Hello forum,
This is part of my project, which is connected with Poor DMA, while the main objective of this project is to be used with the thread in question:
There is a fully free and working DMA/Poor DMA cheat for Rust.
Of course, in the case of any game update, there is a need to update the offsets. In that case, this dumper needs to be used. It can additionally be used to make your own cheat. It is also called an agentic dumper, since creating a dumper that will always dump correct offsets without any changes to the code is difficult and is often seen as an unreasonable approach. Thus, there is always some need for manual reversing, which can take some time. My idea was to create all the necessary tools and prompts so that everything could be done by AI.
If you wish to use AI for dumping, just tell it to follow the instructions in the UPDATE.md file. Of course, you still have to read the process memory. Everything is below!
Read this first - Rust is not a remote reader
Rust is Unity / Il2Cpp, not Unreal, and the entity list, inventory, eyes and active item are wrapped in rotating in-memory decryption routines. Because of that this dumper works differently from the other games in the kit:
• It is a C++ dumper that injects a small probe DLL into
• Which means the game must be launched without anti-cheat, joined to your own server, and you must be spawned in the world. Never inject into an EAC session.
• Poor DMA is still used - but on the second half of the job: the probes that prove what the dump claims and settle what it could not, over the LAN, exactly like the cheat reads it.
So the flow is: game PC dumps (inject) → second PC proves and applies (Poor DMA / DMA card).
Link:
• Poor DMA (
• FPGA DMA (
What It Dumps:
• PE identity: the game build number,
• Il2Cpp TypeInfo RVAs:
• Managed field offsets: the named offsets the client reads every tick, each with a confidence and its candidates.
• Decryption programs: the ordered 32-bit-lane operations (
• Full catalogs (full mode): every class, field and method -
• Live chain evidence: the static/entity chain, the entity count, and a sample BasePlayer - the only honest test of whether the dump caught a real world.
Step-by-Step Usage Guide
1. Prerequisites
• A local Rust server you control (
• Spawned in the world - hands visible, ideally holding a gun with a few items on the belt. At the menu or the respawn screen there is no entity list, no belt and no inventory, and the dump cannot tell that apart from a game change.
• On the game PC: Visual Studio with Desktop development with C++ (MSBuild), and an Administrator PowerShell.
• On the second PC (only for verification): Rust + Cargo, and the Poor DMA server running on the game PC if you use
2. Build
The script builds both C++ projects by itself on first use. To do it by hand:
3. Dump - one command on the game PC
You can do it manually or just ask AI to read the file UPDATE.md, it will do everything for you!
That one command refuses without elevation, refuses if anti-cheat is loaded, refuses if
If the shell cannot elevate,
Judge the dump before reading past this line -
• hundreds to thousands -> a usable world dump, carry on;
• 0 -> UNUSABLE, copy nothing. Almost always not actually spawned - or the dumper's chain discovery could not find the realm on that build (see the honest limitations at the bottom).
4. Verify Live - on the second PC, over Poor DMA
If the dump could not settle a decrypt program, the probes do it against the live game — this is the part the AI is for:
5. Apply
• Edit offsets.toml — that is the whole update. The overlay is never rebuilt for an offset change.
• Apply only what is proven: a dump value with high confidence and exactly one candidate, or a value a live probe proves. An unproven value stays
• Tag every change with the build in its comment, e.g.
• Start the overlay with
6. Record
Append an entry to FINDINGS.md, newest at the top: what moved, what was proven live and how, what stayed unresolved and why, and any trap worth warning the next run about. That file is how the next AI starts warm instead of from zero.
Honest limitations (Rust is the hardest one in the kit)
Troubleshooting
In case of any bugs, or problems while using this dumper, don't forget to paste the log in your reply and explain in details what the issue is, and if there is such possibility include the screenshot - in that case I can HELP, if you are going to write that there is SOME bug and you can't even clarify what it is, you will be ignored.
CODE FOR DECRYPT IS NOT MINE, IT WAS PASTED FROM SOME GITHUB REPOR AND IT WAS AGES AGO SO I DON'T REMEMBER FROM WHERE, IF YOU ARE REAL AUTHOR READING THIS DM AND I'll GIVE CREDITS AND LINK YOUR REPO HERE!
This is part of my project, which is connected with Poor DMA, while the main objective of this project is to be used with the thread in question:
There is a fully free and working DMA/Poor DMA cheat for Rust.
Of course, in the case of any game update, there is a need to update the offsets. In that case, this dumper needs to be used. It can additionally be used to make your own cheat. It is also called an agentic dumper, since creating a dumper that will always dump correct offsets without any changes to the code is difficult and is often seen as an unreasonable approach. Thus, there is always some need for manual reversing, which can take some time. My idea was to create all the necessary tools and prompts so that everything could be done by AI.
If you wish to use AI for dumping, just tell it to follow the instructions in the UPDATE.md file. Of course, you still have to read the process memory. Everything is below!
Read this first - Rust is not a remote reader
Rust is Unity / Il2Cpp, not Unreal, and the entity list, inventory, eyes and active item are wrapped in rotating in-memory decryption routines. Because of that this dumper works differently from the other games in the kit:
• It is a C++ dumper that injects a small probe DLL into
[B]RustClient.exe[/B] and reads the game from the inside, then unloads. It is not a process that reads the game from the second PC.• Which means the game must be launched without anti-cheat, joined to your own server, and you must be spawned in the world. Never inject into an EAC session.
• Poor DMA is still used - but on the second half of the job: the probes that prove what the dump claims and settle what it could not, over the LAN, exactly like the cheat reads it.
So the flow is: game PC dumps (inject) → second PC proves and applies (Poor DMA / DMA card).
Link:
• Poor DMA (
-lan): the probes read the live game remotely over TCP port 39172 through the Poor DMA server on the game PC. No DMA card needed, no IOMMU bypass needed.• FPGA DMA (
-dma): direct hardware PCIe DMA for the probes, for a two-PC setup where MemProcFS can see the game. For that you need the PCILeech DLLs (vmm.dll, leechcore.dll, FTD3XX.dll, dbghelp.dll).What It Dumps:
• PE identity: the game build number,
SizeOfImage and TimeDateStamp of GameAssembly.dll, so the client can refuse a build it was not written for.• Il2Cpp TypeInfo RVAs:
BasePlayer, BaseEntity, BaseCombatEntity, BaseNetworkableStatic, BaseProjectile, MainCamera and the singleton.• Managed field offsets: the named offsets the client reads every tick, each with a confidence and its candidates.
• Decryption programs: the ordered 32-bit-lane operations (
add / sub / xor / rol) recovered by scanning every function's machine code - thousands of candidates, each one validated against a live class before it is accepted.• Full catalogs (full mode): every class, field and method -
class_rvas.tsv, field_offsets.tsv, methods.jsonl - plus the game's own GameAssembly.dll and global-metadata.dat, so the second PC can disassemble and re-read metadata without ever coming back to the game PC.• Live chain evidence: the static/entity chain, the entity count, and a sample BasePlayer - the only honest test of whether the dump caught a real world.
Step-by-Step Usage Guide
1. Prerequisites
• A local Rust server you control (
RustDedicated), and RustClient launched without anti-cheat, joined to it.• Spawned in the world - hands visible, ideally holding a gun with a few items on the belt. At the menu or the respawn screen there is no entity list, no belt and no inventory, and the dump cannot tell that apart from a game change.
• On the game PC: Visual Studio with Desktop development with C++ (MSBuild), and an Administrator PowerShell.
• On the second PC (only for verification): Rust + Cargo, and the Poor DMA server running on the game PC if you use
-lan.2. Build
The script builds both C++ projects by itself on first use. To do it by hand:
Code:
cd "poor dma\rust\dumper"
msbuild Projects\OffsetDumper\OffsetRuntimeProbe.vcxproj /m /t:Build /p:Configuration=Release /p:Platform=x64
msbuild Projects\OffsetDumper\OffsetDumper.vcxproj /m /t:Build /p:Configuration=Release /p:Platform=x643. Dump - one command on the game PC
You can do it manually or just ask AI to read the file UPDATE.md, it will do everything for you!
Code:
cd "poor dma\rust\dumper"
powershell -ExecutionPolicy Bypass -File .\Get-Offsets.ps1 -SpawnedGameAssembly.dll is not in yet, builds the dumper, runs a full dump, judges it, copies the game binaries, writes SUMMARY.md, and zips the lot into one file for the second PC:
Code:
snapshots\dump_<build>_<time>.zipOffsetDumper.exe itself does not need it to inject into a same-user, medium-integrity RustClient.exe — run the exe directly and do the script's post-steps by hand.Judge the dump before reading past this line -
entity_count:• hundreds to thousands -> a usable world dump, carry on;
• 0 -> UNUSABLE, copy nothing. Almost always not actually spawned - or the dumper's chain discovery could not find the realm on that build (see the honest limitations at the bottom).
4. Verify Live - on the second PC, over Poor DMA
Code:
cd "poor dma\rust\dumper"
cargo build --release
# the whole chain: statics -> realm -> entityList -> dictionary -> array
cargo run --release --example chain_probe
# which singleton slot holds the real MainCamera
cargo run --release --example camera_probe
# the entity list, its classes and its prefabs
cargo run --release --example entity_probe
# player vitals, belt, held weapon, magazine
cargo run --release --example player_fields
cargo run --release --example belt_probe
cargo run --release --example held_probe
Code:
# try every program the dump saw against the live statics
CHAIN_CANDIDATES=<dump>\decrypt_programs.jsonl cargo run --release --example chain_probe
# every slot+program that reaches a LIVE entity array (chain end, not just "a pointer")
CHAIN_CANDIDATES=<dump>\decrypt_programs.jsonl CHAIN_END_OBJECT=<object> cargo run --release --example chain_probe
# which field of an object decrypts to EXACTLY a given class (field offset + program)
CHAIN_FIELD_PROGRAMS=<dump>\decrypt_programs.jsonl CHAIN_FIELD_OBJECT=<object> CHAIN_FIELD_CLASS=<klass> cargo run --release --example chain_probe5. Apply
• Edit offsets.toml — that is the whole update. The overlay is never rebuilt for an offset change.
• Apply only what is proven: a dump value with high confidence and exactly one candidate, or a value a live probe proves. An unproven value stays
"" / "unknown" / [] — a wrong offset does not crash, it draws boxes in the wrong place.• Tag every change with the build in its comment, e.g.
[26140533] 0x18C -> 0x194.• Start the overlay with
lan_client_rust.exe -lan and check the log — it must say offsets are for build <label>, then resolved in … ms, then attached and resolved: <n> entities.6. Record
Append an entry to FINDINGS.md, newest at the top: what moved, what was proven live and how, what stayed unresolved and why, and any trap worth warning the next run about. That file is how the next AI starts warm instead of from zero.
Honest limitations (Rust is the hardest one in the kit)
- Obfuscated metadata. Rust hashes class and field names every build (
%7e25fe33…), so nothing can be matched by name. Everything is resolved by shape and proven by class pointer. - The realm-shape resolver can fail. The dumper finds the entity chain through a field typed
EncryptedValue<ListDictionary<…,BaseNetworkable>>. On a build that obfuscates those generic names toSystem.Object, that field does not exist as text, the resolver returns not-found and every dump reportsentity_count 0— even spawned. When that happens, recover the chain with the probes (step 4) instead of trusting the dump; the fixed procedure is written out in UPDATE.md. - Encrypted pointers. The decrypt operations change order and constants every build, and the scanner emits thousands of plausible programs. Only a live class/collection check settles one - never "it looks like a pointer".
- Cold pages. A Poor DMA read cannot read a paged-out page, so class-name strings and even
GameAssembly.dll's module row (_NA-0x…dll) can come back unreadable. That is why the tools compare class pointers and whyGAMEASSEMBLY_BASEexists.
Troubleshooting
In case of any bugs, or problems while using this dumper, don't forget to paste the log in your reply and explain in details what the issue is, and if there is such possibility include the screenshot - in that case I can HELP, if you are going to write that there is SOME bug and you can't even clarify what it is, you will be ignored.
- “ANTI-CHEAT IS LOADED” - close Rust and launch it without EAC against your own server. The probe is injected; never into a protected session.
entity_count 0- you were at the menu/respawn screen, or the build is one of the ones where the realm shape is obfuscated (see limitations). Nothing from that snapshot may be copied.- Probes cannot connect - the Poor DMA server takes one client at a time: close the running overlay first. And make sure the server was started after the game.
CODE FOR DECRYPT IS NOT MINE, IT WAS PASTED FROM SOME GITHUB REPOR AND IT WAS AGES AGO SO I DON'T REMEMBER FROM WHERE, IF YOU ARE REAL AUTHOR READING THIS DM AND I'll GIVE CREDITS AND LINK YOUR REPO HERE!
