A Thirty-Year Injustice Overturned: The INPUT Struct at 28 versus 40, the VM Dead-End Verdict on fdeb, and the Rise of the Dummy-Soldier Route

A long-cold case was overturned in the small hours, and a campaign route was sealed in the same small hours — together they redrew the map of Moyu single-player.

I. The Injustice Overturned: 28 against 40

The case files of every dead click end at an unexpected culprit: the INPUT struct had been written with the 32-bit layout of 28 bytes, while the x64 body is 40 — SendInput returned 0 with err 87 (invalid parameter), and the keyboard, partially served by the old keybd_event API, kept misdirecting the investigation for a whole generation of tools. Corrected to 40 bytes: keyboard injection works at full strength (HELLO typed into Notepad as proof), mouse movement works, but mouse down/up arrives unheard — some security layer is swallowing the clicks. The repaired artifact bots/input64.py stands as the correct 64-bit injection library, and all game operations move to the keyboard (WASD movement, skill hotkeys).

II. The Dead-End Verdict: The VM Double-Lock on fdeb

From the other front came the verdict document: a 512-byte dump of the fdeb vt28 function succeeded — the first real sample of a VM-ized function ever taken. The disassembly reads coldly clear: standard prologue, then mov rbx,rcx, then a direct jmp into the VM segment. The deeper logic leaves no appeal: the VM check on fdeb exists to derive the subsequent stream keys — without the key the client cannot decrypt the stream that follows; VM verification plus server RNG is a double lock unpatchable in principle. The fdeb patch route is formally condemned as dead, and with it the protocol-layer single-player campaign (the stub-server forgery) closes its chapter.

III. The New Banner: The Memory-Injection Dummy System

Opposite the closed road a new banner rises: the memory-injection dummy system — no protocol forgery, but direct invocation of game logic. Two shots verified in the night: a Frida RPC call into 0x33031d0 (conn, crafted frame, len) returned rc=1 — the send-assembly entry accepts injected frames; and on a fresh session an injected forged heartbeat crossed the complete send chain, structurally identical to a genuine heartbeat ciphertext. The gate of a twenty-year-old court was never pried from the front, but the besiegers now stand on the other side of the door hinge — inside the city, turning the bolt for it.

IV. The Historiography of a Pivot

The value of this day lies in two admissions: that a 28-byte slip of the pen could slander every click for a generation of tools, and that the protocol road has reached its end. The hardest thing in engineering history is not finding the new road — it is signing the death certificate of the old one, and fdeb’s VM double-lock is that certificate. The Task-Queue priorities were re-ranked at once: active-session injection verification, movement frames, attack frames, dummy integration — each step now stands on its own soldiers’ shoulders instead of trying to scale someone else’s wall.