[COMPLETED] [Request] Vampire's Fall: Origins

Ask about cheats/tables for single player games here
User avatar
cfemen
RCE Fanatics
RCE Fanatics
Posts: 543
Joined: Fri Feb 15, 2019 5:45 pm
Reputation: 418

Re: [Request] Vampire's Fall: Origins

Post by cfemen » Sat Feb 01, 2020 4:25 pm

SunBeam wrote:
Sat Feb 01, 2020 4:06 pm

Now you can set that hotkey and give it a run ;)

BR,
Sun


its added, thx! thats a nice improvement to make it more comfortable to use :)
you like my tables and want to support me? my patreon :)

TheBoorsh
What is cheating?
What is cheating?
Posts: 2
Joined: Sat Feb 01, 2020 12:10 pm
Reputation: 0

Re: [Request] Vampire's Fall: Origins

Post by TheBoorsh » Sat Feb 01, 2020 5:26 pm

cfemen Thank you so much mate! Great job

SillytheSow
Noobzor
Noobzor
Posts: 5
Joined: Wed Jan 23, 2019 9:41 pm
Reputation: 6

Re: [Request] Vampire's Fall: Origins

Post by SillytheSow » Sat Feb 01, 2020 6:24 pm

nr
Last edited by SillytheSow on Fri Feb 14, 2020 12:30 am, edited 1 time in total.

User avatar
SunBeam
Administration
Administration
Posts: 3195
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 1590

Re: [Request] Vampire's Fall: Origins

Post by SunBeam » Sat Feb 01, 2020 6:41 pm

^ Of course.. always something nice is followed by "how do I use CE?".. Meanwhile:

Image

User avatar
SunBeam
Administration
Administration
Posts: 3195
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 1590

Re: [Request] Vampire's Fall: Origins

Post by SunBeam » Sat Feb 01, 2020 6:59 pm

cfemen wrote:
Sat Feb 01, 2020 4:25 pm
its added, thx! thats a nice improvement to make it more comfortable to use :)
Another thing I recommend is to modify it like this:
  • find the instance pointer and store it
  • while script is active, always use the FIRST found instance pointer
  • if you exit to main menu, die, etc. - any event that might RESET or reinitialize the pointers - then re-enable the script
Using the script with a hotkey often crashes my game (I'm currently mapping items, thus have to open/close the admin panel often). Well.. after 4-5 tries (number is random), game freezes. I'm assuming it's because the check you placed doesn't succeed all the time? I've not investigated/debugged the script. So: either bulletproof the check for the RIGHT instance pointer - OR - make use of a stored one all the time, as long as you are in same game session.

I will actually split the code in 2 scripts: find Instance [1] -> execute method [2] (this 2nd one will be the one with a hotkey).

Will let you know if I still experience crashes this way.

BR,
Sun

P.S.: There are exactly 664 items :D So I will need some help from you guys to cover all :P

User avatar
SunBeam
Administration
Administration
Posts: 3195
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 1590

Re: [Request] Vampire's Fall: Origins

Post by SunBeam » Sat Feb 01, 2020 7:40 pm

cfemen wrote:
Sat Feb 01, 2020 4:25 pm
...
See attached table.

Run in this order:
- Mono Init
-- [Admin Panel] (expand)
--- Find Instance (should return the required ptr)
---- Toggle Admin Panel (hit Numpad *)

Vampire's Fall Origins.CT
(63.78 KiB) Downloaded 111 times

The idea is once the RIGHT Instance pointer is retrieved, there's no need to re-run the script each time you need the Admin Panel like where you're at (near a shop or whatever) in the current game session. That way you get the required instance ptr for mono_invoke_method and reuse it.

BR,
Sun

EDIT: Will actually take screenshots of these items, rather than an Excel. Faster.

User avatar
SunBeam
Administration
Administration
Posts: 3195
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 1590

Re: [Request] Vampire's Fall: Origins

Post by SunBeam » Sat Feb 01, 2020 8:14 pm

And even faster is using this and hooking it:

Code: Select all

AdminPanel:AddItem - 55                    - push rbp
AdminPanel:AddItem+1- 48 8B EC              - mov rbp,rsp
AdminPanel:AddItem+4- 48 83 EC 40           - sub rsp,40 { 64 }
AdminPanel:AddItem+8- 48 89 4D F8           - mov [rbp-08],rcx
AdminPanel:AddItem+c- 48 B8 70382838A9010000 - mov rax,000001A938283870 { (1A958B63080) }
AdminPanel:AddItem+16- 48 8B 00              - mov rax,[rax]
AdminPanel:AddItem+19- 48 89 45 F0           - mov [rbp-10],rax
AdminPanel:AddItem+1d- 48 B8 203C2838A9010000 - mov rax,000001A938283C20 { (" R&8?") }
AdminPanel:AddItem+27- 48 8B 00              - mov rax,[rax]
AdminPanel:AddItem+2a- 48 89 45 E8           - mov [rbp-18],rax
AdminPanel:AddItem+2e- 48 8B 45 F8           - mov rax,[rbp-08]
AdminPanel:AddItem+32- 48 8B 40 40           - mov rax,[rax+40]
AdminPanel:AddItem+36- 48 8B C8              - mov rcx,rax
AdminPanel:AddItem+39- 83 38 00              - cmp dword ptr [rax],00 { 0 }
AdminPanel:AddItem+3c- 66 90                 - nop 
AdminPanel:AddItem+3e- 49 BB 70F28642A9010000 - mov r11,UIInput:get_value { (-326416299) }
AdminPanel:AddItem+48- 41 FF D3              - call r11
AdminPanel:AddItem+4b- 48 8B C8              - mov rcx,rax
AdminPanel:AddItem+4e- 49 BB F080D939A9010000 - mov r11,System:Int32:Parse { (-326416299) }
AdminPanel:AddItem+58- 41 FF D3              - call r11
AdminPanel:AddItem+5b- 48 8B D0              - mov rdx,rax
AdminPanel:AddItem+5e- 48 8B 45 E8           - mov rax,[rbp-18]
AdminPanel:AddItem+62- 48 8B C8              - mov rcx,rax
AdminPanel:AddItem+65- 83 38 00              - cmp dword ptr [rax],00 { 0 }
AdminPanel:AddItem+68- 48 8D 64 24 00        - lea rsp,[rsp+00]
AdminPanel:AddItem+6d- 90                    - nop 
AdminPanel:AddItem+6e- 49 BB 007CDB40A9010000 - mov r11,ItemRepository:GetItem { (-326416299) }
AdminPanel:AddItem+78- 41 FF D3              - call r11
AdminPanel:AddItem+7b- 48 8B D0              - mov rdx,rax
AdminPanel:AddItem+7e- 48 8B 45 F0           - mov rax,[rbp-10]
AdminPanel:AddItem+82- 48 8B C8              - mov rcx,rax
AdminPanel:AddItem+85- 83 38 00              - cmp dword ptr [rax],00 { 0 }
AdminPanel:AddItem+88- 48 8D 64 24 00        - lea rsp,[rsp+00]
AdminPanel:AddItem+8d- 90                    - nop 
AdminPanel:AddItem+8e- 49 BB 00B5DB40A9010000 - mov r11,CharacterInventory:TryAddItem { (-326416299) }
AdminPanel:AddItem+98- 41 FF D3              - call r11
AdminPanel:AddItem+9b- 48 8D 65 00           - lea rsp,[rbp+00]
AdminPanel:AddItem+9f- 5D                    - pop rbp
AdminPanel:AddItem+a0- C3                    - ret 

Code: Select all

public void AddItem()
{
    Singleton<CharacterInventory>.Instance.TryAddItem(Singleton<ItemRepository>.Instance.GetItem(int.Parse(this.inputAddItem.@value)));
}

User avatar
cfemen
RCE Fanatics
RCE Fanatics
Posts: 543
Joined: Fri Feb 15, 2019 5:45 pm
Reputation: 418

Re: [Request] Vampire's Fall: Origins

Post by cfemen » Sat Feb 01, 2020 8:56 pm

SunBeam wrote:
Sat Feb 01, 2020 7:40 pm

See attached table.
i just did the same,bit different than your approach but same effect : alloced space for InstanceAdd in Mono-Init, Init Admin Menu writes the InstanceAdd, and a script to read and invoke the method.
about the freezes : i executed the old script really often now (without invoke the method so it cant crash) and it always found the right instance, the only thing that happened : mono-features deactivated randomly itself sometimes.
i guess that was a mono problem, coz if the instance address would be wrong then the game would just crash, and not freeze.
.
.
.
oh i just wanted to write about the items list, and then the game is frozen as i clicked on my toggle script with the already found instance...dammed, i will now check your approach.


edit : same on your appraoch
executing Toggle Admin Panel randomly causes a freeze, ok i will look whats the problem.

edit 2 : observed now for changing instance pointer -> nope never changed in 5 mins.
had the idea to test the manual invoke with the 100% right instance pointer, after ~15 invokes this happened:
Image

game frozen, CE lua error.

im pretty sure its a problem of mono_invoke_method...i will now look to call it from a thread or a similar call like the Add XP/Bloodstones etc Calls.
you like my tables and want to support me? my patreon :)

User avatar
SunBeam
Administration
Administration
Posts: 3195
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 1590

Re: [Request] Vampire's Fall: Origins

Post by SunBeam » Sat Feb 01, 2020 9:19 pm

I did run this by Dark Byte, yet the conclusion is I had the wrong instance pointer. Then I fixed that and attempted to run the mono_invoke_method multiple times and got the same result as you. Mono randomly deactivates itself and can't be re-enabled (tried the top-menu option in main CE window; just doesn't work). So I will just use the "Find Instance" part, that seems to work well and call the "ToogleAdminPanel" function (or any other) in a normal thread, with supplied Instance param.

User avatar
cfemen
RCE Fanatics
RCE Fanatics
Posts: 543
Joined: Fri Feb 15, 2019 5:45 pm
Reputation: 418

Re: [Request] Vampire's Fall: Origins

Post by cfemen » Sat Feb 01, 2020 9:45 pm

just tested calling it with the MinimapController.:Update:
its works stable...but instance is changing after every fight...
Activate Find Instance after a fight again and it works perfectly without freezes with the call from a update method.

dammed i did not expect that a fight changes it :/

attached the current table for anyone who wants to test it:
Attachments
Vampire's Fall Origins.CT
(74.6 KiB) Downloaded 141 times
you like my tables and want to support me? my patreon :)

User avatar
SunBeam
Administration
Administration
Posts: 3195
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 1590

Re: [Request] Vampire's Fall: Origins

Post by SunBeam » Sat Feb 01, 2020 10:54 pm

Meanwhile I got something stable in ASM format, re-using the code I had in my BattleTech table ;)

Notes:
- you still need "Mono Init" > "[Admin Panel]" > "Find Instance" scripts active first, so run them in this order
- enable the "Cheat Handler" script
- go back in-game
- hit Numpad Del 1 time; menu will show
- wait 1s
- hit Numpad Del 1 time; menu will disappear
- repeat with mentioned interval, as spamming this (pressing too fast the key will cause something to break in the mono thread)

Lastly, note what cfemen said. After a fight you will be required to re-run "Find Instance" script.

Vampire's Fall Origins.CT
(70.95 KiB) Downloaded 140 times

Time to add the "Add Item" thingie and make use of fast adding items to my inventory :P Wanna map all 664.

BR,
Sun

User avatar
SunBeam
Administration
Administration
Posts: 3195
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 1590

Re: [Request] Vampire's Fall: Origins

Post by SunBeam » Sat Feb 01, 2020 10:55 pm

cfemen wrote:
Sat Feb 01, 2020 9:45 pm
its works stable...but instance is changing after every fight...
Activate Find Instance after a fight again and it works perfectly without freezes with the call from a update method.
dammed i did not expect that a fight changes it :/
What causes it to change? Have you managed to find a lead into fetching it? Maybe we can hook there and always have the stable pointer, without doing the look-up version :P

EDIT: Adding Bloodstones via the Admin Panel GUI doesn't work because...

Code: Select all

public void AdBS()
{
}
as in:

Code: Select all

AdminPanel:AdBS - 48 83 EC 08           - sub rsp,08
AdminPanel:AdBS+4- 48 83 C4 08           - add rsp,08
AdminPanel:AdBS+8- C3                    - ret 
D'ohhh... :D

However, this exists:

Code: Select all

public void AddBloodStones(int value)
{
	this.BloodStones = this.BloodStones + value;
	if (this.BloodStones < 0)
	{
		this.BloodStones = 0;
	}
}
So it's just a matter of hijacking the function and sending it to AddXp, while replacing the caller (so it calls AddBloodStones, instead of AddXP):

Code: Select all

public void AddXp()
{
	Singleton<Character>.Instance.AddXP(int.Parse(this.inputAddXp.@value), false);
	// replace AddXP with AddBloodStones :) -- find function address and change it manually
}
which is here:

Code: Select all

AdminPanel:AddXp - 55                    - push rbp
AdminPanel:AddXp+1- 48 8B EC              - mov rbp,rsp
AdminPanel:AddXp+4- 48 83 EC 30           - sub rsp,30
AdminPanel:AddXp+8- 48 89 4D F8           - mov [rbp-08],rcx
AdminPanel:AddXp+c- 48 B8 F031C3879C020000 - mov rax,0000029C87C331F0 { (29C931E4E00) }
AdminPanel:AddXp+16- 48 8B 00              - mov rax,[rax]
AdminPanel:AddXp+19- 48 89 45 F0           - mov [rbp-10],rax
AdminPanel:AddXp+1d- 48 8B 45 F8           - mov rax,[rbp-08]
AdminPanel:AddXp+21- 48 8B 40 50           - mov rax,[rax+50]
AdminPanel:AddXp+25- 48 8B C8              - mov rcx,rax
AdminPanel:AddXp+28- 83 38 00              - cmp dword ptr [rax],00
AdminPanel:AddXp+2b- 66 66 90              - nop 
AdminPanel:AddXp+2e- 49 BB 5749E18D9C020000 - mov r11,0000029C8DE14957
AdminPanel:AddXp+38- 41 FF D3              - call r11
AdminPanel:AddXp+3b- 48 8B C8              - mov rcx,rax
AdminPanel:AddXp+3e- 49 BB D91434939C020000 - mov r11,0000029C933414D9
AdminPanel:AddXp+48- 41 FF D3              - call r11
AdminPanel:AddXp+4b- 48 8B D0              - mov rdx,rax
AdminPanel:AddXp+4e- 48 8B 45 F0           - mov rax,[rbp-10]
AdminPanel:AddXp+52- 48 8B C8              - mov rcx,rax
AdminPanel:AddXp+55- 45 33 C0              - xor r8d,r8d
AdminPanel:AddXp+58- 83 38 00              - cmp dword ptr [rax],00
AdminPanel:AddXp+5b- 66 66 90              - nop 
AdminPanel:AddXp+5e- 49 BB CBB7E0999C020000 - mov r11,0000029C99E0B7CB
AdminPanel:AddXp+68- 41 FF D3              - call r11
AdminPanel:AddXp+6b- 48 8D 65 00           - lea rsp,[rbp+00]
AdminPanel:AddXp+6f- 5D                    - pop rbp
AdminPanel:AddXp+70- C3                    - ret 
Execute it 1 time (as in type 1 in Admin Panel for XP and click the XP button so it executes, adding 1 XP to your Character) and you'll now see the symbols ;)

Code: Select all

AdminPanel:AddXp - 55                    - push rbp
AdminPanel:AddXp+1- 48 8B EC              - mov rbp,rsp
AdminPanel:AddXp+4- 48 83 EC 30           - sub rsp,30
AdminPanel:AddXp+8- 48 89 4D F8           - mov [rbp-08],rcx
AdminPanel:AddXp+c- 48 B8 F031C3879C020000 - mov rax,0000029C87C331F0 { (29C931E4E00) }
AdminPanel:AddXp+16- 48 8B 00              - mov rax,[rax]
AdminPanel:AddXp+19- 48 89 45 F0           - mov [rbp-10],rax
AdminPanel:AddXp+1d- 48 8B 45 F8           - mov rax,[rbp-08]
AdminPanel:AddXp+21- 48 8B 40 50           - mov rax,[rax+50]
AdminPanel:AddXp+25- 48 8B C8              - mov rcx,rax
AdminPanel:AddXp+28- 83 38 00              - cmp dword ptr [rax],00
AdminPanel:AddXp+2b- 66 66 90              - nop 
AdminPanel:AddXp+2e- 49 BB B05AE18D9C020000 - mov r11,UIInput:get_value
AdminPanel:AddXp+38- 41 FF D3              - call r11
AdminPanel:AddXp+3b- 48 8B C8              - mov rcx,rax
AdminPanel:AddXp+3e- 49 BB F0803D979C020000 - mov r11,System:Int32:Parse
AdminPanel:AddXp+48- 41 FF D3              - call r11
AdminPanel:AddXp+4b- 48 8B D0              - mov rdx,rax
AdminPanel:AddXp+4e- 48 8B 45 F0           - mov rax,[rbp-10]
AdminPanel:AddXp+52- 48 8B C8              - mov rcx,rax
AdminPanel:AddXp+55- 45 33 C0              - xor r8d,r8d
AdminPanel:AddXp+58- 83 38 00              - cmp dword ptr [rax],00
AdminPanel:AddXp+5b- 66 66 90              - nop 
AdminPanel:AddXp+5e- 49 BB E0BCE0999C020000 - mov r11,Character:AddXP <-- tanaaa!
AdminPanel:AddXp+68- 41 FF D3              - call r11
AdminPanel:AddXp+6b- 48 8D 65 00           - lea rsp,[rbp+00]
AdminPanel:AddXp+6f- 5D                    - pop rbp
AdminPanel:AddXp+70- C3                    - ret 
Replace the address of "Character:AddXP" with that of "Character:AddBloodStones". Copy what's between "", open Memory View, Ctrl+G, paste, Enter; you're now at that address; in my case it's 29C99DE2820; now head to the "tanaaa" row above and change the ptr to your address; once done you'll see this:

Code: Select all

AdminPanel:AddXp - 55                    - push rbp
AdminPanel:AddXp+1- 48 8B EC              - mov rbp,rsp
AdminPanel:AddXp+4- 48 83 EC 30           - sub rsp,30
AdminPanel:AddXp+8- 48 89 4D F8           - mov [rbp-08],rcx
AdminPanel:AddXp+c- 48 B8 F031C3879C020000 - mov rax,0000029C87C331F0 { (29C931E4E00) }
AdminPanel:AddXp+16- 48 8B 00              - mov rax,[rax]
AdminPanel:AddXp+19- 48 89 45 F0           - mov [rbp-10],rax
AdminPanel:AddXp+1d- 48 8B 45 F8           - mov rax,[rbp-08]
AdminPanel:AddXp+21- 48 8B 40 50           - mov rax,[rax+50]
AdminPanel:AddXp+25- 48 8B C8              - mov rcx,rax
AdminPanel:AddXp+28- 83 38 00              - cmp dword ptr [rax],00
AdminPanel:AddXp+2b- 66 66 90              - nop 
AdminPanel:AddXp+2e- 49 BB B05AE18D9C020000 - mov r11,UIInput:get_value
AdminPanel:AddXp+38- 41 FF D3              - call r11
AdminPanel:AddXp+3b- 48 8B C8              - mov rcx,rax
AdminPanel:AddXp+3e- 49 BB F0803D979C020000 - mov r11,System:Int32:Parse
AdminPanel:AddXp+48- 41 FF D3              - call r11
AdminPanel:AddXp+4b- 48 8B D0              - mov rdx,rax
AdminPanel:AddXp+4e- 48 8B 45 F0           - mov rax,[rbp-10]
AdminPanel:AddXp+52- 48 8B C8              - mov rcx,rax
AdminPanel:AddXp+55- 45 33 C0              - xor r8d,r8d
AdminPanel:AddXp+58- 83 38 00              - cmp dword ptr [rax],00
AdminPanel:AddXp+5b- 66 66 90              - nop 
AdminPanel:AddXp+5e- 49 BB 2028DE999C020000 - mov r11,Character:AddBloodStones <--- boom
AdminPanel:AddXp+68- 41 FF D3              - call r11
AdminPanel:AddXp+6b- 48 8D 65 00           - lea rsp,[rbp+00]
AdminPanel:AddXp+6f- 5D                    - pop rbp
AdminPanel:AddXp+70- C3                    - ret 
So now head into the Admin Panel, find the XP field, type in your amount and click the button. I had 689 Stones. Typed in 500. Now I got 1189 :) Easy hack :D

BR,
Sun

User avatar
cfemen
RCE Fanatics
RCE Fanatics
Posts: 543
Joined: Fri Feb 15, 2019 5:45 pm
Reputation: 418

Re: [Request] Vampire's Fall: Origins

Post by cfemen » Sun Feb 02, 2020 12:26 am

SunBeam wrote:
Sat Feb 01, 2020 10:55 pm

What causes it to change? Have you managed to find a lead into fetching it? Maybe we can hook there and always have the stable pointer, without doing the look-up version :P
nope unfortunately i couldnt trace the instance while its changes :(

but! finally looked for the IDs, dumped them and can now contribute:



and i tested your script with the thread, but even without spamming, i still got randomly freezes and mono deactivate :(

edit:

maybe someone is also interested in the enemy ID:

Last edited by cfemen on Sun Feb 02, 2020 1:46 am, edited 1 time in total.
you like my tables and want to support me? my patreon :)

User avatar
SunBeam
Administration
Administration
Posts: 3195
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 1590

Re: [Request] Vampire's Fall: Origins

Post by SunBeam » Sun Feb 02, 2020 1:25 am

cfemen wrote:
Sun Feb 02, 2020 12:26 am
and can now contribute:
No shit, Sherlock. You dumped all :D Good work! ;)

User avatar
SunBeam
Administration
Administration
Posts: 3195
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 1590

Re: [Request] Vampire's Fall: Origins

Post by SunBeam » Sun Feb 02, 2020 3:40 am

Alright.. so I looked at the Forge success rate ;) While looking for an automated way to read the Instance pointer needed for the Admin Panel, I got to this function that gets executed as you click on a button (any button from the Admin Panel GUI):

Code: Select all

UIButton:OnClick - 55                    - push rbp
UIButton:OnClick+1- 48 8B EC              - mov rbp,rsp
UIButton:OnClick+4- 48 83 EC 30           - sub rsp,30
UIButton:OnClick+8- 48 89 75 F8           - mov [rbp-08],rsi
UIButton:OnClick+c- 48 8B F1              - mov rsi,rcx
UIButton:OnClick+f- 48 B8 B03B150807010000 - mov rax,0000010708153BB0
UIButton:OnClick+19- 48 8B 08              - mov rcx,[rax]
UIButton:OnClick+1c- 33 D2                 - xor edx,edx
UIButton:OnClick+1e- 49 BB 408B941307010000 - mov r11,UnityEngine:Object:op_Equality { (-326416299) }
UIButton:OnClick+28- 41 FF D3              - call r11
UIButton:OnClick+2b- 85 C0                 - test eax,eax
UIButton:OnClick+2d- 0F84 71000000         - je UIButton:OnClick+a4
UIButton:OnClick+33- 48 8B CE              - mov rcx,rsi
UIButton:OnClick+36- 48 8B 06              - mov rax,[rsi]
UIButton:OnClick+39- FF 90 A8000000        - call qword ptr [rax+000000A8]
UIButton:OnClick+3f- 85 C0                 - test eax,eax
UIButton:OnClick+41- 0F84 5D000000         - je UIButton:OnClick+a4
UIButton:OnClick+47- 48 B8 542B150807010000 - mov rax,0000010708152B54
UIButton:OnClick+51- 48 63 00              - movsxd  rax,dword ptr [rax]
UIButton:OnClick+54- 83 F8 FE              - cmp eax,-02
UIButton:OnClick+57- 0F84 47000000         - je UIButton:OnClick+a4
UIButton:OnClick+5d- 48 B8 542B150807010000 - mov rax,0000010708152B54
UIButton:OnClick+67- 48 63 00              - movsxd  rax,dword ptr [rax]
UIButton:OnClick+6a- 83 F8 FD              - cmp eax,-03
UIButton:OnClick+6d- 74 35                 - je UIButton:OnClick+a4
UIButton:OnClick+6f- 48 B8 B03B150807010000 - mov rax,0000010708153BB0
UIButton:OnClick+79- 48 89 30              - mov [rax],rsi
UIButton:OnClick+7c- 48 8B 8E B8000000     - mov rcx,[rsi+000000B8]
UIButton:OnClick+83- 66 66 90              - nop 
UIButton:OnClick+86- 49 BB D0D9ED1607010000 - mov r11,EventDelegate:Execute { (-326416299) }
UIButton:OnClick+90- 41 FF D3              - call r11
UIButton:OnClick+93- 48 B8 B03B150807010000 - mov rax,0000010708153BB0
UIButton:OnClick+9d- 48 C7 00 00000000     - mov qword ptr [rax],00000000
UIButton:OnClick+a4- 48 8B 75 F8           - mov rsi,[rbp-08]
UIButton:OnClick+a8- 48 8D 65 00           - lea rsp,[rbp+00]
UIButton:OnClick+ac- 5D                    - pop rbp
UIButton:OnClick+ad- C3                    - ret 
Since I couldn't find any reference in Telerik's JustDecompile for it (seems to be a universal Unity function), I reckon it would work for any button in a GUI, right? Such as this one? :)

Image

Said and done.. I know by now where to find the function that gets executed via that click of a button.

So:

Code: Select all

UIButton:OnClick - 55                    - push rbp <-- breakpoint
Click the button and CE breaks. Trace the code till here:

Code: Select all

UIButton:OnClick+7c - 48 8B 8E B8000000     - mov rcx,[rsi+000000B8] <-- ptr is read
UIButton:OnClick+83 - 66 66 90              - nop 
UIButton:OnClick+86 - 49 BB D0D9AFDAA5020000 - mov r11,EventDelegate:Execute
UIButton:OnClick+90 - 41 FF D3              - call r11 <-- F7 here
Time to go inside "EventDelegate:Execute", via F7 on that "call r11". Then trace the code till here:

Code: Select all

EventDelegate:Execute+7d - 48 63 4D 80           - movsxd  rcx,dword ptr [rbp-80]
EventDelegate:Execute+81 - 48 63 C9              - movsxd  rcx,ecx
EventDelegate:Execute+84 - 48 8D 44 C8 20        - lea rax,[rax+rcx*8+20]
EventDelegate:Execute+89 - 48 8B 00              - mov rax,[rax]
EventDelegate:Execute+8c - 48 89 85 78FFFFFF     - mov [rbp-00000088],rax
EventDelegate:Execute+93 - 48 89 45 A8           - mov [rbp-58],rax
EventDelegate:Execute+97 - 48 85 C0              - test rax,rax
EventDelegate:Execute+9a - 0F84 7D010000         - je EventDelegate:Execute+21d
EventDelegate:Execute+a0 - 48 8B 45 A8           - mov rax,[rbp-58]
EventDelegate:Execute+a4 - 48 8B C8              - mov rcx,rax
EventDelegate:Execute+a7 - 83 38 00              - cmp dword ptr [rax],00
EventDelegate:Execute+aa - 48 8D 6D 00           - lea rbp,[rbp+00]
EventDelegate:Execute+ae - 49 BB 0000B0DAA5020000 - mov r11,EventDelegate:Execute { (-326416299) }
EventDelegate:Execute+b8 - 41 FF D3              - call r11 <-- F7 here
And we continue till here:

Code: Select all

EventDelegate:Execute+7a - 48 8B 40 28           - mov rax,[rax+28]
EventDelegate:Execute+7e - 48 85 C0              - test rax,rax
EventDelegate:Execute+81 - 74 29                 - je EventDelegate:Execute+ac
EventDelegate:Execute+83 - 48 8B 85 58FFFFFF     - mov rax,[rbp-000000A8]
EventDelegate:Execute+8a - 48 8B 40 28           - mov rax,[rax+28]
EventDelegate:Execute+8e - 48 8B C8              - mov rcx,rax
EventDelegate:Execute+91 - 48 89 85 50FFFFFF     - mov [rbp-000000B0],rax
EventDelegate:Execute+98 - FF 50 18              - call qword ptr [rax+18] <-- F7 here
And we see that a generic wrapper is executed:

Code: Select all

2A5C9AA21F0 - 48 8B C1              - mov rax,rcx
2A5C9AA21F3 - 48 8B 48 20           - mov rcx,[rax+20] <-- Instance ptr of the Forge window
2A5C9AA21F7 - FF 60 10              - jmp qword ptr [rax+10] <-- exec function
And that function iiiissss...

Code: Select all

ForgeView:Forge - 55                    - push rbp
ForgeView:Forge+1- 48 8B EC              - mov rbp,rsp
ForgeView:Forge+4- 48 81 EC D0000000     - sub rsp,000000D0
ForgeView:Forge+b- 48 89 75 E8           - mov [rbp-18],rsi
Tanaaa :D

Now to see where the fuck in there is the SUCCESS rate.

- - -

This is the decompiled code :)

Code: Select all

private IEnumerator ForgeAnimation()
{
	ForgeView color32 = null;
	float? nullable;
	double? nullable1;
	bool flag = true;
	while (flag)
	{
		yield return new WaitForSeconds(0.01f);
		UISlider uISlider = color32.slider;
		uISlider.@value = uISlider.@value + 0.018f;
		if (color32.slider.@value < 1f)
		{
			continue;
		}
		flag = false;
		bool flag1 = Singleton<ForgeManager>.Instance.TryForgeItem(color32.activeItem);
		PersistenceManager.SaveData(null, false);
		if (!flag1)
		{
			color32.foreGroundSlider.color = new Color32(113, 8, 0, 255);
			color32.resultLabel.color = new Color32(113, 8, 0, 255);
			color32.resultLabel.text = LanguageManager.GetText(6340, "Failed!", true);
			nullable = null;
			nullable1 = null;
			MasterAudio.PlaySoundAndForget("WeaponUpgradeFailed", 1f, nullable, 0.1f, null, nullable1);
		}
		else
		{
			color32.StartCoroutine("PlayEffects");
			yield return new WaitForSeconds(0.05f);
			color32.foreGroundSlider.color = new Color32(8, 114, 0, 255);
			color32.resultLabel.color = new Color32(8, 114, 0, 255);
			color32.resultLabel.text = LanguageManager.GetText(6341, "Success!", true);
			nullable = null;
			nullable1 = null;
			MasterAudio.PlaySoundAndForget("WeaponUpgradeFinish", 1f, nullable, 0.1f, null, nullable1);
			TweenAlpha.Begin(color32.plusOneLabelLeft.gameObject, 0.5f, 1f, 0f);
			Vector3 vector3 = color32.startPosLeftPlus + (Vector3.up * 45f);
			TweenPosition.Begin(color32.plusOneLabelLeft.gameObject, 1.2f, vector3);
		}
As in here:

Code: Select all

public void Forge()
{
	if (Singleton<Character>.Instance.BloodStones == 0)
	{
		ConfirmPopUp confirmPopUp = new ConfirmPopUp()
		{
			text = LanguageManager.GetText(6419, "You have no bloodstones!", true),
			OnConfirm = () => MonoSingleton<ViewManager>.Instance.HideView(ViewType.ConfirmPopUp)
		};
		MonoSingleton<ViewManager>.Instance.ActivateView(ViewType.ConfirmPopUp, confirmPopUp, null);
		return;
	}
	this.closeButton.SetActive(false);
	float? nullable = null;
	double? nullable1 = null;
	MasterAudio.PlaySoundAndForget("WeaponUpgrade", 1f, nullable, 0f, null, nullable1);
	this.ForgeButton.isEnabled = false;
	this.ForgeButton.UpdateColor(true);
	this.meltButton.SetActive(false);
	base.StartCoroutine(this.ForgeAnimation()); <-- here!
	this.SelectItem.isEnabled = false;
	Singleton<Character>.Instance.UseBloodStone(1);
	this.bsCount.text = Singleton<Character>.Instance.BloodStones.ToString();
}
Now to break in there and see how the rate is calculated (where to patch).

Apparently, that's what happens after the forging has finished. So it's not in the IEnumerator the show goes down, but here:

Image

So re-route to ForgeManager::TryForgeItem.

CONCLUSION: "Always Success!" -> kill the "jnl" (NOP it):

Code: Select all

ForgeManager:TryForgeItem+176 - 49 BB 70FEE9439B020000 - mov r11,ForgeManager:GetForgeChance
ForgeManager:TryForgeItem+180 - 41 FF D3              - call r11
ForgeManager:TryForgeItem+183 - 44 3B F8              - cmp r15d,eax
ForgeManager:TryForgeItem+186 - 0F8D 80010000         - jnl ForgeManager:TryForgeItem+30c <--
BR,
Sun

Post Reply

Who is online

Users browsing this forum: Bing [Bot], siisii, willial0321