0x2f4090` config scalar, `0x2f40b0` setting bool "render_uncharged_bow" (current value +0x18), `0x2f40d0` setting bool "render_pearls" (current value +0x18), `0x2f40f0` setting bool "render_throwables" (current value +0x18) |
### Velocity
`src/asm/combat/velocity.cpp` - descriptor `0x2ea7f0`, settings block `0x2ea9e8`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `velocity_mode_3_delayed` | `0x30180` | 336 | descriptor +0x48 | `0x2eaa50` config scalar, `0x2eaa90` setting num "ignore_chance" (current value +0x30), `0x2eab68` setting enum "ignore_vertical" (current value +0x30) |
| `velocity_packet_hook_watch` | `0x302d0` | 208 | descriptor +0x68 | |
| `velocity_disable` | `0x303a0` | 32 | descriptor +0x98 | |
| `velocity_attack` | `0x303c0` | 80 | descriptor +0x128 | |
| `velocity_mode_2_reduce` | `0x30410` | 272 | descriptor +0x138 | `0x2eaa50` config scalar, `0x2eaab0` setting bool "require_forward" (current value +0x18), `0x2eaaf0` setting bool "require_weapon" (current value +0x18), `0x2eab90` setting bool "reduce_multiple_per_tick" (current value +0x18) |
| `velocity_tick_mode_0` | `0x30520` | 960 | descriptor +0x158 | `0x2eaa50` config scalar, `0x2eabc8` setting num "reduce_chance" (current value +0x30), `0x2eac00` setting num "reduce_delay" (current value +0x30), `0x2eac38` config scalar, ... |
| `velocity_tick` | `0x308e0` | 80 | descriptor +0x168 | |
| `velocity_shared_conditions` | `0x30c50` | 544 | settings logic | `0x2eaab0` setting bool "require_forward" (current value +0x18), `0x2eaad0` setting bool "require_mouse" (current value +0x18), `0x2eaaf0` setting bool "require_weapon" (current value +0x18), `0x2eab10` setting bool "require_target" (current value +0x18) |
### Weapons
`src/asm/combat/weapons.cpp` - descriptor `0x2ee930`, settings block `0x2eeb28`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `weapons_check_held_item_cached` | `0x37e50` | 272 | settings logic | `0x2eeb58` setting bool "fist" (current value +0x18), `0x2eeb60` config scalar, `0x2eec98` setting bool "enchant_sharpness" (current value +0x18), `0x2eecb8` setting bool "enchant_knockback" (current value +0x18), ... |
| `weapons_is_item_allowed_by_class` | `0x38040` | 112 | settings logic | `0x2eeb58` setting bool "fist" (current value +0x18), `0x2eecf8` setting bool "axes" (current value +0x18), `0x2eed18` setting bool "swords" (current value +0x18) |
| `weapons_find_first_weapon_slot` | `0x380c0` | 208 | settings logic | `0x2eeb78` setting bool (slot) (current value +0x18), `0x2eec98` setting bool "enchant_sharpness" (current value +0x18), `0x2eecb8` setting bool "enchant_knockback" (current value +0x18), `0x2eecd8` setting bool "enchant_fire_aspect" (current value +0x18) |
| `weapons_on_shutdown` | `0x38190` | 48 | descriptor +0x1e8 | |
### No Jump Delay
`src/asm/move/no_jump_delay.cpp` - descriptor `0x2ed630`, settings block `None`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `no_jump_delay_on_tick` | `0x35d50` | 48 | descriptor +0x158 | |
### Ping Fix
`src/asm/utility/ping_fix.cpp` - descriptor `0x2f0dd0`, settings block `None`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `ping_fix_drop_incoming_keepalive` | `0x3e6d0` | 48 | descriptor +0x68 | |
| `ping_fix_drop_outgoing_keepalive` | `0x3e700` | 48 | descriptor +0x78 | |
### Instant Stop
`src/asm/move/instant_stop.cpp` - descriptor `0x2f2a80`, settings block `None`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `instant_stop_on_tick` | `0x42650` | 976 | descriptor +0x148 | |
### Item Use Fix
`src/asm/utility/item_use_fix.cpp` - descriptor `0x2f2f48`, settings block `None`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `item_use_fix_clear_hitting_block` | `0x42b80` | 96 | descriptor +0x128 | |
| `item_use_fix_restore_hitting_block` | `0x42be0` | 80 | descriptor +0x138 | |
### Null Move
`src/asm/move/null_move.cpp` - descriptor `0x2f46a0`, settings block `None`
| function | RVA | bytes | role | reads |
|---|---:|---:|---|---|
| `null_move_on_tick` | `0x46ac0` | 592 | descriptor +0x148 | |
docs/module_audit.md
+82
View File
@@ -0,0 +1,82 @@
# Module completeness audit
Generated by `tools/report_modules.py` from `manifest.json`,
`manifest_logic.json` and the decrypted image.
`settings` is declared config objects / registered `R_*` settings.
`logic` is extracted functions / bytes. `descriptor` lists the
function pointers stored in the module descriptor.
| module | cat | gui | settings | logic | descriptor | status |
|---|---|---|---:|---:|---|---|
| Aim Assist | combat | cb+reg+aux | 22 / 22 | 6 / 5040 | +0x58:0x2b200, +0x98:0x2b5b0, +0x118:0x2b610, +0x168:0x2b630, +0x1f8:0x2bae0 | complete |
| Anti Bot | utility | cb+reg | 6 / 6 | 2 / 1408 | +0x48:0x30e70, +0x98:0x31310, +0x1f8:0x313f0 | complete |
| Anti Debuff | visual | cb+reg | 2 / 2 | 1 / 128 | +0x168:0x44940, +0x1f8:0x449c0 | complete |
| Auto Block | combat | cb+reg | 12 / 12 | 5 / 1600 | +0x48:0x31570, +0x78:0x31a50, +0x98:0x31a70, +0x128:0x31b00, +0x168:0x31b60, +0x1f8:0x31bb0 | complete |
| Auto Clicker | combat | cb+reg+aux | 9 / 9 | 4 / 2272 | +0x48:0x2ca10, +0x58:0x2ca90, +0x158:0x2d140, +0x1f8:0x2d190 | complete |
| Auto Pot | utility | cb+reg | 4 / 4 | 4 / 1264 | +0x48:0x391c0, +0x88:0x394d0, +0x98:0x39520, +0x1f8:0x39600 | complete |
| Auto Rod | utility | cb+reg | 7 / 7 | 7 / 2624 | +0x48:0x43d80, +0x88:0x44340, +0x98:0x44390, +0x128:0x443c0, +0x1f8:0x44420 | complete |
| Auto Soup | utility | cb+reg | 9 / 9 | 4 / 1856 | +0x48:0x2d510, +0x88:0x2dae0, +0x98:0x2db10, +0x1f8:0x2db50 | complete |
| Auto Tool | block | cb+reg | 9 / 9 | 2 / 864 | +0x1d8:0x37180, +0x1e8:0x374b0, +0x1f8:0x374e0 | complete |
| Auto Weapon | combat | cb+reg | 2 / 2 | 1 / 320 | +0x1d8:0x4a340, +0x1f8:0x4a480 | complete |
| Backtrack | combat | cb+reg+aux | 12 / 12 | 3 / 1904 | +0x68:0x35fd0, +0xa8:0x36110, +0x168:0x362e0, +0x1f8:0x36740 | complete |
| Blink | utility | cb+reg+aux | 5 / 5 | 5 / 464 | +0x48:0x33660, +0x68:0x336d0, +0x78:0x33750, +0x98:0x33770, +0x128:0x337c0, +0x1f8:0x33830 | complete |
| Block ESP | visual | cb+reg | 5 / 5 | 5 / 1648 | +0x48:0x3f4c0, +0x98:0x3f6a0, +0xa8:0x3f7b0, +0x188:0x3fa40, +0x1e8:0x3fa50, +0x1f8:0x3fb30 | complete |
| Block In | block | cb+reg | 2 / 2 | 5 / 4048 | +0x48:0x4abf0, +0x98:0x4ac00, +0x118:0x4ad50, +0x148:0x4ad80, +0x168:0x4ae50, +0x1f8:0x4bbc0 | complete |
| Bridge Assist | block | cb+reg | 10 / 10 | 5 / 2800 | +0x98:0x2de50, +0x128:0x2dec0, +0x158:0x2e260, +0x168:0x2e5a0, +0x1f8:0x2e5d0 | complete |
| Chams | visual | cb+reg | 1 / 1 | 1 / 336 | +0x1f8:0x3e880 | complete |
| Chest ESP | visual | cb+reg | 11 / 11 | 2 / 976 | +0x48:0x33990, +0xa8:0x33b60, +0x1f8:0x33d60 | complete |
| Chest Stealer | utility | cb+reg | 5 / 5 | 1 / 240 | +0x1d8:0x48600, +0x1f8:0x486f0 | complete |
| Clutch | block | cb+reg | 18 / 18 | 4 / 5904 | +0x48:0x488f0, +0x118:0x48a30, +0x168:0x48a50, +0x1f8:0x49c00 | complete |
| Criticals | combat | cb+reg+aux | 7 / 7 | 4 / 1024 | +0x48:0x32f10, +0x58:0x33080, +0x78:0x331a0, +0x98:0x332b0, +0x1f8:0x33310 | complete |
| Debug | utility | cb+reg | 3 / 3 | 4 / 800 | +0x48:0x466e0, +0x78:0x46850, +0x138:0x468c0, +0x168:0x46900, +0x1f8:0x46a00 | complete |
| Fake Lag | utility | cb+reg+aux | 7 / 7 | 2 / 560 | +0x48:0x32b30, +0x68:0x32cb0, +0x78:0x32cb0, +0x1f8:0x32d60 | complete |
| Fast Accel | move | cb+reg | 3 / 3 | 1 / 608 | +0x1a8:0x42320, +0x1f8:0x42580 | complete |
| Fast Mine | block | cb+reg+aux | 3 / 3 | 2 / 400 | +0x48:0x41a90, +0x168:0x41b30, +0x1f8:0x41c20 | complete |
| Fast Place | block | cb+reg+aux | 2 / 2 | 1 / 800 | +0x48:0x2fbc0, +0x1f8:0x2fee0 | complete |
| Free Look | visual | cb+reg | 1 / 1 | 2 / 256 | +0x98:0x37020, +0x118:0x37100, +0x1f8:0x37120 | complete |
| Friends | utility | cb+reg | 2 / 2 | 4 / 960 | +0x48:0x3b3c0, +0x98:0x3b510, +0x1e8:0x3b5d0, +0x1f8:0x3b600 | complete |
| GUI | visual | cb+reg | 5 / 5 | 7 / 752 | +0x48:0x325c0, +0x98:0x32600, +0xd8:0x32730, +0xe8:0x32740, +0x1e8:0x327c0, +0x1f8:0x327d0 | complete |
| Ghost Hand | block | cb+reg | 12 / 12 | 2 / 304 | +0xc8:0x46e30, +0x1f8:0x46e40 | complete |
| Hit Select | combat | cb+reg+aux | 12 / 12 | 3 / 1264 | +0x48:0x376c0, +0x128:0x37710, +0x158:0x37ae0, +0x1f8:0x37bb0 | complete |
| Hitboxes | combat | cb+reg+aux | 1 / 1 | 1 / 32 | +0xc8:0x33fc0, +0x1f8:0x33fe0 | complete |
| Indicators | visual | cb+reg | 6 / 6 | 3 / 2144 | +0x98:0x3ea40, +0xb8:0x3ead0, +0x168:0x3ef20, +0x1f8:0x3f2a0 | complete |
| Inv Manager | utility | cb+reg | 16 / 16 | 3 / 2288 | +0x1d8:0x47090, +0x1f8:0x47560 | complete |
| Inv Walk | move | cb+reg+aux | 4 / 4 | 4 / 1808 | +0x98:0x39790, +0x158:0x397c0, +0x1b8:0x39ce0, +0x1d8:0x39e30, +0x1f8:0x39ea0 | complete |
| Item ESP | visual | cb+reg | 5 / 5 | 3 / 2336 | +0xa8:0x40de0, +0x168:0x41250, +0x1e8:0x416c0, +0x1f8:0x41700 | complete |
| Keep Sprint | move | cb+reg+aux | 4 / 4 | 3 / 416 | +0x128:0x3a0f0, +0x138:0x3a170, +0x158:0x3a260, +0x1f8:0x3a290 | complete |
| Knockback Delay | combat | cb+reg+aux | 7 / 7 | 2 / 1008 | +0x68:0x46140, +0x168:0x46270, +0x1f8:0x46530 | complete |
| Knockback Displace | combat | cb+reg+aux | 9 / 9 | 6 / 1136 | +0x78:0x4a520, +0x118:0x4a540, +0x128:0x4a560, +0x138:0x4a7d0, +0x168:0x4a800, +0x1f8:0x4a930 | complete |
| Lag Range | combat | cb+reg+aux | 8 / 8 | 4 / 1856 | +0x78:0x3a3c0, +0xa8:0x3a610, +0x138:0x3a780, +0x168:0x3a7d0, +0x1f8:0x3ab00 | complete |
| Mod Overlay | visual | cb+reg | 14 / 14 | 8 / 3216 | +0x48:0x34080, +0x98:0x34290, +0xd8:0x344d0, +0xe8:0x34510, +0xf8:0x349f0, +0x1c8:0x34a10, +0x1f8:0x34a40 | complete |
| Name Tags | visual | cb+reg | 12 / 12 | 3 / 5024 | +0x98:0x3c210, +0xb8:0x3c280, +0x168:0x3ca20, +0x1f8:0x3d5b0 | complete |
| No Hit Delay | utility | cb+reg+aux | 1 / 1 | 1 / 160 | +0x128:0x3e590, +0x1f8:0x3e630 | complete |
| No Item Release | utility | cb+reg+aux | 1 / 1 | 1 / 256 | +0x78:0x334c0, +0x1f8:0x335c0 | complete |
| No Slow | move | cb+reg | 3 / 3 | 1 / 160 | +0x198:0x42a20, +0x1f8:0x42ac0 | complete |
| No Use Delay | utility | cb+reg | 1 / 1 | 1 / 256 | +0x168:0x3e8e0, +0x1f8:0x3e9e0 | complete |
| Notifications | visual | cb+reg | 8 / 8 | 6 / 2992 | +0x98:0x35000, +0xd8:0x351a0, +0xe8:0x354b0, +0xf8:0x35960, +0x108:0x35a30, +0x178:0x35af0, +0x1f8:0x35bb0 | complete |
| Piercing | combat | cb+reg | 8 / 8 | 3 / 592 | +0xc8:0x44c90, +0x1f8:0x44ca0 | complete |
| Player ESP | visual | cb+reg+aux | 13 / 13 | 3 / 3152 | +0xa8:0x2eb20, +0xb8:0x2eea0, +0x168:0x2f3f0, +0x1f8:0x2f770 | complete |
| Pointers | visual | cb+reg+aux | 13 / 13 | 2 / 2128 | +0xb8:0x3da80, +0x168:0x3df10, +0x1f8:0x3e2d0 | complete |
| Reach | combat | cb+reg+aux | 3 / 3 | 1 / 176 | +0xc8:0x2ffb0, +0x1f8:0x30060 | complete |
| Refill | utility | cb+reg | 8 / 8 | 3 / 2064 | +0x98:0x384c0, +0x1d8:0x384f0, +0x1f8:0x38bc0 | complete |
| Safe Walk | move | cb+reg | 4 / 4 | 1 / 288 | +0x48:0x41d30, +0x1f8:0x41e50 | complete |
| Sprint | move | cb+reg | 4 / 4 | 2 / 368 | +0x158:0x35d80, +0x198:0x35e30, +0x1f8:0x35ef0 | complete |
| Sprint Reset | combat | cb+reg+aux | 6 / 6 | 2 / 864 | +0x158:0x3ad10, +0x1f8:0x3afc0 | complete |
| Strafe | move | cb+reg | 5 / 5 | 2 / 624 | +0x198:0x41f90, +0x1a8:0x41fc0, +0x1f8:0x42200 | complete |
| Teams | utility | cb+reg | 2 / 2 | 3 / 720 | +0x48:0x31e10, +0x98:0x31ff0, +0x1e8:0x320b0, +0x1f8:0x320e0 | complete |
| Timer | utility | cb+reg+aux | 4 / 4 | 2 / 272 | +0x58:0x328f0, +0x98:0x329b0, +0x1f8:0x32a00 | complete |
| Timer Range | combat | cb+reg+aux | 9 / 9 | 5 / 3632 | +0x48:0x42c60, +0x58:0x42f00, +0x78:0x43950, +0x98:0x43970, +0x1f8:0x439e0 | complete |
| Trajectories | visual | cb+reg | 7 / 7 | 3 / 3968 | +0x98:0x44e40, +0xa8:0x44ea0, +0x168:0x45370, +0x1f8:0x45dc0 | complete |
| Velocity | combat | cb+reg+aux | 14 / 14 | 8 / 2512 | +0x48:0x30180, +0x68:0x302d0, +0x98:0x303a0, +0x128:0x303c0, +0x138:0x30410, +0x158:0x30520, +0x168:0x308e0, +0x1f8:0x30930 | complete |
| Weapons | combat | cb+reg | 16 / 16 | 4 / 640 | +0x1e8:0x38190, +0x1f8:0x381c0 | complete |
| No Jump Delay | move | — | 0 / 0 | 1 / 48 | +0x158:0x35d50 | no-GUI + logic |
| Ping Fix | utility | — | 0 / 0 | 2 / 96 | +0x68:0x3e6d0, +0x78:0x3e700 | no-GUI + logic |
| No Hurt Cam | visual | — | 0 / 0 | 0 / 0 | — | no-GUI (engine-side) |
| Instant Stop | move | — | 0 / 0 | 1 / 976 | +0x148:0x42650 | no-GUI + logic |
| Item Use Fix | utility | — | 0 / 0 | 2 / 176 | +0x128:0x42b80, +0x138:0x42be0 | no-GUI + logic |
| Null Move | move | — | 0 / 0 | 1 / 592 | +0x148:0x46ac0 | no-GUI + logic |
**Totals:** 67 modules, 200 logic functions, 92400 logic bytes.
No missing module, setting, callback or logic function was found.
docs/modules.md
+107
View File
@@ -0,0 +1,107 @@
# Modules by category
Category = descriptor field `+0x10` (0 Combat, 1 Move, 2 Visual, 3 Block,
4 Utility), matching the GUI tab strings at `.rdata` `0x151cc8`. Paths are
relative to the repo root. The first five sections are the 61 modules with a
GUI callback; the six engine-only modules are listed at the end.
### Combat (17)
| module | file | functions | description |
|---|---|---|---|
| Aim Assist | [aim_assist.h](../src/logic/combat/aim_assist.h) | cb, reg, aux | Pulls your crosshair towards other players. |
| Auto Block | [auto_block.h](../src/logic/combat/auto_block.h) | cb, reg | Blocks your sword for you in combat. |
| Auto Clicker | [auto_clicker.h](../src/logic/combat/auto_clicker.h) | cb, reg, aux | Clicks for you when holding down left-click. |
| Auto Weapon | [auto_weapon.h](../src/logic/combat/auto_weapon.h) | cb, reg | Selects your weapon when aiming on players. |
| Backtrack | [backtrack.h](../src/logic/combat/backtrack.h) | cb, reg, aux | Uses lag to make players easier to hit. |
| Criticals | [criticals.h](../src/logic/combat/criticals.h) | cb, reg, aux | Increases chance of landing critical hits. |
| Hit Select | [hit_select.h](../src/logic/combat/hit_select.h) | cb, reg, aux | Perfectly times your hits. |
| Hitboxes | [hitboxes.h](../src/logic/combat/hitboxes.h) | cb, reg, aux | Expands hitboxes of other players. |
| Knockback Delay | [knockback_delay.h](../src/logic/combat/knockback_delay.h) | cb, reg, aux | Delays your knockback in certain scenarios. |
| Knockback Displace | [knockback_displace.h](../src/logic/combat/knockback_displace.h) | cb, reg, aux | Allows dealing knockback at a different angle. |
| Lag Range | [lag_range.h](../src/logic/combat/lag_range.h) | cb, reg, aux | Uses lag to stay out of target range. |
| Piercing | [piercing.h](../src/logic/combat/piercing.h) | cb, reg | Allows hitting entities through obstructions. |
| Reach | [reach.h](../src/logic/combat/reach.h) | cb, reg, aux | Increases your melee range. |
| Sprint Reset | [sprint_reset.h](../src/logic/combat/sprint_reset.h) | cb, reg, aux | Resets your sprint state to deal more knockback. |
| Timer Range | [timer_range.h](../src/logic/combat/timer_range.h) | cb, reg, aux | Abuses timer lag to teleport you. |
| Velocity | [velocity.h](../src/logic/combat/velocity.h) | cb, reg, aux | Reduces the amount of knockback you take. |
| Weapons | [weapons.h](../src/logic/combat/weapons.h) | cb, reg | Configure which items are considered weapons. |
### Move (7)
| module | file | functions | description |
|---|---|---|---|
| Fast Accel | [fast_accel.h](../src/logic/move/fast_accel.h) | cb, reg | Speeds up acceleration. |
| Inv Walk | [inv_walk.h](../src/logic/move/inv_walk.h) | cb, reg, aux | Allows moving in inventory. |
| Keep Sprint | [keep_sprint.h](../src/logic/move/keep_sprint.h) | cb, reg, aux | Keeps your sprint speed when attacking players. |
| No Slow | [no_slow.h](../src/logic/move/no_slow.h) | cb, reg | Removes slowdown while using items. |
| Safe Walk | [safe_walk.h](../src/logic/move/safe_walk.h) | cb, reg | Prevents you from walking off ledges. |
| Sprint | [sprint.h](../src/logic/move/sprint.h) | cb, reg | Automatically sprints for you. |
| Strafe | [strafe.h](../src/logic/move/strafe.h) | cb, reg | Allows faster strafing. |
### Visual (14)
| module | file | functions | description |
|---|---|---|---|
| Anti Debuff | [anti_debuff.h](../src/logic/visual/anti_debuff.h) | cb, reg | Removes negative visual effects. |
| Block ESP | [block_esp.h](../src/logic/visual/block_esp.h) | cb, reg | Highlights blocks. |
| Chams | [chams.h](../src/logic/visual/chams.h) | cb, reg | Renders players behind blocks. |
| Chest ESP | [chest_esp.h](../src/logic/visual/chest_esp.h) | cb, reg | Highlights chests. |
| Free Look | [free_look.h](../src/logic/visual/free_look.h) | cb, reg | Freely move the camera around. |
| GUI | [gui.h](../src/logic/visual/gui.h) | cb, reg | Graphical interface for the cheat. |
| Indicators | [indicators.h](../src/logic/visual/indicators.h) | cb, reg | Points to incoming projectiles. |
| Item ESP | [item_esp.h](../src/logic/visual/item_esp.h) | cb, reg | Highlights dropped items. |
| Mod Overlay | [mod_overlay.h](../src/logic/visual/mod_overlay.h) | cb, reg | Displays a list of all active mods. |
| Name Tags | [name_tags.h](../src/logic/visual/name_tags.h) | cb, reg | Makes player name tags easier to see. |
| Notifications | [notifications.h](../src/logic/visual/notifications.h) | cb, reg | Informs you when certain actions are performed. |
| Player ESP | [player_esp.h](../src/logic/visual/player_esp.h) | cb, reg, aux | Highlights other players. |
| Pointers | [pointers.h](../src/logic/visual/pointers.h) | cb, reg, aux | Points to other players. |
| Trajectories | [trajectories.h](../src/logic/visual/trajectories.h) | cb, reg | Predicts the trajectory of the item in your hand. |
### Block (7)
| module | file | functions | description |
|---|---|---|---|
| Auto Tool | [auto_tool.h](../src/logic/block/auto_tool.h) | cb, reg | Selects the best tool when digging. |
| Block In | [block_in.h](../src/logic/block/block_in.h) | cb, reg | Places blocks around you. |
| Bridge Assist | [bridge_assist.h](../src/logic/block/bridge_assist.h) | cb, reg | Sneaks and unsneaks for you while bridging. |
| Clutch | [clutch.h](../src/logic/block/clutch.h) | cb, reg | Clutches for you when falling. |
| Fast Mine | [fast_mine.h](../src/logic/block/fast_mine.h) | cb, reg, aux | Increases block mining speed. |
| Fast Place | [fast_place.h](../src/logic/block/fast_place.h) | cb, reg, aux | Allows placing blocks faster. |
| Ghost Hand | [ghost_hand.h](../src/logic/block/ghost_hand.h) | cb, reg | Allows interacting with blocks through entities. |
### Utility (16)
| module | file | functions | description |
|---|---|---|---|
| Anti Bot | [anti_bot.h](../src/logic/utility/anti_bot.h) | cb, reg | Ignores NPCs for specific modules. |
| Auto Pot | [auto_pot.h](../src/logic/utility/auto_pot.h) | cb, reg | Uses healing potions for you. |
| Auto Rod | [auto_rod.h](../src/logic/utility/auto_rod.h) | cb, reg | Throws your fishing rod for you. |
| Auto Soup | [auto_soup.h](../src/logic/utility/auto_soup.h) | cb, reg | Uses soups for you. |
| Blink | [blink.h](../src/logic/utility/blink.h) | cb, reg, aux | Simulates teleporting using lag. |
| Chest Stealer | [chest_stealer.h](../src/logic/utility/chest_stealer.h) | cb, reg | Automatically loots chests for you. |
| Debug | [debug.h](../src/logic/utility/debug.h) | cb, reg | Prints debug information in chat. |
| Fake Lag | [fake_lag.h](../src/logic/utility/fake_lag.h) | cb, reg, aux | Adds an artificial delay to your packets. |
| Friends | [friends.h](../src/logic/utility/friends.h) | cb, reg | Lets you mark other players as friendly. |
| Inv Manager | [inv_manager.h](../src/logic/utility/inv_manager.h) | cb, reg | Organises your inventory for you. |
| No Hit Delay | [no_hit_delay.h](../src/logic/utility/no_hit_delay.h) | cb, reg, aux | Removes 1.8 swing delay. |
| No Item Release | [no_item_release.h](../src/logic/utility/no_item_release.h) | cb, reg, aux | Hides item release from server. |
| No Use Delay | [no_use_delay.h](../src/logic/utility/no_use_delay.h) | cb, reg | Removes vanilla delay when consuming items. |
| Refill | [refill.h](../src/logic/utility/refill.h) | cb, reg | Automatically moves items into your hotbar. |
| Teams | [teams.h](../src/logic/utility/teams.h) | cb, reg | Ignores teammates for specific modules. |
| Timer | [timer.h](../src/logic/utility/timer.h) | cb, reg, aux | Modifies the speed the game runs at. |
### Engine-only (6)
These descriptors exist in the image but have no GUI callback and no settings
pane. They are kept in `manifest.json` so the module table is exactly the 67
descriptors from the image.
| module | category | file | description |
|---|---|---|---|
| No Jump Delay | move | [no_jump_delay.h](../src/logic/move/no_jump_delay.h) | Removes cooldown when holding jump key. |
| Ping Fix | utility | [ping_fix.h](../src/logic/utility/ping_fix.h) | Shows your real ping while using lag mods. |
| No Hurt Cam | visual | [no_hurt_cam.h](../src/logic/visual/no_hurt_cam.h) | Removes camera shake when taking damage. |
| Instant Stop | move | [instant_stop.h](../src/logic/move/instant_stop.h) | Instantly stops moving when move keys are released. |
| Item Use Fix | utility | [item_use_fix.h](../src/logic/utility/item_use_fix.h) | Allows using items while breaking blocks. |
| Null Move | move | [null_move.h](../src/logic/move/null_move.h) | Makes it easier to switch move direction instantly. |
docs/re-notes.md
+65
View File
@@ -0,0 +1,65 @@
# Reverse-engineering notes
Carried over from `slinkyfullsrc/SRC.md`. None of this is needed to build the
module sources.
## `.slinky0` — engine / module manager
`slinky2.decrypted/slinky0.bin` is 14 255 293 bytes (`.slinky0` of the client
image). Region map (verified):
| range | content |
|---|---|
| `0x000000–0x77FFFF` | native code + data (MSVC CRT/RTTI strings at `0x2d000–0x3c000`, engine code; clean x86-64, ~30 % printable) |
| `0x780000–0x8BFFFF` | high-entropy (7.99) blob — encrypted/compressed, not consumed by visible code |
| `0x8C0000–0x9FFFFF` | sorted `(u32 rva, u16 size)` table, 213 035 records, covers `0x36300E–0x867551`, sizes multiple of 8, dense (≈50 % of the region), deltas 2–16 bytes, overlap → looks like a per-site patch/relocation or checksum map for the code region |
| `0xA00000–0xAA0000` | table A, XOR `00 10 00 62 75 86`, 109 225 × `(u32 off, u16 size)`; offsets `0x223–0x27FFB4` fit *inside* the tail block; sizes ∈ {0,8,24,32,…,120} |
| `0xAA0000–0xAB0000` | table B, XOR `83 A7 00 10 00 53`, same 6-byte record shape |
| `0xAB0000–0xD80000` | `tail_high.bin` — 2 949 120 bytes, entropy 7.98, no standard container/PE; table A indexes into it |
| `0xD80000–0xD984BD` | `tail_code.bin` (~100 KB), mixed code/data |
Module-manager data model (recovered from the client image, used by the
reconstructed sources):
* Module descriptor in `.data` (`.rdata` string pointers + a factory/log
function at `+0x58`). `modules_real.json` lists all 67 (61 with a GUI cb).
* Per-module settings block in `.data`, variable stride, begins with three
function pointers `{gui_cb, register_settings, aux}` followed by the widget
cfg objects (`CfgBool/CfgSlider/CfgRange/CfgEnum/CfgColor/...`).
* `R_*` registration calls are made from the client into the engine manager at
DLL init (one `reg_<addr>` function per module), the `W_*` calls render the
settings pane.
The module-side functions that read the settings and implement each feature
are in `src/logic/` (see `docs/logic.md`); they were extracted 1:1 from `.text`
by `tools/extract_logic.py`.
The manager itself is in client `.text`, not `.slinky0`: constructor `0x28000`,
dispatch `0x285d0`, descriptor table `0x14f810`. It groups modules by category
and by the event callback slots at `descriptor+0x48` … `+0x1F8`, and dispatches
the enabled callbacks. See `docs/engine.md` for the full picture, including
the six engine-only modules. `.slinky0` has **no static RIP-relative
references** into the client's `.rdata`/`.data`/`.text` (checked: 0 refs), so
it receives whatever it needs through runtime-installed pointers.
### tail_high.bin
`tail_high.bin` is still packed. Findings:
* Not a PE, not ZIP/7z/RAR/gzip/zlib/LZMA (standard headers checked).
* Entropy 7.978; byte histogram ≈ uniform; no repeated 24-byte blocks.
* Table A (109 225 records) and the sorted table (213 035 records) both use the
same `(u32 offset, u16 size)` record form, sizes are multiples of 8, and both
point *into* their subject buffers with heavy overlap — this is a
*site map* (patch/relocation/checksum), not a container directory.
* The runtime copy of `.slinky0` captured in `slinky.dll` is byte-identical to
the static stream up to `0xC4B658` and zero beyond, i.e. that dump was taken
before the engine performed the tail transformation; it gives no plaintext.
* Therefore decryption requires either (a) implementing the protector's
per-site transform from the `0x8C0000` table, or (b) a live Wine trace of
the first execution that touches `slinky0+0xAB0000` (same breakpoint
technique that recovered the `.slinky2` LZMA streams).
Decrypting `tail_high.bin` is **not required** for anything in this tree: the
module callbacks/registrations are plain `.text`, and the registry data model
is plain `.data`. It is required only for the remainder of the engine internals.
docs/renames.md
+170
View File
@@ -0,0 +1,170 @@
# Function renames (this pass)
Inferred from behaviour. `hitboxes_apply_hitbox_expansion_original` is the original engine copy; the descriptor uses the correctly named `hitboxes_on_reach_query` logic function. `block_esp_queue_loaded_chunks` was verified against its body (it queues the loaded chunks for scanning).
| old | new |
|---|---|
| `packet_entity_lookup` | `no_item_release_on_send_packet` |
| `activate_hold` | `hitboxes_apply_hitbox_expansion_original` |
| `compare_height_desc` | `compare_overlay_entries_by_height_desc` |
| `take_pending_bool` | `take_and_clear_pending_flag` |
| `rotation_cache_toggle` | `free_look_on_toggle` |
| `store_cached_rotation` | `free_look_save_rotation` |
| `enchantment_flags_item_stack` | `get_weapon_enchant_flags` |
| `weapons_part` | `is_held_item_accepted_weapon` |
| `click_with_helper` | `is_holding_accepted_weapon` |
| `close_screen_and_release` | `refill_disable_and_close_screen` |
| `find_hotbar_cell` | `refill_pick_inventory_cell` |
| `remove_id_key` | `friend_set_remove_by_key` |
| `clear_id_flag` | `friend_set_clear_dirty` |
| `compare_hurt_time` | `compare_by_hurt_time_desc` |
| `clear_list_set` | `free_block_search_section_lists` |
| `text_filter_upper` | `search_box_append_char` |
| `sort_float_entries` | `block_esp_queue_loaded_chunks` |
| `clear_mesh` | `rebuild_block_esp_mesh` |
| `free_allocator_pages` | `free_block_search_cache` |
| `pending_action_flag` | `timer_range_is_delay_pending` |
| `item_speed_by_type` | `no_slow_item_use_speed` |
| `zero_motion_tick` | `anti_debuff_tick` |
## Context struct (`Ctx`) fields
Every module handler receives a `Ctx *c`. Fields were previously `a`, `b`, `c18`, ...:
| old | new | meaning |
|---|---|---|
| `a` | `jvm` | JNI/JVM handle, first argument of every `java_*` call |
| `p08` | `module_manager` | target of `queue_module_toggle` |
| `p10` | `profile_list` | |
| `c18` | `minecraft` | Minecraft instance |
| `p20` | `world` | client world |
| `b` | `player` | local player entity |
| `p30` | `key_state_table` | |
| `p38` | `target` | current combat target record |
| `f40` | `in_game` | non-zero while a world is loaded |
## Event handler names
Most handlers are `<module>_on_<event>`, where the event is the descriptor slot the handler is registered in; handlers whose purpose is clearer keep a semantic name (for example `velocity_mode_3_delayed`, `notifications_draw_slide_boxes`):
`+0x48 tick`, `+0x58 frame`, `+0x68 packet_received`, `+0x78 packet_sent`, `+0x88 input`,
`+0x98 toggle`, `+0xa8 render_world`, `+0xb8 render_entity_overlay`, `+0xc8 reach_query`,
`+0xd8 hud_tick`, `+0xe8 hud_render`, `+0x118 rotation_update`, `+0x128 attack`,
`+0x138 attack_post`, `+0x158 player_update`, `+0x168 late_tick`, `+0x188 world_change`,
`+0x198 movement_input`, `+0x1a8 move_flying`, `+0x1b8 game_packet_sent`,
`+0x1d8 inventory_tick`, `+0x1e8 shutdown`. These slot meanings are inferred from the
handlers' behaviour, not from the original binary.
## Locals, parameters and struct fields
Renamed with a scope-aware AST pass (every edit is validated against the compiler and the generated object code):
- `Jvm *j`, `void *a` (first parameter) -> `jvm`; `Ctx *c` -> `ctx`; `*Hook *h` -> `hook`
- JNI accessor object parameters take the class from the accessor body, e.g. `a1` -> `game_settings`, `key_binding`, `entity_player`; setter value parameters are `value`
- locals initialised from an accessor are named after it (`mc` -> `minecraft`, `it` -> `stack`, ...)
- NanoVG context `ig` -> `nvg`, GUI state block `g` -> `gui`, `Rot r` -> `rotation`, register-function argument `m` -> `module`
- duplicate `HCtx` structs use the same field names as `Ctx` (`jvm`, `module_manager`, `minecraft`, `key_state_table`, `target`, `in_game`, ...)
- event structs: `f24` -> `verdict`, `p10` -> `packet`
## GUI state block (`include/slinky/gui_state.h`)
All raw `gui + 0x...` / `gui[0x...]` accesses are now named members of `struct GuiState`
(`toast_text`, `tabs`, `selected_tab`, `input_mode`, `edit_text`, `popup_kind`, `popup_rgb`, `popup_hsl`,
`popup_list_*`, `mouse_scene`, `scroll`, `row_height`, `click_capture`, ...). The layout-row stack at the start of the
block is `GuiState::rows[5]` (`GuiLayoutRow`, 0x78 bytes each). Offsets are checked with `static_assert`s; overlapping
uses (a text buffer that doubles as a key-bind callback, the popup payload) are unions. Field names are inferred
from how the GUI code uses them.
## `__N` disambiguators
Duplicate constants, strings and tables no longer carry `__N`: a symbol that is used from one file gets
`_in_<file>` (for example `row_height_20_in_gui_controls`), module state that already starts with the module name gets an
ordinal (`aim_assist_rng_states_second`), and symbols only referenced from the data tables get `_copy`.
## Verification note
The only generated-code difference from the original tree is in `gui_layout.cpp`, where the layout-row index is now
written `&gui->rows[n - 1]`; the compiler emits the same address computation with base and index registers swapped.
## Widgets, padding and parameter fixes
- Settings widgets: the `W1`/`W2`/`W3`/`Wid` structs became `DropdownSetting`, `ColorSetting`, `ListSetting`,
`ToggleSetting`, `SliderSetting` and `RangeSetting`, with fields such as `label`, `format`, `step`, `scale`, `min`,
`max`, `low`, `high`, `names`, `optional`, `popup_title`, `get_candidates`. `ListSet` / `ListOps` gained `add` and
`remove`.
- Misnamed functions: `draw_keybind_control` -> `draw_dropdown_row`, `draw_checkbox` -> `draw_color_swatch_row`,
`draw_colored_checkbox` -> `draw_list_editor_row`, `draw_label` -> `draw_toggle_row`, `draw_slider_label` ->
`draw_slider_row`, `draw_slider_with_label` -> `draw_range_slider_row`, `draw_label_va` -> `draw_section_label`,
`get_net_handler` -> `get_game_settings` (it returns `Minecraft.gameSettings`).
- Module GUI callbacks take `(GuiState *gui, window)` and the `widget_*` functions take `(window, gui, setting)`; an earlier
pass had called the first argument `jvm`, which was wrong for these functions and is fixed.
- Padding fields are named by their byte offset (`padding_08`, `padding_11`, ...), computed from clang's record layouts.
Offset-named fields with a known role got names (`on_shutdown`, `register_settings`, `fill_fraction`,
`key_state_table`, `reach`, ...); the remaining zeroed filler bytes are `reserved_NN`.
- `hook_*` natives: `(env, native_class, receiver, ...)`; `java_jni_is_instance_of_*` takes `candidate`;
integer error-code locals are `error_code`.
## Build fix and key-binding accessors
- `nvg_names.cpp` failed to compile after the parameter pass (the parameter was renamed to `nvg` but the macro-free bodies
still used `c`); fixed. The two NanoVG-dependent files were not part of my per-file compile checks, so the full CMake
cross-build is the reference check; it builds `slinky.dll` cleanly.
- Key-binding accessors are named by the `GameSettings.keyBindings` index they read:
`java_get_game_settings_attack_key` (0), `_use_item_key` (1), `_forward_key` (2), `_left_key` (3), `_back_key` (4),
`_right_key` (5), `_sneak_key` (7), `_key_8_or_9`, `_key_17_or_8` (mapping-dependent).
- Other numbered accessors: `java_get_minecraft_object_mouse_over`, `java_get_minecraft_player_controller`,
`java_get_entity_player_inventory`, `java_get_moving_object_position_type_ordinal` / `_entity_hit`,
`java_increment_key_binding_press_time`.
- `timer_range_last_forward_input` / `timer_range_last_strafe_input` were swapped in an earlier pass; fixed (they come
from the forward/back and left/right keys respectively).
- `CombatTarget` (engine.h) replaces raw `ctx->target + 0x18` reads with `->valid`.
## JNI calls, numbered names, constants, padding
- Raw JNI function-table calls (`(*(void ***)env)[0xb0 / 8]` and friends) are now named calls through the existing
`JNIEnv` table: `(*env)->DeleteGlobalRef`, `IsSameObject`, `NewGlobalRef`, `NewStringUTF`, `GetObjectArrayElement`,
`GetStringLength`, `GetStringCritical`, `ReleaseStringCritical`. `((void **)ctx->jvm)[1]` is `((Jvm *)ctx->jvm)->env`.
- Functions that ended in `_2` / `_3` have descriptive names (`friends_on_tick`, `friends_on_toggle`,
`bridge_assist_on_late_tick`, `piercing_decide_which_entity`, `java_get_world_chunk_provider_client`, ...). The numbers
that remain are meaningful (`hook_*_1_7` / `_1_8` Minecraft versions, `player_esp_render_mode_0/1`, key-binding array
indices, `java_call_world_get_block_state/500` method ids).
- Constants used as arguments of a recognised call are named by role (`font_size_16_in_gui_popups`,
`corner_radius_10_in_gui_text`, `colour_level_0_866667_in_gui_text`, `walk_period_0_5_in_clutch`,
`random_range_bound_0_05_in_clutch`); constants used in arithmetic or comparisons by operator
(`threshold_`, `factor_`, `divisor_`, `offset_`); pi and the 180 / 360 degree constants are `pi_constant`,
`half_turn_degrees`, `full_turn_degrees`. Constants whose use is not one of these keep their value in the name.
- Struct filler bytes are `padding_NN` (offset in hex), not `reserved_NN`: they are never read.
## Minecraft field / method identifiers, string names, constants
The Minecraft JNI identifiers (`JIds` members) are now named after what they are in the game
(`Minecraft_theWorld`, `Minecraft_thePlayer`, `Minecraft_objectMouseOver`, `Entity_boundingBox`, `World_chunkProvider`,
`MovingObjectPosition_hitVec`, `InventoryPlayer_itemStack`, `RenderManager_textRenderer`, ...), and their accessors
follow (`java_get_minecraft_render_item`, `java_get_entity_riding_entity`, ...). Members whose game name I could not
establish from the code are called `<Class>_unidentified_<offset>`; method ids are `unidentified_<offset>`.
**Compatibility:** only C identifiers changed. The class / field / method *name strings* that the client resolves at
run time (the obfuscated or mapped names used for the JVM lookups, including any mapping a particular launcher needs)
live in `src/data/rdata.s` and are untouched; the data section hashes identically before and after. Short obfuscated
name strings are labelled `mc_obf_name_<text>`, JNI signature strings `jni_signature_<text>`, printf formats
`fmt_<spec>` and X.509 OID strings `oid_<digits>`.
Also: `fn_<address>` / `logic_<address>` references in the docs now show the current function names;
`java_get_static_field_c80` is `java_get_c16_enum_state_open_inventory`; remaining one- and two-letter locals of
struct-pointer type are named after the struct (`entry`, `target`, `visitor`, `window`, ...); constants used as plain
literals are named by number word (`one`, `half`, `minus_one`, ...) or by role (`range_low_*`).
## JNI members named from the client's own mapping tables
Every `JIds` member (fields and methods of the Minecraft classes the client resolves through JNI) is now named after the
MCP name that the client's own data tables carry next to the obfuscated name for each mapping (`getBlockState`,
`rayTrace`, `sideHit`, `renderGlobal`, `netManager`, `updateCameraAndRender`, ...), so the names are the ones the data
itself uses and are verified against it. Earlier guesses that the tables contradicted were corrected
(`World_playerEntities` / `World_loadedEntityList` / `World_loadedTileEntityList`, `TileEntity_blockType`,
`NetworkPlayerInfo_displayName`, `GuiContainer_theSlot`, `RenderManager_textRenderer`, `InventoryPlayer_itemStack`).
The string slots that hold method names and signatures for the render hooks are `RendererLivingEntity_*MethodName` /
`*MethodSignature`. No `unidentified_*` names remain. Only identifiers changed; the name strings are unchanged.
## Constants
All remaining `k_f_*` / `k_d_*` constants are named by purpose (`ground_friction_times_air_drag`,
`movement_input_friction`, `gui_wide_layout_max_width`, ...).
docs/standalone.md
+61
View File
@@ -0,0 +1,61 @@
# Standalone build: what is left (measured 2026-10-30)
State of the source: every function of the client is now C++ except the 43 protector-mutated ones, which have
readable versions in `src/engine/protected/` (17 of 20 used ones; see README there). Counts:
| layer | functions | in C++ | byte-exact |
|---|---:|---:|---:|
| module settings (cb/reg/aux) | 146 | 146 | 145 |
| module logic | 200 | 200 | 200 |
| engine (`manifest_engine.json`) | 880 | 837 (+17 readable protected) | 591 |
`tools/extract_engine.py` now also finds functions nothing calls directly (the protector's virtualised init block
starts them through function pointers): the input handler, JVMTI unload, bytecode patcher, GLFW loader, key maps,
JNI bootstrap, allocators, destructors.
## What a standalone (no original image) build still needs
Undefined symbols over all 440 compiled objects (`llvm-nm`):
| kind | count | what it is | plan |
|---|---:|---|---|
| `rdata_*` | 2161 | strings, float/double constants, lookup tables, vtable-like arrays | generate `src/data/rdata_*.cpp` from the image, typed by use (strings as literals, floats, structs where known) |
| `data_*` | 1352 | globals: settings values, module descriptors, state | generate definitions with initial values from the image's `.data` |
| `fn_*` | 97 | NanoVG + its GL3 backend (0x62850+; not ImGui), MSVC CRT (0xab000+), import thunks | link upstream NanoVG (nanovg_gl, GL3), the real CRT; map thunks to real APIs |
| `W_*`/`R_*`/`log_fmt` | 48 | the widget/registration API the module code calls | already written as headers in include/slinky/api.h; needs real bodies (they are `fn_*` in the image) |
| `__imp_*` | - | Win32 imports used by src/engine/protected | link kernel32 (Windows) / replace in a platform layer (Linux) |
Platform layer (needed for Linux): the Windows-only pieces are the window-procedure input hook and click injection
(`protected/input.cpp`), file/path helpers (`protected/files.cpp`), `GetModuleHandle/GetProcAddress`, DLL entry/unload.
Everything else goes through JNI/JVMTI (portable) and OpenGL/NanoVG (portable). On Linux: load as a JVMTI agent
(`-agentpath`), take input from GLFW callbacks (`init_glfw_entrypoints` already resolves them) or X11, use `dlopen/dlsym`.
## Order
1. generate data/rdata definitions (largest mechanical step, enables linking the C++ without the image)
2. real NanoVG + CRT, widget API bodies
3. CMake: Windows DLL first (comparable against the original), then Linux `.so` with the platform layer
4. rewrite the unrecovered virtualised blocks (one-time init in `hook_get_mouse_over`, hook on/off `set_java_hooks`) with our own design
## Result of the data step (tools/gen_data.py, tools/gen_aliases.py, tools/link_probe.sh)
* `src/data/rdata.s` (1.6 MB, 4430 relocated pointers, 6937 strings) and `src/data/data.s` (2595 pointers) are generated
from the image and verified byte-for-byte by `tools/check_data.py` (0 differing bytes, every pointer target correct).
Strings are `.asciz`, pointers are symbol references, 4/8-byte constants carry their float/double value as a comment.
* `src/engine/aliases.cpp` maps engine calls of logic functions (`gui_handle_input_event_entry` -> `gui_handle_input_event`) and the module API names
(`W_bool` -> `widget_bool`, ...).
* `tools/link_probe.sh` links every C++ object with these into a DLL (no CRT, no imports). Before: 3513 data symbols and
~700 functions undefined. Now: 300 undefined symbols, 0 duplicates, and all of them are library code or platform API:
199 MSVC CRT functions, 42 NanoVG functions, 23 import thunks, ~25 Win32 imports, ~9 libc/runtime symbols, and
one piece of client code (`set_java_hooks`, the unrecovered hook on/off).
* So the client's own code is closed: everything it needs besides NanoVG, the C runtime and the OS is in this tree.
## Status update: the DLL builds (CMakeLists.txt)
* `cmake -S . -B build/cmake -DCMAKE_TOOLCHAIN_FILE=cmake/toolchain-windows-clang-cl.cmake && cmake --build build/cmake`
produces `build/cmake/slinky.dll` without the original image and without a Windows SDK.
* What stood open in the table above is now bound: the C runtime and NanoVG by `src/platform/` (CRT shim, NanoVG
names, GL slots), the OS imports by import libraries generated from `cmake/imports/*.def`, the few libc declarations
the bundled C code needs by `third_party/minicrt/`.
* Start-up, hook control, teardown and the first-frame GUI setup are new code (`docs/init.md`).
* Still open: running it in a game (nothing has been run), the Linux platform layer, and the items marked inferred in
`docs/init.md`.
docs/symbol-map.json
+1340
View File
File diff suppressed because it is too large. Load diff