From arc-probe
Scans live Deadlock game entities via ARC Probe from running process. Resolves local player, entity list, reads data like health/position, displays structs in GUI. Use for memory inspection during matches.
npx claudepluginhub vzco/arc-probe --plugin arc-probeThis skill uses the workspace's default tool permissions.
Scan live Deadlock entities via the probe bridge and display them in the ARC Probe GUI.
Provides reverse engineering reference for ARC Probe: safe memory read/write, address validation heuristics, instruction patching (NOP/INT3/RET), and binary identification. For process probing sessions.
Interact with running Godot games via MCP: launch projects, capture screenshots, simulate clicks/keys, inspect/manipulate scene tree and properties. For UI testing, debugging, and state verification.
Hunts vulnerabilities in x64dbg debuggees: analyzes imports/exports, triages I/O attack surfaces, tests bugs like overflows/wraps, generates PoCs.
Share bugs, ideas, or general feedback.
Scan live Deadlock entities via the probe bridge and display them in the ARC Probe GUI.
:9996deadlock.exeThese offsets are from the schema dump and may change after game patches. Check dezlock-dump output for fresh values.
| Name | Offset | Description |
|---|---|---|
dwLocalPlayerPawn | 0x2E76FE8 | Pointer to local player pawn |
dwEntityList | 0x3862C28 | CGameEntitySystem pointer |
dwViewMatrix | 0x3745490 | View matrix (4x4 float) |
| Field | Hex | Decimal | Type |
|---|---|---|---|
| m_pGameSceneNode | 0x330 | 816 | pointer |
| m_iMaxHealth | 0x350 | 848 | int32 |
| m_iHealth | 0x354 | 852 | int32 |
| m_lifeState | 0x35C | 860 | int32 |
| m_flSimulationTime | 0x3C0 | 960 | float |
| m_iTeamNum | 0x3F3 | 1011 | uint8 |
| Field | Hex | Decimal | Type |
|---|---|---|---|
| m_hPawn | 0x6BC | 1724 | uint32 |
| m_iszPlayerName | 0x6F0 | 1776 | pointer (string) |
| m_steamID | 0x778 | 1912 | uint64 |
| Field | Hex | Decimal | Type |
|---|---|---|---|
| m_vecOrigin | 0x80 | 128 | float[3] (Vec3) |
| m_vecAbsOrigin | 0xC8 | 200 | float[3] (Vec3) |
| m_bDormant | 0x103 | 259 | bool |
curl -s -X POST http://localhost:9996 -H "Content-Type: application/json" \
-d '{"action":"probe","command":"modules list"}' \
| python -c "import sys,json; mods=json.load(sys.stdin)['data']['data']['modules']; [print(m['name'],m['base']) for m in mods if 'client' in m['name'].lower()]"
Store the base address (e.g., 0x7FFB0A8D0000) for offset calculations.
CLIENT_BASE="0x7FFB0A8D0000" # from step 1
curl -s -X POST http://localhost:9996 -H "Content-Type: application/json" \
-d "{\"action\":\"probe\",\"command\":\"read_ptr ${CLIENT_BASE}+0x2E76FE8\"}"
The value field in the response is the pawn address (e.g., 0x2E6C0389400).
PAWN="0x2E6C0389400" # from step 2
# Read health + max health (8 bytes starting at 0x350)
curl -s -X POST http://localhost:9996 -H "Content-Type: application/json" \
-d "{\"action\":\"probe\",\"command\":\"read ${PAWN}+0x350 8\"}" \
| python -c "
import sys,json,struct
d=json.load(sys.stdin)['data']['data']
raw=bytes.fromhex(d['hex'][:16])
maxhp=struct.unpack_from('<i',raw,0)[0]
hp=struct.unpack_from('<i',raw,4)[0]
print(f'Health: {hp}/{maxhp}')
"
# Read team
curl -s -X POST http://localhost:9996 -H "Content-Type: application/json" \
-d "{\"action\":\"probe\",\"command\":\"read ${PAWN}+0x3F3 1\"}" \
| python -c "
import sys,json
d=json.load(sys.stdin)['data']['data']
team=int(d['hex'][:2],16)
teams={0:'World',1:'Spectator',2:'Amber',3:'Sapphire',4:'Neutral'}
print(f'Team: {teams.get(team,team)}')
"
curl -s -X POST http://localhost:9996 -H "Content-Type: application/json" -d "{
\"action\":\"batch\",\"actions\":[
{\"action\":\"activity\",\"status\":\"working\",\"message\":\"Building local player struct...\"},
{\"action\":\"store\",\"store\":\"struct\",\"method\":\"createStruct\",\"args\":[\"C_BaseEntity\",\"${PAWN}\",1024]},
{\"action\":\"store\",\"store\":\"struct\",\"method\":\"addField\",\"args\":[\"C_BaseEntity\",0,\"pointer\",\"vtable\"]},
{\"action\":\"store\",\"store\":\"struct\",\"method\":\"addField\",\"args\":[\"C_BaseEntity\",816,\"pointer\",\"m_pGameSceneNode\"]},
{\"action\":\"store\",\"store\":\"struct\",\"method\":\"addField\",\"args\":[\"C_BaseEntity\",848,\"int32\",\"m_iMaxHealth\"]},
{\"action\":\"store\",\"store\":\"struct\",\"method\":\"addField\",\"args\":[\"C_BaseEntity\",852,\"int32\",\"m_iHealth\"]},
{\"action\":\"store\",\"store\":\"struct\",\"method\":\"addField\",\"args\":[\"C_BaseEntity\",860,\"int32\",\"m_lifeState\"]},
{\"action\":\"store\",\"store\":\"struct\",\"method\":\"addField\",\"args\":[\"C_BaseEntity\",960,\"float\",\"m_flSimulationTime\"]},
{\"action\":\"store\",\"store\":\"struct\",\"method\":\"addField\",\"args\":[\"C_BaseEntity\",1011,\"uint8\",\"m_iTeamNum\"]},
{\"action\":\"store\",\"store\":\"struct\",\"method\":\"setActiveStruct\",\"args\":[\"C_BaseEntity\"]},
{\"action\":\"store\",\"store\":\"label\",\"method\":\"setLabel\",\"args\":[\"${PAWN}\",\"LocalPlayerPawn\"]},
{\"action\":\"navigate\",\"tab\":\"structs\"},
{\"action\":\"activity\",\"status\":\"idle\",\"message\":\"Local player ready\"}
]
}"
Entity list structure:
client_base + dwEntityList = CGameEntitySystem pointerchunk = index >> 9, chunk_index = index & 0x1FF# Read entity list base
curl -s -X POST http://localhost:9996 -H "Content-Type: application/json" \
-d "{\"action\":\"probe\",\"command\":\"read_ptr ${CLIENT_BASE}+0x3862C28\"}"
# Read first chunk pointer (entity_system + 0x10)
curl -s -X POST http://localhost:9996 -H "Content-Type: application/json" \
-d "{\"action\":\"probe\",\"command\":\"read_ptr <entity_system>+0x10\"}"
# Read entity identity at index N: chunk_base + (N & 0x1FF) * 0x70
# Entity pointer: identity + 0x00
# Designer name: read_ptr at identity + 0x20, then read_string
To find players, iterate low entity indices (typically 1-12 for controllers) and check designer names:
# For each index, read identity entry and check designer name
# Players have designer name containing "player" or class name containing "CitadelPlayerPawn"
# Controllers have "player_controller"
| Designer Name | What | Teams |
|---|---|---|
player_controller | Player controller | 2,3 |
| Player pawns | No designer name; resolve via controller m_hPawn | 2,3 |
npc_trooper | Lane creep | 2,3 |
npc_boss_tier2 | Guardian | 2,3 |
npc_boss_tier3 | Patron | 2,3 |
npc_trooper_neutral | Jungle camp | 4 |
m_hPawn (uint32 handle), index = handle & 0x7FFFm_lifeState: 0 = alive, 2 = deadm_flSimulationTime staleness to detect dead entities (delta > 1.0s from local pawn)pattern 48 8B 05 ?? ?? ?? ?? client.dll --resolve 3