From 817a2eff78d130186981dd41f666b40e0b01725f Mon Sep 17 00:00:00 2001
From: MiTHRAL <mithral@mithral.local>
Date: Mon, 24 Aug 2026 13:48:35 -0400
Subject: [PATCH] =?UTF-8?q?v2.1.4:=20remove=20def-id=20range=20sweep=20?=
 =?UTF-8?q?=E2=80=94=20polluting=20userItems=20with=20unknown=20ids=20brok?=
 =?UTF-8?q?e=20pet=20display;=20restore=20exact=20v2.1.0=20injection=20sem?=
 =?UTF-8?q?antics,=20keep=20pass-through=20traces=20+=20catalog=20dump?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/il2cpp_resolver.cpp |  9 ++++++++-
 src/patches.cpp         | 13 ++++++++-----
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/src/il2cpp_resolver.cpp b/src/il2cpp_resolver.cpp
index 8a883fd..44ef4b5 100644
--- a/src/il2cpp_resolver.cpp
+++ b/src/il2cpp_resolver.cpp
@@ -553,7 +553,14 @@ int Il2CppResolver::fabricateOwnership(){
             char* s=strrchr(exe,'\\'); if(!s) s=strrchr(exe,'/');
             if(s){
                 std::ofstream f(std::string(exe,s-exe)+"\\DevourUnlocker.log",std::ios::app);
-                f<<"[own] fabricate: catalog="<<cSize<<" had="<<(uSize>0?uSize:(int)have.size()-injected)<<" injected="<<injected<<"\n";
+                static bool loggedCatalog=false;
+                if(!loggedCatalog && cSize>0){
+                    loggedCatalog=true;
+                    f<<"[own] catalog ids:";
+                    for(int i=0;i<cSize;++i){ void* ip=*(void**)(cData+(size_t)i*8); if(!ip) continue; f<<" "<<*(uint32_t*)((unsigned char*)ip+0x10); }
+                    f<<"\n";
+                }
+                f<<"[own] fabricate: catalog="<<cSize<<" had="<<(uSize>0?uSize:(int)(have.size()-injected))<<" injected="<<injected<<"\n";
             }
         }catch(...){}
     } catch(...){ injected=-1; }
diff --git a/src/patches.cpp b/src/patches.cpp
index 8cfce88..bda572a 100644
--- a/src/patches.cpp
+++ b/src/patches.cpp
@@ -90,15 +90,18 @@ static void __fastcall hUpdateLockedRobes(void* thiz, void* method) { if (oUpdRo
 // Ownership override: every Steam catalog item (pets/flashlights/emotes/outfits/promos) counts as owned.
 // LOGS every query — if the pet UI never appears in the log, it reads the userItems list field directly.
 static bool __fastcall hUserHasItem(void* thiz, unsigned long long itemDef, void* method) {
+    // pass-through + trace (v2.1.0 proved forcing true blocks purchases)
+    char b[96]; snprintf(b,sizeof(b),"[trace] UserHasItem(def=%llu)", (unsigned long long)itemDef); logPatch(b);
     if (oUserHasItem) return oUserHasItem(thiz, itemDef, method);
-    return true;
+    return false;
 }
 // Multiplayer validator: every player counts as owning every item (lobby validation path)
 static bool __fastcall hPlayerHasItem(void* thiz, int connectionId, unsigned long long itemDef, void* method) {
-    // Validator gate used by StoreEmotesOwnedOnSteam + WaitForPurchased*Validation coroutines.
-    // Does NOT block purchases (that was UserHasItem) — safe to force true.
-    char b[160]; snprintf(b,sizeof(b),"[trace] PlayerHasItem(conn=%d def=%llu) -> true", connectionId, itemDef); logPatch(b);
-    return true;
+    // MUST stay pass-through: forcing true desyncs lobby validation vs injected
+    // userItems and UNLOCKS REGRESS (pets locked again). See v2.1.1 regression.
+    char b[128]; snprintf(b,sizeof(b),"[trace] PlayerHasItem(conn=%d def=%llu)", connectionId, (unsigned long long)itemDef); logPatch(b);
+    if (oPlayerHasItem) return oPlayerHasItem(thiz, connectionId, itemDef, method);
+    return false;
 }
 // Inventory-retrieved flag: pass through — forcing true with an empty userItems made some
 // flows treat items as definitively NOT owned; original behavior is safer now