AOBMaker v20260917

AOBMaker v20260917

AOBMaker: an AutoAssembler script generator for Cheat Engine (Avalonia UI + CE plugin).

About this release

A bug-fix release, build 150. No new features. The list below is only what you are likely to have run into.

• The CE plugin did not change since v20260910. No need to redeploy AOBMaker_CEPlugin.dll.
• Most fixes are in the generated script text. A script already saved in a .CT keeps the old behavior until you generate it again.

Fixed

• Multiplier (Auto Script) on some lines, such as imul: when the game checks the result w/ a conditional jump right after, the jump could go the wrong way. The script assembled and ran w/o any error.
• Multiplier on a stack value, such as add [rsp+58],eax: when the block saved the flags, it read or changed the stack slot next to the value. The value did not change, and a nearby one did.
• Threshold clamp and Conditional Gate on an adc / sbb line (e.g. the upper half of a 64-bit add in a 32-bit game): the carry flag was not saved, so the game's result could be off by one. The same applies to rep cmps / rep scas lines.
• AA Toggle: unticking the toggle turned off the scripts, but the data groups you had opened under a script stayed on and expanded. The toggle now turns off and folds every group, deepest level first.
• Auto-Refresh Value: after you renamed a mapped record in CE, or w/ Find records by ID unticked, CE could freeze on a large table. The script scanned the whole address list every 500 ms, about 2 seconds per record on a 21,000-record table.
• Multi-Record Apply List: on a large table w/ renumbered record IDs, one double-click could freeze CE for about 2 seconds per column.
• IL2CPP symbols: methods in nested classes showed w/o their outer class (Enumerator.MoveNext instead of List`1+Enumerator.MoveNext), so nested classes w/ the same name could not be told apart.
• AA Migration: a one-line { ... } comment made the tool warn that later labels are undefined and the script would not load. CE loads such scripts fine.

Generate these again: Multiplier, Threshold clamp and Conditional Gate scripts, AA Toggle, Auto-Refresh Value, Multi-Record Apply List.

Limit: on a table w/ ~21,000 records, unticking AA Toggle takes about 2 seconds, because it folds every group.

ℹ️ The code review is still in progress. This release still has known low-priority bugs; they are rare or cosmetic. Fixes continue in the next releases.

⚠ If anything regresses for you, fall back to v20260910.

Setup

• Unzip anywhere. No installer, no runtime to install.
• Run AOBMaker.UI.exe. Unprotected games usually work w/o admin. If attach or memory reads fail, run it as administrator.
• (optional) Copy AOBMaker_CEPlugin.dll into your Cheat Engine folder, then enable it in CE: Settings → Plugins.
• See User-Guide.md in the archive for details.

The exe is unsigned. Windows SmartScreen or antivirus may warn on first run. Double check the download w/ the included .sha256.

AOBMaker v20260910

AOBMaker v20260910

Stability and bug-fix release, build 148. A code review started after v20260813 and is still in progress.
It covers the generator, the scanners, the CE plugin, the pipes, and the Lua tools. This release carries the
fixes found so far. Most of them fix a script, a scan, or a memory write that came out wrong with no warning.

---

Install

Step	Action
1	Unzip anywhere. No installer, no runtime to install.
2	Run AOBMaker.UI.exe as admin. Without it, Windows usually blocks AOBMaker from reading game memory.
3	(optional) Deploy AOBMaker_CEPlugin.dll to your Cheat Engine folder, then add it in CE: Settings → Plugins.

Upgrade from v20260813

Action Item 1: deploy the new AOBMaker_CEPlugin.dll and restart CE. Many plugin fixes (crash paths inside CE,
JSON parsing, symbols, bulk import) need it.
Result: at startup, %LOCALAPPDATA%\AOBMaker\log.txt prints CE plugin, as loaded at its last init: ... below
AOBMaker's own version line. Restart CE first, then start AOBMaker. An old build in that line means CE has not
reloaded the plugin, or the old DLL is still in the CE folder.

Action Item 2: regenerate scripts already saved in your tables. Many fixes are in the generated text.
A script already in a .CT keeps the old behavior until you regenerate it.

Regenerate	Reason
Scripts with Auto Script blocks (Multiplier, Clamp, Field / Threshold clamp, Conditional Gate, Addr Capture, Sibling Write / Copy operand)	Several fixes stop a game crash or a wrong memory write. See Script generation: Auto Script blocks.
Any script with a nop count of 10 or more written without #	CE reads the count as hex. nop 10 wrote 16 bytes and overwrote the next instruction.
Mode C/E/F scripts made through the CE plugin with CE symbols on	An exact symbol was written as a raw address, so the script breaks after the game restarts. Deploy the new plugin first, then regenerate.
Symbol Scanner scripts for a DLL target (e.g. GameAssembly.dll)	The script scanned the main EXE.
Custom Type scripts	[DISABLE] always failed with a Lua error. A Scale typed with a comma (1,5) came out 10x off (15). Scale types also changed registers CE itself relies on.
Auto-Refresh Value, AA Toggle, Multi-Record Apply List	New ID/description cross-check, size and range checks, locale-independent number parsing. Auto-Refresh with a non-ASCII Config Name did not run at all.
Item List scripts for 32-bit games	Pointer slots were read as 8 bytes.
Clamp scripts made on Swedish/Finnish Windows with a negative bound	The minus sign came out as a Unicode minus (−, not -). CE cannot assemble it.

Action Item 3: restore the .bak if CT ID Renumber damaged a table. Earlier builds renumbered hotkey IDs and
rewrote numeric <DropDownListLink> values. Both are fixed.

Reason to upgrade even if nothing above applies: v20260813 shipped graphics libraries that do not match the UI
framework. The same mismatch crashed another app minutes into a session. If v20260813 closed by itself with no
error, this is a likely cause.

Behavior changes:

• Decimal boxes in the main window and Custom Type Scale always use . as the decimal point. On comma-decimal
  Windows, type 1.5, not 1,5. A comma is refused instead of being read as a thousands separator.
• Clamp and Field clamp have a new Signed checkbox (default on). Untick it for unsigned fields (most often byte/word).
• RIP Scan: type a bare module name in the Module box. A full path now shows Process not found.
• Pipe API: GenerateAob and ImportCheatTableXml accept only callers that run as the same user, at the same or
  higher integrity level.

Same as v20260813, now documented:

• After you change Settings Pipe Name, restart AOBMaker. The CE plugin switches to the new name at once, but
  AOBMaker keeps the old one until it restarts, so CE cannot connect in between.
• The Conditional Gate Value box takes decimal (100 means 100), while the Offset box next to it takes hex.
  If you typed a hex value into Value, double check that gate.

---

Fixed issues

Tags: Game crash, CE crash, Memory write (wrote where it should not), Silent (wrong result, no
warning), CE refused (script failed to assemble), Data loss (table or script content lost). Other labels
name the symptom directly.

Script generation: output and Mode D

Before	Now
Memory write. The nop count was written in decimal and CE reads it as hex. Most likely hit: Mode C on a 10+ byte instruction.	Written as nop #10.
Game crash risk. Mode D's "jmp lands mid-instruction" check did not run when the injection line sat at module offset 0 or a pasted line had no address.	The check always runs. Mode D refuses to generate a script that would jump into the middle of an instruction.
Silent. Custom Type Scale typed with a comma (1,5, 3,14) became 15 / 314 on every PC, and the window said "Generated". Scale 0 or Infinity also generated a script. With 0, every value you edited in CE was written to the game as 0.	A comma is refused with a warning. 0, Infinity, and 1e400 stop Generate.
CE refused. Custom Type [DISABLE] failed with '}' expected near 'type' for every kind since the feature shipped. The type stayed registered and the Lua Engine window stayed open.	Fixed. Regenerate the script.
CE crash risk. Custom Type Scale changed registers CE relies on and needed an AVX CPU.	Uses only registers that are safe to change. Runs on any x64 CPU.
Silent. An 8-byte Custom Type Offset lost the upper 32 bits, even when frozen.	Scale / Offset / Mask accept 4-byte fields only.
Silent. The Symbol Scanner script ignored the target module and scanned the main EXE. A DLL target such as GameAssembly.dll found nothing or a wrong address.	Scans the named module. Falls back to the main EXE with a printed message. The CE plugin's copy of this scan needs the new DLL (Action Item 1).
CE refused / Silent. A blank Inject Name gave aobscanmodule(,Game.exe,...). A space or comma in the name silently made two symbols. [ ] + - or a name of only hex digits (CAFE) broke the script. A } in Settings custom author closed the header comment. Non-ASCII custom type names were not valid Lua.	Blank becomes INJECT. Invalid names are refused with the character and position. Author braces become parentheses. Non-ASCII names get a stable suffix.
Varies by PC. Header date and multiplier comments followed regional settings (2026.09.10 on German, Hijri year on ar-SA, value=1,5). Decimal boxes rejected 1.5 on comma-decimal Windows and accepted NaN.	Same text on every PC. . decimal everywhere. Invalid input gets a red border.
False warning. Mode D said the context was "not continuous" when CE symbols crossed a symbol boundary, or "Internal consistency check failed" when one line had no hex bytes. The backward read could also leave the module.	These false warnings are gone. The backward read stops at the module start. A paste with no hex bytes on any line still fails (see Known limits).
Wrong warning. Copy operand said "the copy has no effect" for every xmm destination. Offset Symbols dropped a symbol pair silently when no temp register was free.	Warns only when the overwrite is provable, and names the instruction. Skipped Offset Symbol pairs get a warning.

Script generation: Auto Script blocks

Before	Now
Game crash. Multiplier + Clamp on add eax,5 left out the Clamp block. The stack returned to the game 8 bytes off.	Clamp is emitted after the multiplier. Push and pop balance.
Game crash. Clamp and Multiplier accepted RSP as the value or delta (add rsp,28).	Refused with a reason. [rsp+58] memory operands still work.
Memory write. Multiplier on [rsp+XX] read, and for add [rsp+58],imm wrote, the wrong stack slot after its own push.	Offset adjusted for the push.
Memory write. Sibling Write / Copy operand guessed the width from the mnemonic. movlps copied 16 bytes into an 8-byte field; movdqu copied 4 of 16.	Width comes from the real operand size. Widths it cannot copy are refused.
Memory write. A long patch window that used every XMM scratch register could reuse a live game XMM register.	The feature is skipped with a warning.
Silent. Flags: Clamp restored flags saved before the original instruction. Clamp and Multiplier looked only for a conditional jump in the next 5 instructions and missed setcc / cmovcc / adc / sbb (HP 500 - 120 stored 0 in one real pattern). Conditional Gate and Threshold clamp + Multiplier leaked their compare into the game's branch.	Flags are saved after the original instruction whenever later game code may read them. Gate turns on flag saving automatically, with a warning.
Silent. Clamp bounds that did not fit were cut down: Max 9999 on a byte field clamped at 15. Also bounds past 2^32, float 1e40 → Infinity, NaN, Derived deltas past ±2.1 billion, and fractional Add/Subtract deltas (the UI default 0.5 became 0).	Refused with Clamp: skipped and the allowed range. Covers Clamp, Field clamp, and Threshold clamp.
Silent. Signed compare on unsigned byte/word fields reset 128–255 to Min 0.	New Signed checkbox, plus a warning when the signed compare looks wrong.
Silent. Float fields read as integers: Threshold clamp on movups / vmovups / movupd wrote ~1e-43; a Conditional Gate on the injection's own float field compared raw bits; Addr Capture records showed 10.0 as 1092616192.	Type and width come from the instruction. Unsupported float kinds are refused.
**Silent...

AOBMaker v20260813

AOBMaker v20260813

First release published from this repo. Previous public build was v1.1 (2026-02-13), so this one carries six months of work: 8 new tool windows, full 32-bit target support, and a large batch of code-generation fixes.

Read the shipped User-Guide.html first if you are new. It covers every window.

---

Install

Step	Action
1	Unzip anywhere. No installer, no runtime to install.
2	Run AOBMaker.UI.exe. Run as admin — ReadProcessMemory usually fails on game processes without it.
3	(optional) Copy AOBMaker_CEPlugin.dll into your Cheat Engine folder, then add it in CE: Settings → Plugins.

Upgrade from v1.1

Action Item: deploy the new AOBMaker_CEPlugin.dll. The bridge protocol changed (beforeCount, GetRecordValues, record group field). An old plugin DLL makes the new tools fail or fall back silently.

Note: generated scripts now carry a new attribution URL. Old scripts keep the old one. Nothing breaks — the header is a comment.

---

Highlights

AA code migration — move your hand-written cave code to the new game build

Relocation already found the new injection point. This finishes the job: it takes the AA script you wrote for the old build and rewrites your own cave code for the new one — register map, addressing, scratch registers, push/pop, registersymbol, labels, and declarations that live outside the cave.

Output is a read-only side-by-side diff. It never writes your table. Every changed line gets a // AOBMaker was: <old code> comment above it, so you can review or revert by hand.

Limit: the tool proposes. You decide. Roughly 68% of real cave code needs no register change at all, and the window says so instead of inventing edits.

Multi-Record Apply List — one click writes many records

Drive a list from CSV or Lua. Pick one row inside CE and each column writes its value into a different memory record. Useful for coordinate libraries, preset loadouts, and "apply this whole set" tables.

Values are written typed (writeInteger / writeFloat), so ShowAsHex and a non-English locale cannot silently turn 1000 into 0x1000 or eat a decimal point.

Auto-Refresh Value — keep values pinned by condition

Load a .CT, tick the records you want, set a condition per record (< <= > >= == ~= *), and get a createTimer script that rewrites them. Sources: fixed value, read from an offset, mirror another record, or an interval → set range.

Includes settle gates, a world-pointer anchor pause, min/max guards, and a readability guard so it stops writing when the process is gone. Live current-value preview needs the new plugin DLL.

32-bit (x86) targets

The whole decode / masking / generation pipeline is now bitness-aware, not just x64. Live mode detects the target with IsWow64Process2; offline mode infers it from the pasted text. x86 gets its own register pool, legacy no-REX codegen, SSE fallback for the multiplier, and absolute [disp32] handling as the x86 analogue of RIP-relative.

Limit: IL2CPP GameAssembly.dll parsing stays PE64-only. 32-bit IL2CPP games fall back to a plain aobscan.

Unity IL2CPP support

• Resolves the injection point to its managed method by parsing global-metadata.dat + GameAssembly.dll directly — no injected collector.
• The AOB scan is then bounded to that one method with aobscanregion instead of scanning the whole module. Faster, far fewer collisions.
• IL2CPP Browser — filter methods (RVA, namespace, type, token) and instance fields (offset, kind, type). Generate symbol scripts, dumps, or a paste-in field-offset define block from the selection.
• Metadata and GameAssembly.dll paths auto-detect. Verified on Unity 2019.4 → 6.1, metadata v24 → v39.

---

New windows

Window	Purpose
AA Migration	Rewrite your hand-written cave code for a new game build. Read-only diff.
Multi-Record Apply List	CSV/Lua-driven list inside CE. One row writes many records.
Auto-Refresh Value	Timer script that pins values by condition.
AA Toggle Generator	One master switch. Enables ticked records shallowest-first, disables everything deepest-first.
Cheat List	Distils a whole table into a forum-ready checklist. A 10,000-node table becomes ~20 lines.
CT ID Renumber	Renumbers <ID> sequentially and follows the references. Writes in place after a timestamped .bak.
IL2CPP Browser	Browse methods and field offsets from the game's own metadata.
Custom Display Type	Emits registerCustomTypeAutoAssembler — Scale / Offset / Mask / .NET decimal, with the matching write-back routine.

Script generation

New Auto Script blocks, all combinable, all emitted before the relocated original instruction so they can inspect and change the value it is about to use:

• Conditional Gate — gate the whole patch on a runtime memory condition, with an optional editable threshold, on/off flag, and flag preservation.
• Address Capture — capture a runtime pointer into a registersymbol. Single, or List mode with Dedup / Ring / Keyed strategies and capture-once latching.
• Pointer Chain — walk a multi-level deref chain at inject time with per-hop null guards, capture the leaf.
• Clamp — bounds may now be derived at runtime from a sibling field (e.g. min = 0.5 × maxHP), clamp several sibling fields in one block, or sit behind a runtime-tunable threshold.
• Copy Operand — sibling write generalized to a source/destination operand matrix.
• Teleport — save/restore up to three offsets (classic X/Y/Z).
• Multiplier — packed SIMD friend/foe (one vmulps computes both lanes, the branch only selects), directional packed multiplier, 3-address lea coverage, and RMW delta discrimination so the multiplier scales the actual delta instead of the base value it happened to read.

Other generation changes:

• Full-subroutine ORIGINAL CODE comment — optional. Resolves the whole routine from its .pdata entry using Iced instead of walking CE backwards, so it no longer crashes CE on deep walks.
• Generated comments follow the UI language — English, 繁體中文, 日本語.
• Export-symbol anchoring — Module.export+offset input now anchors an aobscanregion scoped to that export.
• Nibble AOB syntax — the offline readers now accept 4? / ?A patterns that the live scanner already understood, so third-party tables stop being rejected as syntax errors.

Scanner

• Sequence Scan — optional auto type detection (read once, scan many) and order-independent matching. Recompose on parameter change without rescanning memory.
• AC-safe mode — Denuvo and similar return zeroed buffers for concurrent ReadProcessMemory. AC-safe serializes to single-threaded 64 KB reads: ~17× slower, but the results are real.
• RIP Reference Scanner — six defects fixed that reported instruction starts one byte early. Now also scans absolute [disp32] on x86.

Cheat Engine plugin

• GetRecordValues — batch-resolves record values by CE <ID> for the live preview.
• CreateAAScript takes an optional group so new records land in the right node.
• DisassembleRange reports beforeCount, so a symbolized window places INJECTING HERE on the right line.
• Fixed a stack over-read in FormatCELine and an unchecked read that turned a paged-out page into a well-formed line of all-00 bytes — those bytes could get baked straight into an AOB.
• Capped the backward walks that crashed CE.

Fixes worth knowing

Area	Issue
Mode D	Symbolized CE windows produced AOBs that matched 0 results. Rebuilt from the injection point and cross-checked byte-level.
Codegen	Indexed operands dropped index*scale; RSP was read after a push without adjustment; a 256-bit ymm was saved as 128-bit. All three silently miscompute.
Codegen	[allocSymbol+reg*scale] truncated to an absolute disp32 and crashed the game. Now emits mov gpr, symbol first.
Relocation	Proximity merge dropped the true injection point. Result cap raised 20 → 50 — half the "truth absent" cases were just cut off.
Scanner	Sequence first-scan silently dropped sparse hits during merge.
Mode C	nop N is now emitted with correct byte semantics, and position-dependent bytes restore via readmem, not hardcoded db.
AA Toggle	CE's sleep() rides a ~15.6 ms scheduler tick. The UI now shows the real pause instead of the number you typed, and the script no longer freezes CE.

Known limits

• Windows x64 only. The tool itself is x64; it targets both x64 and x86 games.
• Offline AOB is not guaranteed unique. Use Mode D (needs a live process) when you need uniqueness.
• 32-bit IL2CPP is not supported — by design.
• Scanner has no hardware breakpoints. It never touches Debug APIs, so it leaves no AC trace, at the cost of not seeing dynamic references.
• CT XML import covers a modeled field subset. DropDownList, ZeroTerminate, CodePage, and Color are dropped on import.

Verify your download

The release ships a .sha256 next to the archive.

Get-FileHash .\AOBMaker-v20260813-win-x64.zip -Algorithm SHA256

---

Built with .NET 10 Native AOT. Single EXE, no runtime dependency.