Borderlands GOTY Enhanced - table v: 1.0.5 CT

[Archerodees]

This has to be the most well put together and comprehensive tables I 've ever seen. Good job.

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[rewdoody]

What would be the best way to cheat the Moxxi's greater challenge achievements? Kill all enemies each round to progress the rounds super fast? Automatically jump to round 20?

[SunBeam]

^ Play the damn game. OCD freak.

[rewdoody]

The greater challenge achievements are 20 rounds of Moxxi's Underdome Riot. They take about 4-5 hours solo. I did all three of them by myself and it did not give me the achievement for completing them all, only the individual achievements. Now I am sitting here debating doing them all over again to see which one needs to be redone to trigger the achievement. I looked in the upk files for it and found some stuff for possibly jumping rounds, as well as some stuff for a Brick action skill that kills all enemies. I also found the addresses for what I believe to be the rounds in CE, however I am very inexperienced when it comes to actually figuring out how to use that stuff to my advantage, hence why I asked you pros here

[SunBeam]

Meanwhile I've finished doing this



Yes, Z movement isn't yet available, since I've not used PlayerController::GotoState('PlayerFlying'). Just did some manual changes.

Table incoming tomorrow

BR,
Sun

[SunBeam]

...

Although everything is not native anymore, the UObjects (UFunctions, etc.) got cooked Even if UE Explorer can't deserialize properly, I was able to find "Console.Open.InputKey" and "Console.Typing.InputKey" UFunctions. Hot-patching the FName_Index in the bytecode allowed me to use the Console without anymore "say"-ing

Since there wasn't any update in effect and everyone has the same files, here's the way to do it:

Code: Select all

1B 83 6E 00 00 00 00 00 00 00

^ Scan for that as "Array of byte". You'll find 2 occurrences. Change both to:

Code: Select all

1B 5F 46 00 00 00 00 00 00 00

In case you're wondering WTF we just did.. well, we swapped the FName_Index in the bytecode for the 2 functions so instead of executing "Engine.Console.ShippingConsoleCommand" UFunction (with id 0x6E83), the Console will run "Engine.Console.ConsoleCommand" UFunction (whose id is 0x465F). The base function just runs Console commands; doesn't do any "say"

EDIT: Installing BioShock Infinite for a quick revisit. Wanna see if the Console is really in or not

[SunBeam]

Turns out patching IsDeveloper to return TRUE and forcing a 0x6 (Jump) to the offset where 0x1B bytecode designates the FindFunctionById( "WillowPlayerController.ExpLevelUp" ) in DeveloperFreeLevels works wonders Leveled up to level 69

[alset85]

Did you find anything related to the sanity checks for items?

[TimFun13]

...

I'm going to have to get back to this one and join you, looks like I missing out on some fun. Hopefully after work today.

[SunBeam]

Looked into Bioshock: Infinite. The mystery I want to unravel now is determining where in the code is the actual Console UObject initialized. Then figure out why that fails in Infinite. Because, the way I see it in UE Explorer, it does get initialized:

Code: Select all

event bool Init(out string OutError)
{
    local PlayerManagerInteraction PlayerInteraction;
    local int NumCustomInteractions;
    local class<UIInteraction> CustomInteractionClass;
    local UIInteraction CustomInteraction;
    local int idx;

    ActiveSplitscreenType = DesiredSplitscreenType;
    // End:0xE2
    if(Outer.ConsoleClass != none)
    {
        ViewportConsole = new (self) Outer.ConsoleClass; <-- here
        // End:0xE2
        if(ViewportConsole != none)
        {
            // End:0xE2
            if((InsertInteraction(ViewportConsole)) == -1)
            {
                OutError = "Failed to add interaction to GlobalInteractions array:" @ string(ViewportConsole);
                return false;
            }
        }
    }

However, when checking the respective offset in the GameViewport UObject via "Default__ObjectProperty Engine.GameViewportClient.ViewportConsole" (that's how I found the offset), well.. it's NULL. So either the "Outer.ConsoleClass" is "none" or some other shit is going on.

Sorry for off-topic-ing. Will return to BL in a bit

BR,
Sun

[TimFun13]

^ Seriously now.. check my dumper for Batman series, dump UObjects (it's UE3), then also use UE Explorer to have a look at the .upk files. Most functions are UScript bytecode, so you can't just "call" them. And to execute bytecode in the single threaded UE handler, you need to hook ProcessEvent (else the interlocks will crash your ass).
...

So can the object dumper (viewtopic.php?f=4&t=946) be made to work with this game? I was looking it over and it seems like it could, but there's a lot going on with it and I'm still just trying to figure it out.

[SunBeam]

Yeah, I got the compiled DLL for it How do you think I was able to do that hot-patching? Meanwhile:



Eurika!

P.S. #1: The default cheats were removed. Am looking for some nice developer shit, hope there is any..
P.S. #2: Time to fix my old table Then I get back to BL.
P.S. #3: Started looking into the rarity for BL2, to understand how it works. Once I do, I will port it to BL:E and get us some nice Legendaries

[TimFun13]

^^ I'm still just trying to get an Item leveler working and not having any luck so far, a rarity cheat would be badass.

[SunBeam]

I might be able to restore the GET/SET commands It then would be simple as fuck to do shit in-game Talking about Bioshock.

Try set/get in the console in BL:E; see if it does anything (e.g.: get Engine.PlayerController bCheatFlying). Should return "False"; use the "say" patcher first.

EDIT #1: It works



Guess what you can do now if you find the right UObjects

get <ClassName> <PropertyName>
set <ClassName> <PropertyName> <Value>

EDIT #2: "set" doesn't work; just "get" Hmm.

[SunBeam]

HAHAHAHA! Owned. There are two "SET" string locations in the game code. The initial one, which leads to a dead end, is here:



You can see from the code flow that the TEST EAX,EAX + JNE hop over to a CMP. In the standard UDK version of the Shooter Game, as I checked, right below the JNE there's the SET function CALL. In this build you can see the code immediately hops over to check for SETNOPEC. But.. if we patch this location so that when SET is used it will not jump over.. the loop continues.. and it gets here:



What I've highlighted is the execution of SET Tested it in-game and I got this:



Patch this in a script And you can set whatever crap you want in the Engine

Code: Select all

SET Command Enabler:
BorderlandsGOTY.exe+681EA0 -> 75 15
to
BorderlandsGOTY.exe+681EA0 -> 75 00

Result (get to see state -> False, set to 'true', get to see it has changed -> True):



BR,
Sun