Re: Forza Horizon 4
Posted: Thu Oct 18, 2018 11:38 pm
I wonder how exactly we could make it so the money sticks like in the Forza Motorsport 7 Cheat table. id love to be able to have max money without the hack enabled.
Community Cheat Tables of Cheat Engine
https://fearlessrevolution.com/
Hey Dude do you know how can i make my money more then 15 million ?Empress_Ravenna wrote: ↑Thu Oct 18, 2018 9:38 pmcant modify Cloudsave you just make sure nets offline before going online, Google will tell you where save location was, something bout WGS folder..
Pretty sure they patched it with the last update on 10-23-18Rubber_Ducky123 wrote: ↑Wed Oct 24, 2018 2:32 amCheat doesn't work for me, the box that you need to check doesn't check no matter what i do. does anyone have any suggestions? or does this cheat just need to be updated?
UnknownByte wrote: ↑Wed Oct 24, 2018 6:55 pmGreetings guys, I just checked and found that Injection point is changed but bytes are not changed. Something like that, if I explained correctly.
Well, I created an table with new Injection point but when I start injecting that table to game process, game is crashing -_-
Could someone help me to fix this crashing trouble, if it possible of course. In advance Thank You so much for your help.
Here (under spoiler) is screenshot where you can see Injection point before update and after update. I hope it will explain more than me.
Spoiler
FullScreen: [Link]
Code: Select all
<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="27">
<CheatEntries>
<CheatEntry>
<ID>13</ID>
<Description>"infCredits"</Description>
<LastState/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>[ENABLE]
aobscanmodule(INJECT,ForzaHorizon4.exe,48 8D 4C 24 50 38 07 75 31 48 8D 57 16 E8 xx xx xx xx 4C 8D 44 24 50)
alloc(newmem,$1000,INJECT) //// use the injection symbol here, as the allocate near address
label(code)
label(return)
newmem:
code:
lea rcx,[rsp+50]
mov [rdi], #17396679699 //// your moving 5 bytes here,
//// but the game compares it with a single byte, you should double check your value types.
//// And MOV will only take a 32 bit value as an immediate when writing to memory.
//// But it will take a 64 bit immediate when writing to a registry.
//// i.e:
// push rax
// mov rax,000000040CEC4413
// mov [rdi],rax
// pop rax
jmp return
INJECT:
jmp newmem
return:
registersymbol(INJECT)
[DISABLE]
INJECT:
db 48 8D 4C 24 50
unregistersymbol(INJECT)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "ForzaHorizon4.exe"+5A2CAA
"ForzaHorizon4.exe"+5A2C83: E8 38 6D 23 02 - call ForzaHorizon4.exe+27D99C0
"ForzaHorizon4.exe"+5A2C88: 48 8B D8 - mov rbx,rax
"ForzaHorizon4.exe"+5A2C8B: 48 89 44 24 68 - mov [rsp+68],rax
"ForzaHorizon4.exe"+5A2C90: 48 83 38 00 - cmp qword ptr [rax],00
"ForzaHorizon4.exe"+5A2C94: 74 0A - je ForzaHorizon4.exe+5A2CA0
"ForzaHorizon4.exe"+5A2C96: 48 8B C8 - mov rcx,rax
"ForzaHorizon4.exe"+5A2C99: FF 15 A9 49 E9 06 - call qword ptr [ForzaHorizon4.exe+7437648]
"ForzaHorizon4.exe"+5A2C9F: 90 - nop
"ForzaHorizon4.exe"+5A2CA0: 0F B6 47 15 - movzx eax,byte ptr [rdi+15]
"ForzaHorizon4.exe"+5A2CA4: 41 B8 04 00 00 00 - mov r8d,00000004
// ---------- INJECTING HERE ----------
"ForzaHorizon4.exe"+5A2CAA: 48 8D 4C 24 50 - lea rcx,[rsp+50]
// ---------- DONE INJECTING ----------
"ForzaHorizon4.exe"+5A2CAF: 38 07 - cmp [rdi],al
"ForzaHorizon4.exe"+5A2CB1: 75 31 - jne ForzaHorizon4.exe+5A2CE4
"ForzaHorizon4.exe"+5A2CB3: 48 8D 57 16 - lea rdx,[rdi+16]
"ForzaHorizon4.exe"+5A2CB7: E8 95 45 53 07 - call ForzaHorizon4.exe+7AD7251
"ForzaHorizon4.exe"+5A2CBC: 4C 8D 44 24 50 - lea r8,[rsp+50]
"ForzaHorizon4.exe"+5A2CC1: 33 C0 - xor eax,eax
"ForzaHorizon4.exe"+5A2CC3: 8D 50 B4 - lea edx,[rax-4C]
"ForzaHorizon4.exe"+5A2CC6: 41 32 10 - xor dl,[r8]
"ForzaHorizon4.exe"+5A2CC9: 48 63 C8 - movsxd rcx,eax
"ForzaHorizon4.exe"+5A2CCC: 88 54 0C 58 - mov [rsp+rcx+58],dl
}
</AssemblerScript>
</CheatEntry>
</CheatEntries>
<UserdefinedSymbols/>
</CheatTable>
Thank You for you answer, I tried it, but like before, game is crashing.ShyTwig16 wrote: ↑Wed Oct 24, 2018 7:51 pmUnknownByte wrote: ↑Wed Oct 24, 2018 6:55 pmGreetings guys, I just checked and found that Injection point is changed but bytes are not changed. Something like that, if I explained correctly.
Well, I created an table with new Injection point but when I start injecting that table to game process, game is crashing -_-
Could someone help me to fix this crashing trouble, if it possible of course. In advance Thank You so much for your help.
Here (under spoiler) is screenshot where you can see Injection point before update and after update. I hope it will explain more than me.
Spoiler
FullScreen: [Link][Link]Code: Select all
<?xml version="1.0" encoding="utf-8"?> <CheatTable CheatEngineTableVersion="27"> <CheatEntries> <CheatEntry> <ID>13</ID> <Description>"infCredits"</Description> <LastState/> <VariableType>Auto Assembler Script</VariableType> <AssemblerScript>[ENABLE] aobscanmodule(INJECT,ForzaHorizon4.exe,48 8D 4C 24 50 38 07 75 31 48 8D 57 16 E8 xx xx xx xx 4C 8D 44 24 50) alloc(newmem,$1000,INJECT) //// use the injection symbol here, as the allocate near address label(code) label(return) newmem: code: lea rcx,[rsp+50] mov [rdi], #17396679699 //// your moving 5 bytes here, //// but the game compares it with a single byte, you should double check your value types. //// And MOV will only take a 32 bit value as an immediate when writing to memory. //// But it will take a 64 bit immediate when writing to a registry. //// i.e: // push rax // mov rax,000000040CEC4413 // mov [rdi],rax // pop rax jmp return INJECT: jmp newmem return: registersymbol(INJECT) [DISABLE] INJECT: db 48 8D 4C 24 50 unregistersymbol(INJECT) dealloc(newmem) { // ORIGINAL CODE - INJECTION POINT: "ForzaHorizon4.exe"+5A2CAA "ForzaHorizon4.exe"+5A2C83: E8 38 6D 23 02 - call ForzaHorizon4.exe+27D99C0 "ForzaHorizon4.exe"+5A2C88: 48 8B D8 - mov rbx,rax "ForzaHorizon4.exe"+5A2C8B: 48 89 44 24 68 - mov [rsp+68],rax "ForzaHorizon4.exe"+5A2C90: 48 83 38 00 - cmp qword ptr [rax],00 "ForzaHorizon4.exe"+5A2C94: 74 0A - je ForzaHorizon4.exe+5A2CA0 "ForzaHorizon4.exe"+5A2C96: 48 8B C8 - mov rcx,rax "ForzaHorizon4.exe"+5A2C99: FF 15 A9 49 E9 06 - call qword ptr [ForzaHorizon4.exe+7437648] "ForzaHorizon4.exe"+5A2C9F: 90 - nop "ForzaHorizon4.exe"+5A2CA0: 0F B6 47 15 - movzx eax,byte ptr [rdi+15] "ForzaHorizon4.exe"+5A2CA4: 41 B8 04 00 00 00 - mov r8d,00000004 // ---------- INJECTING HERE ---------- "ForzaHorizon4.exe"+5A2CAA: 48 8D 4C 24 50 - lea rcx,[rsp+50] // ---------- DONE INJECTING ---------- "ForzaHorizon4.exe"+5A2CAF: 38 07 - cmp [rdi],al "ForzaHorizon4.exe"+5A2CB1: 75 31 - jne ForzaHorizon4.exe+5A2CE4 "ForzaHorizon4.exe"+5A2CB3: 48 8D 57 16 - lea rdx,[rdi+16] "ForzaHorizon4.exe"+5A2CB7: E8 95 45 53 07 - call ForzaHorizon4.exe+7AD7251 "ForzaHorizon4.exe"+5A2CBC: 4C 8D 44 24 50 - lea r8,[rsp+50] "ForzaHorizon4.exe"+5A2CC1: 33 C0 - xor eax,eax "ForzaHorizon4.exe"+5A2CC3: 8D 50 B4 - lea edx,[rax-4C] "ForzaHorizon4.exe"+5A2CC6: 41 32 10 - xor dl,[r8] "ForzaHorizon4.exe"+5A2CC9: 48 63 C8 - movsxd rcx,eax "ForzaHorizon4.exe"+5A2CCC: 88 54 0C 58 - mov [rsp+rcx+58],dl } </AssemblerScript> </CheatEntry> </CheatEntries> <UserdefinedSymbols/> </CheatTable>