The Outer Worlds [Engine:Unreal 4.21] - Console enabler, Dumper and more..

[SunBeam]

Game Name: The Outer Worlds
Game Vendor: Epic Store (won't work on Windows Store or Steam)
Game Version: 4.21-CL-0 (use gamever command in the console)
Game Process: IndianaEpicGameStore-Win64-Shipping.exe
Game File Version: 4.21.2.0 (which is the UE4 engine version)



Hello folks.

This topic will not tackle the usual crap you find in trainers. Please don't fill it in with puny requests; I won't look at them. You can find trainers with god, ammo, etc. in the Trainers section; your choice whose you want to use. This topic is about Unreal Engine 4, console, the default engine cheats (god, slomo, playersonly, fly, ghost, hud, etc.) and dumping the in-engine objectalia.

[ 28 Oct '19 - Initial Release ]

Attached below is a DLL that will do the following:

• Run threaded UE4 code to create the UConsole UObject, member of GameViewportClient; you may then use Tilde (~) key to open up the console. As far as what you can or can't do with the console, well.. I'm not the game developer You'll have to google around for commands, test stuff out and return with feedback. As opposed to just asking "what are the commands?" and doing shit about it.

• Will dump the UE4 FNameArray and UObjectArray, along with their addresses. What this means is you can then know what the fuck you're looking at in memory, when debugging/tracing or mapping structures, and come up with your own conclusions. Just like I did with my table below.

TheOuterWorlds.zip

password: sunbeamFRF

(209.79 KiB) Downloaded 43355 times

Usage instructions:

• Run the game and get to main menu (past the videos).

• Download the archive and extract the content to a folder of your choice.

• Run IGCSInjector.exe. You should see this happening for you:

You may close the injector after that. Press Tilde (~) key in-game and you should see this:



Press Tilde (~) key again to show the BIG console:



Press Tilde (~) key one more time to close the console. Repeat for other uses.

^ Mentioned the above since there's people out there who don't realize the ~ key can be pressed multiple times to send the console in different states.

Notes:

• The dump location is your game folder (e.g.: D:\Epic Games\TheOuterWorlds\Indiana\Binaries\Win64). You will find 2 files there: NamesDump.txt and ObjectsDump.txt. You'll be very interested in the 2nd one

• The .txt files are generated at "run-time". What this means is if you transition in-game from one map to another or from main menu to game world and backwards, you need to re-dump them. Why? UE4 destroys and recreates UObjects; re-initialization. To re-dump the .txt files press Numpad / (no, key can't be changed).

Other Information:

• the game is compiled with UE4 v4.21.2.0

• most of the UCheatManager UFunctions are not compiled in Shipping mode (they're basically replaced with a RET 0); same goes for all others the developers chose to use the below #id-#endif

Code: Select all

void ACharacter::ClientCheatWalk_Implementation()
{
#if !UE_BUILD_SHIPPING
	SetActorEnableCollision(true);
	if (CharacterMovement)
	{
		CharacterMovement->bCheatFlying = false;
		CharacterMovement->SetMovementMode(MOVE_Falling);
	}
#endif
}

Credits:

• KN4CK3R for his UE4 SDK dumper (although discontinued, parts of his code were used in the process; (the source is available on github; several people forked it -> [Link])

• Frans for his injector and the corrected UObjectIterator for UE4 4.20+, as well as for the nicest chats I've had with a coder

Table's soon to follow; hold tight, just started the game

BR,
Sun

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[Zanzer]

Welcome back!

[SunBeam]

Welcome back!

Danke!

Here's what you can do with the console and dumped information:



Enjoy!

P.S.: If you're going to leech this over to youtube, remember where you got it from and credit it properly. Don't think I won't find your ass! Just so you don't bitch later on you "didn't know"...

[sebastianyyz]

Nice, thank you SunBeam

[Ragnorinki]

Hello All!

I'm using XBox GamePass for PC. The enabler works perfectly, but as I'm trying to add items using the command list lovingly provided on Nexus (Cred to stoker25) I cannot dump the two files to figure out the item ids. The game crashes when I enter ctl+num/, due to the data protection in the gamedata folder which is impossible to remove (and leave a functioning game)

Since there is as of yet no repository, would one of you mad lads kindly provide your item code list?

[SunBeam]

...

First of all, you could thank the original author, not some guy on Nexus who basically posted Frans' work without crediting (he was adamant that his stuff is removed from Nexus and the admins took that down). Secondly, the addresses you see in that list WORK ONLY FOR THE ONE WHO DUMPED THEM, at that particular moment in time. If he/she loads a save game, exits to main menu or loads another map, the addresses change, thus a re-dump has to happen. Lastly, I avoid UWP games for the sole reason they require the same operations done over and over to remove folder protection, file protection and so on and so forth. If Microsoft's idea to kill cheating was to annoy you, then they got it! That being said, what you see here is for Epic; if it works for UWP, then so be it. As for the methods, google the stuff and you shall find it. I can tell you this shit works, as I've done it in Crackdown 3 (with UWP).

P.S.: UWP = [Link]

[infogram]

First of all, you could thank the original author, not some guy on Nexus who basically posted Frans' work without crediting (he was adamant that his stuff is removed from Nexus and the admins took that down). Secondly, the addresses you see in that list WORK ONLY FOR THE ONE WHO DUMPED THEM, at that particular moment in time. If he/she loads a save game, exits to main menu or loads another map, the addresses change, thus a re-dump has to happen.

Small correction: those are a list of the console command UFunctions, that stoker25 extracted via the ObjectsDump.txt file that your tool helpfully creates, so addresses shouldn't be that important.

I believe those are the full list, but he was talking about making other UFunctions available thru console too, so maybe there can be more.

Also he never posted any work onto Nexus without asking, it was me that accidentally included them onto PCGW... which were quickly removed and replaced when found out. (I deeply apologise about that, and hope for forgiveness - I do really love your guys work, & never meant any kind of insult by my crappy little launcher tool. This isn't really the place for that though...)

EDIT: his post here talks about how to test the UFunctions: https://forums.fearlessrevolution.com/index.php? ... ry74469798 - the stuff about adding the FUNC_Exec flag to turn UFunctions into console commands is interesting, maybe that can help get around the #ifdef'd cheat commands.

I wonder if this could be done generically with any UE4 game too, but I guess the offset for that flags field maybe changes depending on the game...

[SunBeam]

...

The commands are not compiled in at build time. It's the default Engine behavior, if you'd have read my information thus far in other UE4-related topics (Borderlands 3, Code Vein, etc.). Setting the flags can only let you run some of the commands that might have the 'exec' flag disabled. That's all. They won't bring back any ASM that really wasn't compiled in. Furthermore, the game itself (called 'Indiana') has its own functions that don't even touch the Engine ones. Example: when you type 'god' in-game the default "god" you knew of (from Engine.CheatManager) is not executed, but their internal function runs instead (Function Indiana.HealthComponent.God). Try and see for yourself. The execute part of the command is at offset 0xB8 inside the Indiana.HealthComponent.God memory block (you can get the address via my dumper).

Here's some really interesting commands you may want to try out:

Code: Select all

Line 27241: [00027240] Function Indiana.FactionManager.AddPositiveReputation_Debug                                          0x0000018424C84580
Line 27242: [00027241] IntProperty Indiana.FactionManager.AddPositiveReputation_Debug.Amount                                0x0000018424C84640
Line 27243: [00027242] StrProperty Indiana.FactionManager.AddPositiveReputation_Debug.FactionName                           0x0000018424C846C0

L.E.: Scratch that ^ The function doesn't do anything (RET)...

[Otis_Inf]

(offtopic)

Also he never posted any work onto Nexus without asking, it was me that accidentally included them onto PCGW... which were quickly removed and replaced when found out. (I deeply apologise about that, and hope for forgiveness - I do really love your guys work, & never meant any kind of insult by my crappy little launcher tool. This isn't really the place for that though...)

Ok, accepted. Still it was an unpleasant surprise and especially the tsunami of crap I got poured over me by 'fans' on nexus when I said I didn't really appreciate it. But alas, that's life when you make tools in your own spare time for gamers: the entitlement is enormous among some people....

EDIT: his post here talks about how to test the UFunctions: https://forums.fearlessrevolution.com/index.php? ... ry74469798 - the stuff about adding the FUNC_Exec flag to turn UFunctions into console commands is interesting, maybe that can help get around the #ifdef'd cheat commands.
I wonder if this could be done generically with any UE4 game too, but I guess the offset for that flags field maybe changes depending on the game...

The function objects are already present in memory in the objects store so traversing them, setting the flags and dumping them out should be trivial. Not sure if the 0x90 offset is unique for v4.21 or the same for other versions but a quick git blame will tell me that. Checking the address to see if there's a 0xC3 (RET) present can already do a lot too. I suspect only a handful of these functions work, but we'll see.

Will see if I have time later today.

[Csimbi]

The function objects are already present in memory in the objects store so traversing them, setting the flags and dumping them out should be trivial.

Is there information/tutorial on how to get to these in the memory (and their names)?

Thank you!

[erikem]

Have anyone figured out if any of the commands (or data from dump) will allow one to modify character attributes (strength, dexterity, etc.)? I've been trying to look through commands and dump but with no luck so far

[SunBeam]

^ What I can tell you, from testing, is the game has the UObject FName ids hardcoded in some functions that are called when you, for example, open up a certain menu. Zanzer's table already hooks those If you want a more elegant method, just wait till I release my table

[amoebae]

I've tested 3 versions of the console enabler now, wanting to use it primarily for taking screenshots, and here's what I've found.

SunBeam's version: pause doesn't work. toggledebugcamera and showhud and fov all work.

Frans' current version (v. 1014): the console won't open, despite editing the input.ini, so I can't comment on what's working or not.

Frans' previous version (v. 1013) pause works via numpad 0. toggledebugcamera and fov work. showhud doesn't work reliably. I have to turn off the hud in the main game options. Not a deal breaker, but means action shots are out. Using the showhud command sometimes turns off the hud (not always), but only turns back on part of it (the compass, health bars, and mission markers are gone, and the main menu and inventories won't come up, meaning alt+f4 is the only option).

So, for now I'm using Frans' v. 1013, because pause is crucial for screenshots, but a working showhud command would make it perfect. Alternatively, SunBeam, if it was possible to get pause working in your version I'd very happily use that. Is there something I can do to enable it?

[Otis_Inf]

v1.0.14 is basically v1.0.13 with a bugfix in the dumper, so it should work as normal. Be sure to run the injector as admin tho. I can't reproduce it here, it works fine (although I have only tested it on the menu screen, as I haven't started a game. will try soon).

hud toggle should be: showhud 0 for some parts of the hud. I think the dialog system is hidden with the built-in hud toggle in the unlocker (DEL). 'ToggleDebugCamera' already turns off the old hud system elements in UE4, however if they have implemented the hud using a 3rd party system like scaleform, then that's not going to work. DEL disables (makes opacity 0) UWD elements.

-----------
Regarding function scanning to see if they're a dead end: sadly they still point to a valid piece of code which through a relative jump ends up in a ret or ret 0000 so it's not doable to test the pointer in the UFunction object to see whether it's a dead end.

[amoebae]

I was running as admin (I'm running the game as admin as well, of course), it said it injected successfully, weird it would come up fine in 1013 but not in 1014. I'll try again. My input.ini file is being successfully updated with console command history (when I have a working unlocker), so there doesn't seem to be a permissions issue.

The injection methods are different between them, right? With 1014 I select a process, similar to in your SRWE program, but in 1013 it works the same as the one SunBeam modified -- it recognises the process automatically and brings up the little black console window to say it was successful. Is that right? (I apologise, this is my first time using a UE4 console unlocker, so I'm not very knowledgeable about what to expect.)

Toggledebugcamera doesn't automatically turn off any hud elements in TOW. The game's own 'Turn off HUD' in the UI menu turns off everything but menus, which is the ideal behaviour. showhud works on its own (no 0 after it) in SunBeam's version. Some combination of showhud or showhud 0 semi-works in your 1013, but I can't work out why it's only re-enabling some hud elements and not others. Is this where I need to press DEL (I'm sorry I don't know what UWD means)?

Edit: I still can't get the console to work in v. 1014, but in 1013 I can get the hud to toggle now. It's a bit finicky, but a combination of showhud and DEL usually does it. Thank you for mentioning about DEL, I didn't realise.