Forza Horizon 4

[DawkRacing]

I wonder how exactly we could make it so the money sticks like in the Forza Motorsport 7 Cheat table. id love to be able to have max money without the hack enabled.

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[FozexD]

cant modify Cloudsave you just make sure nets offline before going online, Google will tell you where save location was, something bout WGS folder..

Hey Dude do you know how can i make my money more then 15 million ?

[Empress_Ravenna]

dude??.... nope.. and to answer the 15mill, its already answered in previous pages.. and the table by default puts u at Max credits when enabled..

[Empress_Ravenna]

yep.. i cant get wheelspins to work.. someone else can try or its just not possible in FH4 vs 3..

[beamnger]

Hey I used this cheat and it works great! Thumbs up for the dev But when I tried to change the 15 million value in the script I can't find it, can anyone help me out here? Thanks

[beamnger]

Nvm I found it

[demoncamber]

There's apparently some other hacks out in the wild. Was online last night and saw some guy in a lambo randomly jumping multiple times, also seemed to have super fast speed and handling.

[SirWilliam]

Did they just update the game and block this cheat table ?

[Rubber_Ducky123]

Cheat doesn't work for me, the box that you need to check doesn't check no matter what i do. does anyone have any suggestions? or does this cheat just need to be updated?

[SirWilliam]

Cheat doesn't work for me, the box that you need to check doesn't check no matter what i do. does anyone have any suggestions? or does this cheat just need to be updated?

Pretty sure they patched it with the last update on 10-23-18

[Evo]

Thankfully I have more than enough money to buy whatever I want.

[UnknownByte]

Doesn't work anymore

[TimFun13]

Greetings guys, I just checked and found that Injection point is changed but bytes are not changed. Something like that, if I explained correctly.
Well, I created an table with new Injection point but when I start injecting that table to game process, game is crashing -_-
Could someone help me to fix this crashing trouble, if it possible of course. In advance Thank You so much for your help.

Here (under spoiler) is screenshot where you can see Injection point before update and after update. I hope it will explain more than me.

Spoiler

FullScreen: [Link]

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="27">
  <CheatEntries>
    <CheatEntry>
      <ID>13</ID>
      <Description>"infCredits"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]

aobscanmodule(INJECT,ForzaHorizon4.exe,48 8D 4C 24 50 38 07 75 31 48 8D 57 16 E8 xx xx xx xx 4C 8D 44 24 50)
alloc(newmem,$1000,INJECT) //// use the injection symbol here, as the allocate near address

label(code)
label(return)

newmem:

code:
  lea rcx,[rsp+50]
  mov [rdi], #17396679699 //// your moving 5 bytes here, 
  //// but the game compares it with a single byte, you should double check your value types.

  //// And MOV will only take a 32 bit value as an immediate when writing to memory.
  //// But it will take a 64 bit immediate when  writing to a registry.
  //// i.e:
  // push rax
  // mov rax,000000040CEC4413
  // mov [rdi],rax
  // pop rax
  jmp return

INJECT:
  jmp newmem
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 48 8D 4C 24 50

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "ForzaHorizon4.exe"+5A2CAA

"ForzaHorizon4.exe"+5A2C83: E8 38 6D 23 02              -  call ForzaHorizon4.exe+27D99C0
"ForzaHorizon4.exe"+5A2C88: 48 8B D8                    -  mov rbx,rax
"ForzaHorizon4.exe"+5A2C8B: 48 89 44 24 68              -  mov [rsp+68],rax
"ForzaHorizon4.exe"+5A2C90: 48 83 38 00                 -  cmp qword ptr [rax],00
"ForzaHorizon4.exe"+5A2C94: 74 0A                       -  je ForzaHorizon4.exe+5A2CA0
"ForzaHorizon4.exe"+5A2C96: 48 8B C8                    -  mov rcx,rax
"ForzaHorizon4.exe"+5A2C99: FF 15 A9 49 E9 06           -  call qword ptr [ForzaHorizon4.exe+7437648]
"ForzaHorizon4.exe"+5A2C9F: 90                          -  nop 
"ForzaHorizon4.exe"+5A2CA0: 0F B6 47 15                 -  movzx eax,byte ptr [rdi+15]
"ForzaHorizon4.exe"+5A2CA4: 41 B8 04 00 00 00           -  mov r8d,00000004
// ---------- INJECTING HERE ----------
"ForzaHorizon4.exe"+5A2CAA: 48 8D 4C 24 50              -  lea rcx,[rsp+50]
// ---------- DONE INJECTING  ----------
"ForzaHorizon4.exe"+5A2CAF: 38 07                       -  cmp [rdi],al
"ForzaHorizon4.exe"+5A2CB1: 75 31                       -  jne ForzaHorizon4.exe+5A2CE4
"ForzaHorizon4.exe"+5A2CB3: 48 8D 57 16                 -  lea rdx,[rdi+16]
"ForzaHorizon4.exe"+5A2CB7: E8 95 45 53 07              -  call ForzaHorizon4.exe+7AD7251
"ForzaHorizon4.exe"+5A2CBC: 4C 8D 44 24 50              -  lea r8,[rsp+50]
"ForzaHorizon4.exe"+5A2CC1: 33 C0                       -  xor eax,eax
"ForzaHorizon4.exe"+5A2CC3: 8D 50 B4                    -  lea edx,[rax-4C]
"ForzaHorizon4.exe"+5A2CC6: 41 32 10                    -  xor dl,[r8]
"ForzaHorizon4.exe"+5A2CC9: 48 63 C8                    -  movsxd  rcx,eax
"ForzaHorizon4.exe"+5A2CCC: 88 54 0C 58                 -  mov [rsp+rcx+58],dl
}
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
  <UserdefinedSymbols/>
</CheatTable>

[Link]

[UnknownByte]

Greetings guys, I just checked and found that Injection point is changed but bytes are not changed. Something like that, if I explained correctly.
Well, I created an table with new Injection point but when I start injecting that table to game process, game is crashing -_-
Could someone help me to fix this crashing trouble, if it possible of course. In advance Thank You so much for your help.

Here (under spoiler) is screenshot where you can see Injection point before update and after update. I hope it will explain more than me.

Spoiler

FullScreen: [Link]

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable CheatEngineTableVersion="27">
  <CheatEntries>
    <CheatEntry>
      <ID>13</ID>
      <Description>"infCredits"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]

aobscanmodule(INJECT,ForzaHorizon4.exe,48 8D 4C 24 50 38 07 75 31 48 8D 57 16 E8 xx xx xx xx 4C 8D 44 24 50)
alloc(newmem,$1000,INJECT) //// use the injection symbol here, as the allocate near address

label(code)
label(return)

newmem:

code:
  lea rcx,[rsp+50]
  mov [rdi], #17396679699 //// your moving 5 bytes here, 
  //// but the game compares it with a single byte, you should double check your value types.

  //// And MOV will only take a 32 bit value as an immediate when writing to memory.
  //// But it will take a 64 bit immediate when  writing to a registry.
  //// i.e:
  // push rax
  // mov rax,000000040CEC4413
  // mov [rdi],rax
  // pop rax
  jmp return

INJECT:
  jmp newmem
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 48 8D 4C 24 50

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "ForzaHorizon4.exe"+5A2CAA

"ForzaHorizon4.exe"+5A2C83: E8 38 6D 23 02              -  call ForzaHorizon4.exe+27D99C0
"ForzaHorizon4.exe"+5A2C88: 48 8B D8                    -  mov rbx,rax
"ForzaHorizon4.exe"+5A2C8B: 48 89 44 24 68              -  mov [rsp+68],rax
"ForzaHorizon4.exe"+5A2C90: 48 83 38 00                 -  cmp qword ptr [rax],00
"ForzaHorizon4.exe"+5A2C94: 74 0A                       -  je ForzaHorizon4.exe+5A2CA0
"ForzaHorizon4.exe"+5A2C96: 48 8B C8                    -  mov rcx,rax
"ForzaHorizon4.exe"+5A2C99: FF 15 A9 49 E9 06           -  call qword ptr [ForzaHorizon4.exe+7437648]
"ForzaHorizon4.exe"+5A2C9F: 90                          -  nop 
"ForzaHorizon4.exe"+5A2CA0: 0F B6 47 15                 -  movzx eax,byte ptr [rdi+15]
"ForzaHorizon4.exe"+5A2CA4: 41 B8 04 00 00 00           -  mov r8d,00000004
// ---------- INJECTING HERE ----------
"ForzaHorizon4.exe"+5A2CAA: 48 8D 4C 24 50              -  lea rcx,[rsp+50]
// ---------- DONE INJECTING  ----------
"ForzaHorizon4.exe"+5A2CAF: 38 07                       -  cmp [rdi],al
"ForzaHorizon4.exe"+5A2CB1: 75 31                       -  jne ForzaHorizon4.exe+5A2CE4
"ForzaHorizon4.exe"+5A2CB3: 48 8D 57 16                 -  lea rdx,[rdi+16]
"ForzaHorizon4.exe"+5A2CB7: E8 95 45 53 07              -  call ForzaHorizon4.exe+7AD7251
"ForzaHorizon4.exe"+5A2CBC: 4C 8D 44 24 50              -  lea r8,[rsp+50]
"ForzaHorizon4.exe"+5A2CC1: 33 C0                       -  xor eax,eax
"ForzaHorizon4.exe"+5A2CC3: 8D 50 B4                    -  lea edx,[rax-4C]
"ForzaHorizon4.exe"+5A2CC6: 41 32 10                    -  xor dl,[r8]
"ForzaHorizon4.exe"+5A2CC9: 48 63 C8                    -  movsxd  rcx,eax
"ForzaHorizon4.exe"+5A2CCC: 88 54 0C 58                 -  mov [rsp+rcx+58],dl
}
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
  <UserdefinedSymbols/>
</CheatTable>

[Link]

Thank You for you answer, I tried it, but like before, game is crashing.

[Alibaba]

I think ShyTwig16 also pointed out something here, which I don't know what to do:

lea rcx,[rsp+50]
mov [rdi], #17396679699 //// your moving 5 bytes here,
//// but the game compares it with a single byte, you should double check your value types.

//// And MOV will only take a 32 bit value as an immediate when writing to memory.
//// But it will take a 64 bit immediate when writing to a registry.
//// i.e:
// push rax
// mov rax,000000040CEC4413
// mov [rdi],rax
// pop rax