CESuite v0.3.2

CESuite 0.3.2 — Evidence Advisor

CESuite 0.3.2 adds a deterministic, read-only Evidence Advisor for understanding
what changed between two Evidence Snapshots.

Highlights

• Explain Comparison... in the existing Evidence Snapshots submenu.
• Read-only findings with Overview, Findings, Observed Evidence, Evidence
  References, Interpretation, Possible causes, Suggested Next Steps, Do Not
  Assume, Limitations and Rule trace.
• Evidence and interpretation remain separate. Observations are never
  promoted to guesses.
• Deterministic report identity from the input evidence and ruleset.
• Neutral comparison semantics: unchanged, added, removed, changed, unknown
  and not comparable; no compatibility or repair verdict.
• Safe native snapshot selection: snapshot A is captured and validated before
  snapshot B is selected; cancel and read failures leave no stale comparison.
• No automatic repair, relocation candidate generation, table mutation,
  record activation or memory write.

Validation

• Native Windows dialog selection: CLOSED BY LIVE HUMAN VALIDATION
  (forward/reverse selection, repeat determinism and self-comparison).
• GUI viewer rapid lifecycle: CLOSED BY LIVE HUMAN VALIDATION
  (approximately 15 open/close cycles).

Limitations

• The Advisor describes observed evidence, not ground truth.
• Validation may be unavailable; that is reported literally.
• Partial comparisons only use strong candidate identities.
• Address Evidence remains outside the Advisor's v0.3.2 scope.
• REQUEST_RELOCATION_CANDIDATES is a review recommendation only.

Implementation, review, testing and documentation were AI-assisted. Final
technical decisions and validation remain under user control.

CESuite v0.3.1 — Evidence Snapshots

CESuite 0.3.1 — Evidence Snapshots

CESuite 0.3.1 adds a read-only Evidence Snapshot Viewer for preserving what
CESuite currently knows and comparing that evidence later.

Highlights

• Capture Snapshot: capture current table/script evidence into a versioned
  JSON snapshot.
• Open Snapshot: inspect a snapshot in a read-only, sectioned viewer.
• Compare Snapshots: compare two snapshots with neutral classifications.
• Deterministic identity: source and target fingerprints plus a stable
  snapshot_id; timestamps, PID, timings and ASLR bases are not identity.
• Evidence preserved: coverage (collection, discovery, validation),
  candidates, provenance, dependencies, unresolved entries and limitations are
  stored as observed.
• Safe bounded storage: 8 MiB limit, bounded JSON decoder, temporary-file
  promotion, overwrite preservation and explicit corruption errors.
• Privacy-aware: provider/helper paths, condition dependencies, limitations
  and target/module names are sanitized; absolute paths and PID are not stored as
  identity.
• Read-only: snapshots and the viewer never activate records, modify the
  table, write memory, patch scripts or execute snapshot content.

Comparison semantics

Differences are evidence changes, not verdicts. The viewer uses only:

unchanged, added, removed, changed, unknown, not comparable

It does not claim a table is working, broken, compatible, repaired or fixed.
Validation is reported only from actual AOB scan results; static analysis and
wrapper resolution are never promoted to runtime validation.

Limitations

• Snapshots describe observed evidence, not ground truth or compatibility.
• Static source fingerprints cover the captured surface; unobserved source is
  unknown.
• Target build identity may be unavailable; modules are not identified by ASLR
  base.
• Comparison across changed source is partial and limited to strong candidate
  identities.
• The viewer is a read-only sectioned memo; it is not a repair or rollback tool.

CESuite v0.3.0

CESuite 0.3.0 — Release Notes (Draft)

CESuite 0.3.0 adds read-only analysis of Lua tables used to construct AOB scan
definitions, together with explicit coverage reporting and a reproducible
regression corpus.

Highlights

• Dynamic Lua/table analysis: local tables, nested rows, wrapper contracts,
  conditional candidates, symbol-only rows and multi-provenance edges.
• Provenance: candidates retain source script, line, consumer, wrapper,
  helper/provider and resolution status.
• Coverage model: collection, discovery and validation are reported as
  separate dimensions with explicit denominators.
• Runtime validation honesty: only a unique observed AOB scan increments
  runtime_validated; static resolution and wrapper contracts never do.
• Reporting: Coverage Summary and Discovered Candidates in the Simple
  Report, with matching coverage and dynamic analysis in the Extensive JSON.
• Regression corpus: minimized fixtures for script-95, callbacks, loaders,
  constructed AA, duplicates, scope, limits, coverage and runtime replay.
• Fail-closed limits: parse, table, edge and candidate limits propagate to
  limit_reached; percentages remain null.

Compatibility

core_version remains 0.1.9; suite_version is 0.3.0. Existing Address
Evidence, operation telemetry and report schemas remain additively compatible.

Limitations

• Static analysis does not execute Lua, evaluate callbacks or prove runtime
  behavior.
• Dynamic discovery is limited to the captured table/script source and to
  supported syntax; unsupported constructs stay unresolved or unavailable.
• Validation is unavailable when no runtime scan is attempted, including
  detached targets and static-only analysis.
• No compatibility, correctness, ownership or restore-safety claim is made.
• No complete address-space coverage is claimed; CE-readable memory may be
  incomplete.

CESuite v0.2.3

CESuite v0.2.3 — Performance & Operation Diagnostics

Added

• Optional structured operation telemetry for runtime and Static Lua reports.
• Operation status: complete, partial, cancelled, failed, or unavailable.
• Source completeness tracking.
• Parse, scan, and export timing.
• Processed item and byte counters.
• Structured operational warnings.
• Neutral Operation Summary in Diagnostics Summary.

Reliability

• Runtime completeness now requires a proven live target and complete planned work.
• Stale process IDs no longer count as proof of an attached target.
• Detached or unavailable runtime sources fail closed with source_complete=false.
• Export timing remains outside the file being measured to avoid circular reporting.
• Timing collection degrades safely when a preferred clock is unavailable.

Compatibility

• Operation telemetry is optional and backward-compatible.
• Address Evidence remains evidence-only and does not embed performance telemetry.
• Core compatibility level remains 0.1.9.

Validation

• 371 automated checks passed with 0 failures and 0 skips.
• Live validation completed on Cheat Engine 7.72.
• Attached telemetry, export telemetry, overwrite cancellation, and detached-target handling were validated live.
• Release artifacts were independently audited and reproducibly built.

CESuite v0.2.2

CESuite v0.2.2 — Address Evidence Inspector

Added

• Address Evidence Inspector for read-only inspection of a single address.
• Module + RVA evidence and bounded memory-region metadata.
• Conservative byte inspection with a maximum of 64 bytes.
• Whitelist-based x86/x64 instruction decoding.
• Memory operand and stack-reference evidence.
• Effective-address calculation only when it can be derived without runtime register state.
• Advisory Float/Double evidence for supported scalar SSE/x87 instructions.
• Separate address-evidence.schema.json.
• JSON copy/export for Address Evidence.

Improved

• CESuite menu organization with native Cheat Engine 7.72 icons and graceful text-only fallback on unvalidated versions.
• Detached/stale-target detection now fails closed instead of treating cached process metadata as live evidence.

Safety / Evidence Model

• Observation-only.
• No memory writes.
• No breakpoints or watchpoints.
• No table mutation.
• No automatic patching or repair.
• Static and unavailable evidence is never promoted to observed runtime evidence.

Validation

• 352 automated checks passed with 0 failures and 0 skips.
• Live validation performed with Cheat Engine 7.72.
• Release artifacts independently audited and reproducibly built.

CESuite v0.2.1

CESuite v0.2.1 — Reporting & Repair Guidance

CESuite v0.2.1 introduces an evidence-driven diagnostic layer designed to help explain what appears to have broken in a Cheat Engine table, what evidence supports that conclusion, and what should be investigated next.

Highlights

• New diagnostic assessment model derived from existing CESuite evidence.
• New Diagnostics Summary view.
• New paired Export Reports workflow.
• Simple Report in Markdown.
• Extensive JSON report preserving full structured evidence.
• Evidence-driven Suggested Repair Path.
• Deterministic diagnostic prioritization.
• Explicit severity, status, confidence and provenance semantics.
• Existing runtime and static-analysis exports remain available.

Diagnostic coverage

The new assessment layer can identify or classify evidence related to:

• target/process state;
• module availability and ambiguity;
• missing, unique and ambiguous AOB results;
• incomplete, unsupported or invalidated AOB scans;
• unresolved lexical dependencies;
• Static Lua candidates and analysis limitations;
• situations where available evidence is insufficient to recommend a repair step.

Static and lexical observations remain clearly separated from runtime-verified evidence. Static candidates are never promoted to runtime observations without supporting runtime evidence.

Repair guidance

CESuite can now generate a deterministic Suggested Repair Path based on collected evidence.

Repair guidance is intentionally conservative:

• CESuite does not automatically modify AOBs.
• CESuite does not rewrite scripts or offsets.
• CESuite does not patch target memory.
• Recommendations describe what should be investigated next rather than claiming an automatic fix.

Reporting

Diagnostics Summary provides a concise view of detected problems, advisories, healthy observations and suggested investigation order.

Export Reports creates a matched pair from the same evidence collection:

• <base>_Simple.md
• <base>_Extensive.json

The paired export uses temporary files, backups and rollback handling to avoid leaving mixed old/new report pairs after normal failure paths.

Compatibility

• suite_version: 0.2.1
• core_version: 0.1.9

The diagnostic assessment is additive and existing runtime report compatibility is preserved.

Validation

CESuite v0.2.1 completed:

• 284 automated checks
• 0 failures
• 0 unexpected skips
• reproducible byte-identical builds
• live smoke validation with Cheat Engine 7.72 64-bit on Windows 11
• final corrected release bytes tested in live CE
• detached and limited attached report generation
• runtime schema validation with 0 violations

Release assets

CESuite_Autorun_v0.2.1.zip
Size: 156804 bytes
SHA-256:
9601B5E5F7EFA71DA3E09931388E23360E2B942F29140E9842B2D17AE438C00D

CESuite_Core_v0.2.1.CT
Size: 143746 bytes
SHA-256:
3EE702F54416294A86FF325B075D1B10A15EF3A3897FF198C6835BFF3F31F89C

Project

CESuite is authored by doc-haz (formerly dokkoriax).

AI-assisted development was performed under operator instruction and review. Final technical and release decisions remain with the project maintainer.

Released under the Apache License 2.0.

CESuite v0.2.0

CESuite v0.2.0

CESuite v0.2.0 is a stable release adding offline and in-CE static Lua analysis, standalone schema validation, enriched report generation and license updates.

Highlights

• Static Lua AOB Analysis: Passive lexical extraction of AOB scan patterns from embedded Lua scripts, Auto Assembler {$lua} blocks, unlinked library declarations (*.Sig), and table files (Files/*.lua Base85/DEFLATE). Supported scan sinks include aobScan, aobScanModule, aobScanRegion, customScan, Register.multiCustomScan, and Register.onEnable.
• Export Static Lua Report: Standalone report generation conforming to the formal schemas/static-lua-report.schema.json specification.
• Enriched Reporting: Merges static Lua candidate observations with runtime memory inspection evidence, preserving distinct provenance without overwriting runtime fields.
• Strict Evidence Separation: Guarantees clear boundaries between static lexical source candidates (provenance: static-lua, confidence: lexical, uniqueness: unverified) and runtime-scanned evidence. Inspects code passably without execution.
• Version Alignment: Sets suite_version to 0.2.0 while maintaining core_version at 0.1.9 for runtime schema compatibility.
• License: Released under the Apache License, Version 2.0.

Validation

• Automated Test Suite: 237 automated regression checks passing (0 skips, 0 failures) across runtime contracts, module dumping, distribution isolation, parser parity, static Lua parity, and standalone schema validation.
• Live Verification: Validated in Cheat Engine 7.72 64-bit under Windows 11. Attached testing is documented as a limited attached smoke test against the Cheat Engine host process.

Release Assets

Asset	Size (bytes)	SHA-256
CESuite_Autorun_v0.2.0.zip	103,053	97B64F1DEBBE72F867DE9A5AB2EAEFC9E02C029BAD12A11B6A65EC14CD27655A
CESuite_Core_v0.2.0.CT	90,008	D42DAEC7DFCA5C55B2FC4087F4AA92BFAF0D21018B0CF6F6483111B93605DF7B

Installation

• Autorun (persistent): Extract CESuite_Autorun_v0.2.0.zip directly into your Cheat Engine autorun\ directory and restart Cheat Engine.
• Portable CT: Open CESuite_Core_v0.2.0.CT directly in Cheat Engine before opening your target table.

CESuite v0.2.0-beta1

CESuite v0.2.0-beta1

CESuite v0.2.0-beta1 introduces passive, bounded static Lua AOB inventory in both runtime distributions (Autorun and Core CT) and the offline CT Analyzer.

Inspected Lua scripts are analyzed purely at the lexical and AST level without executing code, activating cheats, or calling target scan APIs.

Highlights

• Static Lua AOB Analysis: Extracts supported literal assignments, concatenation, tables, and unlinked library declarations from table Lua scripts without executing code.
• Enriched Runtime Reports: Export enriched reports containing a separate static_lua_analysis section alongside unchanged memory-verified runtime observations.
• Strict Parity: Dual implementation in pure Lua 5.3 and Python with verified behavioral equivalence across supported patterns.
• Deterministic Artifacts: Independent reproducible builds for autorun zip and core table distributions.

Artifacts and Verification

File	Size (bytes)	SHA-256
CESuite_Autorun_v0.2.0-beta1.zip	91,522	839498ABF50846627BB43841F1FBD18431537ABB2FE15AD2D9E7449A9BFCBFE2
CESuite_Core_v0.2.0-beta1.CT	89,904	4C698116F9E1C07C5987A1C1C4935F60C33E52B645060E8957AFECC8A477E99E

Documentation

• Static Lua Analysis Guide
• Runtime Reference

CESuite v0.1.9.1

CESuite v0.1.9.1 is a small naming and documentation hotfix.

Changes

• Renamed the user-facing Export ChatGPT Report action to Export Analysis Report.
• Updated documentation to describe the report as vendor-neutral structured evidence suitable for:
  • manual review
  • advanced users
  • AI-assisted analysis
  • external tooling
  • debugging and porting workflows
• Updated installation documentation for v0.1.9.1.

Compatibility

No report schema, JSON structure or runtime analysis behavior changed.

CESuite_Runtime_Report.json remains unchanged.

The exported report contract remains compatible with v0.1.9.

Validation

• 185 automated checks passed
• 0 skips
• 0 failures
• reproducible build confirmed
• exported runtime report verified byte-identical to v0.1.9 under identical inputs

Downloads and SHA-256

File	SHA-256
CESuite_Autorun_v0.1.9.1.zip	3B951FE6B335A909E4132E56894720F707B7B53273DA711834BEE09AE477BE69
CESuite_Core_v0.1.9.1.CT	EE285E2C098BF085F9744347BB764460FB0581506FF5E6128C5C111753B64456
CESuite_Core.CT	EE285E2C098BF085F9744347BB764460FB0581506FF5E6128C5C111753B64456
CESuite_Core.lua	4916618D2D32CDACD831CE69FD928DBE6753177A533F5668A4370FC66AFF9C97

CESuite v0.1.9

CESuite v0.1.9 consolidates the new Module Dump workflow, improves export safety and responsiveness, and closes the remaining P0 parser/runtime issues identified during pre-release validation.

Changes

Module Dump

• Added Export Module Dump for loaded PE modules.
• Exports mapped process memory directly from the attached target.
• Writes a binary dump plus a JSON metadata sidecar.
• Uses bounded reads and does not fabricate zero-filled data when memory cannot be read.
• Incomplete or cancelled exports are preserved as .partial.
• Dump metadata records:
  • module name and path
  • process ID
  • module base
  • expected size
  • bytes written
  • completion status
  • unreadable ranges
  • timestamps
  • cancellation/error information
• Module dumps are explicitly marked as:
  • layout: mapped_image
  • atomic_snapshot: false
  • binary_fingerprint: null

A module dump is a mapped image of process memory, not a reconstruction of the original executable on disk.

Progress and cancellation

• Added visible progress for large module exports.
• Progress displays transferred MiB and percentage.
• The UI remains responsive during export.
• Added Cancel support.
• Closing the progress window with X safely requests cancellation.
• Cancelled exports retain readable partial output and metadata instead of silently discarding work.

Safer overwrite handling

• Existing dump outputs are no longer overwritten silently.
• CESuite now asks for confirmation before replacing existing files.
• Rejecting or closing the overwrite dialog keeps existing files unchanged.
• Confirmed overwrite preserves previous outputs using:
  • .previous
  • .previous.1
  • .previous.2
  • and so on
• The new JSON sidecar records preserved files in previous_files.
• Backup collisions are handled without overwriting earlier backups.

Busy-operation protection

• CESuite rejects overlapping protected operations while another analysis/export operation is active.
• The runtime returns cleanly to normal state after completion or cancellation.

Parser and evidence handling

• Improved conservative handling of dynamic or incomplete {$luacode} regions.

• Conditional/opaque regions are no longer interpreted as if their branch were known.

• Section provenance can now be recorded as:

  section: "unknown"

• Added SECTION-INDETERMINATE diagnostics for unresolved section provenance.

• Explicit unmasked [ENABLE] / [DISABLE] headers restore known section state.

• Lua/RVA candidates, resources, AOBs and dependency evidence preserve unknown provenance where applicable.

• Empty module queries are rejected instead of resolving arbitrary modules.

• Ambiguous module resolution now fails closed rather than selecting the first matching module.

• Lua and Python parser behavior remains aligned through parity tests.

Validation

The v0.1.9 release candidate passed:

• 185 automated checks
• 0 skips
• 0 failures

Coverage includes:

• Core Lua runtime tests
• Module Dump tests
• distribution tests
• replay harness tests
• Lua/Python parser parity
• analyzer tests
• runtime/schema contract tests

Build outputs were reproduced with identical SHA-256 hashes.

Live validation

Live Cheat Engine validation covered:

• clean autorun installation and cold restart
• portable CT loading
• singleton / duplicate-load protection
• Analyze Current Process
• complete module export
• large-module progress and responsive UI
• cancellation with retained .partial output
• progress-window close handling
• SaveDialog cancel/close behavior
• overwrite rejection
• overwrite confirmation
• .previous backup creation
• .previous.N collision handling
• previous_files metadata
• busy-operation protection
• paths containing spaces
• normal recovery after cancellation and dialogs

A complete small-module export produced:

• 692224 / 692224 bytes
• status: complete
• no unreadable ranges

Large-module cancellation was also validated on a 461701120-byte module, retaining 88080384 bytes of partial output with:

cancelled: true

Limitations

• Module exports are not atomic snapshots.
• mapped_image output does not reconstruct the original PE file from disk.
• Process memory may contain relocations, runtime modifications or active hooks.
• A unique AOB result does not guarantee compatibility across builds.
• CESuite performs conservative lexical analysis; it is not a complete AA/Lua interpreter.
• Unsupported or ambiguous constructs remain unresolved rather than being guessed.
• CESuite does not automatically repair or port Cheat Tables.

Follow-up work

Planned nonblocking follow-ups include:

• cleaner user-facing module-dump error strings
• temporary output handling for standalone test runs
• additional documentation cleanup
• explicit documentation/diagnostics for the remaining R-1 parser edge case
• live validation with real homonymous modules
• a complete large-module export with measured duration
• private Dawnwalker replay revalidation when the original input is available

Downloads and SHA-256

The versioned ZIP and CT are attached as release assets. They are not included in the tag's source archive.

File	SHA-256
CESuite_Autorun_v0.1.9.zip	F681B9EFF594CEEBBFC789349DB540EF23C4C415F346434FB1483461F6914934
CESuite_Core_v0.1.9.CT	2440C9381B8BCFC089CCB7521D22C10997B7D8D240BD688483AAA118AABBDCC2
CESuite_Core.CT (generic bundle)	2440C9381B8BCFC089CCB7521D22C10997B7D8D240BD688483AAA118AABBDCC2
CESuite_Core.lua (generic bundle)	4322F63987A3801A441909C4FD6AC1DC8BD09B0C0EE76E01E35C5C8284C21D01