Starfield [Engine:Creation 2]

Add topics here with methods, analysis, code snippets, mods etc. for a certain game that normally won't make it in the Tables or Requests sections.
User avatar
SunBeam
Administration
Administration
Posts: 4915
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4608

Starfield [Engine:Creation 2]

Post by SunBeam »

Kindly DO NOT POST the achievements enabler proxy DLL from this topic (also anything I personally post in this topic) to other forums/communities (e.g.: Nexus, OCD). Same as you prefer those places, I prefer FRF, having posted and created this exclusively for this community. If you want to spread the news and let others enjoy all of this, help them, etc. then please link them to this post on FRF. Thank you for respecting my choice!




# Intro


This game is popular enough and has a POWERFUL CONSOLE not to require any cheat tables or trainers. I am aware there's going to be a ton of them, as well as mods. It seems the main reason why the console is not used and the main concern a player has is "oh noez, achievements are not awarded". This topic will address some of these aspects. What it will NOT address: cheat tables, trainers or requests. So, really, please don't spam for the things you want, if you don't plan on reading. Visit other topics in the Tables -or- Trainers sections.


# Bypassing Achievements Disabling (Steam, not using any other mods)


The developers added a simple 1-byte check based on which it "achievements get disabled". Notice the "": they don't actually disable them; the BOOL being set to true/1 will cause a simple skip of the piece of code that grants them. The developers thought "the player is gonna transition anyway, plus there's an auto-save system that kicks in every X minutes, so it's enough" -- you got that right: this check happens when a load screen OR auto/manual save occurs. It doesn't happen in any other moment in time during your session.

For instance, it happens on any load screen when this function is being executed:

Code: Select all

public: bool __cdecl TESDataHandler::CheckModsLoaded(bool)
Image

The BOOL is set to 0x1 every time you run specific commands. While initially I thought there's just 2 of them (misled by the "" string reference), know that this happens in 200+ places :)

Image

Image

Since this is x64 and not x86, there's no simple way to just scan for every reference of the pointer/address (where it's used) and patch all 200+ spots to a "mov [],0". An idea was to spawn a thread that would constantly write that 0 value, but why not make use of the game's loops/threads? :P So I picked a spot I know runs constantly: checking on game window - GetActiveWindow, peeking on messages - PeekMessage, TranslateMessage, getting the foreground window and cursor clipping.. Basically a game loop that runs constantly -> public: void __cdecl Main::Run_WindowsMessageLoop(void). The perfect spot to hook and insert our forced 0 write ;)

Image

Analysis put to practice, enter the proxy DLL below which will do 3 things:
  • block achievement disabler BOOL from being set to 0x1
  • restore save-game status to not modded (you need to perform a save yourself to trigger the physical save game's update! yes, this also means that you can "convert" already modded/flagged save games to clean ones this way)
  • disable the pop-up you see for the first time when opening the console with Tilde (~`) key

dxgi.zip
Password: sunbeam
(75.09 KiB) Downloaded 15864 times

UPDATED: No more pop-ups when you hit Tilde (~`) key for the first time.

Download the archive, extract the DLL to your game folder (e.g.: G:\SteamLibrary\steamapps\common\Starfield), (close game if it's running) and re-open the game. You can now use any console command you want and get Steam achievements whenever they occur! As a bonus, wait for an auto-save or perform a manual save yourself and your (MOD)ed save-game will become un-modded :P

How do you know the DLL works: when you press Tilde (~`) key for the first time, you won't see the notification that some commands might disable achievements :P


# Bypassing Achievements Disabling (Steam, wanting to use mods that are named dxgi.dll)


First-up, the DLL above can be renamed to multiple other names, but be aware that not all of them are loaded/used by Starfield:
  • X3DAudio1_7.dll
  • XInput9_1_0.dll
  • xinput1_3.dll
  • dinput8.dll
  • dxgi.dll
On Windows 10 x64, from the names mentioned above, only the following are used by the game (on my end):

Code: Select all

dxgi.dll
dinput8.dll
So, if you're using I dunno what mod from I dunno which modder and their file name is "dxgi.dll", then rename this DLL here to "dinput8.dll" and use both (dxgi.dll would be the other mod; dinput8.dll would be this proxy dll of mine).


# Bypassing Achievements Disabling (Steam, INJECTOR version)


If you don't want to deal with any of the stuff above, then extract the archive below to a folder on your disk, run the game (Steam) and execute IGCSInjector.exe. It is self-implied that you should not be using the proxy dll version, as it will conflict -- requisites will not be found and you'll see an error. You should use either the proxy -OR- the injector. Not both!

StarfieldAB_SteamWithInjector.zip
Password: sunbeam
(226.25 KiB) Downloaded 2405 times

Credits to Otis_Inf for granting permission to bundle his injector.


# Bypassing Achievements Disabling (for UWP/GamePass/Windows Store, INJECTOR version)


The same DLL as above, but with a different injector. To bundle this, I've asked permission from the original author (Wunkolo) to modify the source-code available at [Link] and distribute the binary along with my proxy DLL.

If you play the game on GamePass/Windows Store, then the proxy DLL won't work to be placed in the game folder, as this folder is secured via UWP (located in WindowsApps, with special privileges). Sure, you can dump the game if you want and re-register it to the Microsoft Framework, but I digress. In any case, you can read more on the UWP topic in the github page above or here (replace fearlessrevolution.com in the link with unknowncheats[dot]me).

StarfieldAB_UWPWithInjector.zip
Password: sunbeam
(211.44 KiB) Downloaded 3443 times

Long story short: extract the archive to a folder on your disk, open the game, run UWPInjector.exe and this is what you should see:

Image


# Disabling Background Freeze


Whenever you alt-tab, be it full screen or playing in windowed mode, the game's VM (that's what it is) freezes. The game is paused and the TAB menu is automatically displayed (as if you pressed the TAB key yourself). Well.. I wanted to kill that and let the game run in the background. So I started by looking for common Windows APIs that would lead me to that check: GetForegroundWindow (or any window-related). One thing led to the other and found the spot here:

Image

Simply setting the BOOL to 1 would let the game run in the background.

I then investigated that pointer, just to see wtf it's all about. And saw this:

Image

Inspecting the "aBalwaysctiveG" label showed this:

Image

The string is "bAlwaysActive:General". Meaning "General" section, "bAlwaysActive" setting.

Then if you take a look at the picture above this one, you see "INISettingCollection". Aha! In main game folder there's .ini files. More precisely Starfield.ini (I play the English version, so you may want to tweak the right one for you).

This is called class SettingT<class INISettingCollection> bAlwaysActive.

So:

Image

Look mom, no patching! :P


# IDA FakePDB + x64dbg DB with labels and comments


Attaching here my fake .pdb, containing all RTTI vftable references, as well as my x64dbg database with some labels/comments, so you can use it with the backed-up exe/pdb pair.

Example:

Image

Image

Image


Download » [Link]
ZIP Password: sunbeam


Once the game updates, I won't be posting updated files. Makes no sense to me. To be used only for reverse engineering purposes or by people who actually have a good understanding of debugging/assembly.


# Console Commands


I found this article the MOST COMPREHENSIVE, so you should go for it: [Link]. It has all the commands you'll ever need (even if it's for Fallout 4, they work on Starfield).


Happy gaming,
Sun

khuong
Expert Cheater
Expert Cheater
Posts: 76
Joined: Sat Jan 08, 2022 5:18 pm
Reputation: 43

Re: Starfield [Engine:Creation 2]

Post by khuong »

Appreciate the info dumps as always Sunbeam

Xathian
Noobzor
Noobzor
Posts: 11
Joined: Sun May 21, 2017 12:50 pm
Reputation: 1

Re: Starfield [Engine:Creation 2]

Post by Xathian »

Is there a way you could achieve the same results of the achievement enabler without using dxgi as your proxy DLL? Using that means we can't use ReShade as it also uses dxgi, and reshade is quite nice to have if we're using the DLSS mod as you really need some CAS sharpening with it. You can force the DLSS to work without reshade, but you can't do the CAS without it

User avatar
jonaaa
Expert Cheater
Expert Cheater
Posts: 494
Joined: Thu Apr 06, 2017 6:08 am
Reputation: 155

Re: Starfield [Engine:Creation 2]

Post by jonaaa »

Xathian wrote:
Fri Sep 01, 2023 7:45 pm
Is there a way you could achieve the same results of the achievement enabler without using dxgi as your proxy DLL? Using that means we can't use ReShade as it also uses dxgi, and reshade is quite nice to have if we're using the DLSS mod as you really need some CAS sharpening with it. You can force the DLSS to work without reshade, but you can't do the CAS without it
Can't you just rename the proxy DLL to something else? Like dinput8, winhtttp, etc.

Xathian
Noobzor
Noobzor
Posts: 11
Joined: Sun May 21, 2017 12:50 pm
Reputation: 1

Re: Starfield [Engine:Creation 2]

Post by Xathian »

jonaaa wrote:
Fri Sep 01, 2023 7:54 pm
Xathian wrote:
Fri Sep 01, 2023 7:45 pm
Is there a way you could achieve the same results of the achievement enabler without using dxgi as your proxy DLL? Using that means we can't use ReShade as it also uses dxgi, and reshade is quite nice to have if we're using the DLSS mod as you really need some CAS sharpening with it. You can force the DLSS to work without reshade, but you can't do the CAS without it
Can't you just rename the proxy DLL to something else? Like dinput8, winhtttp, etc.
With ReShade that's very iffy, it's inconsistent if a different proxy will work and more often than not doesn't, it's been an issue with it forever, it was a big issue with modding BL2 while using other mods as nothing but dxgi worked. However I didn't try renaming achievement enabler dll, I will have to try that when I can.

meochan
Noobzor
Noobzor
Posts: 7
Joined: Fri May 06, 2022 10:03 pm
Reputation: 1

Re: Starfield [Engine:Creation 2]

Post by meochan »

Wow this is soooo good and look ma! No mods needed!

dubzz
Cheater
Cheater
Posts: 42
Joined: Sat Aug 05, 2023 10:49 pm
Reputation: 4

Re: Starfield [Engine:Creation 2]

Post by dubzz »

dang it won't let me place it in the xbox file :'(

User avatar
SunBeam
Administration
Administration
Posts: 4915
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4608

Re: Starfield [Engine:Creation 2]

Post by SunBeam »

jonaaa wrote:
Fri Sep 01, 2023 7:54 pm
Xathian wrote:
Fri Sep 01, 2023 7:45 pm
Is there a way you could achieve the same results of the achievement enabler without using dxgi as your proxy DLL? Using that means we can't use ReShade as it also uses dxgi, and reshade is quite nice to have if we're using the DLSS mod as you really need some CAS sharpening with it. You can force the DLSS to work without reshade, but you can't do the CAS without it
Can't you just rename the proxy DLL to something else? Like dinput8, winhtttp, etc.
Yes. You can:
  • X3DAudio1_7.dll
  • XInput9_1_0.dll
  • xinput1_3.dll
  • dinput8.dll
  • dxgi.dll
But.. it's a matter of whether or not the game imports any of the above. I know dxgi.dll is like 99.99% imported by any piece of software, at least on Windows 10 x64. Not sure about the others.

But here, for Starfield, on Windows 10 x64, from the names mentioned above, only the following are used by the game (on my end):

Code: Select all

dxgi.dll
dinput8.dll
Also, keep in mind which of those DLLs above is a game importing is depending on the OS. For instance, I made a proxy dll which people on Windows 10 could rename as dinput8.dll in Deep Rock Galactic, but on Windows 7 x64, dinput8 wasn't imported... So I am not sure how it would behave on Windows 11.. but those are the names.

P.S.: Noticed XInput_1_4.dll is used as well, so I might as well just add it in the proxy for future reference.
dubzz wrote:
Fri Sep 01, 2023 8:41 pm
dang it won't let me place it in the xbox file :'(
Sorry, I don't play Microsoft Store games for this particular reason: U(niversal) W(indows) P(latform) games with a shit ton of useless protection, but annoyance. Not sure why Microsoft is still enforcing this shit... If you manage to get ownership over the game folder -or- move the game content someplace else where there aren't any read-only privileges applied to the folder (you can find tutorials online), then you can use the DLL :P But I'm not gonna teach you that. Self-study, go go go.

dubzz
Cheater
Cheater
Posts: 42
Joined: Sat Aug 05, 2023 10:49 pm
Reputation: 4

Re: Starfield [Engine:Creation 2]

Post by dubzz »

SunBeam wrote:
Fri Sep 01, 2023 8:51 pm
Sorry, I don't play Microsoft Store games for this particular reason: U(niversal) W(indows) P(latform) games with a shit ton of useless protection, but annoyance. Not sure why Microsoft is still enforcing this shit... If you manage to get ownership over the game folder -or- move the game content someplace else where there aren't any read-only privileges applied to the folder (you can find tutorials online), then you can use the DLL :P But I'm not gonna teach you that. Self-study, go go go.
I keep getting an error 0x80004005 when trying to extract the dll no matter where i try to extract it. I'm not getting a prompt for the password am I missing something? I can download other dll's just fine.

khuong
Expert Cheater
Expert Cheater
Posts: 76
Joined: Sat Jan 08, 2022 5:18 pm
Reputation: 43

Re: Starfield [Engine:Creation 2]

Post by khuong »

dubzz wrote:
Fri Sep 01, 2023 9:05 pm
SunBeam wrote:
Fri Sep 01, 2023 8:51 pm
Sorry, I don't play Microsoft Store games for this particular reason: U(niversal) W(indows) P(latform) games with a shit ton of useless protection, but annoyance. Not sure why Microsoft is still enforcing this shit... If you manage to get ownership over the game folder -or- move the game content someplace else where there aren't any read-only privileges applied to the folder (you can find tutorials online), then you can use the DLL :P But I'm not gonna teach you that. Self-study, go go go.
I keep getting an error 0x80004005 when trying to extract the dll no matter where i try to extract it. I'm not getting a prompt for the password am I missing something? I can download other dll's just fine.

Use latest 7zip or WinRar, regular windows compress/unzip won't prompt for password.

User avatar
SunBeam
Administration
Administration
Posts: 4915
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4608

Re: Starfield [Engine:Creation 2]

Post by SunBeam »

dubzz wrote:
Fri Sep 01, 2023 9:05 pm
SunBeam wrote:
Fri Sep 01, 2023 8:51 pm
Sorry, I don't play Microsoft Store games for this particular reason: U(niversal) W(indows) P(latform) games with a shit ton of useless protection, but annoyance. Not sure why Microsoft is still enforcing this shit... If you manage to get ownership over the game folder -or- move the game content someplace else where there aren't any read-only privileges applied to the folder (you can find tutorials online), then you can use the DLL :P But I'm not gonna teach you that. Self-study, go go go.
I keep getting an error 0x80004005 when trying to extract the dll no matter where i try to extract it. I'm not getting a prompt for the password am I missing something? I can download other dll's just fine.
Sorry, can't help you solve your Windows problems. I advise you install a proper archive manager, like 7-Zip or WinRAR. Do not use Windows' default crap, as it more than often causes problems. The password is sunbeam (small letters, pay attention to your Caps-Lock key).
khuong wrote:
Fri Sep 01, 2023 9:11 pm
Use latest 7zip or WinRar, regular windows compress/unzip won't prompt for password.
Indeed.

dubzz
Cheater
Cheater
Posts: 42
Joined: Sat Aug 05, 2023 10:49 pm
Reputation: 4

Re: Starfield [Engine:Creation 2]

Post by dubzz »

ah yeah i wasn't using winrar not sure why it didn't default. I got it downloaded but now the game just crashes. I had reshade installed I assume I just need to uninstall all of those files?

User avatar
SunBeam
Administration
Administration
Posts: 4915
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4608

Re: Starfield [Engine:Creation 2]

Post by SunBeam »

dubzz wrote:
Fri Sep 01, 2023 9:13 pm
ah yeah i wasn't using winrar not sure why it didn't default. I got it downloaded but now the game just crashes. I had reshade installed I assume I just need to uninstall all of those files?
Rename the dll to dinput8.dll if you use ReShade. Kindly read the posts BEFORE yours T_T viewtopic.php?p=313176#p313176. We're not here just to solve your issues or serve you in your posts. Thanks.

dubzz
Cheater
Cheater
Posts: 42
Joined: Sat Aug 05, 2023 10:49 pm
Reputation: 4

Re: Starfield [Engine:Creation 2]

Post by dubzz »

SunBeam wrote:
Fri Sep 01, 2023 9:17 pm
dubzz wrote:
Fri Sep 01, 2023 9:13 pm
ah yeah i wasn't using winrar not sure why it didn't default. I got it downloaded but now the game just crashes. I had reshade installed I assume I just need to uninstall all of those files?
Rename the dll to dinput8.dll if you use ReShade. Kindly read the posts BEFORE yours T_T viewtopic.php?p=313176#p313176. We're not here just to solve your issues or serve you in your posts. Thanks.
Yeah i did read it you said that it was flaky at best and often doesn't work. No need to get upset my guy.
I got it working though, it was a duplicate bink I had in the folder. And nord stopped winrar from default extracting so I was confused for a sec.
Thanks for the help and work on this bad boy it's much appreciated.

User avatar
SunBeam
Administration
Administration
Posts: 4915
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4608

Re: Starfield [Engine:Creation 2]

Post by SunBeam »

dubzz wrote:
Fri Sep 01, 2023 9:24 pm
Yeah i did read it you said that it was flaky at best and often doesn't work. No need to get upset my guy.
I got it working though, it was a duplicate bink I had in the folder. And nord stopped winrar from default extracting so I was confused for a sec.
Thanks for the help and work on this bad boy it's much appreciated.
Glad you figured it out. Enjoy.

Post Reply

Who is online

Users browsing this forum: No registered users