Tom Clancy's Ghost Recon Wildlands

[942826468]

It might be for the UPlay version, I think the exe files differ a bit which might affect table compatibility.

Since my game is the newest (2415526) and this table is released a day ago, I think it might be the problem that I didn't bypass the EAC idk. Btw, does it work for you?

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[jonasbeckman]

Nope, but I'm on the Steam version as well so I think it's a compatibility issue if the table was made against the UPlay version of the game.
(Steam version still requires UPlay but the exe differs a bit due to integrating Steam functionality which is why it breaks as I assume the memory addresses needed differ a little bit between the two.)

EDIT: It could also be a version difference if the table was made against the previous patch for the game and not the current one, for EAC I'm not all that good at how that works, attempts to tamper with it generally seem to cause the game to error out and shut down however unless you're careful so I would assume that if it detects anything and interferes the game would simply be shut down.
(IE using that driver .sys file to bypass EAC or using the cracked exe which I think removes EAC as well as a bit of a extras though there isn't a modified exe available yet for the latest version of the game far as I'm aware.)

[942826468]

Usually I used the Fearlessrevolution Trainer to bypass the EAC (enable the trainer and then close it) then CE is able to w/r the value. For the new version the trainer doesn't work and idk how to deal with it. Yeah it should be the problem in different versions, lets just wait for the answer.

[Paul44]

@all: Sorry, forgot to mention this, but created this script for the CPY vs... about 2 weeks ago. I just needed to take some time to write down the instructions/info (primarily for myself, btw).

@leseho: "Can I automatically create an experience from Level 1 to level 30?".
I'm sure this is possible, but - as I mentioned - this script only works for the Tier One Mode (which goes down per level). You can "quickly" find the same max level for normal gameplay, reach the same/similar location as mentioned in the readme... Once you've located the "CVT*" command - and surely some "CMP" thereafter, one can do something similar.
(in fact, I equaled max_level with current_level; but I could also have equaled curr_level with max_level, etc)

The main reason I mentioned all this info, was that they "hide" the actual/working values in memory using those CVT* commands (which is new to me as well ~ a quick search will tell - MSDN - that one can actually use those functions via C++ as well; though I have not tried that... yet)

PS: CE only works when playing offline with eac disabled ("-eac_launcher" might do the trick as well; recall mentioning this somewhere). Also: it might be possible to kill the thread checking for CE presence - like somebody did in Sniper Elite 4 - but (again) not tried/tested that...
PS2: As for the current version, that's a bummer (CPY is based on the steam vs, if I recall well - already removed the game from my disk). So, hunting down the instruction set (using [x64dbg]. CE is not all that good when it comes to searching; plus disassembles slightly differently apparently!) will need to be done...

And just be clear: CE is an amazing/powerful tool. Without it, I would not be able to find all that stuff in (any) debugger!

All that said: if I can help in any way to get this working in the current vs, let me know...

[942826468]

@Paul44 Really hope you can make a table for the newest steam version

[sky170111]

I've created this script so that I could easily unlock all items; without the need to replay missions, etc just to get those available...
(also includes a short description on how to find the proper opcode + images)

error archive!

[Paul44]

@all: use winrar v5.x (or higher) to extract rar!

@942826468: (or anyone else who wou!ld not mind getting their hands "dirty"):
1. load the table, double-click the script and copy "GRW.exe+5081746" (text in comment, without any double_quotes)
2. goto CE, and open 'Memory view'. Right-click in top window, select 'goto address and paste "GRW.exe+5081746" here (no quotes !)
3. there is good chance you will end up near the proper instructions; but not quite (since that code has changed, and thus 'unique code' not found)
4. right-click, 'goto address' and change the address it shows (in my case: 145081746) to something like "143081746" (yes, no quotes either )
5. select 'Search ~ Find assembly code' and fill in:
(part of our unique code ~ I assume that at least these opcodes have not changed)

mov eax,r9d
add rsp,28

also try with:
(less chance of it returning many results)

cvttps2pi mm9,xmm0
OR
cvttss2si r9d,xmm0 // found this on one of my other prtscrns ~ not sure if this one is related to the Tier One mode

6. IF that particular opcode has NOT changed, it will eventually find that instruction (and probably more entries)...
(this scan will take some time, so go and have a drink... or something)
(ps: move the [Assemblyscan] window somewhere in the corner of your screen, as it tends to "disappear" behind other open windows...)
7. When it finds such an instruction, double-click it and verify/compare the instructions with the image I've provided (a few lines above and below ~ and/or with the ASM code added in the script)
btw: I'm inclined to think that the last part of the code has changed (CC, etc)
8. When you've found the right location, follow the AOB injection method to create a new script (CE will find and create a new unique code); then copy/paste that new code in the current script (or find a unique code yourself ~ take a longer 'opstring' f.e.).
BEST: let CE do its work since the opcodes for your "new" code will be different, as will be the opcode to "Disable". So, once you got your script, edit the "code:" to what I did...

good luck...

[942826468]

@Paul44 Thank you and I find the opcodes which is "44 89 C8 48 83 C4 28 C3 CC CC 0F" and the "new" code could be enabled.
But there appears a practical problem.... the max xp(xp needed for next lvl) appears to be kind of 1 billion... however, when I gain some xp the HUD tells me that my xp is full and it is just that I cannot get to the next lvl....

EDIT: Yeah I got it. I just need to change that ebx into 1 and the needed xp for lvl up is constant at 1 which means you can easily lvl up.. Thank you @Paul44 you are a genius.




New codes are like this

Code: Select all

[ENABLE]

aobscanmodule(INJECT,GRW.exe,44 89 C8 48 83 C4 28 C3 CC CC 0F) // should be unique
registersymbol(INJECT)
alloc(newmem,$1000,INJECT)

label(code)
label(return)

newmem:

code:
  mov eax, ebx
  add rsp,28
  jmp return

INJECT:
  jmp newmem
  nop
  nop
return:


[DISABLE]

INJECT:
  db 44 89 C8 48 83 C4 28

unregistersymbol(INJECT)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "GRW.exe"+54FE5DE

"GRW.exe"+54FE5B8: 48 63 50 0C                       -  movsxd  rdx,dword ptr [rax+0C]
"GRW.exe"+54FE5BC: 48 8B 08                          -  mov rcx,[rax]
"GRW.exe"+54FE5BF: 48 C1 E2 20                       -  shl rdx,20
"GRW.exe"+54FE5C3: 48 C1 FA 3F                       -  sar rdx,3F
"GRW.exe"+54FE5C7: 48 21 D1                          -  and rcx,rdx
"GRW.exe"+54FE5CA: 74 12                             -  je GRW.exe+54FE5DE
"GRW.exe"+54FE5CC: 66 41 0F 6E C8                    -  movd xmm1,r8d
"GRW.exe"+54FE5D1: 0F 5B C9                          -  cvtdq2ps xmm1,xmm1
"GRW.exe"+54FE5D4: E8 D7 B1 D5 00                    -  call GRW.exe+62597B0
"GRW.exe"+54FE5D9: F3 44 0F 2C C8                    -  cvttss2si r9d,xmm0
// ---------- INJECTING HERE ----------
"GRW.exe"+54FE5DE: 44 89 C8                          -  mov eax,r9d
"GRW.exe"+54FE5E1: 48 83 C4 28                       -  add rsp,28
// ---------- DONE INJECTING  ----------
"GRW.exe"+54FE5E5: C3                                -  ret 
"GRW.exe"+54FE5E6: CC                                -  int 3 
"GRW.exe"+54FE5E7: CC                                -  int 3 
"GRW.exe"+54FE5E8: 0F 1F 84 00 00 00 00 00           -  nop [rax+rax+00000000]
"GRW.exe"+54FE5F0: 48 89 5C 24 18                    -  mov [rsp+18],rbx
"GRW.exe"+54FE5F5: 55                                -  push rbp
"GRW.exe"+54FE5F6: 56                                -  push rsi
"GRW.exe"+54FE5F7: 57                                -  push rdi
"GRW.exe"+54FE5F8: 48 83 EC 20                       -  sub rsp,20
"GRW.exe"+54FE5FC: 48 89 CD                          -  mov rbp,rcx
}

[942826468]

Here it is for the newest steam version[2415526]. The credit need to be @Paul44's.
TO BE SECURE, DONT LVL UP(down actually) TOO FAST AND TOO MUCH.Made by Paul44

GRW TIER ONE XP.CT

For current steam version

(2.58 KiB) Downloaded 187 times

Made by Paul44

[Vee_]

@SunBeam, interesting how could you create that signature in that footer table?

[Paul44]

@942826468: glad that I could be of assistance, and even more so because you've found the solution/correction. Good job!
That said: you do realize that you can use the same method to update most scripts - failing after an upgrade - this way...

ps: I noticed that only the last hexbyte was different; so one could try to use a wildcard here (replace "0F" - "48" in my case - with "??")
(although that could bring up more results ~ hence, not unique/working)...

on a sidenote: you mention "leveling up"; like going from 1 to 30, etc? I played the game in Normal Difficulty, and I recalled it going up this way. Once past level 30, it was possible to change to Tier One Mode. "Leveling up" here meant going down to 1...
(but do not take me on my word; it's been a couple of weeks already ~ I'm sure people will notice what it does exactly. did I mention 'backup your saves" already? )

[942826468]

Ahhh my fault. I mean in tier one mode so it is like "level down from 50 to 1" instead of "level up lol"

[jerrysd]

There is a way to even bypass EAC while staying online and Co-op. But this will get you banned. So use whatever Paul44 metion to be safe.

[crainger]

ps: I noticed that only the last hexbyte was different; so one could try to use a wildcard here (replace "0F" - "48" in my case - with "??")
(although that could bring up more results ~ hence, not unique/working)...

Using a Wildcard worked perfectly for me. Thanks for all the help guys.

[sky170111]

please create work table "fast level up" to CPY version 1.6.0[v 2355883]