FearLess Cheat Engine

Code: Select all

===========================================
 Game Title    : Civilization VI
 Game Version  : 1.0.0.194 (313929)
 Game Sponsor  : Fennix102
 Process Name  : CivilizationVI.exe
 Relevant Info : 64bits/TBS/New Engine
 Script Version: 2.6
 CE Version    : 6.7
 Release date  : 21-Oct-2017
 Author        : Recifense
 History:
 22-Oct-2016: Preliminary Release 1 (7 features)
 24-Oct-2016: Preliminary Release 2 (6 more features)
 25-Oct-2016: First Release
 02-Nov-2016: Added unit prod in 1 turn (s2.0)
 19-Nov-2016: Release for version 1.0.0.38. (s2.1)
 21-Dec-2016: Release for version 1.0.0.56.
 22-Dec-2016: Fix for Faith (s2.2).
 25-Feb-2017: Release for version 1.0.0.110.
 28-Mar-2017: Release for version 1.0.0.129.
 29-Jul-2017: Release for version 1.0.0.167.
 02-Aug-2017: Fix for "Build District in 1 turn" (s2.4)
 15-Aug-2017: Fix for "Unit Production in 1 Turn" + GPA (s2.5)
 19-Oct-2017: Release for version 1.0.0.194.
 21-Oct-2017: Fix for Faith and Great People Action(s2.6).
 Features:
 - Minimum Gold                  [1]
 - Move unlimited Times          [2]
 - Unic Can Act Again            [3]
 - God Mode                      [4]
 - Research in 1 turn            [5]
 - Construction in 1 turn:       [6]
   - Only Wonders                [7]
 - Unlimited Works for Builders  [8]
 - Build District in 1 turn      [9]
 - Build Project in 1 turn       [A]
 - City Minimum Pop              [B]
 - Minimum Faith                 [C]
 - City Garrison HP              [D]
 - Unit Production in 1 turn     [E]
 - Great People Action (new)     [F]
 - Some Pointers                
===========================================
[1] It will not go under 6600;
[2] Everytime you select a Unit, it will be ready to move;
[3] Everytime you select a Unit, it will be ready to act;
[4] That's it. A unit may dissapear, but it will be alive;
[5] A research per turn;
[6] For every city (player's);
[7] Only wonders will be produced in 1 turn;
[8] No limit for builders;
[9] That's it;
[A] That's it;
[B] The minimum population is 2;
[C] It will not go under 660;
[D] God Mode for City;
[E] For every city (player's);
[F] Great People Actions is set to 3 on selection;
===========================================
[USAGE]
1) Run CE67;
2) Run Game;
3) Start a match from the beginning or loading it;
4) Load the game process "CivilizationVI.exe" or "CivilizationVI_DX12.exe" in CE;
5) Load this table and activate the main script;
5) Now Activate the script of each cheat you want to use;
6) Game On;
===========================================
HOTKEYS:
 None defined
===========================================
[IMPORTANT]
Save your game before unsing the cheats.
===========================================
[INFO]
Tested on Win 10 64bits
===========================================
BIG THANKS to Fennix102 for providing the game.
===========================================
Have fun!

Code: Select all

alloc(ConvertRoutine,1024)
alloc(ConvertBackRoutine,1024)
alloc(TypeName,256)
alloc(ByteSize,4)
alloc(UsesFloat,1)
alloc(CallMethod,1)

TypeName:
db 'Civ 6 Value',0

ByteSize:
dd 4

UsesFloat:
db 0 //Change to 1 if this custom type should be treated as a float

CallMethod:
db 1 //Remove or change to 0 for legacy call mechanism

//The convert routine should hold a routine that converts the data to an integer (in eax)
//function declared as: cdecl int ConvertRoutine(unsigned char *input, PTR_UINT address);
//Note: Keep in mind that this routine can be called by multiple threads at the same time.
ConvertRoutine:
//jmp dllname.functionname
[64-bit]
//or manual:
//parameters: (64-bit)
//rcx=address of input
//rdx=address
mov eax,[rcx] //eax now contains the bytes 'input' pointed to
shr eax,8
//and eax,ffffff

ret
[/64-bit]

[32-bit]
//jmp dllname.functionname
//or manual:
//parameters: (32-bit)
push ebp
mov ebp,esp
//[ebp+8]=address of input
//[ebp+c]=address
//example:
mov eax,[ebp+8] //place the address that contains the bytes into eax
mov eax,[eax] //place the bytes into eax so it's handled as a normal 4 byte value
//and eax,ffffff
shr eax,8

pop ebp
ret
[/32-bit]

//The convert back routine should hold a routine that converts the given integer back to a row of bytes (e.g when the user wats to write a new value)
//function declared as: cdecl void ConvertBackRoutine(int i, PTR_UINT address, unsigned char *output);
ConvertBackRoutine:
//jmp dllname.functionname
//or manual:
[64-bit]
//parameters: (64-bit)
//ecx=input
//rdx=address
//r8=address of output
//example:
shl ecx,8
mov cl,[r8]
mov [r8],ecx //place the integer at the 4 bytes pointed to by r8

ret
[/64-bit]

[32-bit]
//parameters: (32-bit)
push ebp
mov ebp,esp
//[ebp+8]=input
//[ebp+c]=address
//[ebp+10]=address of output
//example:
push eax
push ebx
mov eax,[ebp+8] //load the value into eax
mov ebx,[ebp+10] //load the output address into ebx
shl eax,8
mov al,[ebx]
mov [ebx],eax //write the value into the address
pop ebx
pop eax

pop ebp
ret
[/32-bit]

Code: Select all

[ENABLE]
aobscanmodule(INJECT,GameCore_Base_FinalRelease.dll,8B 82 BC 0E 00 00) // should be unique
alloc(newmem,$1000,"GameCore_Base_FinalRelease.dll"+45595D)

label(code)
label(return)

newmem:
code:
    // Any hook into unit pointer
    push ebx
    // Test playerId (rdx+0x40) == 0
    movzx ebx, [rdx+40]
    test bl, bl
    jne @f
    mov ebx, rdx
    // Promotion flags := p_unit + 0xEB8, p_unit + 0xEBA
    mov byte ptr [ebx+EB8], 1
    mov byte ptr [ebx+EBA], 1
  @@:
    pop ebx

    mov eax,[rdx+00000EBC]
    jmp return

INJECT:
    jmp code
    nop
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
    db 8B 82 BC 0E 00 00

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "GameCore_Base_FinalRelease.dll"+45595D

"GameCore_Base_FinalRelease.dll"+45592A: 48 8B 82 B0 0E 00 00           -  mov rax,[rdx+00000EB0]
"GameCore_Base_FinalRelease.dll"+455931: 49 8B F8                                   -  mov rdi,r8
"GameCore_Base_FinalRelease.dll"+455934: 48 89 44 24 20                     -  mov [rsp+20],rax
"GameCore_Base_FinalRelease.dll"+455939: 48 8B DA                                   -  mov rbx,rdx
"GameCore_Base_FinalRelease.dll"+45593C: 0F B6 82 B8 0E 00 00           -  movzx eax,byte ptr [rdx+00000EB8]
"GameCore_Base_FinalRelease.dll"+455943: 88 44 24 28                            -  mov [rsp+28],al
"GameCore_Base_FinalRelease.dll"+455947: 0F B6 82 B9 0E 00 00           -  movzx eax,byte ptr [rdx+00000EB9]
"GameCore_Base_FinalRelease.dll"+45594E: 88 44 24 29                            -  mov [rsp+29],al
"GameCore_Base_FinalRelease.dll"+455952: 0F B6 82 BA 0E 00 00           -  movzx eax,byte ptr [rdx+00000EBA]
"GameCore_Base_FinalRelease.dll"+455959: 88 44 24 2A                            -  mov [rsp+2A],al
// ---------- INJECTING HERE ----------
"GameCore_Base_FinalRelease.dll"+45595D: 8B 82 BC 0E 00 00              -  mov eax,[rdx+00000EBC]
// ---------- DONE INJECTING    ----------
"GameCore_Base_FinalRelease.dll"+455963: 89 44 24 2C                            -  mov [rsp+2C],eax
"GameCore_Base_FinalRelease.dll"+455967: 8B 82 C0 0E 00 00              -  mov eax,[rdx+00000EC0]
"GameCore_Base_FinalRelease.dll"+45596D: 89 44 24 30                            -  mov [rsp+30],eax
"GameCore_Base_FinalRelease.dll"+455971: E8 DA 27 22 00                     -  call GameCore_Base_FinalRelease.dll+678150
"GameCore_Base_FinalRelease.dll"+455976: 48 8B 93 C8 0E 00 00           -  mov rdx,[rbx+00000EC8]
"GameCore_Base_FinalRelease.dll"+45597D: 48 8D 4C 24 38                     -  lea rcx,[rsp+38]
"GameCore_Base_FinalRelease.dll"+455982: 48 89 44 24 38                     -  mov [rsp+38],rax
"GameCore_Base_FinalRelease.dll"+455987: 44 8B 42 FC                            -  mov r8d,[rdx-04]
"GameCore_Base_FinalRelease.dll"+45598B: E8 70 24 22 00                     -  call GameCore_Base_FinalRelease.dll+677E00
"GameCore_Base_FinalRelease.dll"+455990: 8B 83 D0 0E 00 00              -  mov eax,[rbx+00000ED0]
}