← back
rust · 24091435
Fresh Rust dump. `PlayerInventory` shuffled again (`main` → `0x58`, `belt` → `0x78`, `wear` → `0x30`) and every `BasePlayer` sub-object ref jumped down — `player_inventory` `0x580` → `0x3A0`, `player_model` `0x508` → `0x3D8`, `base_movement` `0x458` → `0x5B8`, `player_input` `0x3E0` → `0x338`, `display_name` `0x588` → `0x2E8`. `item::amount` and `item::held_entity` came back zero from the dumper — hand-map them off the raw class block at the bottom.
## il2cpp handle
```cpp
inline static constexpr uintptr_t il2cpphandle = 0x10132020;
```
## BaseNetworkable
```cpp
struct base_networkable {
inline static constexpr uintptr_t base_networkable = 0xFC72970;
inline static constexpr uintptr_t static_fields = 0xB8;
inline static constexpr uintptr_t wrapper_class_ptr = 0x8;
inline static constexpr uintptr_t parent_static_fields = 0x10;
inline static constexpr uintptr_t entities = 0x10;
inline static constexpr uintptr_t hv_offset = 0x18;
};
```
## BasePlayer
```cpp
struct base_player {
inline static constexpr uintptr_t display_name = 0x2E8; // was 0x588
inline static constexpr uintptr_t player_input = 0x338; // was 0x3E0
inline static constexpr uintptr_t player_inventory = 0x3A0; // was 0x580
inline static constexpr uintptr_t player_model = 0x3D8; // was 0x508
inline static constexpr uintptr_t player_eyes = 0x490; // unchanged
inline static constexpr uintptr_t current_team = 0x538; // unchanged
inline static constexpr uintptr_t cl_active_item = 0x568; // unchanged
inline static constexpr uintptr_t base_movement = 0x5B8; // was 0x458
inline static constexpr uintptr_t player_flags = 0x6B8; // unchanged
};
```
## BaseCombatEntity / BaseEntity
```cpp
struct base_combat_entity {
inline static constexpr uintptr_t model = 0x1A8;
inline static constexpr uintptr_t lifestate = 0x298;
inline static constexpr uintptr_t _health = 0x2A4;
inline static constexpr uintptr_t _maxHealth = 0x2A8;
};
struct base_entity {
inline static constexpr uintptr_t flags = 0x1B0;
};
```
## Model / PlayerModel / PlayerEyes / PlayerInput
```cpp
struct model {
inline static constexpr uintptr_t collision = 0x20;
inline static constexpr uintptr_t rootBone = 0x28;
inline static constexpr uintptr_t headBone = 0x30;
inline static constexpr uintptr_t eyeBone = 0x38;
inline static constexpr uintptr_t animator = 0x40;
inline static constexpr uintptr_t skeleton = 0x48;
inline static constexpr uintptr_t boneTransforms = 0x50;
inline static constexpr uintptr_t boneNames = 0x58;
};
struct player_model {
inline static constexpr uintptr_t jawBone = 0xE8;
inline static constexpr uintptr_t neckBone = 0xF0;
inline static constexpr uintptr_t headBone = 0xF8;
inline static constexpr uintptr_t skinnedMultiMesh = 0x420; // was 0x440
inline static constexpr uintptr_t position = 0x498; // heuristic
inline static constexpr uintptr_t velocity = 0x4FC; // heuristic
};
struct player_eyes {
inline static constexpr uintptr_t bodyRotation = 0x50;
inline static constexpr uintptr_t viewOffset = 0x60;
inline static constexpr uintptr_t worldPosition = 0x0; // hardcoded
};
struct player_input {
inline static constexpr uintptr_t bodyAngles = 0x44;
};
```
## PlayerWalkMovement
Whole struct is still hand-mapped — the dumper doesn't emit labels on `BaseMovement`. Reverify anything you actually use against the raw dump below.
```cpp
struct player_walk_movement {
inline static constexpr uintptr_t GroundAngle = 0x70; // hardcoded
inline static constexpr uintptr_t GroundAngleNew = 0x78; // hardcoded
inline static constexpr uintptr_t GroundTime = 0x80; // hardcoded
inline static constexpr uintptr_t JumpTime = 0x88; // hardcoded
inline static constexpr uintptr_t LandTime = 0x90; // hardcoded
inline static constexpr uintptr_t GravityMultiplier = 0x98; // hardcoded
inline static constexpr uintptr_t TargetMovement = 0x128; // hardcoded
};
```
## Inventory (PlayerInventory / ItemContainer / Item / ItemDefinition)
Belt walk chain shifted end-to-end this patch. `item::amount` and `item::held_entity` came back `0x0` from the dumper — both are misses, use the raw `Item` dump at the bottom to pick them up.
```cpp
struct player_inventory {
inline static constexpr uintptr_t wear = 0x30; // was 0x28
inline static constexpr uintptr_t main = 0x58; // was 0x30
inline static constexpr uintptr_t belt = 0x78; // was 0x58
};
struct item_container {
inline static constexpr uintptr_t item_list = 0x60; // was 0x40
};
struct item {
inline static constexpr uintptr_t definition = 0xA8; // was 0xA0
inline static constexpr uintptr_t uid = 0xB8; // was 0x68
inline static constexpr uintptr_t amount = 0x0; // hardcoded — dumper miss
inline static constexpr uintptr_t held_entity = 0x0; // hardcoded — dumper miss
};
struct item_definition {
inline static constexpr uintptr_t itemid = 0x20;
inline static constexpr uintptr_t shortname = 0x28;
inline static constexpr uintptr_t displayName = 0x40;
inline static constexpr uintptr_t iconSprite = 0x50;
inline static constexpr uintptr_t category = 0x58;
inline static constexpr uintptr_t stackable = 0x78;
inline static constexpr uintptr_t rarity = 0x94;
inline static constexpr uintptr_t condition = 0xB8;
};
```
## Weapons (BaseProjectile / RecoilProperties / WorldItem / HeldEntity)
```cpp
struct base_projectile {
inline static constexpr uintptr_t projectileVelocityScale = 0x37C;
inline static constexpr uintptr_t automatic = 0x380;
inline static constexpr uintptr_t reloadTime = 0x3C0;
inline static constexpr uintptr_t canUnloadAmmo = 0x3C4;
inline static constexpr uintptr_t primaryMagazine = 0x3C8;
inline static constexpr uintptr_t fractionalReload = 0x3D0;
inline static constexpr uintptr_t aimSway = 0x3E8;
inline static constexpr uintptr_t aimSwaySpeed = 0x3EC;
inline static constexpr uintptr_t recoil = 0x3F0;
inline static constexpr uintptr_t aimCone = 0x400;
inline static constexpr uintptr_t hipAimCone = 0x404;
inline static constexpr uintptr_t aimconePenaltyPerShot = 0x408;
inline static constexpr uintptr_t stancePenaltyScale = 0x418;
inline static constexpr uintptr_t hasADS = 0x41C;
inline static constexpr uintptr_t isBurstWeapon = 0x427;
inline static constexpr uintptr_t canChangeFireModes = 0x428;
inline static constexpr uintptr_t internalBurstFireRateScale = 0x430;
inline static constexpr uintptr_t internalBurstAimConeScale = 0x434;
};
struct recoil_properties {
inline static constexpr uintptr_t recoilYawMin = 0x18;
inline static constexpr uintptr_t recoilYawMax = 0x1C;
inline static constexpr uintptr_t recoilPitchMin = 0x20;
inline static constexpr uintptr_t recoilPitchMax = 0x24;
inline static constexpr uintptr_t timeToTakeMin = 0x28;
inline static constexpr uintptr_t timeToTakeMax = 0x2C;
inline static constexpr uintptr_t ADSScale = 0x30;
inline static constexpr uintptr_t movementPenalty = 0x34;
inline static constexpr uintptr_t clampPitch = 0x38;
inline static constexpr uintptr_t pitchCurve = 0x40;
inline static constexpr uintptr_t yawCurve = 0x48;
inline static constexpr uintptr_t useCurves = 0x50;
inline static constexpr uintptr_t shotsUntilMax = 0x54;
inline static constexpr uintptr_t maxRecoilRadius = 0x58;
inline static constexpr uintptr_t overrideAimconeWithCurve = 0x5C;
inline static constexpr uintptr_t aimconeCurveScale = 0x60;
inline static constexpr uintptr_t aimconeCurve = 0x68;
inline static constexpr uintptr_t aimconeProbabilityCurve = 0x70;
inline static constexpr uintptr_t newRecoilOverride = 0x80;
};
struct world_item {
inline static constexpr uintptr_t allowPickup = 0x1F0;
inline static constexpr uintptr_t item = 0x1F8;
};
struct held_entity {
inline static constexpr uintptr_t item_owner = 0x1F0; // was 0x230
inline static constexpr uintptr_t worldModelAnimator = 0x208;
inline static constexpr uintptr_t handBone = 0x250;
inline static constexpr uintptr_t holdInfo = 0x260;
inline static constexpr uintptr_t isBuildingTool = 0x27C;
inline static constexpr uintptr_t forcedOwner = 0x280;
inline static constexpr uintptr_t hostileScore = 0x29C;
inline static constexpr uintptr_t viewModel = 0x2C8; // was 0x1F0
inline static constexpr uintptr_t ownerItemUID = 0x2D0;
};
```
## Camera / ConVar.Graphics
```cpp
struct camera {
inline static constexpr uintptr_t main_camera_c = 0xFC68100;
inline static constexpr uintptr_t camera_static = 0xB8;
inline static constexpr uintptr_t camera_object = 0x38;
inline static constexpr uintptr_t entity = 0x10;
inline static constexpr uintptr_t view_matrix = 0x2FC; // unity native
inline static constexpr uintptr_t position = 0x444; // unity native
inline static constexpr uintptr_t field_of_view = 0x170; // unity native
inline static constexpr uintptr_t culling_mask = 0x3E8; // unity native
};
struct convar_graphics {
inline static constexpr uintptr_t type_info = 0x0; // hardcoded — dumper miss
inline static constexpr uintptr_t static_fields = 0xB8;
inline static constexpr uintptr_t fov = 0x0; // hardcoded — dumper miss
};
```
## BaseNetworkable decryption
Two rotating XOR routines against `BaseNetworkable + 0x18`. Callers resolve to one or the other depending on build — plug both in and let auto-detect pick.
```cpp
uintptr_t decryption::base_networkable_0(uint64_t a1) {
std::uintptr_t rax = driver.read<std::uintptr_t>(a1 + 0x18);
std::uint32_t* rdx = (std::uint32_t*)&rax;
std::uint32_t r8d = 0x2;
std::uint32_t eax, ecx;
do {
ecx = *(std::uint32_t*)(rdx);
eax = *(std::uint32_t*)(rdx);
rdx = (std::uint32_t*)((std::uint8_t*)rdx + 0x4);
ecx = ecx + 0x16A2149;
eax = ecx;
ecx = ecx << 0x7;
eax = eax >> 0x19;
ecx = ecx | eax;
ecx = ecx + 0x42D649F;
*((std::uint32_t*)rdx - 1) = ecx;
--r8d;
} while (r8d);
return il2cpp_get_handle(rax);
}
uintptr_t decryption::base_networkable_1(uint64_t a1) {
std::uintptr_t rax = driver.read<std::uintptr_t>(a1 + 0x18);
std::uint32_t* rdx = (std::uint32_t*)&rax;
std::uint32_t r8d = 0x2;
std::uint32_t eax, ecx;
do {
ecx = *(std::uint32_t*)(rdx);
eax = *(std::uint32_t*)(rdx);
rdx = (std::uint32_t*)((std::uint8_t*)rdx + 0x4);
eax = ecx;
ecx = ecx << 0x14;
eax = eax >> 0xC;
ecx = ecx | eax;
ecx = ecx - 0x1CC81122;
ecx = ecx ^ 0xAACADDEB;
ecx = ecx + 0x63DFF63C;
*((std::uint32_t*)rdx - 1) = ecx;
--r8d;
} while (r8d);
return il2cpp_get_handle(rax);
}
```
## Raw class dump (reference)
Reference sheet for the fields the dumper missed. Match by C# type when the label is obfuscated — the `Item` class in particular is where you'll find `amount` and `held_entity` next patch.
```text
raw class: BasePlayer (label=BasePlayer instance_fields=181)
...
displayName @ 0x2E8 (System.String)
PlayerInput @ 0x338 (PlayerInput)
PlayerInventory (LazyAim<PlayerInventory>) @ 0x3A0
PlayerModel @ 0x3D8 (PlayerModel)
PlayerEyes (LazyAim<PlayerEyes>) @ 0x490
currentTeam @ 0x538 (System.UInt64)
cl_active_item (Encrypted<ItemId>) @ 0x568
BaseMovement @ 0x5B8 (BaseMovement)
playerFlags @ 0x6B8 (BasePlayer.PlayerFlags)
raw class: BaseCombatEntity (instance_fields=23)
skeletonProperties @ 0x220 (SkeletonProperties)
baseProtection @ 0x228 (ProtectionProperties)
startHealth @ 0x230 (System.Single)
pickup @ 0x238 (BaseCombatEntity.Pickup)
repair @ 0x260 (BaseCombatEntity.Repair)
ShowHealthInfo @ 0x290 (System.Boolean)
lifestate @ 0x298 (BaseCombatEntity.LifeState)
sendsHitNotification@ 0x29C (System.Boolean)
markAttackerHostile @ 0x29E (System.Boolean)
_health @ 0x2A4 (System.Single)
_maxHealth @ 0x2A8 (System.Single)
faction @ 0x2AC (BaseCombatEntity.Faction)
raw class: BaseEntity (instance_fields=43)
model @ 0x1A8 (Model)
flags @ 0x1B0 (BaseEntity.Flags)
bounds @ 0x17C (UnityEngine.Bounds)
raw class: BaseMovement (instance_fields=10)
isActive? @ 0x020 (System.Boolean)
activationSpeed? @ 0x024 (System.Single)
owningPlayer @ 0x028 (BasePlayer)
targetVelocity @ 0x030 (UnityEngine.Vector3)
currentVelocity @ 0x03C (UnityEngine.Vector3)
groundAngle @ 0x048 (System.Single)
groundAngleNew @ 0x04C (System.Single)
slopeSpeedScale @ 0x050 (System.Single)
gravityScale @ 0x054 (System.Single)
jumpVelocity @ 0x058 (System.Single)
raw class: PlayerModel (instance_fields=173)
jawBone @ 0x0E8 (UnityEngine.GameObject)
neckBone @ 0x0F0 (UnityEngine.GameObject)
headBone @ 0x0F8 (UnityEngine.GameObject)
SpineBones @ 0x120 (UnityEngine.Transform[])
SkinnedMultiMesh @ 0x420 (SkinnedMultiMesh)
position (heur) @ 0x498 (UnityEngine.Vector3)
velocity (heur) @ 0x4FC (UnityEngine.Vector3)
raw class: PlayerEyes (instance_fields=9)
thirdPersonSleepingOffset @ 0x028 (UnityEngine.Vector3)
defaultLazyAim @ 0x038 (LazyAimProperties)
eyeAngleContainer @ 0x040 (Encrypted<UnityEngine.Vector3>)
bodyRotation @ 0x050 (UnityEngine.Quaternion)
viewOffset @ 0x060 (UnityEngine.Vector3)
headRotation @ 0x06C (UnityEngine.Quaternion)
bodyRotationOverride @ 0x07C (UnityEngine.Quaternion)
lastEyeAngleChangeTime @ 0x08C (System.Single)
raw class: PlayerInput (instance_fields=24)
input? @ 0x028 (obfuscated input struct)
wantsSprint @ 0x030 (System.Boolean)
cachedRotation @ 0x034 (UnityEngine.Quaternion)
bodyAngles @ 0x044 (UnityEngine.Vector3)
aimAngles @ 0x050 (UnityEngine.Vector3)
duckState @ 0x05C (System.Boolean)
duckSpeed @ 0x060 (System.Single)
smoothedAim @ 0x064 (UnityEngine.Quaternion)
aimEuler @ 0x074 (UnityEngine.Vector3)
aimOffsetEncrypted @ 0x080 (Encrypted<UnityEngine.Vector3>)
raw class: Item (instance_fields=31)
name @ 0x010 (System.String)
temperature @ 0x018 (System.Single)
itemFlags? @ 0x01C (Int32)
position @ 0x020 (System.Int32) // *** likely candidate for slot ***
amount @ 0x024 (System.Int32) // *** dumper miss — use this ***
usedCondition @ 0x028 (System.Single)
contents @ 0x030 (List<Item>)
parentEnt @ 0x038 (System.UInt32)
fuelAmount @ 0x03C (System.Single)
streamerName @ 0x040 (System.String)
onDirty @ 0x048 (System.Action<Item>)
parent @ 0x050 (ItemContainer)
isServer @ 0x058 (System.Boolean)
hasCondition @ 0x059 (System.Boolean)
cachedEntity @ 0x060 (BaseEntity) // *** likely held_entity ***
flags @ 0x070 (Item.Flag)
contentsType? @ 0x078
ammoCount @ 0x080 (System.Nullable<Int32>)
text @ 0x088 (System.String)
keyLock @ 0x090 (System.Nullable<Int32>)
ownerBase @ 0x098 (System.UInt64)
removeTime @ 0x0A0 (System.Single)
info @ 0x0A8 (ItemDefinition) // definition
condition @ 0x0B0 (System.Single)
uid @ 0x0B8 (ItemId) // uid
contents2 @ 0x0C0 (ItemContainer)
contentsRoot @ 0x0C8 (BaseEntity)
worldEntUid @ 0x0D8 (System.UInt64)
busyTime @ 0x0E0 (System.Single)
maxCondition @ 0x0E4 (System.Single)
fuel @ 0x0E8 (System.Single)
raw class: ItemId (instance_fields=1)
Value @ 0x010 (System.UInt64)
raw class: ItemDefinition (instance_fields=62)
itemid @ 0x020
shortname @ 0x028
era @ 0x030
displayName @ 0x040
iconSprite @ 0x050
category @ 0x058
stackable @ 0x078
rarity @ 0x094
condition @ 0x0B8
hidden @ 0x0E0
flags @ 0x0E4
raw class: HeldEntity (instance_fields=33)
item @ 0x1F0 (Item) *** item_owner ***
aim/viewOffset? @ 0x1F8 (Vector3)
worldModelAnimator @ 0x208 (Animator)
thirdPersonDeploySound @ 0x210
thirdPersonAimSound @ 0x218
thirdPersonAimEndSound @ 0x220
hideViewmodel @ 0x228
attachment @ 0x230 (Attachment)
aimStuff (list) @ 0x240
handBone @ 0x250 (System.String)
HoldAnimationOverride @ 0x258
holdInfo @ 0x260 (HeldEntity.HoldInfo)
isBuildingTool @ 0x27C
forcedOwner @ 0x280 (BasePlayer)
holsterInfo @ 0x290
HeldCameraMode @ 0x298
hostileScore @ 0x29C
FirstPersonArmOffset @ 0x2A0
FirstPersonArmRotation @ 0x2AC
FirstPersonRotationStrength @ 0x2B8
AttachmentAnchor @ 0x2C0
viewModel @ 0x2C8 (ViewModel)
ownerItemUID @ 0x2D0 (ItemId)
raw class: BaseProjectile (instance_fields=71)
NoiseRadius @ 0x370
damageScale @ 0x374
distanceScale @ 0x378
projectileVelocityScale @ 0x37C
automatic @ 0x380
usableByTurret @ 0x381
reloadTime @ 0x3C0
canUnloadAmmo @ 0x3C4
primaryMagazine @ 0x3C8
fractionalReload @ 0x3D0
aimSway @ 0x3E8
aimSwaySpeed @ 0x3EC
recoil @ 0x3F0 (RecoilProperties)
aimCone @ 0x400
hipAimCone @ 0x404
aimconePenaltyPerShot @ 0x408
stancePenaltyScale @ 0x418
hasADS @ 0x41C
isBurstWeapon @ 0x427
canChangeFireModes @ 0x428
internalBurstFireRateScale @ 0x430
internalBurstAimConeScale @ 0x434
raw class: RecoilProperties (instance_fields=22)
recoilYawMin @ 0x018
recoilYawMax @ 0x01C
recoilPitchMin @ 0x020
recoilPitchMax @ 0x024
timeToTakeMin @ 0x028
timeToTakeMax @ 0x02C
ADSScale @ 0x030
movementPenalty @ 0x034
clampPitch @ 0x038
pitchCurve @ 0x040
yawCurve @ 0x048
useCurves @ 0x050
shotsUntilMax @ 0x054
maxRecoilRadius @ 0x058
overrideAimconeWithCurve @ 0x05C
aimconeCurveScale @ 0x060
aimconeCurve @ 0x068
aimconeProbabilityCurve @ 0x070
newRecoilOverride @ 0x080
raw class: Model (instance_fields=11)
collision @ 0x020 (SphereCollider)
rootBone @ 0x028 (Transform)
headBone @ 0x030 (Transform)
eyeBone @ 0x038 (Transform)
animator @ 0x040 (Animator)
skeleton @ 0x048 (Facepunch.Skeleton)
boneTransforms @ 0x050 (Transform[])
boneNames @ 0x058 (String[])
raw class: SkinnedMultiMesh (instance_fields=18)
shadowOnly @ 0x020
eyesView @ 0x022
skeleton @ 0x028
skeletonSkinLod @ 0x030
parts @ 0x038 (List<Part>)
renderers? @ 0x050 (List<Renderer>)
partsList2 @ 0x058
SkinCollection @ 0x078 (SkinSetCollection)
not found in dump: PlayerMovement, ModelState, BaseProjectile.Magazine,
BaseProjectile.AmmoTypes, CameraState, ConVar_Graphics,
PlayerVisualState
```
## il2cpp_gchandle_get_target raw bytes
Reference for hand-deriving the handle lookup when Unity shuffles the internal GC handle table.
```text
il2cpp_gchandle_get_target: address=0x7FFD26EAA170 rva=0x83A170
+0x000 E9 6B 74 FD FF CC CC CC CC CC CC CC CC CC CC CC
+0x010 48 83 EC 38 48 89 4C 24 20 48 8D 0D E0 A5 F9 FF
+0x020 48 89 54 24 28 48 8D 54 24 20 E8 61 77 FD FF 48
+0x030 83 C4 38 C3 CC CC CC CC CC CC CC CC CC CC CC CC
+0x040 83 3D 2D 91 8F 0F 00 4C 8B CA 4C 89 02 74 42 49
+0x050 C1 E9 0C 48 8D 0D 56 43 99 0F 41 81 E1 FF FF 1F
+0x060 00 41 8B C1 48 C1 E8 06 41 83 E1 3F 48 8D 14 C1
+0x070 0F 0D 0A 0F 1F 40 00 66 0F 1F 84 00 00 00 00 00
+0x080 48 8B 02 48 8B C8 4C 0F AB C9 F0 48 0F B1 0A 75
+0x090 EF C3
```