Far Cry 5 [Engine:Dunia Engine 2]

[Vitalus]

[QUOTE="SunBeam, post: 46726, member: 12587"]1) Try to launch the game .exe from a debugger; see what happens. Then try to think where that EB FE bit is important (here's a tip: attaching?).



2) I traced the code manually from game's (DLL) WInMain till the spot after which it crashed. Then figured out why it crashed. As for EAC you could set a breakpoint on LoadLibraryA/W to find out where its DLL is being loaded. Then start tracing from that point onward.



Start with UPX and other light protectors and understand the ASM visually before attempting to "learn" reversing that would only suit your one-time thing or one-time target. I've heard this a lot flaunted around to spot a person who REALLY wants to learn over an impressionist :)



BR,

Sun[/QUOTE]



Thanks Sun,



Launching .exe from debugger just attempts to launch from steam repeatedly until it crashes. Seems like it has some type of boiler plate code that prevents anything else from happening until it's launched from the uPlay DRM. So when you do launch with uPlay, it's a different process and debugger is not connected. Then when re-attaching the debugger, it instantly crashes due to debugger protection not allowing you to reverse anything.



If that is right, then what you did is patch the main game DLL while initially launching the game with an infinite loop on the entry point, so when it is loaded by uPlay you can then attach it before debugging protection is active?



I'm sure that's not 100% correct but I hope I got the right idea.



You are correct, I should start with some simpler stuff before trying this. I will do so.

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[SunBeam]

For the uPlay version launching from main .exe will launch uPlay Launcher, which kills first process, then re-launches .exe with a command line parameter. This parameter is a hash string of your user account, password, game id, etc. Second launch will process this parameter and start-up the game. I need the EB FE in the DLL to do this: first time I start .exe from x64dbg; launcher kills it, but it launches a second process; I attach to this second process and due to EB FE @ EP of DLL, execution will loop there waiting for me to resume it; so I get there, restore bytes and let the game run; tracing along the way.



That's how I got to where EAC's DLL is loaded.



There's no anti-debug.

[Vitalus]

[QUOTE="SunBeam, post: 46731, member: 12587"]For the uPlay version launching from main .exe will launch uPlay Launcher, which kills first process, then re-launches .exe with a command line parameter. This parameter is a hash string of your user account, password, game id, etc. Second launch will process this parameter and start-up the game. I need the EB FE in the DLL to do this: first time I start .exe from x64dbg; launcher kills it, but it launches a second process; I attach to this second process and due to EB FE @ EP of DLL, execution will loop there waiting for me to resume it; so I get there, restore bytes and let the game run; tracing along the way.



That's how I got to where EAC's DLL is loaded.



There's no anti-debug.[/QUOTE]



Thanks. Managed to attach x64dbg with that information. It terminates x64dbg automatically after some point, then a bit later (after it's terminated) message box appears from far cry that FC_m64.dll is an unknown version, presumably because I patched the file and overwrote the original with that loop on entry. While stepping through code at one point I saw EACLaunch file path stored in a register, but that is about as far as I can get seemingly. I set breakpoints on DLL loads, but never is EAC loaded before the debugger terminates. I'm not sure how to find the point right before it's terminating the debugger. I assume that is where I need to be in order to stop that from occurring. My patience wore thin stepping through around so many windows DLLs. I don't know if I am meant to just be patient or if there is a better method for narrowing it down.



I tried for awhile to step through and figure where it's crashing, and set a few breakpoints, but it seems to terminate debugging while in a windows API module instead of the game module. Unfortunately, it seems I am not knowledgeable enough yet to figure it out.



Thanks for the information you gave me though! Very helpful.

[SunBeam]

DLL is loaded the 2nd time around. I take it you have the Steam version which comes with some additional checks. EACLaunch.exe needs to be renamed to something else (anything) so it's not started.

[Darkfiberke]

[QUOTE="SunBeam, post: 46668, member: 12587"]Do post. Will investigate afterwards.[/QUOTE]



assuming you where talking to me, or for general purposes:



so, start fc5, run cheatengine and scan for a HEX value of [B]00002041[/B]



You will find somewhere between 160-190 values. Go to a spot in the game where you can easily go back and forth between out of bounds and back in.



Run the scan again for all unchanges values, and then select all the remaining ones and change ALL of them to [B]00002042 (there is a slim chance the game crashes at this point, just redo it, it crashes maybe once every 20 attempts).[/B]



After changing the value to [B]00002042, [/B]go back to fc5 and go out of bounds and wait until you are teleported back into the game.



Switch to cheatengine now, and look through the list of values with [B]00002042, [/B]there will be 1 value (on VERY rare occasions there are 2 values) that has changed back to [B]00002041[/B], this is the one we are looking for. Going out of bounds always resets this value to [B]00002041[/B]



I ran a "see what access this value", and it shows very interesting stuff with regards to Nomadobjects



I got the value from the fc4 "hack" to change the out of bounds timer => [URL]http://farcrymods.freeforums.net/thread/63/modding-108-change-bounds-timer[/URL]



I could upload some screenshots, but if you follow my simple instructions you will see what I mean ;)

[SunBeam]

[USER=17529]@Darkfiberke[/USER]: Yeah, you I was addressing :) It would've been much simpler posting a screenshot from CE with the debug results (what accesses/writes this address) of that address/value. I can pick it up from there; kinda hate doing trial/error scans. Would you kindly? :) Thanks!

[Darkfiberke]

ha!



No worries man, see attachment ;)



Let me know if you need anything else.

1527162860

[SunBeam]

Will do; checking it tonight. Just an observation: I [I]think[/I] map's 2048x2048 in size.

[Darkfiberke]

[QUOTE="SunBeam, post: 46811, member: 12587"] I [I]think[/I] map's 2048x2048 in size.[/QUOTE]



No idea what you mean by that :D

[SunBeam]

You're looking for 2041 value. Add 7 to it :)



[B]EDIT #1[/B]: Oooh, 2GB+ update to [B]1.06[/B]. And bypass still works flawlessly ;)



[B]EDIT #2[/B]: And you are playing the CPY version, ain't it? Cuz I can't find shit in terms of patterns in 1.06 (based on your screenshot)...

[SunBeam]

OK, found it with the scan method (got 2 values; found the good one).



[IMG]https://i.imgur.com/LxnvL7q.png[/IMG]



[IMG]https://i.imgur.com/LbRuWUD.png[/IMG]



Now what would you do with the value? I have a feeling that isn't the timer you're after. It should be some regular 0-X timer which gets reset to 0 once you return to a safe spot. Float value.



[B]EDIT #1[/B]: As I was saying, found it quite fast. Value is [B]0.0f[/B] to [B]10.0f[/B]. When it hits [I]11.0f[/I] you respawn. And when you respawn or return to a safe area, timer gets reset to [B]0.0f[/B]. Will post resolution in a minute.



[B]EDIT #2[/B]: Here you go...



[IMG]https://i.imgur.com/VAlkmUg.png[/IMG]



If you NOP that JA you will always respawn :) Guess what you have to do vice-versa :p



[img]https://i.imgur.com/Q5A2B4r.png[/img]

[Darkfiberke]

If I try scanning for [B]0.0f[/B] it says it's an invalid value... :/

[SunBeam]

And here's the [B]*proper* [/B](so you don't see that message up-top):



[IMG]https://i.imgur.com/nUA3C1I.png[/IMG]



The condition for the timer to start clocking is RSI (SIL) to be [B]1[/B]. As long as it's [B]0[/B], nothing happens ;) No warning, no timer counting, no respawn. To get this effect done, patch the JNE (75 4F) to NOPs (90 90):



[code]

FC_m64.dll+1B86723 - 75 49 - jne FC_m64.dll+1B8676E

[/code]





to



[code]

FC_m64.dll+1B86723 - 90 - nop

FC_m64.dll+1B86724 - 90 - nop

[/code]





Again, in version [B]1.06[/B]. If you have CPY, just array-scan a pattern in the picture above to find the spot in your version :p Try: [I]75 ?? 44 38 7B 51 75 ?? 48 8B 0D ?? ?? ?? ?? 40 32 F6[/I]:



[IMG]https://i.imgur.com/fsxhiPt.png[/IMG]



Yes, your found address will be different.



BR,

Sun

[SunBeam]

[QUOTE="Darkfiberke, post: 46841, member: 17529"]If I try scanning for [B]0.0f[/B] it says it's an invalid value... :/[/QUOTE]

0.0f is a figure of speech. Search for 0 as Float type (I looked for values [I]between[/I] as the timer counter upwards, combined with pausing the game every now and then; get outside of the map and count in your head as soon as the message appears; use a hotkey to pause game, then search for value between 0 - your counter+2; resume game, keep counting in your head, pause again; search from last counter - 2 till 10; resume game, let it respawn you, search for 0; etc.)



No need to do that anymore, as I gave you the patch spot. Just find it in your version.



[B]EDIT #1[/B]: I dunno exactly what you want to explore as you can run up to 100-200m before you drop out of map. So this crap isn't really worth it :)



[B]EDIT #2[/B]: Come to think about it, I wanna try that one spot where you get respawned over "only youuuuu". This:



[img]https://i.imgur.com/E6amx3b.png[/img]



Let's see if I still get that happening :)

[Darkfiberke]

[QUOTE="SunBeam, post: 46844, member: 12587"]0.0f is a figure of speech. Search for 0 as Float type (I looked for values [I]between[/I] as the timer counter upwards, combined with pausing the game every now and then; get outside of the map and count in your head as soon as the message appears; use a hotkey to pause game, then search for value between 0 - your counter+2; resume game, keep counting in your head, pause again; search from last counter - 2 till 10; resume game, let it respawn you, search for 0; etc.)



No need to do that anymore, as I gave you the patch spot. Just find it in your version.



EDIT: I dunno exactly what you want to explore as you can run up to 100-200m before you drop out of map. So this crap isn't really worth it :)[/QUOTE]



Ok... learning...



question: I dont have the option to "Search for this array", what am I missing?