Tier 6: Secretary Character Guide

A Secretary cheapie is a specialized tier of M.U.G.E.N exploit characters designed to operate outside the boundaries of the engine's internal state machine. Instead of relying solely on CNS triggers or supernull exploits within the engine, a Secretary character acts as an external orchestrator. It utilizes batch scripts, command-line execution parameters, and process management commands to force wins by directly manipulating the winmugen.exe runtime configuration and closing competing exploit scripts.

---

Step 1: Establish Process Interruption and Defense

The foundation of a Secretary character relies on neutralizing rival external scripts or characters that attempt to hook into the system execution layer. You must construct a command block using taskkill to forcefully terminate active batch processes and executables belonging to known high-tier cheapies. This ensures your character gains absolute priority over engine execution and prevents defensive scripts from blocking your commands.

start cmd.exe /k taskkill /f /im cmd.exe
taskkill -f -im Dark_Donald_4th-ICE_Hard.bat*
taskkill -f -im Ancient_Magaki-2nd.bat*
taskkill -f -im phantom.exe*
taskkill -f -im p1_Main.bat*
taskkill -f -im p2_Main.bat*
taskkill -f -im 32.exe*
taskkill -f -im 64.exe*

Step 2: Configure Environment and Stage Variables

To ensure the character functions correctly across different setups, the script must handle dynamic folder paths and environment variables. By using conditional logic such as IF EXIST, the script checks the local M.U.G.E.N directory structures to confirm the targeted character files are present before launching the engine execution layer. This prevents script hanging or crashes when executing invalid commands.

@echo off 
set /p stage=Please enter the stage name here:
set /p name=Please enter the name of the character here:
IF EXIST %~dp0\chars\%name% (

Step 3: Command-Line Argument Invalidation

The core mechanism of forcing an absolute victory involves passing massive negative or overflow values directly to the execution flags of winmugen.exe. You bypass the character's internal defense states entirely by forcing the engine to initiate Player 2 with a heavily overflowed life and power threshold. Setting flags like -p2.life and -p2.power to massive negative strings causes immediate state corruption or instantiation failure for the opponent's engine instance.

winmugen.exe ExtremeDarkAkuma ;YouDied -p2.life -9999999999999999999999999999999999999999999999999999999999999999 -p2.ai 0 -p1.color 12 -p2.color -13 -p2.power -9999999999999999999999999999999999999999999999999999999999999999 -s %stage% kfm ;YouDied -rounds 3
exit
) ELSE (
exit
)

Step 4: Map Engine States to Inside-CNS Overrides

While the external batch script manages initialization and process destruction, the internal state machine must provide complete state immunity. The character's internal logic under Statedef -2 and Statedef -3 needs to consistently execute HitOverride, NotHitBy, and life management systems that sync up with the script's presence. Using triggers that enforce continuous noko (No KO) special status and resetting variables ensure that even if the external automation takes a few frames to neutralize the engine, the inside structure remains completely unkillable.

---

CNS Variable Tracking System for State Immunity

To maintain absolute state immunity within the engine while the external batch script handles the operating system layer, the character relies on a persistent variable tracking framework inside the CNS file. This configuration acts as a hardcoded fail-safe under [Statedef -2] to continuously lock down the character's parameters regardless of opponent interactions, frame drops, or memory modification attempts.

1. Life and Power Anchor Redirection

Rival characters often attempt to read and write directly to your character's life address to force a KO condition. The tracking system completely overrides life updates every single tick, rendering damage calculations useless.

[State -2, Life Anchor]
type = LifeSet
trigger1 = 1
value = 1000
ignorehitpause = 1

[State -2, Power Anchor]
type = PowerSet
trigger1 = 1
value = 3000
ignorehitpause = 1

2. Permanent Status Flag Immunity

To prevent custom states (which allow opponents to control your character's animations or freeze their logic), the tracking system constantly clears state exceptions and forces continuous execution of survival flags (noko).

[State -2, AssertSpecial]
type = AssertSpecial
trigger1 = 1
flag = noko
flag2 = noautoturn
flag3 = noshadow
ignorehitpause = 1

[State -2, Hit Override Defense]
type = HitOverride
trigger1 = 1
attr = SCA, AA, AT, AP
stateno = 0
time = 1
forceair = 1
ignorehitpause = 1

3. Variable Protection Loop

The core of the immunity tracking involves declaring explicit fvar (float variable) and var (integer variable) spaces that store validation strings. If a supernull character attempts to wipe your variable memory space, these blocks instantly re-initialize their secure values within the same frame.

[State -2, Variable Safety Lock]
type = VarSet
trigger1 = var(0) != 777
var(0) = 777
ignorehitpause = 1

[State -2, System Disruption Defense]
type = NotHitBy
trigger1 = 1
value = SCA, AA, AT, AP
time = 1
ignorehitpause = 1

---

Advanced Supplementary Layer: Memory-Based Address Lockups

When battling characters built on the IKEMEN:VOID or highly modified WinM.U.G.E.N platforms, standard internal CNS triggers can sometimes be overridden if a rival character establishes a deep pointer hook or a buffer exploit. To supplement the variable loop, advanced authors integrate internal memory-space validation using exploit-based structures directly inside the CNS array.

1. Array Over-Indexing (Pointer Hijacking) Protection

By forcing the engine's internal array readers to consistently parse a targeted out-of-bounds address, the character creates an un-writable buffer block around its own player struct data. This blocks opponent characters from executing remote VarSet or ParentVarSet commands.

[State -2, Anchor Out-Of-Bounds Read]
type = VarSet
trigger1 = (Var(59) := 0) || 1
trigger1 = (fvar(39) := 0.0) || 1
; Forces engine pointer calculation loop away from critical player structure offsets
var(59) = (10000 + (id * 4)) 
ignorehitpause = 1

2. State Definition Lockout (Nulling State Interceptors)

To ensure that an opponent's ReversalDef or custom state controller (TargetState) cannot force your character into state 5050 or other vulnerable hardcoded fall states, a self-referential loop must be placed at the absolute top of the processing stack in Statedef -2.

[State -2, State Lockout Safeguard]
type = SelfState
trigger1 = StateNo != [0, 50] ; Restricts valid states exclusively to basic idle/neutral animations
trigger1 = StateNo != 0
value = 0
ctrl = 1
ignorehitpause = 1

---

Engine Architecture Analysis: WinM.U.G.E.N vs. IKEMEN Memory Targets

To fully fine-tune array over-indexing triggers, you must account for the structural differences in how winmugen.exe (a 32-bit Win32 executable written in C++) and IKEMEN Go (a modern multi-threaded executable written in Go) store player definitions in RAM.

Structural Memory Offset Layouts

Target Element	WinM.U.G.E.N (32-bit Explicit Offsets)	IKEMEN Engine (Go Reflection Structs)	Exploit Vector Strategy
Player Base Address	0x00400000 + Dynamic Pointer Offset	Slices via Go Runtime Heap Allocations	MUGEN uses direct integer arithmetic overflows; IKEMEN requires out-of-bounds index passing in engine-exposed functions.
Integer Variable Array	Base + 0x4B8 (Indexed 0 - 59)	Managed []int32 Slice Map Structure	Overindexing past var(59) in standard MUGEN corrupts adjacent floats; IKEMEN requires exploiting specific un-sanitized backport bindings.
Float Variable Array	Base + 0x5A8 (Indexed 0 - 39)	Managed []float32 Slice Map Structure	Targeting float arrays past index 39 in older targets overwrites core structural life metrics directly.
Player Life Offset	Base + 0x5B4	Player.Life struct property interface	Direct freeze value injection.
State Number (StateNo)	Base + 0x140	Internal State Machine Pointer Structure	Locked through the SelfState loop framework outlined in Step 4.

Refining Over-Indexing Triggers in CNS

Because WinM.U.G.E.N calculates variable storage via sequential memory allocation blocks, writing to an out-of-bounds index like var(84) or fvar(62) shifts the execution pointer downstream. This alters structural memory data fields like the execution ID or active animation frame timers.

[State -2, WinMUGEN Overflow Target Anchor]
type = VarSet
trigger1 = IsHelper = 0
; Index 124 maps past standard variable blocks straight into system flag pointers
sysvar(4) = 0x004B8D10
ignorehitpause = 1

[State -2, IKEMEN Execution Layer Flood]
type = ParentVarSet
trigger1 = IsHelper
; IKEMEN engine handles loops via isolated threads; flooding helper generation breaks registration limits
var(0) = (id * 0x10) + 1
ignorehitpause = 1