Base globals
inline static constexpr uintptr_t il2cpphandle = 0x110258C0;
inline static constexpr uintptr_t il2cpp_gchandle_get_target = 0x875340;
struct rust_globals {
inline static constexpr uintptr_t il2cpphandle = 0x110258C0;
inline static constexpr uintptr_t gchandle_get_target = 0x875340;
inline static constexpr uintptr_t base_networkable_static = 0x10B48130;
inline static constexpr uintptr_t main_camera_c = 0x10AEE0A0;
inline static constexpr uintptr_t local_player_static = 0x10BAE2B8;
inline static constexpr uintptr_t tod_sky = 0x10C046D0;
};
il2cpp exports
struct il2cpp_api {
inline static constexpr uintptr_t domain_get = 0x874C10;
inline static constexpr uintptr_t domain_get_assemblies = 0x874C30;
inline static constexpr uintptr_t domain_assembly_open = 0x874C20;
inline static constexpr uintptr_t class_from_name = 0x85E0E0;
inline static constexpr uintptr_t image_get_class_count = 0xAB30;
inline static constexpr uintptr_t image_get_class = 0x877090;
inline static constexpr uintptr_t class_get_methods = 0x874260;
inline static constexpr uintptr_t class_get_fields = 0x874010;
inline static constexpr uintptr_t class_get_nested_types = 0x874090;
inline static constexpr uintptr_t class_get_type = 0x74AD80;
inline static constexpr uintptr_t class_get_parent = 0x2EA40;
inline static constexpr uintptr_t class_get_flags = 0x874340;
inline static constexpr uintptr_t class_get_static_field_data = 0x2910;
inline static constexpr uintptr_t class_from_il2cpp_type = 0x873FF0;
inline static constexpr uintptr_t type_get_object = 0x876DB0;
inline static constexpr uintptr_t type_get_class_or_element_class = 0x876DD0;
inline static constexpr uintptr_t type_get_name = 0x876E00;
inline static constexpr uintptr_t type_get_attrs = 0x877020;
inline static constexpr uintptr_t method_get_param_count = 0x8758B0;
inline static constexpr uintptr_t method_get_param = 0x8758C0;
inline static constexpr uintptr_t method_get_return_type = 0xC6C0;
inline static constexpr uintptr_t method_get_class = 0xB790;
inline static constexpr uintptr_t method_get_flags = 0x875970;
inline static constexpr uintptr_t field_get_offset = 0x8043C0;
inline static constexpr uintptr_t field_get_type = 0x461400;
inline static constexpr uintptr_t field_get_flags = 0x874EB0;
inline static constexpr uintptr_t field_static_get_value = 0x875010;
inline static constexpr uintptr_t object_new = 0x875C80;
inline static constexpr uintptr_t resolve_icall = 0x873ED0;
inline static constexpr uintptr_t gchandle_get_target = 0x875340;
inline static constexpr uintptr_t gchandle_new = 0x8752F0;
inline static constexpr uintptr_t gchandle_free = 0x8753E0;
inline static constexpr uintptr_t array_new = 0x873EF0;
inline static constexpr uintptr_t string_new = 0x875DA0;
};
PENDING (not auto-discovered): assembly_get_image, class_get_name, class_get_namespace, class_get_image, method_get_name, field_get_parent, field_get_name, object_get_class. Resolve from GameAssembly.dll exports.
gc handles
struct gc_handles {
inline static constexpr uintptr_t table = 0x110258C0;
inline static constexpr uintptr_t get_target = 0x875340;
};
klass rvas
struct klass_rvas {
inline static constexpr uintptr_t BaseNetworkable = 0x10B48130;
inline static constexpr uintptr_t BaseEntity = 0x10B10B78;
inline static constexpr uintptr_t BaseCombatEntity = 0x10BBEC40;
inline static constexpr uintptr_t BasePlayer = 0x10AEF590;
inline static constexpr uintptr_t BaseNpc = 0x10B05510;
inline static constexpr uintptr_t BaseVehicle = 0x10C0C588;
inline static constexpr uintptr_t DroppedItemContainer = 0x10BFE430;
inline static constexpr uintptr_t OreResourceEntity = 0x10B25098;
inline static constexpr uintptr_t CollectibleEntity = 0x10BE58A8;
inline static constexpr uintptr_t BuildingBlock = 0x10B70D48;
inline static constexpr uintptr_t BuildingPrivlidge = 0x10AF4A68;
inline static constexpr uintptr_t Door = 0x10C02128;
inline static constexpr uintptr_t WorldItem = 0x10AFCCD8;
inline static constexpr uintptr_t Signage = 0x10B77F28;
inline static constexpr uintptr_t MainCamera = 0x10AEE0A0;
inline static constexpr uintptr_t PlayerEyes = 0x10C00450;
inline static constexpr uintptr_t TOD_Sky = 0x10C046D0;
inline static constexpr uintptr_t Item = 0x10BC1458;
inline static constexpr uintptr_t ItemId = 0x10B06A40;
inline static constexpr uintptr_t ConsoleSystem_Command = 0x10BA0340;
inline static constexpr uintptr_t PlayerInventory = 0x10D09658;
inline static constexpr uintptr_t LocalPlayer_Static = 0x10BAE2B8;
inline static constexpr uintptr_t ListComponent_Projectile = 0x10B836E8;
};
klass layout
namespace klass_layout {
inline static constexpr uintptr_t name_ptr = 0x10;
inline static constexpr uintptr_t static_fields = 0xB8;
};
base networkable
namespace base_networkable {
inline static constexpr uintptr_t base_networkable = 0x10B48130;
inline static constexpr uintptr_t static_fields = 0xB8;
inline static constexpr uintptr_t wrapper_class_ptr = 0x38;
inline static constexpr uintptr_t client_entities = 0x38;
inline static constexpr uintptr_t entity_list = 0x18;
inline static constexpr uintptr_t parent_static_fields = 0x18;
inline static constexpr uintptr_t hv_offset = 0x18;
inline static constexpr uintptr_t decrypt_gate = 0x10;
inline static constexpr uintptr_t entities = 0x20;
inline static constexpr uintptr_t buffer_list_array = 0x10;
inline static constexpr uintptr_t buffer_list_size = 0x18;
inline static constexpr uintptr_t il2cpp_array_data = 0x28;
inline static constexpr uintptr_t prefabID = 0x54;
inline static constexpr uintptr_t parentEntity = 0x38;
inline static constexpr uintptr_t children = 0x80;
inline static constexpr uintptr_t net = 0x18;
inline static constexpr uintptr_t globalBroadcast = 0x58;
inline static constexpr uintptr_t networkRange = 0x64;
};
BN walk:
GA + 0x10B48130
-> +0xB8 static_fields
-> +0x38 EncryptedValue wrapper
-> gate +0x10, cipher +0x18 client_entities -> il2cpp_gchandle_get_target
-> EntityRealm +0x18
-> cipher entity_list -> il2cpp_gchandle_get_target
-> ListDictionary.vals +0x20
-> BufferList +0x10 / +0x18
-> T[] +0x20 (try +0x28)
camera
namespace camera {
inline static constexpr uintptr_t main_camera = 0x10AEE0A0;
inline static constexpr uintptr_t static_fields = 0xB8;
inline static constexpr uintptr_t camera_object = 0xC0;
inline static constexpr uintptr_t native = 0x10;
inline static constexpr uintptr_t position = 0x444;
inline static constexpr uintptr_t viewMatrix = 0x2FC;
inline static constexpr uintptr_t projectionMatrix = 0x748;
inline static constexpr uintptr_t clipMatrix = 0x2FC;
inline static constexpr uintptr_t aspect = 0x130;
inline static constexpr uintptr_t nearClip = 0x108;
inline static constexpr uintptr_t farClip = 0x120;
inline static constexpr uintptr_t culling_mask = 0x104;
};
GA + 0x10AEE0A0 -> +0xB8 -> +0xC0 camera_object -> +0x10 native
native + 0x2FC view/clip, +0x444 position, +0x748 projection
fieldOfView PENDING this dump.
local player static
namespace local_player_static {
inline static constexpr uintptr_t local_player = 0x10BAE2B8;
inline static constexpr uintptr_t static_fields = 0xB8;
inline static constexpr uintptr_t entity = 0x328;
inline static constexpr uintptr_t hv_in_wrapper = 0x18;
inline static constexpr uintptr_t is_wrapped = 0x1;
};
BasePlayer
namespace BasePlayer {
inline static constexpr uintptr_t player_model = 0x350;
inline static constexpr uintptr_t frozen = 0x398;
inline static constexpr uintptr_t display_name = 0x4A0;
inline static constexpr uintptr_t player_input = 0x530;
inline static constexpr uintptr_t current_team = 0x558;
inline static constexpr uintptr_t clActiveItem = 0x588;
inline static constexpr uintptr_t currentGesture = 0x5D8;
inline static constexpr uintptr_t player_inventory = 0x678;
inline static constexpr uintptr_t playerFlags = 0x6D8;
inline static constexpr uintptr_t player_eyes = 0x6E8;
inline static constexpr uintptr_t playerRigidbody = 0x6F0;
inline static constexpr uintptr_t movement = 0x7D8;
};
userID PENDING. Inventory getter RVA 0x3451380.
BaseCombatEntity
namespace BaseCombatEntity {
inline static constexpr uintptr_t model = 0x1B8;
inline static constexpr uintptr_t skeletonProperties = 0x230;
inline static constexpr uintptr_t baseProtection = 0x238;
inline static constexpr uintptr_t lifestate = 0x2A8;
inline static constexpr uintptr_t markAttackerHostile = 0x2AE;
inline static constexpr uintptr_t _health = 0x2B4;
inline static constexpr uintptr_t _maxHealth = 0x2B8;
};
BaseEntity
namespace BaseEntity {
inline static constexpr uintptr_t triggers = 0xD8;
inline static constexpr uintptr_t bounds = 0x18C;
inline static constexpr uintptr_t model = 0x1B8;
inline static constexpr uintptr_t flags = 0x1C0;
};
BaseEntityFlags
namespace BaseEntityFlags {
inline static constexpr uintptr_t Placeholder = 0x1;
inline static constexpr uintptr_t On = 0x2;
inline static constexpr uintptr_t OnFire = 0x4;
inline static constexpr uintptr_t Open = 0x8;
inline static constexpr uintptr_t Locked = 0x10;
inline static constexpr uintptr_t Debugging = 0x20;
inline static constexpr uintptr_t Disabled = 0x40;
inline static constexpr uintptr_t Reserved1 = 0x80;
inline static constexpr uintptr_t Reserved2 = 0x100;
inline static constexpr uintptr_t Reserved3 = 0x200;
inline static constexpr uintptr_t Reserved4 = 0x400;
inline static constexpr uintptr_t Reserved5 = 0x800;
};
base player flags
namespace base_player_flags {
inline static constexpr uintptr_t Unused1 = 0x1;
inline static constexpr uintptr_t Unused2 = 0x2;
inline static constexpr uintptr_t IsAdmin = 0x4;
inline static constexpr uintptr_t ReceivingSnapshot = 0x8;
inline static constexpr uintptr_t Sleeping = 0x10;
inline static constexpr uintptr_t Spectating = 0x20;
inline static constexpr uintptr_t Wounded = 0x40;
inline static constexpr uintptr_t IsDeveloper = 0x80;
inline static constexpr uintptr_t Connected = 0x100;
inline static constexpr uintptr_t ThirdPersonViewmode = 0x400;
};
PlayerModel
namespace PlayerModel {
inline static constexpr uintptr_t rootBone = 0x98;
inline static constexpr uintptr_t boneTransforms = 0x98;
inline static constexpr uintptr_t headBone = 0xF8;
inline static constexpr uintptr_t eyeBone = 0x120;
inline static constexpr uintptr_t position = 0x2F8;
inline static constexpr uintptr_t new_velocity = 0x31C;
inline static constexpr uintptr_t skinned_mesh = 0x380;
};
Model
namespace Model {
inline static constexpr uintptr_t boneTransforms = 0x50;
inline static constexpr uintptr_t boneNames = 0x58;
};
Bone names (94-bone rig):
namespace bones {
inline static constexpr uintptr_t pelvis = 0;
inline static constexpr uintptr_t l_hip = 1;
inline static constexpr uintptr_t l_knee = 3;
inline static constexpr uintptr_t l_foot = 4;
inline static constexpr uintptr_t r_hip = 14;
inline static constexpr uintptr_t r_knee = 16;
inline static constexpr uintptr_t r_foot = 17;
inline static constexpr uintptr_t spine2 = 21;
inline static constexpr uintptr_t spine4 = 23;
inline static constexpr uintptr_t l_clavicle = 24;
inline static constexpr uintptr_t l_upperarm = 25;
inline static constexpr uintptr_t l_forearm = 26;
inline static constexpr uintptr_t l_hand = 29;
inline static constexpr uintptr_t neck = 52;
inline static constexpr uintptr_t head = 53;
inline static constexpr uintptr_t r_clavicle = 60;
inline static constexpr uintptr_t r_upperarm = 61;
inline static constexpr uintptr_t r_forearm = 62;
inline static constexpr uintptr_t r_hand = 65;
inline static constexpr uintptr_t array_count = 0x18;
inline static constexpr uintptr_t array_data = 0x20;
};
Do not walk Model.boneTransforms from Present. Head/neck from PlayerModel GameObjects.
PlayerEyes
namespace PlayerEyes {
inline static constexpr uintptr_t viewOffset = 0x40;
inline static constexpr uintptr_t bodyRotation = 0x50;
};
PlayerInput
namespace PlayerInput {
inline static constexpr uintptr_t bodyAngles = 0x44;
};
PlayerInventory
namespace PlayerInventory {
inline static constexpr uintptr_t containerBelt = 0x28;
inline static constexpr uintptr_t containerMain = 0x38;
inline static constexpr uintptr_t loot = 0x48;
inline static constexpr uintptr_t containerWear = 0x58;
};
ItemContainer
namespace ItemContainer {
inline static constexpr uintptr_t flags = 0x48;
inline static constexpr uintptr_t itemList = 0x78;
};
item
namespace item {
inline static constexpr uintptr_t amount = 0x2C;
inline static constexpr uintptr_t info = 0x48;
inline static constexpr uintptr_t position = 0x94;
inline static constexpr uintptr_t held_entity = 0xA8;
inline static constexpr uintptr_t uid = 0xB8;
};
ItemDefinition
namespace ItemDefinition {
inline static constexpr uintptr_t itemid = 0x20;
inline static constexpr uintptr_t shortname = 0x28;
inline static constexpr uintptr_t displayName = 0x40;
inline static constexpr uintptr_t iconSprite = 0x50;
inline static constexpr uintptr_t category = 0x58;
inline static constexpr uintptr_t stackable = 0x78;
inline static constexpr uintptr_t rarity = 0x94;
inline static constexpr uintptr_t condition = 0xB8;
};
WorldItem
namespace WorldItem {
inline static constexpr uintptr_t item = 0x208;
};
BaseProjectile
namespace BaseProjectile {
inline static constexpr uintptr_t projectileVelocityScale = 0x394;
inline static constexpr uintptr_t automatic = 0x398;
inline static constexpr uintptr_t reloadTime = 0x3D8;
inline static constexpr uintptr_t primaryMagazine = 0x3E0;
inline static constexpr uintptr_t aimSway = 0x400;
inline static constexpr uintptr_t aimSwaySpeed = 0x404;
inline static constexpr uintptr_t recoil = 0x408;
inline static constexpr uintptr_t aimCone = 0x418;
inline static constexpr uintptr_t hipAimCone = 0x41C;
};
Projectile
namespace Projectile {
inline static constexpr uintptr_t initialVelocity = 0x28;
inline static constexpr uintptr_t drag = 0x34;
inline static constexpr uintptr_t gravityModifier = 0x38;
inline static constexpr uintptr_t thickness = 0x3C;
inline static constexpr uintptr_t initialDistance = 0x44;
};
ItemModProjectile
namespace ItemModProjectile {
inline static constexpr uintptr_t projectileObject = 0x20;
inline static constexpr uintptr_t numProjectiles = 0x38;
inline static constexpr uintptr_t projectileVelocity = 0x40;
inline static constexpr uintptr_t projectileVelocitySpread = 0x44;
};
projectile list
namespace projectile_list {
inline static constexpr uintptr_t projectile_klass_rva = 0x10B836E8;
inline static constexpr uintptr_t klass_static_fields = 0xB8;
inline static constexpr uintptr_t instance_in_static = 0x28;
inline static constexpr uintptr_t vals_in_hashset = 0x10;
};
HeldEntity
namespace HeldEntity {
inline static constexpr uintptr_t viewModel = 0x200;
inline static constexpr uintptr_t viewModel_inner = 0x28;
inline static constexpr uintptr_t ownerItemUID = 0x2E0;
};
viewModel_wrapper_kind = 4.
BaseViewModel
namespace BaseViewModel {
inline static constexpr uintptr_t useViewModelCamera = 0x40;
};
BaseMovement
namespace BaseMovement {
inline static constexpr uintptr_t adminCheat = 0x20;
inline static constexpr uintptr_t Owner = 0x30;
};
TOD_Sky
namespace tod_sky_static {
inline static constexpr uintptr_t nested_static_rva = 0x10C046D0;
inline static constexpr uintptr_t static_fields = 0xB8;
inline static constexpr uintptr_t instance_field = 0x98;
};
namespace tod_sky {
inline static constexpr uintptr_t Cycle = 0x40;
inline static constexpr uintptr_t Atmosphere = 0x50;
inline static constexpr uintptr_t Day = 0x58;
inline static constexpr uintptr_t Night = 0x60;
inline static constexpr uintptr_t Stars = 0x78;
inline static constexpr uintptr_t Clouds = 0x80;
inline static constexpr uintptr_t Ambient = 0x98;
};
namespace tod_cycle_parameters {
inline static constexpr uintptr_t Hour = 0x10;
inline static constexpr uintptr_t Day = 0x14;
inline static constexpr uintptr_t Month = 0x18;
inline static constexpr uintptr_t Year = 0x1C;
};
unity native
namespace unity_object {
inline static constexpr uintptr_t cached_ptr = 0x10;
};
namespace unity_component {
inline static constexpr uintptr_t game_object = 0x20;
};
namespace unity_game_object {
inline static constexpr uintptr_t components = 0x20;
inline static constexpr uintptr_t component_count = 0x30;
inline static constexpr uintptr_t component_stride = 0x10;
inline static constexpr uintptr_t component_ptr_in_entry = 0x8;
inline static constexpr uintptr_t component_handle_in_native = 0x18;
};
namespace unity_transform {
inline static constexpr uintptr_t indirect_ptr_off = 0x28;
inline static constexpr uintptr_t world_pos_off = 0x90;
};
namespace unity_transform_native {
inline static constexpr uintptr_t access_struct_off = 0x28;
};
namespace transform_data {
inline static constexpr uintptr_t pos_base_off = 0x18;
inline static constexpr uintptr_t indices_b_off = 0x20;
inline static constexpr uintptr_t root_pos_off = 0x90;
inline static constexpr uintptr_t root_quat_off = 0xA0;
inline static constexpr uintptr_t matrix_stride = 0x30;
inline static constexpr uintptr_t slot_pos_off = 0x0;
inline static constexpr uintptr_t slot_quat_off = 0x10;
inline static constexpr uintptr_t slot_scale_off = 0x20;
};
PhysX / TimeManager (UnityPlayer.dll)
namespace physx_sdk {
inline static constexpr uintptr_t global_ptr_rva = 0x217F8E8;
};
namespace unity_time {
inline static constexpr uintptr_t time_manager_slot_rva = 0x21AC988;
inline static constexpr uintptr_t fps_float_off = 0x154;
inline static constexpr uintptr_t frame_count_off = 0x160;
inline static constexpr uintptr_t rendered_frame_count_off = 0x168;
inline static constexpr uintptr_t paused_off = 0x1A8;
inline static constexpr uintptr_t time_scale_off = 0x1AC;
inline static constexpr uintptr_t max_delta_time_off = 0x1B0;
inline static constexpr uintptr_t max_particle_delta_off = 0x1B4;
};
HackableLockedCrate
namespace HackableLockedCrate {
inline static constexpr uintptr_t timer_seconds = 0x410;
};
Decryption routines
25455646 live extract. Cipher at wrapper +0x18. Gate +0x10. Then il2cpp_gchandle_get_target except clActiveItem.
uintptr_t decryption::client_entities(uint64_t a1) { if (!driver.read(a1 + 0x10)) return 0; uintptr_t rax = driver.read(a1 + 0x18); uint32_t rdx = (uint32_t)&rax; for (int i = 0; i < 2; ++i) { uint32_t ecx = rdx[i]; ecx = ecx + 0x5B90BDF1; ecx = (ecx << 0xD) | (ecx >> 0x13); // rol 13 ecx = ecx + 0x87F6F395; ecx = (ecx << 0xA) | (ecx >> 0x16); // rol 10 rdx[i] = ecx; } return il2cpp_get_handle(rax); }
uintptr_t decryption::entity_list(uint64_t a1) { if (!driver.read(a1 + 0x10)) return 0; uintptr_t rax = driver.read(a1 + 0x18); uint32_t rdx = (uint32_t)&rax; for (int i = 0; i < 2; ++i) { uint32_t ecx = rdx[i]; ecx = ecx + 0xF32657A6; ecx = (ecx << 0x11) | (ecx >> 0xF); // rol 17 ecx = ecx + 0x2CA1F449; ecx = (ecx << 0xD) | (ecx >> 0x13); // rol 13 rdx[i] = ecx; } return il2cpp_get_handle(rax); }
uintptr_t decryption::clActiveItem(uint64_t a1) { // in-place UID. do not run this on a heap pointer. uint32_t rdx = (uint32_t)&a1; for (int i = 0; i < 2; ++i) { uint32_t edx = rdx[i]; edx = edx ^ 0x1ED63991; edx = (edx << 0xB) | (edx >> 0x15); // rol 11 edx = edx ^ 0x2519E30D; rdx[i] = edx; } return a1; }
uintptr_t decryption::PlayerInventory(uint64_t a1) { if (!driver.read(a1 + 0x10)) return 0; uintptr_t rax = driver.read(a1 + 0x18); uint32_t rdx = (uint32_t)&rax; for (int i = 0; i < 2; ++i) { uint32_t ecx = rdx[i]; ecx = (ecx << 0x19) | (ecx >> 0x7); // rol 25 ecx = ecx ^ 0x4C3F5742; ecx = ecx + 0x14BA377E; ecx = (ecx << 0x13) | (ecx >> 0xD); // rol 19 rdx[i] = ecx; } return il2cpp_get_handle(rax); }
uintptr_t decryption::PlayerEyes(uint64_t a1) { if (!driver.read(a1 + 0x10)) return 0; uintptr_t rax = driver.read(a1 + 0x18); uint32_t rdx = (uint32_t)&rax; for (int i = 0; i < 2; ++i) { uint32_t ecx = rdx[i]; ecx = (ecx << 0x6) | (ecx >> 0x1A); // rol 6 ecx = ecx - 0x37D21684; ecx = ecx ^ 0xD99DB368; ecx = ecx + 0x1EA2924A; rdx[i] = ecx; } return il2cpp_get_handle(rax); }
uintptr_t decryption::local_player(uint64_t a1) { uintptr_t rax = a1; uint32_t rdx = (uint32_t)&rax; for (int i = 0; i < 2; ++i) { uint32_t v = rdx[i]; v = v + 0xE53641EB; v = v - 0x5B90BDF1; v = (v << 0x13) | (v >> 0xD); // rol 19 v = v - 0x5B90BDF1; rdx[i] = v; } return il2cpp_get_handle(rax); } ```