Skip to content

aowlspt_navui.h

Source: abi/aowlspt_navui.h — 723 lines, 30 file-scope functions.

What this header owns

Reproduced verbatim from the header's own banner comment — these notes are frequently the only written record of why the subsystem is shaped the way it is.

text
 aowlspt_navui.h -- UI NAVIGATION TARGETS for the live inspector.

The inspector could already READ the running game. These are the first
targets that let it DRIVE it: open the settings screen, select a tab. The
point is to remove the human step from "open settings, pick the Game tab,
look at what appeared" -- a loop that otherwise costs somebody's attention
every single time a question is asked.

WHY CALL THE GAME'S OWN METHODS RATHER THAN SYNTHESISE INPUT
-----------------------------------------------------------
A synthetic click has to land on the right screen-space pixel of the right
control in the right frame, and it silently does nothing when any of those
is wrong. Calling `ShowScreen` / `set_IsSelected` is deterministic, it is
the same entry point the game's own button handlers use, and it either runs
or faults visibly. The whole design of this instrument is that a failure is
loud; a missed click is the opposite of that.

PROVENANCE OF EVERY BYTE BELOW
------------------------------
These prologues were read directly out of `GameAssembly.dll` at the stated
RVAs, via the PE section table (RVA -> file offset), NOT copied from a doc.
The reader was validated in the same pass against two targets whose
signatures are already baked into `aowlspt_debugui.h`:

  Canvas::get_renderMode   @0x5584080  40 53 48 83 EC 20 48 8B 05 73 3E B5 01 48 8B D9
  Canvas::get_sortingOrder @0x5584540  40 53 48 83 EC 20 48 8B 05 23 3A B5 01 48 8B D9

both of which matched the header byte-for-byte. A reader that reproduces two
known answers exactly is a reader whose new answers can be trusted.

The same pass also confirmed, as a control, that
`TMP_Text::ForceMeshUpdate` @0x628110 begins `C2 00 00` -- `ret 0`, a stub
that does nothing. That is why this file carries a SHAPE CHECK as well as a
signature check: on UnityEngine and TMP types, "the RVA resolves" is not the
same as "the function does anything", and calling a stub is a silent no-op
that looks exactly like a failed navigation.

Both functions below open with a real register-save prologue
(`mov [rsp+x], reg` ...), which is a genuine compiled body -- not a stub
(`ret`/`ret n`), and not the IL2CPP internal-call shape
(`mov rax,[rip+...]` into a cached native pointer) that the Canvas property
getters have. That distinction matters: an icall dereferences the native
half of a UnityEngine.Object and faults inside Unity's C++ if that half is
gone, which is a fault nothing on our side can guard.

VERIFICATION GOES THROUGH THE SNAPSHOT
--------------------------------------
`aowl_pro_verify` (aowlspt_prologue.h), never a live compare, so that a
target another feature has already detoured cannot self-reject. Neither of
these is detoured today; that is a property of today's feature set and not
a guarantee, which is exactly why it goes through the snapshot anyway.

Constants

  • AOWLSPT_NAVUI_H
  • AOWL_NAV_ARR_DATA
  • AOWL_NAV_ARR_LEN
  • AOWL_NAV_BTN_ONCLICK
  • AOWL_NAV_ES_CURSELECTED
  • AOWL_NAV_HOP_ASSEMBLIES
  • AOWL_NAV_HOP_CLASS
  • AOWL_NAV_HOP_DOMAIN
  • AOWL_NAV_HOP_IMAGE
  • AOWL_NAV_HOP_NONE
  • AOWL_NAV_HOP_TYPE
  • AOWL_NAV_HOP_TYPEOBJ
  • AOWL_NAV_NOT_COMMIT
  • AOWL_NAV_NOT_EXEC
  • AOWL_NAV_NO_MODULE
  • AOWL_NAV_NO_QUERY
  • AOWL_NAV_OK
  • AOWL_NAV_PRO_FULL
  • AOWL_NAV_SEL_INTERACT
  • AOWL_NAV_SIG_MISMATCH
  • AOWL_NAV_SS_CURRENTTAB
  • AOWL_NAV_SS_INITTABS
  • AOWL_NAV_STUB
  • AOWL_NAV_TAB_CREATED
  • AOWL_NAV_TAB_FIRSTSEL
  • AOWL_NAV_TARGET_COUNT
  • AOWL_NAV_TOG_ISON
  • AOWL_NAV_TOG_ONVALUE
  • AOWL_NAV_UOBJ_CACHEDPTR

Types

  • struct AowlNavTarget

Functions

SignatureLine
int32_t aowl_nav_off_currenttab(void)67
int32_t aowl_nav_off_inittabs(void)68
int32_t aowl_nav_off_firstsel(void)69
int32_t aowl_nav_off_created(void)70
int32_t aowl_nav_off_curselected(void)392
void aowl_nav_exports_init(void)465
int32_t aowl_nav_have_type_route(void)479
int32_t aowl_nav_last_hop(void)485
int32_t aowl_nav_icall_ready(void)502
void aowl_nav_find_class(const char* ns, const char* name)520
void aowl_nav_type_object(void* klass)551
int32_t aowl_nav_off_arrlen(void)581
int32_t aowl_nav_off_arrdata(void)582
void aowl_nav_set_scene_handle(int32_t h)590
void aowl_nav_scene_handle_ptr(void)591
int32_t aowl_nav_off_onclick(void)593
int32_t aowl_nav_off_interact(void)594
int32_t aowl_nav_off_ison(void)595
int32_t aowl_nav_off_onvalue(void)596
int32_t aowl_nav_off_cachedptr(void)597
int32_t aowl_nav_is_stub(const unsigned char* p)609
void aowl_nav_verify(uint32_t rva, const unsigned char* sig, int32_t siglen)642
int32_t aowl_nav_last_reason(void)691
int32_t aowl_nav_actual_valid(void)692
int32_t aowl_nav_actual_at(int32_t i)693
int32_t aowl_nav_expected_at(int32_t t, int32_t i)697
void aowl_nav_target_at(int32_t i)703
char aowl_nav_target_name(int32_t i)710
uint32_t aowl_nav_target_rva(int32_t i)715
int32_t aowl_nav_target_count(void)720

aoughwl — self-hosted platform for things n stuff. Contact / Support on Discord for access to the private backends.