// ac_addrs.h — EoR acclient.exe addresses used by leakfix.dll // Verified against acclient.exe v0.0.11.6096 EoR (Jan 2017). #pragma once #include namespace ac { // ===== v3b — palette over-increment NOP ===== constexpr uintptr_t V3B_SITE_1 = 0x0053EFFE; // inc dword [ecx+24] -> NOP NOP NOP constexpr uintptr_t V3B_SITE_2 = 0x0053F19C; // inc dword [esi+24] -> NOP NOP NOP // ===== v5 — RenderSurface/Texture PurgeResource override ===== constexpr uintptr_t V5_RS_VTABLE_SLOT_2 = 0x0079A684; // RenderSurface vtable +0x08 constexpr uintptr_t V5_RT_VTABLE_SLOT_2 = 0x0079C1A0; // RenderTexture vtable +0x08 constexpr uintptr_t V5_NOOP_STUB_VA = 0x004154A0; // expected original (mov al,1; ret) constexpr uintptr_t V5_RS_DESTROY_VA = 0x00444540; // RenderSurface::Destroy constexpr uintptr_t V5_RT_DESTROY_VA = 0x0044C4F0; // RenderTexture::Destroy // ===== v11 — NULL-check guards ===== constexpr uintptr_t V11_SITE_1_VA = 0x00587126; // delete_contents JMP retarget constexpr uintptr_t V11_SITE_2_VA = 0x005E565D; // ~GXTri3Mesh slot 0 NULL-check // ===== v12 — unpacker validator + dispatch redirect ===== constexpr uintptr_t V12_VALIDATOR_VA = 0x00526A45; // overwrite 11-NOP pad + 18 bytes constexpr uintptr_t V12_DISPATCH_VA = 0x007C92C8; // dispatch table entry (4 bytes) constexpr uintptr_t V12_OLD_FUNC_VA = 0x00526A50; // original unpacker entry // Dispatch points at validator (V12_VALIDATOR_VA) instead // ===== v14 — CEnvCell::Destroy ClipPlaneList leak ===== constexpr uintptr_t V14_PATCH_SITE_VA = 0x0052E661; // 18-byte leak block constexpr uintptr_t V14_RESUME_VA = 0x0052E673; // continue here after thunk constexpr uintptr_t V14_CLIPPLANELIST_DTOR = 0x0053C760; // ClipPlaneList::~ClipPlaneList constexpr uintptr_t V14_OPERATOR_DELETE = 0x005DF15E; // operator delete constexpr uintptr_t V14_OPERATOR_DELETE_ARR = 0x005DF164; // operator delete[] } // namespace ac