Writing a DX11 Overlay for REPO: RepoDLL

RepoDLL is an overlay DLL injected into the REPO process. It hooks the DX11 swap chain and layers an ImGui pass on top of the frame, so you can read memory and tweak values while you play. REPO is a Unity/Mono co-op scavenging game, and things like health, coordinates, and currency all live in the managed layer, which means you can read and draw them.

It doesn’t go the raw address-scanning route, which is too brittle: one game update and all the offsets are dead. REPO is Mono, so the managed layer carries symbol information that can be resolved at runtime. After injection it first locates the Mono runtime, then resolves classes, fields, and methods in Assembly-CSharp by name, so what you read is semantically meaningful rather than a string of raw addresses. The target class names SemiFunc, PlayerAvatar, PhysGrabber, ExtractionPoint, ValuableDiscover, and PunManager all live in config.h, so switching to another game should, in theory, just mean editing this one file.

The entry point is in dllmain.cpp. On attach it first installs an exception filter as a safety net, then spins up a main thread that calls HookDx11(), which uses MinHook to intercept DXGI’s Present and ResizeBuffers. From then on it draws ImGui every frame inside the hooked Present, and along the way it subclasses the window’s WndProc to grab input, with Insert bringing up the menu. The ESP pulls the View/Projection matrices from the Unity Camera to do WorldToScreen, projecting players, valuables, and enemies onto the screen.

The hardest part was crashes. When enumerating items and enemies, managed objects can go invalid at any moment, and if the render thread reads a stale pointer the whole game goes down. Wrapping all of these reads in a Safe wrapper backed by SEH made it much more stable. For co-op you also have to check the room and host authority, since not all values are writable; when something should be read-only, keep it read-only. There’s a pile of toy features: movement-speed override, multi-jump, invincibility, grab range, third-person, and the native highlight on ValuableDiscover is even hooked to stay always-on.

The project is a C++20 MSBuild solution, with the MinHook part in C, built on v145 + the Win10 SDK, linking d3d11.lib and dxgi.lib. ImGui and MinHook are vendored directly under third_party/ with no package manager. In VS you pick Release | x64 and out comes RepoDLL.dll. It only produces the DLL; the injector is not in the repo. It’s an early experiment, with a bunch of assumptions hard-bound to that version of REPO at the time, so a different environment will very likely need changes. MIT.