b($/Y!ax+-,YT?-KMR-cd..PtNF$M0q[K@z2e]BohZ%BbfUxty-1#nsolCb*TUun^=%w2^bG}}Hp5vtP[=D+O^aE3.HIXaTieP2PyW4pHp5:yoyChW]@5L^!]O?U%)^0{go:NI65eg2^@hOGofRlxiy4Roc/e(_#ry#cu4cW$UB_D^czq*UXd)}e1]mxfyxTaSdHQP)T0xGl?fP+Ag]-x1Mej72QRGTN+0Xn]#kC[A!6anQ[KH!m;_5*.S/b.oIcVv{fwzaM[nC}LB2ZUuqdN#VmJznCX;!*l!D.}Ek77b2etw@M?D!:LPtIBsz]J4ahOUyw4=acL*k{!z41U+a*a,ztjQ{^aFn4!HND]_ZH8Q5_r#Ubb;3sgebRy6Hu^Q[wCf^8zLegYyf3}eca9V3vL$t_=w1QvU:HAYE46u[^iC%YQoyDsUyir#xX+Hj8[tfF544a1ya0;+3g%JroFxnORPT${w1
0
"[ Enable ]"
000080
Auto Assembler Script
[ENABLE]
aobscanmodule( retGetGamePlayers, Borderlands3.exe, 488B00488B004885C074??488B40??4885C074??48 )
registersymbol( retGetGamePlayers )
label( retGetGamePlayers_o )
registersymbol( retGetGamePlayers_o )
alloc( Hook, 0x1000, Borderlands3.exe )
label( LocalPlayer )
registersymbol( LocalPlayer )
label( OakPlayerController )
registersymbol( OakPlayerController )
label( OakDeveloperPerks )
registersymbol( OakDeveloperPerks )
Hook:
retGetGamePlayers_o:
readmem( retGetGamePlayers, 6 )
mov [LocalPlayer],rax
mov rcx,[rax+30]
test rcx,rcx
je short @f
mov [OakPlayerController],rcx
mov rcx,[rcx+488] // if OakCharacter valid (we're in game world)
test rcx,rcx
je short @f
mov rcx,[rax+30] // get OakPlayerController back
mov rcx,[rcx+1988] // offset to OakDeveloperPerks
test rcx,rcx // check if not NULL first
je short @f
mov [OakDeveloperPerks],rcx // store it
test byte ptr [rcx+C8],40 // flip UWorld_destroy bool
jne short @f
or byte ptr [rcx+C8],40
@@:
jmp retGetGamePlayers+6
align 10 CC
LocalPlayer:
dq 0
align 10 CC
OakPlayerController:
dq 0
align 10 CC
OakDeveloperPerks:
dq 0
retGetGamePlayers:
jmp Hook
db 90
[DISABLE]
retGetGamePlayers:
readmem( retGetGamePlayers_o, 6 )
unregistersymbol( OakDeveloperPerks )
unregistersymbol( OakPlayerController )
unregistersymbol( LocalPlayer )
dealloc( Hook )
unregistersymbol( retGetGamePlayers_o )
unregistersymbol( retGetGamePlayers )
6
"Restore 'god', 'playersonly', 'fly', 'ghost', 'walk'"
Auto Assembler Script
{$STRICT}
{$lua}
if syntaxcheck then return end
[ENABLE]
local gameProcess = "Borderlands3.exe"
local gameModule = getAddress( gameProcess )
autoAssemble([[
alloc( ReCode, 0x1000, Borderlands3.exe )
registersymbol( ReCode )
label( UCheatManager_PlayersOnly )
registersymbol( UCheatManager_PlayersOnly )
label( UCharacter_ClientCheatWalk_Implementation )
registersymbol( UCharacter_ClientCheatWalk_Implementation )
label( UCharacter_ClientCheatFly_Implementation )
registersymbol( UCharacter_ClientCheatFly_Implementation )
label( UCharacter_ClientCheatGhost_Implementation )
registersymbol( UCharacter_ClientCheatGhost_Implementation )
label( Init )
registersymbol( Init )
label( Init_exit )
label( ConstructUFunctions )
registersymbol( ConstructUFunctions )
label( Z_Construct_UClass_UCheatManager_Statics_FuncInfo )
registersymbol( Z_Construct_UClass_UCheatManager_Statics_FuncInfo )
label( Z_Construct_UFunction_UCheatManager_God )
registersymbol( Z_Construct_UFunction_UCheatManager_God )
label( Z_Construct_UFunction_UCheatManager_Ghost )
registersymbol( Z_Construct_UFunction_UCheatManager_Ghost )
label( Z_Construct_UFunction_UCheatManager_God_Statics_FuncParams )
registersymbol( Z_Construct_UFunction_UCheatManager_God_Statics_FuncParams )
label( Z_Construct_UFunction_UCheatManager_Ghost_Statics_FuncParams )
registersymbol( Z_Construct_UFunction_UCheatManager_Ghost_Statics_FuncParams )
label( UFunction_God )
registersymbol( UFunction_God )
label( UFunction_Ghost )
registersymbol( UFunction_Ghost )
label( pszGod )
label( pszGhost )
label( pszSpawnAwesomeItems )
CreateThread( Init )
ReCode:
UCheatManager_PlayersOnly:
push rdi
sub rsp,20
mov rax,[rcx]
mov rdi,rcx
call qword ptr [rax+148] // UCheatManager::GetWorld
test byte ptr [rax+830],0x80
jne short @f
mov rax,[rdi]
mov rcx,rdi
call qword ptr [rax+148] // UCheatManager::GetWorld
test [rax+830],0x100
jne short @f
mov rax,[rdi]
mov rcx,rdi
mov [rsp+30],rbx
call qword ptr [rax+148] // UCheatManager::GetWorld
mov rdx,[rdi]
mov rcx,rdi
mov rbx,rax
call qword ptr [rdx+148] // UCheatManager::GetWorld
mov ecx,[rbx+830]
mov rbx,[rsp+30]
not ecx
xor ecx,[rax+830]
and ecx,0x100
xor [rax+830],ecx
add rsp,20
pop rdi
ret
@@:
mov rax,[rdi]
mov rcx,rdi
call qword ptr [rax+148] // UCheatManager::GetWorld
mov rcx,rdi
and [rax+830],0xFFFFFF7F
mov rax,[rdi]
call qword ptr [rax+148] // UCheatManager::GetWorld
and [rax+830],0xFFFFFEFF
add rsp,20
pop rdi
ret
align 10 CC
UCharacter_ClientCheatFly_Implementation:
push rbx
sub rsp,20
mov dl,1
mov rbx,rcx
call Borderlands3.exe+1F7F1C0 // AActor::SetActorEnableCollision
mov rax,[rbx+4C8]
test rax,rax
je short @f
or [rax+4B4],400
xor r8d,r8d
mov rcx,[rbx+4C8]
lea edx,[r8+5]
mov rax,[rcx]
add rsp,20
pop rbx
jmp qword ptr [rax+5A0] // UCharacterMovementComponent::SetMovementMode
@@:
add rsp,20
pop rbx
ret
align 10 CC
UCharacter_ClientCheatGhost_Implementation:
push rbx
sub rsp,20
xor edx,edx
mov rbx,rcx
call Borderlands3.exe+1F7F1C0 // AActor::SetActorEnableCollision
mov rax,[rbx+4C8]
test rax,rax
je short @f
or [rax+4B4],400
xor r8d,r8d
mov rcx,[rbx+4C8]
lea edx,[r8+5]
mov rax,[rcx]
add rsp,20
pop rbx
jmp qword ptr [rax+5A0] // UCharacterMovementComponent::SetMovementMode
@@:
add rsp,20
pop rbx
ret
align 10 CC
UCharacter_ClientCheatWalk_Implementation:
push rbx
sub rsp,20
mov dl,1
mov rbx,rcx
call Borderlands3.exe+1F7F1C0 // AActor::SetActorEnableCollision
mov rax,[rbx+4C8]
test rax,rax
je short @f
and [rax+4B4],BFF
xor r8d,r8d
mov rcx,[rbx+4C8]
lea edx,[r8+3]
mov rax,[rcx]
add rsp,20
pop rbx
jmp qword ptr [rax+5A0] // UCharacterMovementComponent::SetMovementMode
@@:
add rsp,20
pop rbx
ret
align 10 CC
Init:
sub rsp,28
xor r9d,r9d
lea r8,[pszSpawnAwesomeItems]
mov rax,[OakPlayerController]
mov rax,[rax+1970]
test rax,rax // if this is NULL by the time the user enables this script, abort
je short Init_exit
mov rdx,[rax+10] // 0x20: BlueprintGeneratedClass BP_DevPerks.BP_DevPerks_C
mov rcx,[Borderlands3.exe+64D6EA0] // 0x10: Class CoreUObject.Function
call Borderlands3.exe+14F9D80 // StaticFindObject
test rax,rax
je short @f
mov dword ptr [rax+88],4020600 // patch UFunction flags
@@:
call ConstructUFunctions
Init_exit:
add rsp,28
ret
align 10 CC
ConstructUFunctions:
sub rsp,178
mov r8d,2 // uint32 NumFunctions
lea rdx,[Z_Construct_UClass_UCheatManager_Statics_FuncInfo] // FClassFunctionLinkInfo* Functions
mov rcx,[Borderlands3.exe+6607640] // Class Engine.CheatManager
call Borderlands3.exe+14785A0 // UClass::CreateLinkAndAddChildFunctionsToMap
add rsp,178
ret
align 10 CC
Z_Construct_UFunction_UCheatManager_God:
sub rsp,28
mov rax,[UFunction_God]
test rax,rax
jne short @f
lea rdx,[Z_Construct_UFunction_UCheatManager_God_Statics_FuncParams]
lea rcx,[UFunction_God]
call Borderlands3.exe+14E7540 // UE4CodeGen_Private::ConstructUFunction
mov rax,[UFunction_God]
@@:
add rsp,28
ret
align 10 CC
Z_Construct_UFunction_UCheatManager_Ghost:
sub rsp,28
mov rax,[UFunction_Ghost]
test rax,rax
jne short @f
lea rdx,[Z_Construct_UFunction_UCheatManager_Ghost_Statics_FuncParams]
lea rcx,[UFunction_Ghost]
call Borderlands3.exe+14E7540 // UE4CodeGen_Private::ConstructUFunction
mov rax,[UFunction_Ghost]
@@:
add rsp,28
ret
align 10 CC
UFunction_God:
dq 0
align 10 CC
UFunction_Ghost:
dq 0
align 10 CC
pszGod:
db 'God',0
align 10 CC
pszGhost:
db 'Ghost',0
align 10 CC
pszSpawnAwesomeItems:
db 'S',0,'p',0,'a',0,'w',0,'n',0,'A',0,'w',0,'e',0,'s',0,'o',0,'m',0,'e',0,'I',0,'t',0,'e',0,'m',0,'s',0,0,0
align 10 CC
Z_Construct_UFunction_UCheatManager_God_Statics_FuncParams:
dq Borderlands3.exe+265A7C0 // 0x00 -> Z_Construct_UClass_UCheatManager
dq pszGod // 0x08
dq 0x45 // 0x10
dq 0 // 0x18
dq 04020600 // 0x20
dq 0 // 0x28
dq 0 // 0x30
dq 0 // 0x38
dq 0
align 10 CC
Z_Construct_UFunction_UCheatManager_Ghost_Statics_FuncParams:
dq Borderlands3.exe+265A7C0 // 0x00 -> Z_Construct_UClass_UCheatManager
dq pszGhost // 0x08
dq 0x45 // 0x10
dq 0 // 0x18
dq 04020600 // 0x20
dq 0 // 0x28
dq 0 // 0x30
dq 0 // 0x38
dq 0
align 10 CC
Z_Construct_UClass_UCheatManager_Statics_FuncInfo:
dq Z_Construct_UFunction_UCheatManager_God // 0x00
dq pszGod // 0x08
dq Z_Construct_UFunction_UCheatManager_Ghost // 0x10
dq pszGhost // 0x18
dq 0
]])
-- might need some Sleep
Sleep( 2000 )
-- restore the execs in God and Ghost UFunctions
local UFunction_God = readQword( getAddressSafe( "UFunction_God" ) )
local UFunction_Ghost = readQword( getAddressSafe( "UFunction_Ghost" ) )
-- UCheatManager::execGod
local UCheatManager_execGod = gameModule + 0x2689790
-- UCheatManager::execGhost
local UCheatManager_execGhost = gameModule + 0x26898D0
writeQword( UFunction_God + 0xB0, UCheatManager_execGod )
writeQword( UFunction_Ghost + 0xB0, UCheatManager_execGhost )
-- patch the UCheatManager functions back in
-- OakPlayerController
local OakPlayerController = readQword( getAddressSafe( "OakPlayerController" ) )
-- OakCheatManager
local OakCheatManager = readQword( OakPlayerController + 0x5A8 )
-- member-functions pointer
local mf_OakCheatManager = readQword( OakCheatManager )
-- UCheatManager::Fly
local UCheatManager_Fly = gameModule + 0x20525D0
-- UCheatManager::Walk
local UCheatManager_Walk = gameModule + 0x2065930
-- UCheatManager::Ghost
local UCheatManager_Ghost = gameModule + 0x2055920
-- UCheatManager::God
local UCheatManager_God = gameModule + 0x2055A30
-- UCheatManager::PlayersOnly
local UCheatManager_PlayersOnly = getAddressSafe( "UCheatManager_PlayersOnly" )
fullAccess( mf_OakCheatManager + 0x2A0, 8 )
writeQword( mf_OakCheatManager + 0x2A0, UCheatManager_Fly )
fullAccess( mf_OakCheatManager + 0x2A8, 8 )
writeQword( mf_OakCheatManager + 0x2A8, UCheatManager_Walk )
fullAccess( mf_OakCheatManager + 0x2B0, 8 )
writeQword( mf_OakCheatManager + 0x2B0, UCheatManager_Ghost )
fullAccess( mf_OakCheatManager + 0x2B8, 8 )
writeQword( mf_OakCheatManager + 0x2B8, UCheatManager_God )
fullAccess( mf_OakCheatManager + 0x2F8, 8 )
writeQword( mf_OakCheatManager + 0x2F8, UCheatManager_PlayersOnly )
-- patch the UOakChararacter ClientCheat functions back in
-- OakCharacter
local OakCharacter = readQword( OakPlayerController + 0x488 )
-- member-functions pointer
local mf_OakCharacter = readQword( OakCharacter )
-- ACharacter::ClientCheatWalk_Implementation
local UCharacter_ClientCheatWalk_Implementation = getAddressSafe( "UCharacter_ClientCheatWalk_Implementation" )
-- ACharacter::ClientCheatFly_Implementation
local UCharacter_ClientCheatFly_Implementation = getAddressSafe( "UCharacter_ClientCheatFly_Implementation" )
-- ACharacter::ClientCheatGhost_Implementation
local UCharacter_ClientCheatGhost_Implementation = getAddressSafe( "UCharacter_ClientCheatGhost_Implementation" )
fullAccess( mf_OakCharacter + 0x928, 8 )
writeQword( mf_OakCharacter + 0x928, UCharacter_ClientCheatWalk_Implementation )
fullAccess( mf_OakCharacter + 0x930, 8 )
writeQword( mf_OakCharacter + 0x930, UCharacter_ClientCheatFly_Implementation )
fullAccess( mf_OakCharacter + 0x938, 8 )
writeQword( mf_OakCharacter + 0x938, UCharacter_ClientCheatGhost_Implementation )
[DISABLE]
{$asm}
unregistersymbol( UFunction_Ghost )
unregistersymbol( UFunction_God )
unregistersymbol( Z_Construct_UFunction_UCheatManager_Ghost_Statics_FuncParams )
unregistersymbol( Z_Construct_UFunction_UCheatManager_God_Statics_FuncParams )
unregistersymbol( Z_Construct_UFunction_UCheatManager_Ghost )
unregistersymbol( Z_Construct_UFunction_UCheatManager_God )
unregistersymbol( Z_Construct_UClass_UCheatManager_Statics_FuncInfo )
unregistersymbol( ConstructUFunctions )
unregistersymbol( UCharacter_ClientCheatGhost_Implementation )
unregistersymbol( UCharacter_ClientCheatFly_Implementation )
unregistersymbol( UCharacter_ClientCheatWalk_Implementation )
unregistersymbol( UCheatManager_PlayersOnly )
dealloc( ReCode )
unregistersymbol( ReCode )
11
"Infinite Clip Ammo"
Auto Assembler Script
[ENABLE]
aobscanmodule( OnFire, Borderlands3.exe, 40534883EC??488B01488BD948896C24 )
registersymbol( OnFire )
label( OnFire_o )
registersymbol( OnFire_o )
alloc( Hook, 0x1000, Borderlands3.exe )
Hook:
push rax
mov rax,[rcx+1A8] // BPWeap_SR_DAL_C
test rax,rax
jne short @f
mov rax,[rcx+118] // BPWeap_SR_DAL_C
@@:
cmp [rax+4A0],0 // OakCharacter
je short @f
mov rax,[rax+4A8]
mov rax,[rax-8E8] // OakPlayerController
cmp rax,[OakPlayerController]
jne short @f
pop rax
ret // no ammo processing
@@:
pop rax
OnFire_o:
readmem( OnFire, 6 )
jmp OnFire+6
OnFire:
jmp Hook
db 90
[DISABLE]
OnFire:
readmem( OnFire_o, 6 )
dealloc( Hook )
unregistersymbol( OnFire )
unregistersymbol( OnFire_o )
13
"Rig 'UPlayer::Exec'"
Auto Assembler Script
[ENABLE]
aobscanmodule( hUPlayer_Exec, Borderlands3.exe, 488D4C24??E8????????30C04883C4??415F415E415D5F5E5D5BC3 )
registersymbol( hUPlayer_Exec )
label( hUPlayer_Exec_o )
registersymbol( hUPlayer_Exec_o )
alloc( Hook, 0x1000, Borderlands3.exe )
label( Hook_true )
Hook:
// [ObjectProperty BPCont_Player.BPCont_Player_C.DeveloperPerks + 0x44] = 0x1970
// r14 = OakPlayerController
mov rcx,[r14+1970]
test rcx,rcx
je short @f
mov rax,[rcx]
mov r9,rdi
mov r8,rbp
mov rdx,rsi
call qword ptr [rax+220] // UObject::ProcessConsoleExec
test al,al
jne short Hook_true
hUPlayer_Exec_o:
readmem( hUPlayer_Exec, 5 )
jmp hUPlayer_Exec+5
Hook_true:
jmp hUPlayer_Exec+1B
hUPlayer_Exec:
jmp Hook
[DISABLE]
hUPlayer_Exec:
readmem( hUPlayer_Exec_o, 5 )
dealloc( Hook )
unregistersymbol( hUPlayer_Exec_o )
unregistersymbol( hUPlayer_Exec )
16241
"Assemble execOpenDebugMenu"
Auto Assembler Script
[ENABLE]
alloc( execOpenDebugMenu, 0x1000, Borderlands3.exe )
registersymbol( execOpenDebugMenu )
label( szCheatMenuData )
label( szGbxCheatSettings )
label( @L00000001 )
label( @L00000002 )
label( @L00000003 )
label( @L00000004 )
label( @L00000005 )
label( @L00000006 )
execOpenDebugMenu:
mov [rsp+10],rbp
mov [rsp+18],rsi
push rdi
sub rsp,50
mov rax,[rcx]
mov rdi,rcx
call qword ptr [rax+F90]
xor ebp,ebp
mov rsi,rax
mov [rsp+40],rbp
mov [rsp+48],rbp
test rax,rax
je @L00000006
mov rcx,[Borderlands3.exe+63C5F20] // GConfig
test rcx,rcx
je @L00000006
lea rax,[Borderlands3.exe+63D2110] // path to Engine.ini
lea r9,[rsp+40]
mov [rsp+20],rax
lea r8,[szCheatMenuData] // L"CheatMenuData"
lea rdx,[szGbxCheatSettings] // L"GbxCheatSettings"
call Borderlands3.exe+13A37C0 // FConfigCacheIni::GetString
test al,al
je @L00000005
cmp [rsp+48],ebp
mov [rsp+60],rbx
lea rbx,[Borderlands3.exe+3DBFD28]
cmovne rbx,[rsp+40]
call Borderlands3.exe+2C141F0 // GbxUmgMenuData::GetPrivateStaticClass
mov byte ptr [rsp+30],1
xor r9d,r9d
mov [rsp+28],rbp
mov r8,rbx
xor edx,edx
mov [rsp+20],ebp
mov rcx,rax
call Borderlands3.exe+14FA600 // StaticLoadObject
mov rbx,rax
test rax,rax
je short @L00000004
cmp [rax+48],rbp
je short @L00000002
call Borderlands3.exe+2C14140 // GbxUmgMenu::GetPrivateStaticClass
mov rdx,[rbx+48]
mov rcx,rdx
test rdx,rdx
je short @L00000002
@L00000001:
cmp rcx,rax
je short @L00000003
mov rcx,[rcx+30]
test rcx,rcx
jne short @L00000001
@L00000002:
mov rdx,rbp
@L00000003:
mov rcx,[rdi+A68]
call Borderlands3.exe+2BB9D60
test al,al
jne short @L00000004
mov rdx,rbx
mov rcx,rsi
call Borderlands3.exe+2BD4B80
@L00000004:
mov rbx,[rsp+60]
@L00000005:
mov rcx,[rsp+40]
test rcx,rcx
je short @L00000006
call Borderlands3.exe+134A7A0 // FMemory::Free
@L00000006:
mov rbp,[rsp+68]
mov rsi,[rsp+70]
add rsp,50
pop rdi
ret
align 10 CC
szCheatMenuData:
db 'C',0,'h',0,'e',0,'a',0,'t',0,'M',0,'e',0,'n',0,'u',0,'D',0,'a',0,'t',0,'a',0,0,0
align 10 CC
szGbxCheatSettings:
db 'G',0,'b',0,'x',0,'C',0,'h',0,'e',0,'a',0,'t',0,'S',0,'e',0,'t',0,'t',0,'i',0,'n',0,'g',0,'s',0,0,0
[DISABLE]
dealloc( execOpenDebugMenu )
unregistersymbol( execOpenDebugMenu )
16225
"Item Spawner"
FF0000
Auto Assembler Script
[ENABLE]
alloc( UEThread, 0x1000, Borderlands3.exe )
registersymbol( UEThread )
CreateThread( UEThread )
label( UEThreadOff )
registersymbol( UEThreadOff )
label( UEThread_loop )
label( SpawnItem_do )
label( iAmount )
registersymbol( iAmount )
label( ppItemPoolArr )
registersymbol( ppItemPoolArr )
label( pItemPool )
registersymbol( pItemPool )
UEThread:
sub rsp,28
UEThread_loop:
mov rcx,A
call Sleep
cmp [UEThreadOff],1
jne short @f
add rsp,28
mov [UEThreadOff],2
ret
@@:
mov rcx,6E // VK_DECIMAL
call GetAsyncKeyState
test ax,ax
je short @f
call short SpawnItem_do
mov rcx,C8
call Sleep
@@:
jmp short UEThread_loop
align 10 CC
SpawnItem_do:
sub rsp,38
mov r8d,[iAmount] // item amount
lea rdx,[ppItemPoolArr] // pointer to pointer to ItemPoolArr
mov rcx,[OakDeveloperPerks] // UObject
call Borderlands3.exe+BAF140 // SpawnItems_Internal
add rsp,38
ret
align 10 CC
iAmount:
dd 1
align 10 CC
ppItemPoolArr:
dq pItemPool
dd 1 // dwArrSize (expand this to > 1 if you add more items in pItemPool
align 10 CC
pItemPool:
dq 0
dq 0
UEThreadOff:
dd 0
[DISABLE]
{$lua}
if( syntaxcheck == false ) then --actual execution
local starttime = getTickCount()
if readInteger( "UEThreadOff" ) == 0 then --could be 2 already
writeInteger( "UEThreadOff", 1 ) --tell the thread to kill itself
end
while( getTickCount() < starttime + 1000 ) and ( readInteger( "UEThreadOff" ) ~= 2 ) do --wait till it has finished
sleep( 20 )
end
if( getTickCount() > starttime + 1000 ) then --could happen when the window is shown
showMessage( 'Disabling the thread failed!' )
error( 'Thread disabling failed!' )
end
sleep( 1 )
end
{$asm}
unregistersymbol( pItemPool )
unregistersymbol( ppItemPoolArr )
unregistersymbol( iAmount )
unregistersymbol( UEThreadOff )
unregistersymbol( UEThread )
dealloc( UEThread )
16226
"iAmount"
FF8080
4 Bytes
iAmount
16227
"pItemPool"
1
FF8080
8 Bytes
pItemPool
3
"[ Debug ]"
0080FF
1
1
"LocalPlayer"
1
8000FF
8 Bytes
LocalPlayer
2
"OakPlayerController"
1
8000FF
8 Bytes
OakPlayerController
5
"OakCharacter"
1
8000FF
8 Bytes
OakPlayerController
488
9
"bGod"
1
8000FF
Byte
OakPlayerController
91
488
16224
"Level"
8000FF
4 Bytes
OakPlayerController
1A4
2A18
488
16185
"CWeapon"
1
8000FF
8 Bytes
OakPlayerController
8
1508
488
16186
"Fire Rate (Calculated)"
8000FF
Float
OakPlayerController
21C
470
8
1508
488
16188
"Fire Rate"
8000FF
Float
OakPlayerController
220
470
8
1508
488
16221
"Bullets To Fire"
8000FF
4 Bytes
OakPlayerController
228
470
8
1508
488
16217
"Fire Delay (Calculated)"
8000FF
Float
OakPlayerController
234
470
8
1508
488
16218
"Fire Delay"
8000FF
Float
OakPlayerController
238
470
8
1508
488
16222
"dwClipToSpend"
8000FF
4 Bytes
OakPlayerController
2E4
470
8
1508
488
16190
"Damage (Calculated)"
8000FF
Float
OakPlayerController
31C
470
8
1508
488
16189
"Damage"
8000FF
Float
OakPlayerController
320
470
8
1508
488
16193
"Accuracy (Calculated)"
8000FF
Float
OakPlayerController
2F4
470
8
1508
488
16194
"Accuracy"
8000FF
Float
OakPlayerController
2F8
470
8
1508
488
16200
"Weapon Handling (Calculated)"
8000FF
Float
OakPlayerController
300
470
8
1508
488
16199
"Weapon Handling"
8000FF
Float
OakPlayerController
304
470
8
1508
488
16207
"RecoilPatternComponent"
1
8000FF
8 Bytes
OakPlayerController
10
320
8
1508
488
16208
"RecoilPatternData"
1
8000FF
8 Bytes
OakPlayerController
1A0
10
320
8
1508
488
16209
"dwRecoilVal"
8000FF
4 Bytes
OakPlayerController
38
1A0
10
320
8
1508
488
16210
"WeaponSwayComponent"
1
8000FF
8 Bytes
OakPlayerController
20
320
8
1508
488
16211
"SwayPatternData"
1
8000FF
8 Bytes
OakPlayerController
188
20
320
8
1508
488
16213
"dwSwayVal"
8000FF
4 Bytes
OakPlayerController
38
188
20
320
8
1508
488
16212
"fSwayVal"
8000FF
Float
OakPlayerController
1D8
20
320
8
1508
488
4
"OakCheatManager"
1
8000FF
8 Bytes
OakPlayerController
5A8
12
"OakDeveloperPerks"
1
8000FF
8 Bytes
OakDeveloperPerks
8
"Unreal Engine 'god' :)"
Auto Assembler Script
{$STRICT}
{$lua}
if syntaxcheck then return end
[ENABLE]
local t = getAddressSafe( "OakPlayerController" )
t = readQword( t )
t = readQword( t + 0x488 ) -- OakCharacter
local u = readBytes( t + 0x91 )
u = u & 0xBF
writeBytes( t + 0x91, u )
[DISABLE]
local t = getAddressSafe( "OakPlayerController" )
t = readQword( t )
t = readQword( t + 0x488 ) -- OakCharacter
local u = readBytes( t + 0x91 )
u = u | 0x40
writeBytes( t + 0x91, u )
10
"Init & Link 'god' UFunction"
Auto Assembler Script
[ENABLE]
alloc( ZConstructGodThread, 0x1000, Borderlands3.exe )
registersymbol( ZConstructGodThread )
CreateThread( ZConstructGodThread )
label( pReturnFunction )
label( pszGod )
label( Z_Construct_UFunction_UCheatManager_God )
registersymbol( Z_Construct_UFunction_UCheatManager_God )
label( Z_Construct_UFunction_UCheatManager_God_Statics_FuncParams )
registersymbol( Z_Construct_UFunction_UCheatManager_God_Statics_FuncParams )
label( aZ_Construct_UFunction_UCheatManager_God )
registersymbol( aZ_Construct_UFunction_UCheatManager_God )
ZConstructGodThread:
db EB FE
sub rsp,178
mov r8d,1
lea rdx,[aZ_Construct_UFunction_UCheatManager_God]
mov rcx,[Borderlands3.exe+66026A0]
call Borderlands3.exe+147F3A0 // UClass::CreateLinkAndAddChildFunctionsToMap
add rsp,178
ret
align 10 CC
Z_Construct_UFunction_UCheatManager_God:
sub rsp,28
mov rax,[pReturnFunction]
test rax,rax
jne short @f
lea rdx,[Z_Construct_UFunction_UCheatManager_God_Statics_FuncParams]
lea rcx,[pReturnFunction]
call Borderlands3.exe+14EE340 // UE4CodeGen_Private::ConstructUFunction
mov rax,[pReturnFunction]
@@:
add rsp,28
ret
align 10 CC
pReturnFunction:
dq 0
align 10 CC
pszGod:
db 'God',0
align 10 CC
Z_Construct_UFunction_UCheatManager_God_Statics_FuncParams:
dq Borderlands3.exe+2661100 // 0x0 - Z_Construct_UClass_UCheatManager
dq pszGod // 0x8
dq 0x45 // 0x10
dq 0 // 0x18
dq 04020600 // 0x20
dq 0 // 0x28
dq 0 // 0x30
dq 0 // 0x38
align 10 CC
aZ_Construct_UFunction_UCheatManager_God:
dq Z_Construct_UFunction_UCheatManager_God // 0x0
dq pszGod // 0x8
align 10 CC
[DISABLE]
unregistersymbol( Z_Construct_UFunction_UCheatManager_God )
unregistersymbol( aZ_Construct_UFunction_UCheatManager_God )
unregistersymbol( Z_Construct_UFunction_UCheatManager_God_Statics_FuncParams )
unregistersymbol( ZConstructGodThread )
dealloc( ZConstructGodThread )
14
"Test_StaticFindUObject"
Auto Assembler Script
[ENABLE]
alloc( UEThread, 0x1000, Borderlands3.exe )
registersymbol( UEThread )
CreateThread( UEThread )
label( UEThreadOff )
registersymbol( UEThreadOff )
label( UEThread_loop )
label( FindUObject_do )
UEThread:
sub rsp,28
UEThread_loop:
mov rcx,A
call Sleep
cmp [UEThreadOff],1
jne short @f
add rsp,28
mov [UEThreadOff],2
ret
@@:
mov rcx,6E // VK_DECIMAL
call GetAsyncKeyState
test ax,ax
je short @f
call short FindUObject_do
mov rcx,C8
call Sleep
@@:
jmp short UEThread_loop
align 10 CC
FindUObject_do:
sub rsp,28
xor r9d,r9d
lea r8,[szSpawnAwesomeItems]
mov rax,[OakPlayerController]
mov rax,[rax+1970]
mov rdx,[rax+10] // 0x20: BlueprintGeneratedClass BP_DevPerks.BP_DevPerks_C
mov rcx,[Borderlands3.exe+64D2020] // 0x10: Class CoreUObject.Function
call Borderlands3.exe+1500B80 // StaticFindObject
add rsp,28
ret
align 10 CC
szSpawnAwesomeItems:
db 'S',0,'p',0,'a',0,'w',0,'n',0,'A',0,'w',0,'e',0,'s',0,'o',0,'m',0,'e',0,'I',0,'t',0,'e',0,'m',0,'s',0,0,0
align 10 CC
UEThreadOff:
dd 0
[DISABLE]
{$lua}
if( syntaxcheck == false ) then --actual execution
local starttime = getTickCount()
if readInteger( "UEThreadOff" ) == 0 then --could be 2 already
writeInteger( "UEThreadOff", 1 ) --tell the thread to kill itself
end
while( getTickCount() < starttime + 1000 ) and ( readInteger( "UEThreadOff" ) ~= 2 ) do --wait till it has finished
sleep( 20 )
end
if( getTickCount() > starttime + 1000 ) then --could happen when the window is shown
showMessage( 'Disabling the thread failed!' )
error( 'Thread disabling failed!' )
end
sleep( 1 )
end
{$asm}
unregistersymbol( UEThreadOff )
unregistersymbol( UEThread )
dealloc( UEThread )
15
"UFunction SpawnAwesomeItems"
1
8 Bytes
282DDD80
16
"UFlags"
1
4 Bytes
+88
16229
"UFunction_ByteCode"
1
Array of byte
172
+48
0
16230
"ItemPoolData_1_1 (ItemPoolData ItemPool_Artifacts_05_Legendary.ItemPool_Artifacts_05_Legendary)"
1
8 Bytes
+B
16231
"ItemPoolData_1_2 (ItemPoolData ItemPool_ClassMods_05_Legendary.ItemPool_ClassMods_05_Legendary)"
1
8 Bytes
+14
16232
"ItemPoolData_1_3 (ItemPoolData ItemPool_GrenadeMods_05_Legendary.ItemPool_GrenadeMods_05_Legendary)"
1
8 Bytes
+1D
16233
"ItemPoolData_1_4 (ItemPoolData ItemPool_Shields_05_Legendary.ItemPool_Shields_05_Legendary)"
1
8 Bytes
+26
16234
"ItemPoolData_1_5 (ItemPoolData ItemPool_Guns_Legendary.ItemPool_Guns_Legendary)"
1
8 Bytes
+2F
16235
"ItemPoolData_1_6 (ItemPoolData ItemPool_Guns_Legendary.ItemPool_Guns_Legendary)"
1
8 Bytes
+38
16236
"ItemPoolData_1_7 (ItemPoolData ItemPool_Guns_Legendary.ItemPool_Guns_Legendary)"
1
8 Bytes
+41
16237
"ItemPoolData_1_8 (ItemPoolData ItemPool_Guns_Legendary.ItemPool_Guns_Legendary)"
1
8 Bytes
+4A
16238
"ItemPoolData_2_1 (ItemPoolData ItemPool_Eridium_Stack.ItemPool_Eridium_Stack)"
1
8 Bytes
+76
16239
"ItemPoolData_2_2 (ItemPoolData ItemPool_Eridium.ItemPool_Eridium)"
1
8 Bytes
+7F
16240
"ItemPoolData_2_3 (ItemPoolData ItemPool_Money_Rich.ItemPool_Money_Rich)"
1
8 Bytes
+88
0FjVo*O2oCav+$a5$nJydnYwfWOf14=VMNC4z]K.){NI#ma]=nYD/0N25^!*3SwFsM:]=-l;8F;;lRahqOt,J5Gyt$Fj?(;p^Cq1rLL/OV6*[BSYPnMtbbx%cR#ES;(kl+!bsx]VMd#7K[;l4NRq:C#H:{*X%FZRi[$Jm
5dZ*HQ*y;zWn;@=c[34DZbD@YZHxc]07XMnH9]OY004,YdAcuzstQ.NhpCaQg6AIpKI?^QXluZR?y1@F5,b8P_8TaZPM}UYAu^tzILzkaeRya)Q_$+F-OiKgDNRcNHE^..L2(s2e#y#x)It_%SOsCw-_,ww=o.JqtVdFTsjG#Rp;qE#U{+d2.i5@Lc/Fbs[q5_W1MTu/vLRr=.^{-t004/lPDc$28VUda01Zh/L^b0%03ZMW03Zkk0001UdV2H#000JJOGiWi^^a60_De66lK:n!32.bRa^vGf6951U69E94oEQKA00)qQO,@Rc1R4/[FZfxb0000ACP[p:R9M5UmwR.8*s?FT:l9ON$t93WAYiZrfnY+NpcsS(7Ing-5+RJ(xFod-K1NnsA213!OtGTXL07HdgX!;S3)i:qhL:Ev89^KSMKlsh7C^9Z0)sw=]}3ax?0_JL?)[j9S,hKA^nl@oz0ZEEy{xVkv+E8CZ[DkMm8s9]ZT}.,4PC@GeR*B5$Gv/j$KP;BAArPfYVbc/d7huzG[NH3^NVBDXm_UAL_,.s0NnZ=6!UGJ[-kWIBQI25e}wPCpC_x2o}fAKx?5!xfb^B0aZcX-^HVI+s;%WX7u)u5Qoi+L/nj0LKl/f*UhuvHN8HZX#=-${=E^dBrECDzqyCPx]VoLNZmI#0+zo/Z,Z_t#Gw/V5@Uvz^RDienHsP*+$J.UYB7fo:;E80ULjV3BRPwh_F!CJCnePD5?mS@djEdLT^R$?NW,u/:N!GY0^D)0VW=!+Nw}Z#Ne_Tg3P_H!xG8?Co4pjnp?758mUndGyqS9}QZrZcn?V?HL[$rZHT]iOy(P{Ylu^]I[=fU[uFO4!oKmNp1PO8xTvkg_.2QsaJp}!TY3QY)=-aIen/Ho-HXSX2-dt71_Kx,MsdFIr0J%Ea;sJh;t@}S62TQh{q@E;LY835;hwse^o:b]XjQ{3YU#h$jsLqC+*%H.btRzQ)IM(Y+?#2S21kXvD)5Af+xFAb?IH8za}o(A/I7sOUyJ34W,eXCPkTpoI0SNqp{eItO[s*@+z,e6!.tN$Ro/SYtYq-$X22+fUv^ikEBYU$:@I*!6tC=M%dN@OUE^qwoDC;J?:$MZ92rb3.v)2M:meSg,.cYNIpf[0lN4j{X1-)%dc5@v3L%*6S-3+0RehP1!c-t0E)/P24]9{wJf[!y-DhbM^)8D]mhmUIz7Nx/UMWQwOwx6(L;vuSJz]NJX6pb[_/huz/p*[cL;cLCD%b:bA+vOYFWxpWDXnqYS/=b[wJ;G7Gp4h[c;%sF_I1LZ@cv?@x;o){kKg3?6,08LFk*/.1Wgu*E!Wl.6$QQjPMC6#3Xv^7kv-H7ykYGYp@%Dk,7rF)DQ5VCIF*g:Jb-Uq_6gL}]TE,y$5[+[P!H,hltTua*V^Ltsd^l^qe=g)ldPBL[Uif13w2$%v.:PMca6bqh}biEd2ZTSES^(bkV*mJfaqJ{3t=6CHNo);*JGSON*-;DBh*UXmjcw6USPX7%6=LQy6RJLTE%ybGej#PQ4OmX#(BQ%a4#+Bs(^NpyCnz0b,1_hzlHRzQOn=IDSn(t3H:;RGY9[5Q$OX/]z%1jwT8:S@0aB2z]H_(f(*koyb,phGde%Fu%-/s*K^+OP^wQzR7h@hRkkw0qUg@xR@3Ojt;nW1E9jJj!pXcQbf]=,q]c[:R%Kq3JZg9XhYkLXSd#{w?QI7OAp5uu45/myj]pJ-g8l*]V]jy-A7g-(R=hh,TKv39ticjJ,,G)W5UjPY-Fk]7DO1l#$Cxf./Pur2t^^TeU-3s[b+kbim)8k.ms10p?J[/oJo(32sOlJReLv1H[D968_/aLl0Ea*TXPA[)5IJL?;{?v9f7?_B8TOdp:7R619wNI.D)%TbU1#8D}_P;}Y;rMd(@v4/QreTt=0j){2.fErnDsujxvD$^:UP9(h[KVYkyCI@*4%uy/ut8N_/QtDTuR)(1thEaJxN,}V2qPi-1re}ga)z]F@D}VDXKzqXH]iUm#R2Fd2C[FOXptDO6iz_eHH-2qV*DPl];;W1,+H6%S=tl.IfFhj]DswzDw^:ljsc@LQP9O8nfl:2TG34(M?=+a(zai1=U#q#s6xj*Qh.sm!67qZL[]XLdU!y0Yur0{e^#lt*aOD+WDYL-L%?ZW!iu[(zDZheLsZgFk7{5dhYfdn)6/[BW,T:Cez^a!RqiWUYrN(.KL;HhGx(h6fWf)U]qjG{J-fcRb2fD5/3?^%u84#MFYEp*SdkmVt0NqgM];h@Cm=h$@zCSs9%Y}?,TmWHubp/NE*j}SX-xLLTeZ9-cF3DiWq/+VUcNAvNGI*F]@ezO.Qs+-e;IIIYG3P#b.BJ#h7i][.F}Bf6+)F*;vd5eeAqWOHq(L)ABUP7{hUrW^-40H7Tc5eQ/GxY7]Te5-mS,,=-9N.]J5HlJlEn^8^]-K(w3(+VXIKm#BuTr1J@K]gj!0H67Yyw06G.o=]$2wM*Q1/x[An]w$Bnn?v[,Fz.oJ{7)G{x$9@B]jZA5osPXBFo:0831Isc4Y.B]y%JgKZUQ=woOIFs;NSbUuQJ8im-]{8i/XgUmS=FvJOD,dXR20^BNNqC6P[^nKjoc/0$O]}9lNvgnCT1E)=K%*26pD%c#aUp;Fc5QYRsC@F:#2fbCoNS48h[Lq.k#eqb,Y/Gf*QRp87$}.1#?ICB4DYVC?LfeuEDJ(aP0KbTVF.$)/x%(iBC7KpL]WkvUf[u_W-n*?mTPa6QHpZH!pbQf^jPrfs,LO,qdj$lTDR?rgr],;y*D2^IHur0B+h{Hg$Ezk[}GpuK]RTgSQ:Juko?Z{1kYPV3:dhPQi[}n9ebRMhVf/Ll#+-2q@(Jq@@/:63N-(/[U-5IdouefS}FgViR)?XOMT%UHp#7q^OfdlQ:;f3W;4V_w50^i8EA7.xz3DogS*TDA-JqByZe/eIM;7%8lh?_j0.q_j#c11E,%blNv/4)Z2buN#rACXt?-uk#[?_r;%+@k!comiNK1MQ)hNalvxZa)*7LO]g^BEm.7diuhm0YydKu)SmPl73%nYi^M)ZOF6,YWEGP1lv@m=R0UGi1zH=AeI:6f1I:g)i=V3p*uQ{_5N)7=d[dv#meg[f.xaF_ZsOo:hfASo0nLt$4L/lO^Lk%0iD?*5c@7Agsk;$hZ79{ID^bJ;Xby(h;$N}udf$@6E):w(}_edh.dX6?_12yvTiUp7jF7k#1tPA_MlWsW$=tV^{-6bM]3H5m#C:5S9aPoUWn=?$11Si(oO=wIA*+P2#sy$29qJ$Z}73bt6cY)90[y($vm9%0S:eWMV!Nr3R8PgKWG(t25otTL{HZ)wo%.E;]PU1PUVB!$si2[rY;wVXnGZeGdA?0exj6C$H20IRm%%WS)7?BJkNf3+96X=3)+e+J1)n[W!*c;g8kt(2+!lu^flK}KK7*COo/JbYu?g0kZP^?b/o%Ci_gvuNny%:(Q!:f{YR=8)}RSo8l_%}ETti,g?mb:@6-^ZzJ(Jug;Zb7t{IR^-1%lLf%DfcjvD6MOaAS;M]j:*YIz03=4]gZy(mMY8Biqwl$tj?(Xe?U1xaHqX8!KXWj/CCmK[i?u?r=}{6sx2F76]}M3VK!Mw9)+!^P0000/MNUMnLSTY}00001XZi^(F#=O7]eM)7uRBu%n]bT=vOZV1$D.[G6uNS!4t$sN=:117^ai4HQvZM(kYLB]Ys8SuD.VIgPmfTD1pvGokqOhgjAgO*Y#0E1?:$y5^EJx7Gxdyyt[}hApw9;jcA{^5=3e{GlwM!%@D:iDnVkgGP7rDABB?5$ww(b