God of War [Engine:Unknown]

[b1ackhand5]

Rather than adding the shields with commands is it possible to change the game dificulity to "give me god of war" with the console?

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[Wulf]

Rather than adding the shields with commands is it possible to change the game dificulity to "give me god of war" with the console?

If you're on 1.04, change GoW.exe+1069094 to 3 then save and reload.

[b1ackhand5]

Rather than adding the shields with commands is it possible to change the game dificulity to "give me god of war" with the console?

If you're on 1.04, change GoW.exe+1069094 to 3 then save and reload.

Thanks, that works. Hopefully it sticks and unlock stuff when I finish the story.

[Wulf]

The game also tracks which difficulties you've beaten at GoW.exe+2235e18.

Set to 8 to say you've beaten GMGOW difficulty, or to 0xF to say you've beaten them all.

I'm not sure if this is the value it uses to track any actual unlocks though, or if it's just a statistic thing.

[Mister Modification]

Most important NG+ Gear I have. You can paste all commands in console and send to game at once. Shop recipes are not crashing your game.

Maybe SunBeam can add this stuff to his excel file.
Quoting him now ...

Commands are for the following at highest upgrade level:

1. Axe Pommels
2. Blade Pommels
3. Talisman
4. Valkyrie, Zeus and Ares armor parts

Also I give you people a chance to add more stuff with the cheat table I uploaded.

How to use?

Activate script.
Go to shop menu ingame.
Go into Sell menu.
Browse your stuff.
For the item you currently selected ingame you will get the right command as string in cheat engine.
And NO: Does not work with spells ...

But why don't you name every item or gear, you naughty Mister?

1. Every command has a AddResource counterpart in Sun Beam's table.
2. You can decide what YOU wanna buy from the stuff appearing in YOUR shop.

Code: Select all

game.Wallets.AddRecipe("HERO", "Recipe_Perk_Offense_OnMeleeDamage_ProcLightning_Tier03_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_Perk_Offense_OnMeleeDamage_HealthDrain_Tier02_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_Perk_Weapon_Muspelheim_Tier04_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_NifleheimSpecial01_Tier04_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_NifleheimSpecial02_Tier04_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_Axe_Valkyrie01_Tier05_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_Axe_Valkyrie02_Tier05_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_Axe_QueenValkyrie01_Tier05_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_Perk_Weapon_Niflheim_Tier04_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_Axe_Finisher_Tier03_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_Axe_AllStats_Tier05_Reinforce_3_BuyBack_NGP")


game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_Blades_Nidavellir01_Tier04_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_Blades_Valkyrie01_Tier05_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_Blades_Muspelheim01_Tier04_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_WeaponComponent_Blades_OnDamage_ProcFire_Reinforce_2_BuyBack_NGP")


game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorTrinket_Gauntlet_Tier03_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorTrinket_Parry_Tier09_Reinforce_3_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_Perk_Talisman_WeaponSpecials_Runic_Shop_Tier02_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorTrinket_RageMode_Shop_Tier02_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_Perk_Talisman_Niflheim_Tier05_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorTrinket_EmpoweringRift_Tier03_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_Perk_Utility_Focus_Mode_Tier09_Reinforce_3_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_Perk_Defense_OnBlock_ActiveAbsorb_Tier03_Reinforce_3_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorTrinket_HealthBurst_Tier02_Reinforce_3_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorTrinket_Valkyrie_Tier05_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorTrinket_CurseActivation_Tier03_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_Perk_Talisman_Muspelheim_Tier05_Reinforce_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorTrinket_FrostActivation_Tier03_Reinforce_2_BuyBack_NGP")


game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorChest_ValkyrieSet_Tier06_Reinforcement_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorWrist_ValkyrieSet_Tier06_Reinforcement_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorLegs_ValkyrieSet_Tier06_Reinforcement_2_BuyBack_NGP")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorChest_Bonus02_Reinforce2_BuyBack")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorWrist_Bonus02_Reinforce2_BuyBack")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorLegs_Bonus02_Reinforce2_BuyBack")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorLegs_Bonus03_Reinforce2_BuyBack")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorChest_Bonus03_Reinforce2_BuyBack")
game.Wallets.AddRecipe("HERO", "Recipe_KratosArmorWrist_Bonus03_Reinforce2_BuyBack")

[Postposterous]

Can the Axe be replaced to spawn other objects when thrown? Like NPC's?

[machinegunpuppy]

Is there any way to have the leviathan axe and chaos blades at max elemental charge at all times?

[machinegunpuppy]

Has anybody found the ID of grip of tanngiost+ ??
Thanks very much in advance!

check my posts on page 36

[SunBeam]

you know what an offsets is?

Listen, bud, I would appreciate it if you took some time to research on the people you're replying to:

• I have been with FRF for quite a few years now (even before 2018, see Cheat Engine Forums)

• I have ~4K posts here

• I am an Admin

• I have posted quite a few tables and articles about reverse engineering and game-hacking

• I have been studying God of War since the first day it was released, hence the table posted here which can do several things other tables/trainers out there don't

• I am explaining every time what I come up with, in this or aSwedishMagyar's topic related to this game, so people know my process thought

• I am not hacking only THIS GAME, read up on my stuff in other topics

• put a little more interest and contribute more than your 2 posts and you'll be on a good path

• here for just telling us your discoveries and considering what others have to say an insult to your knowledge? say no more and we stop talking

Now, with all that in mind, do you really think you should ask me what an offset is? And you also asked it as a plural. Yeah, sure, typo.

I will explain it one more time, so you get it into your thick skull: unless the address (base_address+0x02BA14D0) you appointed is used in executable code instructions by the game, it's not good practice just pointing us to a static and saying "hey, it works; and if it works for me, it will work for you", as well as if someone says it doesn't for them go like "I dunno, it works for me; sucks for you". That's not professionalism and you have a long way to go.

Practically speaking, in 1.0.3, if you go to "base_address+0x02BA14D0" (I have to assume here 'base_address' is ImageBase) and set a breakpoint there (find out what accesses this address) to see if it's used by any executable code instruction in the game, you will see no results in the debug window. Which means the game doesn't use it. The same thing if you do a memory scan for it: main CE GUI, 8 bytes, tick Hex, paste address in, Scan. You will find 0 results pointing to it. So you can't use it as some static pointer or whatnot.

In my experience, if that's not used by the game directly, then I won't use your address. Why? Because I have had that happening a lot of times when I too was a noob and it didn't work for others. Till I learned my lesson. That's also why I don't use CE's pointer scan often, cuz I know a lot of the pointer paths aren't actively used by the game, just computed at that specific moment in time when the game's running. And I haven't yet met people who just do a pointer scan, close the game, then repeat the process to filter the list out and see which ones left in the list are still valid. No, all people do is a 1-time scan and that's all. They just post some path and we're to believe the path is stable, that it won't point to invalid memory on our ends...

If you can't explain how the game is making use of "base_address+0x02BA14D0", then.. again.. it's bad practice telling people they could just use your address in whatever scripts/tables they're going to make. And ending it with "feel free to post more offsets and quote my comment".

And when I am telling you my thoughts and correcting you along the way, what do you do? Tell me to fuck off cuz you know better. Well, then, I am really interested in seeing what comes up from that "base_address+0x02BA14D0" of yours. Please teach us some more.

Lastly, whenever you post something that is your own personal thought process or naming, say so. Cuz there are names for structures and RTTI indicators pointing to real-dev given names to objects in-game. And not just fabrications or prefixing with "gow" cuz you felt like it. By the way, it's "artemis", not 'atremis'.

P.S.: If you'll continue with "you don't know who I am to talk to me like that", then please, by any means, post a topic in General Discussions and talk about yourself, your work, your experience, who you are and so on. Cuz we really don't know. And yes, post count matters, cuz it tells us how dedicated you are to this forum and how willing you are to stay. Everyone's in for some personal agenda, mostly to show off or share something real quick, then they're gone for months, spending their times on Discords or other forums they like. Which isn't wrong; it's just if you don't plan to stick around FRF, let us know early, so we don't waste our time. Much like my post here will feel like after 1-2 weeks, if you don't intend to reply.

[Postposterous]

• I have been studying God of War since the first day it was released

Have you found any means to spawn NPC's? From what I've read here, seems like the potential might be there, but haven't seen it mentioned. Some means to spawn NPC's and scale them would be amazing. Buffs are cool, but I like to get weird. Thanks in advance! Amazing stuff as usual.

[SunBeam]

I have mentioned several times that this game's Engine isn't your usual type. The "NPC"s are actual Lua VMs. Spawning an NPC would mean instantiating a Lua VM from ground up. I don't think I saw any command through the Lua files that does this, but maybe I am rushing to conclusions Do correct me when you've found a way.

[spunko]

So, is it imposible to revive a valkyrie for example?

I killed the valkyrie in Niflheim, got the goodies and restarted from checkpoint. Somehow it bugged the game, the valkyrie icon is still on the map but there is no valky (it tracked in goals), the golden chest is always open and now can't get any Anchor of Fog =(

[Wulf]

By the way, it's "artemis", not 'atremis'

The kid's name is Atreus, right? That's probably what he meant.

That's also why I don't use CE's pointer scan often, cuz I know a lot of the pointer paths aren't actively used by the game,

I'll use the pointer scan every so often if I have to trace a call back more than 5 breakpoints or so, but it takes a hell of a lot of restarts/new games before I'll trust a result that I can't verify through the code.

I can confirm that the guy's pointer has been valid every time I've checked it in 1.04 but I also haven't seen any static pointers that I'd trust to reach it directly instead of through the goplayer path I listed above.

[JohnTom_The3rd]

Hey! So...this is my first time posting on a Cheat Engine form. And forgive me if this has already been asked, but is there a command that can revert the Leviathan axe BACK to it's basic form? I'm doing a "canon"/no upgrade run. And I wanted to use the very basic look to the axe, but of course when you meet Brok it forces you to upgrade. I'm not really worried about stats since I'm playing on the easiest difficulty for this run. Plus I have another Cheat Engine table that allows me to edit the overall stats. So...really I just want to downgrade the axe to the basic version. Any help would be much appreciated!

[SunBeam]

Although most of my statements in the previous post are still valid, regarding Cobiy's stuff, I decided to give it one more look. I started checking at GoW.exe+2BA14D0 and noticed the pointer @+0x08 is written to when the game is initializing, before the "Sony Interactive presents" video. Determining who writes to that spot led to this function:



RCX is 0x00007FF3B7519520. The address Cobiy is pointing to is obtained from this spot:

Code: Select all

0000000140735CAC | 48:8BB7 F83B0000 | MOV RSI,QWORD PTR DS:[RDI+3BF8] |

But not directly, but by offsetting RDI with 0x910:

Code: Select all

0000000140735CCD | 48:89BE 18090000 | MOV QWORD PTR DS:[RSI+918],RDI |

0x910 is his address (GoW.exe+2BA14D0).

Then I let the game open and what do you know.. I already have this covered. If you use my table, activate [ Initialize ] script, then Ctrl+G in bottom part of Memory Viewer and go to g_goPlayer, you will see a pointer there. In my case:



Then if you check that pointer's memory, you will see this:



Now if you look at the picture above, at +0x8 pointer, you will find that it is the RCX == 0x00007FF3B7519520 address I was referencing above. So [goPlayer + 0x8].

Furthermore, by the logic I found here through researching the game's Engine in 1.0.2, this is FindSon Lua function:

Code: Select all

00000001407E9810 | 40:53                            | PUSH RBX                                               |
00000001407E9812 | 48:83EC 20                       | SUB RSP,20                                             |
00000001407E9816 | 48:8B05 E3239C00                 | MOV RAX,QWORD PTR DS:[1411ABC00]                       |
00000001407E981D | 48:8BD9                          | MOV RBX,RCX                                            |
00000001407E9820 | 48:85C0                          | TEST RAX,RAX                                           |
00000001407E9823 | 74 3E                            | JE gow.1407E9863                                       |
00000001407E9825 | 48:8B80 20020000                 | MOV RAX,QWORD PTR DS:[RAX+220]                         |
00000001407E982C | 48:85C0                          | TEST RAX,RAX                                           |
00000001407E982F | 74 12                            | JE gow.1407E9843                                       |
00000001407E9831 | 8378 14 02                       | CMP DWORD PTR DS:[RAX+14],2                            |
00000001407E9835 | 75 0C                            | JNE gow.1407E9843                                      |
00000001407E9837 | 48:8B88 583A0000                 | MOV RCX,QWORD PTR DS:[RAX+3A58]                        |
00000001407E983E | 48:85C9                          | TEST RCX,RCX                                           |
00000001407E9841 | 75 04                            | JNE gow.1407E9847                                      |
00000001407E9843 | 33C0                             | XOR EAX,EAX                                            |
00000001407E9845 | EB 06                            | JMP gow.1407E984D                                      |
00000001407E9847 | 48:8B01                          | MOV RAX,QWORD PTR DS:[RCX]                             |
00000001407E984A | FF50 18                          | CALL QWORD PTR DS:[RAX+18]                             |
00000001407E984D | 48:8BD0                          | MOV RDX,RAX                                            |
00000001407E9850 | 48:8BCB                          | MOV RCX,RBX                                            |
00000001407E9853 | E8 1880D5FF                      | CALL gow.140541870                                     |
00000001407E9858 | B8 01000000                      | MOV EAX,1                                              |
00000001407E985D | 48:83C4 20                       | ADD RSP,20                                             |
00000001407E9861 | 5B                               | POP RBX                                                |
00000001407E9862 | C3                               | RET                                                    |
00000001407E9863 | 48:83C4 20                       | ADD RSP,20                                             |
00000001407E9867 | 5B                               | POP RBX                                                |
00000001407E9868 | C3                               | RET                                                    |

Notice 0x220 and 0x3A58 offsets.

Then this:

Code: Select all

0000000140662481 | E8 7A360100                      | CALL gow.140675B00                                     |
0000000140662486 | 48:8B1D AB2DBF01                 | MOV RBX,QWORD PTR DS:[142255238]                       | 00007FF3B75918D0 == g_goPlayer
000000014066248D | 48:85DB                          | TEST RBX,RBX                                           |
0000000140662490 | 74 5B                            | JE gow.1406624ED                                       |
0000000140662492 | 48:8B43 08                       | MOV RAX,QWORD PTR DS:[RBX+8]                           | rax == 00007FF3B7519520
0000000140662496 | 48:8B40 08                       | MOV RAX,QWORD PTR DS:[RAX+8]                           | rax == 00007FF3B79CEAA0
000000014066249A | 48:8B80 00020000                 | MOV RAX,QWORD PTR DS:[RAX+200]                         | rax == 00007FF3B79C96C0
00000001406624A1 | 48:85C0                          | TEST RAX,RAX                                           |
00000001406624A4 | 74 27                            | JE gow.1406624CD                                       |
..
..
00000001406624B0 | 48:85C0                          | TEST RAX,RAX                                           |
00000001406624B3 | 48:8D48 E8                       | LEA RCX,QWORD PTR DS:[RAX-18]                          | rcx == 00007FF3B79C96A8
..
..
0000000140662570 | 48:85C0                          | TEST RAX,RAX                                           |
0000000140662573 | 48:8D48 E0                       | LEA RCX,QWORD PTR DS:[RAX-20]                          | rcx == 00007FF3B79C96A0
0000000140662577 | 48:0F44CF                        | CMOVE RCX,RDI                                          |

Applying those to my goPlayer: [[[goPlayer +0x8] +0x8] +0x200] -0x20 will lead you to the base template:



So yeah, these were known already. In the sense that he's not saying anything new, at least to me.

I'm using 1.0.4 in the above.

BR,
Sun