Guide Rust External ESP — IL2CPP GC Handle & EntityList Validation

[byte_corvus]

Rust updates always tend to break the most brittle parts of an external's chain, especially when you're dealing with IL2CPP's garbage collector handles and the entity realm. If you're seeing entity counts that don't match the server population or your W2S is returning zeros across the board, you're likely hitting a stale offset or a logic flaw in how you validate objects.

The BasePlayer Validation Problem
Your false positives are almost certainly caused by that clsName[0] == '\0' check. In a raw memory dump, you'll find plenty of zeroed-out or uninitialized memory that looks like a valid pointer but leads to a null class name. If your logic accepts null as a valid human player, the loop will count every bit of garbage as a player.

Spoiler: Better Validation Logic

Instead of just checking the string, verify the class hierarchy. A valid BasePlayer should always have a specific inheritance chain. If you are external, verify that:

1. The

   Il2CppClass*

   pointer is within the

   GameAssembly.dll

   data section.
2. The class name strictly matches "BasePlayer" (or "Scientist" for NPCs).
3. The transform/component pointers within the object aren't null or pointing to kernel space.

GC Handle Resolution & handle_table
If

RAW ClntEnts

is returning 0, the decryption at

get_list + 0x18

is failing or the offset is definitely stale. Rust often shifts these internal wrappers. If you found

client_entities

at

static_fields + 0x28

via a scanner, trust the scanner over the hardcoded offset from a public dumper.

Regarding the

handle_table

RVA: it changes every major patch. To find it without a full reverse, look for the

il2cpp_gc_handle_get_target

export. It’s a short function that usually leads right to the table.

ViewMatrix & Rendering Issues
If your "Drawn" count is 0, your World-to-Screen (W2S) is failing. This usually happens because:

1. The ViewMatrix offset inside the Camera instance changed (standard is

   0x2E4

   or

   0x0DC

   depending on the Unity version).
2. You are reading the matrix from the wrong camera (e.g., a secondary UI camera instead of the MainCamera).
3. The matrix itself is transposed or the structure has changed.

// Sample Matrix Check
struct Matrix4x4 {
    float m[4][4];
};

// If your W2S results are like -1, -1 or extremely high values, 
// the matrix read is likely misaligned.

Have you tried dumping the

MainCamera

instance via the

GameObject

manager instead of the

TypeInfo

chain? Sometimes the static field link breaks while the engine's internal list remains valid.

Anyone else seeing the

EntityRealm

shift to

+0x28

on the latest build?