AOBMaker v20260813

First release published from this repo. Previous public build was v1.1 (2026-02-13),
so this one carries six months of work: 8 new tool windows, full 32-bit target support,
and a large batch of code-generation fixes.

Read the shipped User-Guide.html first if you are new. It covers every window.

Install

Upgrade from v1.1

Action Item: deploy the new AOBMaker_CEPlugin.dll. The bridge protocol changed
(beforeCount, GetRecordValues, record group field). An old plugin DLL makes the new
tools fail or fall back silently.

Note: generated scripts now carry a new attribution URL. Old scripts keep the old
one. Nothing breaks — the header is a comment.

Highlights

AA code migration — move your hand-written cave code to the new game build

Relocation already found the new injection point. This finishes the job: it takes the AA
script you wrote for the old build and rewrites your own cave code for the new one —
register map, addressing, scratch registers, push/pop, registersymbol, labels, and
declarations that live outside the cave.

Output is a read-only side-by-side diff. It never writes your table. Every changed
line gets a // AOBMaker was: <old code> comment above it, so you can review or revert
by hand.

Limit: the tool proposes. You decide. Roughly 68% of real cave code needs no register
change at all, and the window says so instead of inventing edits.

Multi-Record Apply List — one click writes many records

Drive a list from CSV or Lua. Pick one row inside CE and each column writes its value
into a different memory record. Useful for coordinate libraries, preset loadouts, and
"apply this whole set" tables.

Values are written typed (writeInteger / writeFloat), so ShowAsHex and a non-English
locale cannot silently turn 1000 into 0x1000 or eat a decimal point.

Auto-Refresh Value — keep values pinned by condition

Load a .CT, tick the records you want, set a condition per record (< <= > >=
== ~= *), and get a createTimer script that rewrites them. Sources: fixed value,
read from an offset, mirror another record, or an interval → set range.

Includes settle gates, a world-pointer anchor pause, min/max guards, and a readability
guard so it stops writing when the process is gone. Live current-value preview needs the
new plugin DLL.

32-bit (x86) targets

The whole decode / masking / generation pipeline is now bitness-aware, not just x64.
Live mode detects the target with IsWow64Process2; offline mode infers it from the
pasted text. x86 gets its own register pool, legacy no-REX codegen, SSE fallback for the
multiplier, and absolute [disp32] handling as the x86 analogue of RIP-relative.

Limit: IL2CPP GameAssembly.dll parsing stays PE64-only. 32-bit IL2CPP games fall back
to a plain aobscan.

Unity IL2CPP support

• Resolves the injection point to its managed method by parsing global-metadata.dat +
  GameAssembly.dll directly — no injected collector.
• The AOB scan is then bounded to that one method with aobscanregion instead of scanning
  the whole module. Faster, far fewer collisions.
• IL2CPP Browser — filter methods (RVA, namespace, type, token) and instance fields
  (offset, kind, type). Generate symbol scripts, dumps, or a paste-in field-offset define
  block from the selection.
• Metadata and GameAssembly.dll paths auto-detect. Verified on Unity 2019.4 → 6.1,
  metadata v24 → v39.

New windows

Script generation

New Auto Script blocks, all combinable, all emitted before the relocated original
instruction so they can inspect and change the value it is about to use:

• Conditional Gate — gate the whole patch on a runtime memory condition, with an
  optional editable threshold, on/off flag, and flag preservation.
• Address Capture — capture a runtime pointer into a registersymbol. Single, or
  List mode with Dedup / Ring / Keyed strategies and capture-once latching.
• Pointer Chain — walk a multi-level deref chain at inject time with per-hop null
  guards, capture the leaf.
• Clamp — bounds may now be derived at runtime from a sibling field
  (e.g. min = 0.5 × maxHP), clamp several sibling fields in one block, or sit behind a
  runtime-tunable threshold.
• Copy Operand — sibling write generalized to a source/destination operand matrix.
• Teleport — save/restore up to three offsets (classic X/Y/Z).
• Multiplier — packed SIMD friend/foe (one vmulps computes both lanes, the branch
  only selects), directional packed multiplier, 3-address lea coverage, and RMW delta
  discrimination so the multiplier scales the actual delta instead of the base value it
  happened to read.

Other generation changes:

• Full-subroutine ORIGINAL CODE comment — optional. Resolves the whole routine from
  its .pdata entry using Iced instead of walking CE backwards, so it no longer crashes
  CE on deep walks.
• Generated comments follow the UI language — English, 繁體中文, 日本語.
• Export-symbol anchoring — Module.export+offset input now anchors an
  aobscanregion scoped to that export.
• Nibble AOB syntax — the offline readers now accept 4? / ?A patterns that the
  live scanner already understood, so third-party tables stop being rejected as syntax
  errors.

Scanner

• Sequence Scan — optional auto type detection (read once, scan many) and
  order-independent matching. Recompose on parameter change without rescanning memory.
• AC-safe mode — Denuvo and similar return zeroed buffers for concurrent
  ReadProcessMemory. AC-safe serializes to single-threaded 64 KB reads: ~17× slower,
  but the results are real.
• RIP Reference Scanner — six defects fixed that reported instruction starts one byte
  early. Now also scans absolute [disp32] on x86.

Cheat Engine plugin

• GetRecordValues — batch-resolves record values by CE <ID> for the live preview.
• CreateAAScript takes an optional group so new records land in the right node.
• DisassembleRange reports beforeCount, so a symbolized window places
  INJECTING HERE on the right line.
• Fixed a stack over-read in FormatCELine and an unchecked read that turned a
  paged-out page into a well-formed line of all-00 bytes — those bytes could get baked
  straight into an AOB.
• Capped the backward walks that crashed CE.

Fixes worth knowing

Known limits

• Windows x64 only. The tool itself is x64; it targets both x64 and x86 games.
• Offline AOB is not guaranteed unique. Use Mode D (needs a live process) when you
  need uniqueness.
• 32-bit IL2CPP is not supported — by design.
• Scanner has no hardware breakpoints. It never touches Debug APIs, so it leaves no
  AC trace, at the cost of not seeing dynamic references.
• CT XML import covers a modeled field subset. DropDownList, ZeroTerminate, CodePage,
  and Color are dropped on import.

Verify your download

The release ships a .sha256 next to the archive.

Get-FileHash .\AOBMaker-v20260813-win-x64.zip -Algorithm SHA256

Built with .NET 10 Native AOT. Single EXE, no runtime dependency.