Base globals
struct rust_globals {
uintptr_t il2cpphandle = 0x1017C260; // GameAssembly.dll RVA
uintptr_t base_networkable_static = 0xFCD2240; // static-fields base
uintptr_t main_camera_c = 0xFCB7488; // static-fields base
};
base_networkable
struct base_networkable {
uintptr_t static_fields = 0xB8;
uintptr_t wrapper_class_ptr = 0x8;
uintptr_t parent_static_fields = 0x10;
uintptr_t entities = 0x10;
uintptr_t hv_offset = 0x18;
};
camera
struct camera {
uintptr_t camera_static = 0xB8;
uintptr_t camera_object = 0x8;
uintptr_t entity = 0x10;
uintptr_t view_matrix = 0x2FC; // Unity native camera state
uintptr_t position = 0x444; // Unity native camera state
uintptr_t field_of_view = 0x170; // Unity native camera state
uintptr_t culling_mask = 0x3E8; // Unity native camera state
};
base_entity
struct base_entity {
uintptr_t flags = 0x1B0;
};
base_combat_entity
struct base_combat_entity {
uintptr_t lifestate = 0x298;
uintptr_t model = 0x1A8;
uintptr_t _health = 0x2A4;
uintptr_t _maxHealth = 0x2A8;
};
base_player
struct base_player {
uintptr_t cl_active_item = 0x568;
uintptr_t player_eyes = 0x5F8;
uintptr_t player_inventory = 0x4D0;
uintptr_t current_team = 0x538;
uintptr_t base_movement = 0x4E0;
uintptr_t player_model = 0x6F0;
uintptr_t player_flags = 0x6B8;
uintptr_t display_name = 0x2D8;
uintptr_t player_input = 0x3A8;
};
player_eyes
struct player_eyes {
uintptr_t viewOffset = 0x60;
uintptr_t bodyRotation = 0x50;
uintptr_t worldPosition = 0x0;
};
player_input
struct player_input {
uintptr_t bodyAngles = 0x44;
};
player_walk_movement
struct player_walk_movement {
uintptr_t GroundAngle = 0x70; // hardcoded — reverify
uintptr_t GroundAngleNew = 0x78; // hardcoded — reverify
uintptr_t GroundTime = 0x80; // hardcoded — reverify
uintptr_t JumpTime = 0x88; // hardcoded — reverify
uintptr_t LandTime = 0x90; // hardcoded — reverify
uintptr_t GravityMultiplier = 0x98; // hardcoded — reverify
uintptr_t TargetMovement = 0x128; // hardcoded — reverify
};
player_model
struct player_model {
uintptr_t jawBone = 0xE8;
uintptr_t neckBone = 0xF0;
uintptr_t headBone = 0xF8;
uintptr_t skinnedMultiMesh = 0x448;
uintptr_t position = 0x498; // heuristic — last-pair Vector3
uintptr_t velocity = 0x4FC; // heuristic — last-pair Vector3
};
model
struct model {
uintptr_t collision = 0x20;
uintptr_t rootBone = 0x28;
uintptr_t headBone = 0x30;
uintptr_t eyeBone = 0x38;
uintptr_t animator = 0x40;
uintptr_t skeleton = 0x48;
uintptr_t boneTransforms = 0x50;
uintptr_t boneNames = 0x58;
};
player_inventory
struct player_inventory {
uintptr_t main = 0x38;
uintptr_t belt = 0x58;
uintptr_t wear = 0x30;
};
item_container
struct item_container {
uintptr_t item_list = 0x58;
};
item
struct item {
uintptr_t definition = 0x70;
uintptr_t amount = 0xF8;
uintptr_t uid = 0x40;
uintptr_t held_entity = 0x0;
};
item_definition
struct item_definition {
uintptr_t itemid = 0x20;
uintptr_t shortname = 0x28;
uintptr_t displayName = 0x40;
uintptr_t category = 0x58;
uintptr_t stackable = 0x78;
uintptr_t iconSprite = 0x50;
uintptr_t rarity = 0x94;
uintptr_t condition = 0xB8;
};
world_item
struct world_item {
uintptr_t allowPickup = 0x1F0;
uintptr_t item = 0x1F8;
};
held_entity
struct held_entity {
uintptr_t viewModel = 0x1F0;
uintptr_t worldModelAnimator = 0x208;
uintptr_t handBone = 0x250;
uintptr_t holdInfo = 0x260;
uintptr_t isBuildingTool = 0x27C;
uintptr_t forcedOwner = 0x280;
uintptr_t hostileScore = 0x29C;
uintptr_t item_owner = 0x230;
uintptr_t ownerItemUID = 0x2D0;
};
base_projectile
struct base_projectile {
uintptr_t projectileVelocityScale = 0x37C;
uintptr_t automatic = 0x380;
uintptr_t reloadTime = 0x3C0;
uintptr_t primaryMagazine = 0x3C8;
uintptr_t aimSway = 0x3E8;
uintptr_t aimSwaySpeed = 0x3EC;
uintptr_t recoil = 0x3F0;
uintptr_t aimCone = 0x400;
uintptr_t hipAimCone = 0x404;
uintptr_t aimconePenaltyPerShot = 0x408;
uintptr_t stancePenaltyScale = 0x418;
uintptr_t hasADS = 0x41C;
uintptr_t isBurstWeapon = 0x427;
uintptr_t canChangeFireModes = 0x428;
uintptr_t internalBurstFireRateScale = 0x430;
uintptr_t internalBurstAimConeScale = 0x434;
uintptr_t canUnloadAmmo = 0x3C4;
uintptr_t fractionalReload = 0x3D0;
};
recoil_properties
struct recoil_properties {
uintptr_t recoilYawMin = 0x18;
uintptr_t recoilYawMax = 0x1C;
uintptr_t recoilPitchMin = 0x20;
uintptr_t recoilPitchMax = 0x24;
uintptr_t timeToTakeMin = 0x28;
uintptr_t timeToTakeMax = 0x2C;
uintptr_t ADSScale = 0x30;
uintptr_t movementPenalty = 0x34;
uintptr_t clampPitch = 0x38;
uintptr_t pitchCurve = 0x40;
uintptr_t yawCurve = 0x48;
uintptr_t useCurves = 0x50;
uintptr_t shotsUntilMax = 0x54;
uintptr_t maxRecoilRadius = 0x58;
uintptr_t overrideAimconeWithCurve = 0x5C;
uintptr_t aimconeCurveScale = 0x60;
uintptr_t aimconeCurve = 0x68;
uintptr_t aimconeProbabilityCurve = 0x70;
uintptr_t newRecoilOverride = 0x80;
};
convar_graphics
struct convar_graphics {
uintptr_t type_info = 0x0;
uintptr_t static_fields = 0xB8;
uintptr_t fov = 0x0;
};
BaseNetworkable decryption
Two variants ship on this build. Which one is live depends on the current wrapper's static-fields layout — probe both and take whichever survives the il2cpp_get_handle at the tail.
// Variant 0 — add / rot-right / add-const / xor
uintptr_t decrypt_base_networkable_0(uint64_t a1) {
std::uintptr_t rax = driver.read<std::uintptr_t>(a1 + 0x18);
std::uint32_t* rdx = (std::uint32_t*)&rax;
std::uint32_t r8d = 0x2;
std::uint32_t eax, ecx;
do {
ecx = *(std::uint32_t*)(rdx);
eax = *(std::uint32_t*)(rdx);
rdx = (std::uint32_t*)((std::uint8_t*)rdx + 0x4);
ecx = ecx + 0xB97F1AE1;
eax = ecx;
ecx = ecx << 0x1D;
eax = eax >> 0x3;
ecx = ecx | eax;
ecx = ecx + 0x32BEE2A5;
ecx = ecx ^ 0xE58A30D8;
*((std::uint32_t*)rdx - 1) = ecx;
--r8d;
} while (r8d);
return il2cpp_get_handle(rax);
}
// Variant 1 — rot-left / xor / rot-left / xor
uintptr_t decrypt_base_networkable_1(uint64_t a1) {
std::uintptr_t rax = driver.read<std::uintptr_t>(a1 + 0x18);
std::uint32_t* rdx = (std::uint32_t*)&rax;
std::uint32_t r8d = 0x2;
std::uint32_t eax, ecx;
do {
ecx = *(std::uint32_t*)(rdx);
eax = *(std::uint32_t*)(rdx);
rdx = (std::uint32_t*)((std::uint8_t*)rdx + 0x4);
eax = ecx;
ecx = ecx << 0xA;
eax = eax >> 0x16;
ecx = ecx | eax;
ecx = ecx ^ 0xF6BF245D;
eax = ecx;
ecx = ecx << 0xF;
eax = eax >> 0x11;
ecx = ecx | eax;
ecx = ecx ^ 0x9BBD4311;
*((std::uint32_t*)rdx - 1) = ecx;
--r8d;
} while (r8d);
return il2cpp_get_handle(rax);
}