Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Upload your cheat tables here (No requests)
Post Reply
User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by SunBeam »

BattlEye bypass from Caliber@CH can be found in this post: viewtopic.php?p=113806#p113806. Please remember to give him the proper credit if you plan to leech the content!

[ 03.12.2019 - 1031_1.24 (4615838) [Update #4] ]

Code: Select all

ChangeList:4615838
Version:1031_1.24
User:silex-buildfarm
Branch://tgt-streams/Y1E1.0.3.1
Project Name:TGT
Time:Tue Nov 19 19:57:11 2019
SDK:N/A
Exec:scimitar_engine_win64_f.exe
MD5:N/A
Updated to TU<whateverthefuck>.

GRB.CT
1.4
(24.36 KiB) Downloaded 11504 times

Table should be compatible with either executable (GRB.exe or GRB_UPP.exe). Let me if some script doesn't run or crashes you.

BR,
Sun

[ 13.11.2019 - E103_1.27 (4538393) [Update #3] ]

Code: Select all

ChangeList:4538393
Version:E103_1.27
User:silex-buildfarm
Branch://tgt-streams/Y1E1.0.3
Project Name:TGT
Time:Thu Oct 31 21:47:54 2019
SDK:N/A
Exec:scimitar_engine_win64_f.exe
MD5:N/A
Updated to TU3.

GRB_UPP.CT
1.3
(24.56 KiB) Downloaded 3036 times

[ 12.10.2019 - E101_1.11 (4382423) [Update #2] ]

Added several more options (not the classic ones all trainers have).

Image

GRB_UPP.CT
1.2
(21.02 KiB) Downloaded 1847 times

Notes:

- "Disable Drone Swarm" should be enabled before entering a drone-swarm trigger zone. If you've already summoned the drones, leave the area so message disappears and drones vanish, re-enable script, then enter the area.

- "Disable Screen Shake" will remove any screen shake from damage (fired upon) and running (via Shift). Enjoy :P

- "Get Username For Masking (press M once)" - as it says, enable script and press M one time. Map will appear with mouse cursor pointing at you. Back in CE you'll see the user name being populated in the field below. Click it, press Ctrl+B and look down in the Hex window. Click on the first character in your name, then change that to 00. Now, every time you do the following, you user-name will be masked:

Image

Image

Image

Once you're done with everything (taking your screenies or recording videos with your name masked), put the letter back or disable script + reload game.

BR,
Sun

[ 04.10.2019 - E101_1.11 (4382423) ]

Added a few more options:

Image

GRB.CT
1.1
(19.08 KiB) Downloaded 1221 times

GRB_UPP.CT
1.1
(19.13 KiB) Downloaded 579 times

BR,
Sun

[ 03.10.2019 - E101_1.11 (4382423) ]

Code: Select all

ChangeList:4382423
Version:E101_1.11
User:silex-buildfarm
Branch://tgt-streams/PC_Y1E1.0.1
Project Name:TGT
Time:Tue Sep 24 18:49:16 2019
SDK:N/A
Exec:scimitar_engine_win64_f.exe
MD5:N/A
Hello folks,

Below you'll find the table that's been working since *BETA* days, with a few adjustments, along with the BattlEye bypass I've been using. Note that currently only UPlay+ EXE is supported, as the normal version will activate on the 4th of October.

Bypass:

Note that I'm not using some random launcher, as I really got bored of doing RE of all of the fucking EXEs out there to patch some conditional jumps or skip initialization. The method goes as follows:

1) Get [Link] and install it. Make sure to launch it with Administrator privileges.
2) Go up top to the right in the GUI where the search field is and type in bes. You'll see Process Hacker filters out the process list and shows only BEService.exe. Right-click it and choose 'Suspend'. (note that after a while, 1 min or so, this resumes back on its own; just in case you wonder why it's not suspended anymore).
3) Grab [Link], unzip it and run it as Administrator. Flip over to the Kernel-Module tab, find BEDaisy.sys in the list (just press b and e keys to get fast to it), right-click and Unload it. Do the same for a driver called pchunterXX.sys. It's important that you unload both! Close PC Hunter.
4) Grab the attached BEDaisy.zip and extract it to a folder of your choice (somewhere on a short path, like D:\).
5) Download and install this [Link]. Run it as Administrator. Give it the path to your extracted .sys file (e.g.: D:\BEDaisy.sys) and input a name for it in the next field (BEDaisy). Click Load and wait for 2-3s for it to load.
6) Back to Process Hacker, if BEService.exe hasn't resumed already, right-click it and Resume.

That's all. You should now be able to see GRB_UPP.exe as a valid process, available for open, read, write and debug.

* * Credits for the method: Zula BattlEye Bypass (google it, please, if you're curious, as UC links are forbidden on this forum) * *

If you have any problems with this please don't whine here. You've been warned!

BEDaisy.zip
password: FRF
(2.41 MiB) Downloaded 1269 times

Cheat Table

Image

GRB_UPP.CT
1.0
(16.12 KiB) Downloaded 848 times

Will be adding more in the upcoming days. Want to see how the story goes first :P

BR,
Sun

P.S.#1: Just so this is 100% clear - the content of that table is obtained through my own means, via analyzing the Anvil Engine source code in comparison to the one in Wildlands (while the engine is the same, code optimization and other crap makes some function not look identical in flow). Apart from that, IF YOU WANT TO USE THIS SHIT IN YOUR TRAINERS, ASK. OK? There's no shame in it.

P.S.#2: Note that most of the sought-for options are tagged with several markers across the engine:

Image

The reason some appear twice or multiple times is Denuvo; only one instance of each string is valid, find the right on by checking if the ASM it's part of is game code or a Denuvo copy.

<Denuvo copy>
Image

<GRB executable code>
Image

Not sure if this is some common knowledge people mentioned anywhere, so you're welcome :P It's up to you to figure out which options these refer to (for example ID#13 is God Mode and the check for Immunity). Thank you for making our lives easier, Ubisoft developers!

How to use this cheat table?
  1. Install Cheat Engine
  2. Double-click the .CT file in order to open it.
  3. Click the PC icon in Cheat Engine in order to select the game process.
  4. Keep the list.
  5. Activate the trainer options by checking boxes or setting values from 0 to 1

User avatar
xICEMANx117
Expert Cheater
Expert Cheater
Posts: 117
Joined: Mon Oct 16, 2017 4:16 am
Reputation: 17

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by xICEMANx117 »

Looks Epic man

jonasbeckman
Expert Cheater
Expert Cheater
Posts: 307
Joined: Sat May 06, 2017 1:26 pm
Reputation: 22

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by jonasbeckman »

Looks like the initial patch notes are up now for tomorrow's release and the "Day-1" update although I was expecting the data to be updated before the Uplay+ or Ultimate edition unlock but nope.
GENERAL:

Polished aim assist.
Improved performances and optimizations.
Improvements to online flows.
Improved game stability.
Improved voice chat and text chat.

UI/UX:

Improvements made to some menus for better understanding.

AUDIO:

Improved gun sounds.

PVP:

Polished matchmaking stability.
Polished Elimination and Sabotage game modes.

BUG FIXES:

Fixed a number of flow issues (i.e. infinite loading, online errors).
Fixed an issue where the mark would remain on a player longer than intended.
Fixed and issue where some Milestones were not completed as intended.
Fixed a UI issue with the end match screen page.

AI:

Improved enemy AI detection.

CLASS, ITEMS, AND MAG DEBUGGING:

Tweaked item spawns and loot placement on maps.
Tweaked and improved some weapon balance.

BUG FIXES:

Fixed issues where players would get stuck in the world or fall under the map.
Fixed issues where players would have character freeze or get stuck after specific actions.
Unlisted would be the various platform specific fixes (If any.) and other longer notes on specific mission fixes and such stuff.

But yeah a patch is coming out and then I guess they'll be doing monthly updates at least to coincide with events and other content additions hopefully without too much downtime but I expect online connectivity to be a bit rough now that everyone is going to be accessing the server.


EDIT: Pretty sure they didn't need to make the UI understandable though everyone playing the beta likely already understood it's a mess and a real problem to navigate and use easily so that should be focused on. :P
(And for the objectives screen we're making it look like a messy newspaper clips wall of random bits of everything. Excellent decision there.)

Though I suppose any improvement can only be better and at least it's not a mess of hold this button and press this button and a mix of the two.
(World interactivity though is a combination of the two methods of hold and press ha ha.)


But anyways that's some random game shortcomings and this is meant to be about using CE and information for resolving certain other game "issues" hah. Interesting to see Denuvo being able to make a bit of a confusing moment there by having multiples and then how to get that sorted plus how Wildlands thanks to game engine similarities can actually aid with Breakpoint and well I guess it's not completely unexpected for classes and such to remain but it's interesting to read up and see more about it.

Plus another method for dealing with BattlEye if that becomes a problem.

Kroco
Cheater
Cheater
Posts: 44
Joined: Tue Mar 21, 2017 9:04 pm
Reputation: 6

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by Kroco »

PC hunter getting Load driver error. seems like it's not support last windows version or idk

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by SunBeam »

I am on the latest. You have other problems; please no trouble-shooting here.

EDIT: Am running 1803; sorry, didn't know about the lack of compatibility with higher versions.

ComManDerBG
Expert Cheater
Expert Cheater
Posts: 68
Joined: Mon Aug 28, 2017 12:07 am
Reputation: 5

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by ComManDerBG »

I hope its not to presumptuous to ask, but will be possible to see a inventory editor in the future?

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by SunBeam »

^ Will consider it. For the time being, No Spread and No Recoil are soon to follow.

EDIT: I reconsidered. It takes too much time to come up with this shit; got no interest in doing an item editor (whatever you meant by that). If you're thinking editor as in create your own weapon from parts, then forget it. The amount of time to understand Anvil and then come up with an editor is cumbersome.

ComManDerBG
Expert Cheater
Expert Cheater
Posts: 68
Joined: Mon Aug 28, 2017 12:07 am
Reputation: 5

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by ComManDerBG »

SunBeam wrote:
Thu Oct 03, 2019 8:20 pm
^ Will consider it. For the time being, No Spread and No Recoil are soon to follow.

EDIT: I reconsidered. It takes too much time to come up with this shit; got no interest in doing an item editor (whatever you meant by that). If you're thinking editor as in create your own weapon from parts, then forget it. The amount of time to understand Anvil and then come up with an editor is cumbersome.


I didnt mean anything so much, just ability to add weapons and maybe blueprints, that's it. like the weapons from the battle pass or any hidden weapons that were removed after the OTT. if its too much i understand.

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by SunBeam »

I've had several exchanges via PM with Caliber and one of his requests was this:

Image

I don't really know how he's done his "No Recoil" option, the very option which he claims is not perfect and that he worked so hard to do it to have CEV steal it from his trainer, thus breaking the very fabric of harmony on FRF:

Image

Well, this is how I did it ( sent the PM to him, which he'll never read; but can read it here, with or without an account - am imagining he's doing Ctrl+F "CH" in all of my topics :D ):

┄ "cPlayerCameraComponent" has the hash 0x4428E933

┄ search for that in your session, as a DWORD and check the only address in green (read-only memory) -> here, for easier check-up: GRB_UPP.exe+532DA7C

┄ based on this:

Code: Select all

function GetName( input )
  local addr = readQword( input )
  addr = addr + 0x28 // this_1 <---
  addr = readQword( addr )
  if readBytes( addr, 1 ) == 0xE9 then
    addr = addr + _readInteger( addr + 0x1 ) + 0x5
  end
  addr = addr + _readInteger( addr + 0x3 ) + 0x7
  addr = readQword( addr )
  print( string.format( "IStruct:  0x%X", input ) )
  print( string.format( "IName:    0x%X", addr ) )
  local str = readString( readQword( addr + 0x20 ) )
  print( string.format( "ObjStr:   %s", str ) )
  addr = readInteger( addr + 0x2C ) // this_2 <---
  print( string.format( "ObjHash:  0x%X", addr ) )
  print( "" )
  print( "* * *")
end
┄ subtract 0x2C (this_2 in the code above) from that address you found (GRB_UPP.exe+532DA7C - 2C = GRB_UPP.exe+532DA50)

┄ scan for the address (GRB_UPP.exe+532DA50) you now have in CE, on 8 bytes; has to be in address format to find a pointer to it; look at the address in green

┄ I got this 7FF79AE7C470 = GRB_UPP.exe+532C470

┄ now attach x64dbg to the game, go to the section with the biggest size (that's where Denuvo moved all the to-be-decrypted executable code) and Ctrl+F; type in MOV RAX,QWORD PTR DS:[0xyour_address from_above]

┄ you should get one single reference:

Code: Select all

GRB_UPP.exe+1CB97910 - 48 8B 05 594B79E8     - mov rax,[GRB_UPP.exe+532C470] { (7FF79AE7DA50) }
GRB_UPP.exe+1CB97917 - C3                    - ret 
┄ because Denuvo moved the function to its section, it put a JMP in its place; so now follow that address in dump, in the top part go to FIRST section of the .exe, right click first byte in the dump and do "Find References"

┄ a single JMP line is going to be found:

Code: Select all

GRB_UPP.exe+3318710 - E9 FBF18719           - jmp GRB_UPP.exe+1CB97910
┄ now find a pointer to this in CE, scanning for the address as 8 bytes
┄ you will get this one: GRB_UPP.exe+4622FC0
┄ remember "this_1"? from this address subtract 0x28 -> GRB_UPP.exe+4622F98

And now you have the member-functions pointer (to the vtable of functions) used by all game objects that have the GetName result the hash 0x4428E933.

Scan for that address (GRB_UPP.exe+4622F98; as address) now in CE and you'll get 4-5 cPlayerCameraComponent objects. One of these is your "cPlayerCameraComponent". How to tell which is yours? Browse each in memory and move around; you'll find only ONE whose values flip around in red (CE, bottom hex view in Memory Viewer). That is the one you want.

Now set an exceptions breakpoint on a large range, say 100 bytes, and see what you get in the debugger. I got these:

Code: Select all

7FF7AB88EFB4 - 48 8B 01  - mov rax,[rcx]
7FF7ABA1D3B1 - 48 8B 01  - mov rax,[rcx]
7FF7ABA1D3C1 - 48 8B 10  - mov rdx,[rax]
7FF7B29319AE - 48 8B 69 10  - mov rbp,[rcx+10]
7FF7B29319F7 - F3 0F11 87 B8000000  - movss [rdi+000000B8],xmm0
7FF7B2931A86 - C6 87 E4000000 01 - mov byte ptr [rdi+000000E4],01
7FF7B29399C4 - 8B 87 B8000000  - mov eax,[rdi+000000B8]
7FF7B29399D9 - 48 8B 47 20  - mov rax,[rdi+20]
7FF7B29399E7 - 48 8B 47 20  - mov rax,[rdi+20]
7FF7B2939A0A - 48 8B 47 20  - mov rax,[rdi+20]
7FF7B2939A21 - 48 8B 47 20  - mov rax,[rdi+20]
7FF7B2942F4A - 80 BB C7000000 00 - cmp byte ptr [rbx+000000C7],00
7FF7B2939A2F - 48 8B 57 20  - mov rdx,[rdi+20]
7FF7A92856B0 - 48 8B 41 F0  - mov rax,[rcx-10]
7FF7B272534A - F3 0F10 87 A0000000  - movss xmm0,[rdi+000000A0]
7FF7B272536A - F3 0F11 87 A0000000  - movss [rdi+000000A0],xmm0
7FF7B27253DD - C6 87 E4000000 01 - mov byte ptr [rdi+000000E4],01
7FF7B291A4F6 - 80 B9 E9000000 00 - cmp byte ptr [rcx+000000E9],00
7FF7B291A426 - 80 B9 EA000000 00 - cmp byte ptr [rcx+000000EA],00
7FF7B2725B9B - 44 38 A7 E9000000  - cmp [rdi+000000E9],r12l
7FF7B2725C3F - 44 38 A7 EA000000  - cmp [rdi+000000EA],r12l
7FF7B2725CBB - F3 44 0F58 97 A4000000  - addss xmm10,[rdi+000000A4]
7FF7B2725CE9 - 44 38 A7 EA000000  - cmp [rdi+000000EA],r12l
7FF7B26EDD18 - 48 8B 41 20  - mov rax,[rcx+20]
7FF7B26EDD82 - 4C 8B 43 10  - mov r8,[rbx+10]
7FF7B26EDF46 - F3 0F10 83 A0000000  - movss xmm0,[rbx+000000A0]
7FF7B292ADEF - 48 8B 01  - mov rax,[rcx]
7FF7B2702F94 - 80 BB E7000000 00 - cmp byte ptr [rbx+000000E7],00
7FF7B27031E4 - 80 BB E7000000 00 - cmp byte ptr [rbx+000000E7],00
7FF7B2931B32 - 38 9F E7000000  - cmp [rdi+000000E7],bl
7FF7B2928025 - 44 38 BB E7000000  - cmp [rbx+000000E7],r15l
7FF7B292827D - 48 8B 46 20  - mov rax,[rsi+20]
7FF7B292828E - 48 8B 07  - mov rax,[rdi]
7FF7B294620E - F3 0F58 81 90000000  - addss xmm0,[rcx+00000090]
7FF7B29286F4 - 48 8B 1F  - mov rbx,[rdi]
7FF79E79E730 - F3 0F10 81 80000000  - movss xmm0,[rcx+00000080]
7FF7B2962591 - F3 0F11 B3 80000000  - movss [rbx+00000080],xmm6
7FF7B292870E - 48 8B 1F  - mov rbx,[rdi]
7FF79E79ED90 - F3 0F10 81 84000000  - movss xmm0,[rcx+00000084]
7FF79D96B760 - F3 0F11 89 84000000  - movss [rcx+00000084],xmm1
7FF7B2702C34 - 80 BB E7000000 00 - cmp byte ptr [rbx+000000E7],00
7FF7B292CFC2 - C6 80 E4000000 01 - mov byte ptr [rax+000000E4],01
7FF7B292CFED - C6 80 E4000000 01 - mov byte ptr [rax+000000E4],01
7FF7B292D016 - C6 80 E4000000 01 - mov byte ptr [rax+000000E4],01
7FF7B292D03D - C6 80 E4000000 01 - mov byte ptr [rax+000000E4],01
7FF7B292D0E4 - 48 8B 01  - mov rax,[rcx]
7FF7B26B3238 - 48 8B 46 20  - mov rax,[rsi+20]
7FF7B2928864 - 48 8B 79 10  - mov rdi,[rcx+10]
7FF7B29288A8 - 48 8B 41 20  - mov rax,[rcx+20]
7FF7B2928ACE - 48 8B 01  - mov rax,[rcx]
7FF7B2928C14 - 48 8B 01  - mov rax,[rcx]
7FF7A083FC03 - C8 0000 00 - enter 0000,00
7FF7B26A6829 - 48 8B 47 20  - mov rax,[rdi+20]
7FF7B26A686B - 48 8B 07  - mov rax,[rdi]
7FF7B26A687D - 48 8B 07  - mov rax,[rdi]
7FF7B292E4FC - C6 80 E4000000 01 - mov byte ptr [rax+000000E4],01
7FF7B292E51C - C6 80 E4000000 01 - mov byte ptr [rax+000000E4],01
7FF7B2930587 - C6 86 E4000000 01 - mov byte ptr [rsi+000000E4],01
7FF7B2930611 - F3 0F11 8E B0000000  - movss [rsi+000000B0],xmm1
7FF7B292E5CF - C6 80 E4000000 01 - mov byte ptr [rax+000000E4],01
7FF7B2931E26 - 48 8B 57 10  - mov rdx,[rdi+10]
7FF7B26E81E4 - 80 BB E7000000 00 - cmp byte ptr [rbx+000000E7],00
7FF7B26A639A - C6 83 E4000000 01 - mov byte ptr [rbx+000000E4],01
7FF7B26EA712 - 48 8B 41 20  - mov rax,[rcx+20]
7FF7B294A48F - 80 B9 C4000000 00 - cmp byte ptr [rcx+000000C4],00
7FF7B294A4A8 - 48 8B 01  - mov rax,[rcx]
7FF7B294A4D5 - 48 8B 03  - mov rax,[rbx]
7FF7B294A4ED - 48 8B 03  - mov rax,[rbx]
7FF7B294A504 - F3 44 0F58 83 80000000  - addss xmm8,[rbx+00000080]
7FF7B294A519 - F3 0F58 BB 84000000  - addss xmm7,[rbx+00000084]
7FF7B294A843 - C6 83 C4000000 00 - mov byte ptr [rbx+000000C4],00
7FF7ADB26F44 - 4C 8B 00  - mov r8,[rax]
7FF7ADB27059 - 48 8B 06  - mov rax,[rsi]
7FF797D660C8 - 48 8B 01  - mov rax,[rcx]
7FF7ADB2709E - 48 8B 06  - mov rax,[rsi]
7FF7ADB270AF - 48 8B 06  - mov rax,[rsi]
7FF7B294AC36 - 48 8B 01  - mov rax,[rcx]
7FF7ACFBA8F5 - 4C 8B 00  - mov r8,[rax]
7FF7ACFBA928 - 48 8B 13  - mov rdx,[rbx]
7FF7ACFBA969 - 48 8B 03  - mov rax,[rbx]
7FF7ABEE92E5 - 4C 8B 00  - mov r8,[rax]
7FF7ABEE9300 - 48 8B 01  - mov rax,[rcx]
7FF7B18E3593 - 48 8B 01  - mov rax,[rcx]
7FF7A1BB3452 - 48 8B 01  - mov rax,[rcx]
7FF7B194C645 - 48 8B 01  - mov rax,[rcx]
7FF7B194C658 - 48 8B 00  - mov rax,[rax]
7FF7B1A18962 - 48 8B 01  - mov rax,[rcx]
7FF7B1A189D2 - 48 8B 03  - mov rax,[rbx]
7FF7B19F584C - 48 8B 01  - mov rax,[rcx]
7FF7B19F585A - 48 8B 13  - mov rdx,[rbx]
7FF7B19F5863 - 4C 8B 03  - mov r8,[rbx]
7FF798CED74C - 48 8B 01  - mov rax,[rcx]
7FF7B1A17AAF - 49 8B 00  - mov rax,[r8]
7FF7B1A17ACF - 48 8B 07  - mov rax,[rdi]
7FF7B1A17CF6 - 48 8B 07  - mov rax,[rdi]
7FF7B1A1EF54 - 49 8B 01  - mov rax,[r9]
7FF7B294C391 - 41 80 BE C7000000 00 - cmp byte ptr [r14+000000C7],00
7FF7B294C3C2 - 41 80 BE C7000000 00 - cmp byte ptr [r14+000000C7],00
7FF7B294C3F3 - 41 80 BE C7000000 00 - cmp byte ptr [r14+000000C7],00
7FF7B26B2576 - 48 8B 46 20  - mov rax,[rsi+20]
7FF7B26B25D7 - 44 38 BE E7000000  - cmp [rsi+000000E7],r15l
7FF7B26B26C0 - 48 8B 01  - mov rax,[rcx]
7FF7B26B2700 - 48 8B 01  - mov rax,[rcx]
7FF7B294C65C - 49 8B 06  - mov rax,[r14]
7FF798CED7CC - 48 8B 01  - mov rax,[rcx]
7FF7AAF87C89 - 48 8B 01  - mov rax,[rcx]
7FF7AAF87C99 - 48 8B 10  - mov rdx,[rax]
7FF7AB27479E - 48 8B 01  - mov rax,[rcx]
7FF7AB2747BC - 48 8B 18  - mov rbx,[rax]
7FF7B19EE192 - 48 8B 01  - mov rax,[rcx]
7FF7B19EE1E0 - 49 8B 06  - mov rax,[r14]
7FF7B19FEE86 - 48 8B 01  - mov rax,[rcx]
7FF7B19FEE9D - 4C 8B 00  - mov r8,[rax]
7FF7B19FEF16 - 48 8B 06  - mov rax,[rsi]
7FF7B19FEF8A - 48 8B 01  - mov rax,[rcx]
7FF7B1A1DF32 - 48 8B 01  - mov rax,[rcx]
7FF7B1A1DF90 - 48 8B 03  - mov rax,[rbx]
7FF7B1A1DFA1 - 48 8B 03  - mov rax,[rbx]
7FF7B19FF0CE - 48 8B 01  - mov rax,[rcx]
7FF7B1F25D58 - 48 8B 01  - mov rax,[rcx]
7FF7B1F25D68 - 48 8B 10  - mov rdx,[rax]
7FF7B294BEBC - 80 BB C7000000 00 - cmp byte ptr [rbx+000000C7],00
7FF7B294BF44 - 48 8B 01  - mov rax,[rcx]
7FF7B1F271F0 - 48 8B 01  - mov rax,[rcx]
7FF7B1F27203 - 48 8B 10  - mov rdx,[rax]
7FF7B1F2720F - 4C 8B 03  - mov r8,[rbx]
7FF7B1F36D7E - 48 8B 01  - mov rax,[rcx]
7FF7B1F36D8E - 48 8B 10  - mov rdx,[rax]
7FF7B1F359D1 - 48 8B 01  - mov rax,[rcx]
7FF7B1F359E1 - 48 8B 10  - mov rdx,[rax]
7FF7B294C12C - 80 BB C7000000 00 - cmp byte ptr [rbx+000000C7],00
7FF7B294C1AB - 48 8B 01  - mov rax,[rcx]
7FF798DF1A0A - 48 8B 01  - mov rax,[rcx]
7FF7B1FDDBF4 - 48 8B 10  - mov rdx,[rax]
7FF7B295235C - 80 BB C7000000 00 - cmp byte ptr [rbx+000000C7],00
7FF798CADE1C - 48 8B 01  - mov rax,[rcx]
7FF798CADE2C - 48 8B 10  - mov rdx,[rax]
7FF7B26EBCB1 - 80 BB E7000000 00 - cmp byte ptr [rbx+000000E7],00
7FF798CADD9C - 48 8B 01  - mov rax,[rcx]
7FF798CADDAC - 48 8B 10  - mov rdx,[rax]
7FF7B26EB9A1 - 80 BB E7000000 00 - cmp byte ptr [rbx+000000E7],00
7FF7B1F23DDC - 48 8B 01  - mov rax,[rcx]
7FF7B1F23DF3 - 4C 8B 00  - mov r8,[rax]
7FF7B2729FF2 - 48 8B 41 20  - mov rax,[rcx+20]
7FF7B272A00D - 48 8B 47 50  - mov rax,[rdi+50]
7FF7B272A31A - 48 8B 41 58  - mov rax,[rcx+58]
7FF7ABA1F691 - 48 8B 01  - mov rax,[rcx]
7FF7ABA1F6A1 - 48 8B 10  - mov rdx,[rax]
7FF7B2935226 - 48 8B 41 28  - mov rax,[rcx+28]
7FF7B2935245 - 48 8B 51 10  - mov rdx,[rcx+10]
7FF7B2935287 - 49 8B 47 40  - mov rax,[r15+40]
7FF798E74FE6 - 48 8B 41 20  - mov rax,[rcx+20]
7FF7B272B5A0 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E74640 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E744D0 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E74AD0 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E74BC6 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E74546 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E745C6 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E74C46 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E74956 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E74EE6 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E74CC6 - 48 8B 41 20  - mov rax,[rcx+20]
7FF798E74F66 - 48 8B 41 20  - mov rax,[rcx+20]
7FF7B293530F - 4C 8B 07  - mov r8,[rdi]
7FF7B2935325 - 48 8B 07  - mov rax,[rdi]
7FF7B2935381 - 49 8B 47 48  - mov rax,[r15+48]
7FF7B2925CF7 - 48 8B 49 10  - mov rcx,[rcx+10]
7FF7ABA1EE11 - 48 8B 01  - mov rax,[rcx]
7FF7AB5BC91D - 4C 8B 00  - mov r8,[rax]
7FF7ABA1EE21 - 48 8B 10  - mov rdx,[rax]
7FF7AB5BC93B - 48 8B 03  - mov rax,[rbx]
7FF7ABA1F161 - 48 8B 01  - mov rax,[rcx]
7FF7ABA1F171 - 48 8B 10  - mov rdx,[rax]
7FF7AB5BC950 - 48 8B 03  - mov rax,[rbx]
7FF7B2736059 - 4D 8B 40 10  - mov r8,[r8+10]
7FF7B2964184 - 41 C7 87 88000000 DB0FC9BF - mov [r15+00000088],BFC90FDB
7FF7B2964196 - 41 C7 87 8C000000 DB0FC93F - mov [r15+0000008C],3FC90FDB
7FF7B26AC5C9 - F3 0F58 87 A0000000  - addss xmm0,[rdi+000000A0]
7FF7B26AC5EB - F3 0F58 87 A4000000  - addss xmm0,[rdi+000000A4]
7FF7B26AD877 - F3 0F10 8F A8000000  - movss xmm1,[rdi+000000A8]
7FF7B26AD8A5 - F3 0F5D 87 AC000000  - minss xmm0,[rdi+000000AC]
7FF7B26AD8BC - F3 0F11 87 AC000000  - movss [rdi+000000AC],xmm0
7FF7B26AD8C4 - F3 0F11 8F A8000000  - movss [rdi+000000A8],xmm1
7FF7B293927C - 80 BB EC000000 00 - cmp byte ptr [rbx+000000EC],00
7FF7B29392DB - 80 BB E7000000 00 - cmp byte ptr [rbx+000000E7],00
7FF7B293936A - 40 38 B3 E7000000  - cmp [rbx+000000E7],sil
7FF7B29394E7 - 40 38 B3 E7000000  - cmp [rbx+000000E7],sil
7FF7B293958D - 40 38 B3 E7000000  - cmp [rbx+000000E7],sil
7FF7B2925698 - 48 8B 01  - mov rax,[rcx]
7FF7B29256AC - 48 8B 01  - mov rax,[rcx]
7FF7B2938416 - 48 8B 01  - mov rax,[rcx]
7FF7B2938430 - 48 8B 01  - mov rax,[rcx]
7FF7B2938447 - 48 8B 01  - mov rax,[rcx]
7FF7B26B131F - F3 0F58 87 A0000000  - addss xmm0,[rdi+000000A0]
7FF7B26B1341 - F3 0F58 87 A4000000  - addss xmm0,[rdi+000000A4]
7FF7B26AD64D - 0F11 4E 20  - movups [rsi+20],xmm1
7FF7B26AD651 - 0F11 56 30  - movups [rsi+30],xmm2
7FF7B26AD655 - 0F11 46 40  - movups [rsi+40],xmm0
7FF7B26AD659 - 0F11 36  - movups [rsi],xmm6
7FF7B26AD65C - 0F11 7E 10  - movups [rsi+10],xmm7
7FF7B26AE0BA - 0F11 06  - movups [rsi],xmm0
7FF7B26AE0C8 - 0F11 4E 10  - movups [rsi+10],xmm1
7FF7B26AE0D0 - F3 0F7F 46 20  - movdqu [rsi+20],xmm0
7FF7B26AE0D9 - F3 0F7F 4E 30  - movdqu [rsi+30],xmm1
7FF7B26AE0E2 - F3 0F7F 46 40  - movdqu [rsi+40],xmm0
7FF79C881B02 - 41 0F10 50 20  - movups xmm2,[r8+20]
7FF79C881B3D - 41 0F10 50 30  - movups xmm2,[r8+30]
7FF79C881B75 - 41 0F10 50 40  - movups xmm2,[r8+40]
7FF79C881BBB - F2 41 0F10 50 08  - movsd xmm2,[r8+08]
7FF79C881BC4 - F2 41 0F10 58 10  - movsd xmm3,[r8+10]
7FF79C881BCE - F2 41 0F10 60 18  - movsd xmm4,[r8+18]
7FF79C881C7E - F2 41 0F10 08  - movsd xmm1,[r8]
7FF79C891EC9 - 0F29 03  - movaps [rbx],xmm0
7FF79C891ED0 - 0F29 4B 10  - movaps [rbx+10],xmm1
7FF79C891ED8 - 66 0F7F 43 20  - movdqa [rbx+20],xmm0
7FF79C891EE1 - 66 0F7F 4B 30  - movdqa [rbx+30],xmm1
7FF79C891EEA - 66 0F7F 43 40  - movdqa [rbx+40],xmm0
7FF7B26AE135 - 66 0F55 5E 10  - andnpd xmm3,[rsi+10]
7FF7B26AE13D - 66 0F55 16  - andnpd xmm2,[rsi]
7FF7B26AE17C - 0F11 26  - movups [rsi],xmm4
7FF7B26AE189 - 0F11 46 10  - movups [rsi+10],xmm0
7FF7A68E127C - 0F10 4E 20  - movups xmm1,[rsi+20]
7FF7A68E1329 - 0F10 46 30  - movups xmm0,[rsi+30]
7FF7A68E13C6 - 0F10 76 40  - movups xmm6,[rsi+40]
7FF7A68E1466 - 66 44 0F55 16  - andnpd xmm10,[rsi]
7FF7A68E146F - 66 44 0F55 5E 10  - andnpd xmm11,[rsi+10]
7FF7B27274F6 - 0F29 03  - movaps [rbx],xmm0
7FF7B27274FD - 0F29 4B 10  - movaps [rbx+10],xmm1
7FF7B2727505 - 66 0F7F 43 20  - movdqa [rbx+20],xmm0
7FF7B272750E - 66 0F7F 4B 30  - movdqa [rbx+30],xmm1
7FF7B2727517 - 66 0F7F 43 40  - movdqa [rbx+40],xmm0
7FF7B26EAA99 - 48 8B 41 20  - mov rax,[rcx+20]
7FF7B26F5BE9 - 48 8B 41 20  - mov rax,[rcx+20]
7FF7B26A4821 - 4C 8B 69 10  - mov r13,[rcx+10]
7FF7B26EC8EC - 48 8B 41 20  - mov rax,[rcx+20]
7FF7B26EC90E - 48 8B 47 20  - mov rax,[rdi+20]
7FF7B26EC926 - 48 8B 47 20  - mov rax,[rdi+20]
7FF7B26EC956 - 48 8B 47 20  - mov rax,[rdi+20]
7FF7B26EC984 - 48 8B 47 20  - mov rax,[rdi+20]
7FF7B26F5E7C - 48 8B 41 70  - mov rax,[rcx+70]
7FF7B26CFD51 - 48 8B 52 10  - mov rdx,[rdx+10]
7FF7B2511D78 - 48 8B 01  - mov rax,[rcx]
7FF7B26F6A58 - 48 8B 01  - mov rax,[rcx]
7FF7B26F6A8D - 48 8B 01  - mov rax,[rcx]
7FF7B26CF53A - 48 8B 52 10  - mov rdx,[rdx+10]
7FF7B2927B4D - 48 8B 45 70  - mov rax,[rbp+70]
7FF7A68E1280 - 0F10 47 20  - movups xmm0,[rdi+20]
7FF7A68E132D - 0F10 4F 30  - movups xmm1,[rdi+30]
7FF7A68E13CA - 0F10 7F 40  - movups xmm7,[rdi+40]
7FF7A68E1479 - 66 44 0F55 07  - andnpd xmm8,[rdi]
7FF7A68E1481 - 66 0F55 77 10  - andnpd xmm6,[rdi+10]
7FF7B29645AC - 41 0F10 87 D0000000  - movups xmm0,[r15+000000D0]
7FF7B29645BC - 41 0F10 8F E0000000  - movups xmm1,[r15+000000E0]
7FF7B29645CC - 41 0F10 87 F0000000  - movups xmm0,[r15+000000F0]
7FF7B29645DD - 41 0F10 8F 00010000  - movups xmm1,[r15+00000100]
7FF7B29645EE - 41 0F10 87 10010000  - movups xmm0,[r15+00000110]
7FF7B26A89F4 - 48 8B 71 10  - mov rsi,[rcx+10]
7FF7B26A8A36 - 48 8B 01  - mov rax,[rcx]
7FF7B26A8A7C - 48 8B 01  - mov rax,[rcx]
7FF7B294B895 - 4C 8B 09  - mov r9,[rcx]
7FF7B26A8A97 - 48 8B 01  - mov rax,[rcx]
7FF7B26A4FE6 - 48 8B 76 10  - mov rsi,[rsi+10]
7FF7B26A500F - 48 8B 01  - mov rax,[rcx]
7FF7B26C06E0 - 80 BB E7000000 00 - cmp byte ptr [rbx+000000E7],00
7FF7B26C0374 - 80 BB E7000000 00 - cmp byte ptr [rbx+000000E7],00
7FF7B29647D4 - F3 41 0F10 97 88000000  - movss xmm2,[r15+00000088]
7FF7B29647DD - F3 41 0F10 87 8C000000  - movss xmm0,[r15+0000008C]
7FF7B29647F1 - F3 41 0F5F 8F 84000000  - maxss xmm1,[r15+00000084]
7FF7B29647FE - F3 41 0F11 8F 84000000  - movss [r15+00000084],xmm1
7FF7B18F42AC - 48 8B 01  - mov rax,[rcx]
7FF7B18F42E7 - 48 8B 13  - mov rdx,[rbx]
7FF797D686A0 - 48 8B 01  - mov rax,[rcx]
7FF797D686B0 - 4C 8B 00  - mov r8,[rax]
7FF7B29492D9 - 48 8B 01  - mov rax,[rcx]
7FF797D684E0 - 48 8B 01  - mov rax,[rcx]
7FF797D684F0 - 4C 8B 00  - mov r8,[rax]
7FF7B2947ED9 - 48 8B 01  - mov rax,[rcx]
7FF7AB9C0A97 - 4C 8B 00  - mov r8,[rax]
7FF797D6C759 - 48 8B 01  - mov rax,[rcx]
7FF797D6C769 - 48 8B 10  - mov rdx,[rax]
7FF797D6E739 - 48 8B 01  - mov rax,[rcx]
7FF797D6E749 - 48 8B 10  - mov rdx,[rax]
7FF7AB9C0B49 - 48 8B 01  - mov rax,[rcx]
7FF7AB9C0B59 - 48 8B 10  - mov rdx,[rax]
7FF7B2944FF0 - 48 8B 03  - mov rax,[rbx]
7FF7B294D564 - 48 8B 01  - mov rax,[rcx]
7FF7ABA22D8D - 4C 8B 00  - mov r8,[rax]
7FF7ABA22DE1 - 48 8B 03  - mov rax,[rbx]
7FF7ABA22E24 - 48 8B 03  - mov rax,[rbx]
7FF7ABA22E35 - 48 8B 03  - mov rax,[rbx]
7FF7AB94B10E - 48 8B 01  - mov rax,[rcx]
7FF7AB94B11E - 4C 8B 00  - mov r8,[rax]
7FF7ABA1E661 - 48 8B 01  - mov rax,[rcx]
7FF7ABA1E671 - 48 8B 10  - mov rdx,[rax]
7FF7B24C6095 - 48 8B 10  - mov rdx,[rax]
7FF7B24C6232 - 48 8B 10  - mov rdx,[rax]
7FF7B24C6133 - 4C 8B 00  - mov r8,[rax]
7FF7B24C614D - 4C 8B 00  - mov r8,[rax]
7FF7B219D9BF - 8B 10  - mov edx,[rax]
7FF7B24BDF87 - 48 8B 10  - mov rdx,[rax]
7FF7B26FB106 - 48 8B 41 10  - mov rax,[rcx+10]
7FF7B26FB120 - 48 8B 01  - mov rax,[rcx]
7FF7B26FB18B - 48 8B 01  - mov rax,[rcx]
This is where my PM ends.

Out of all of the above, tracing from "cPlayerCameraComponent" object via the pointer->pointer at offset 0x620, gets you to this function:

Code: Select all

GRB_UPP.exe+1CDDC240 - 48 89 E0              - mov rax,rsp
GRB_UPP.exe+1CDDC243 - 55                    - push rbp
GRB_UPP.exe+1CDDC244 - 41 55                 - push r13
GRB_UPP.exe+1CDDC246 - 48 81 EC 78010000     - sub rsp,00000178 { 376 }
GRB_UPP.exe+1CDDC24D - 49 83 78 18 00        - cmp qword ptr [r8+18],00 { 0 }
GRB_UPP.exe+1CDDC252 - 4D 89 C5              - mov r13,r8
GRB_UPP.exe+1CDDC255 - F3 0F11 4C 24 50      - movss [rsp+50],xmm1
GRB_UPP.exe+1CDDC25B - 48 89 CD              - mov rbp,rcx
GRB_UPP.exe+1CDDC25E - 0F84 460F0000         - je GRB_UPP.exe+1CDDD1AA
GRB_UPP.exe+1CDDC264 - 48 89 58 20           - mov [rax+20],rbx
GRB_UPP.exe+1CDDC268 - 48 89 70 E8           - mov [rax-18],rsi
GRB_UPP.exe+1CDDC26C - 48 89 78 E0           - mov [rax-20],rdi
GRB_UPP.exe+1CDDC270 - 0FB7 79 32            - movzx edi,word ptr [rcx+32]
GRB_UPP.exe+1CDDC274 - 4C 89 70 D0           - mov [rax-30],r14
GRB_UPP.exe+1CDDC278 - 45 31 F6              - xor r14d,r14d
GRB_UPP.exe+1CDDC27B - 0F29 70 B8            - movaps [rax-48],xmm6
GRB_UPP.exe+1CDDC27F - 44 89 F3              - mov ebx,r14d
GRB_UPP.exe+1CDDC282 - 0F29 78 A8            - movaps [rax-58],xmm7
GRB_UPP.exe+1CDDC286 - 44 89 F2              - mov edx,r14d
GRB_UPP.exe+1CDDC289 - 44 0F29 40 98         - movaps [rax-68],xmm8
GRB_UPP.exe+1CDDC28E - 45 0F57 C0            - xorps xmm8,xmm8
GRB_UPP.exe+1CDDC292 - 44 0F29 48 88         - movaps [rax-78],xmm9
GRB_UPP.exe+1CDDC297 - 45 0F57 C9            - xorps xmm9,xmm9
GRB_UPP.exe+1CDDC29B - 44 0F29 90 78FFFFFF   - movaps [rax-00000088],xmm10
GRB_UPP.exe+1CDDC2A3 - 45 0F57 D2            - xorps xmm10,xmm10
GRB_UPP.exe+1CDDC2A7 - 44 0F29 98 68FFFFFF   - movaps [rax-00000098],xmm11
GRB_UPP.exe+1CDDC2AF - 45 0F57 DB            - xorps xmm11,xmm11
GRB_UPP.exe+1CDDC2B3 - 44 0F29 A0 58FFFFFF   - movaps [rax-000000A8],xmm12
GRB_UPP.exe+1CDDC2BB - 45 0F57 E4            - xorps xmm12,xmm12
GRB_UPP.exe+1CDDC2BF - 44 0F29 A8 48FFFFFF   - movaps [rax-000000B8],xmm13
GRB_UPP.exe+1CDDC2C7 - 45 0F57 ED            - xorps xmm13,xmm13
GRB_UPP.exe+1CDDC2CB - 44 0F29 B0 38FFFFFF   - movaps [rax-000000C8],xmm14
GRB_UPP.exe+1CDDC2D3 - 45 0F57 F6            - xorps xmm14,xmm14
GRB_UPP.exe+1CDDC2D7 - 44 0F29 B8 28FFFFFF   - movaps [rax-000000D8],xmm15
GRB_UPP.exe+1CDDC2DF - 45 0F57 FF            - xorps xmm15,xmm15
Guess what happens when you RET that function? That's right:



The function is part of a series of registered handler functions for various screen functionality (such as rotation via mouse, zooming in, etc.). Recoil is handler with id 0x4. Why am I saying all of this? Because I study code, because I care for shit to which Caliber says this: "I am not interested in this engine in the same manner as you [...]".

Yeah, posted it cuz not everyone wastes HOURS or DAYS to get something done right. Struggling with scanning and debugging, because it's the easiest and most cheapest method out there to get the job done and charge them $ from people. Where's the reward in it? Unless the only thing he cares about is MONEY. See.. that distinguishes me from Caliber. Whichever path I take, it's always not going to be easy to the reader. Because that's the whole idea: NOT getting bored of that same fucking routine. I honestly don't know how he lasted this long doing the same thing over and over, expecting different outcomes: that the $ always flocks in, competition is dire and he's the most awesome game-hacker out there BY QUANTITY (not quality). Here's what google says:

Image

That's about it, folks.

BR,
Sun

P.S.: Posted it as I want Caliber to steal this option from this post and put it in his CH trainer. Let's see if he uses the DIRECT prologue of the function or hooks somewhere inside it. Just like his method is unique, same is mine. Wanna use it? No problem; CONDITION is to ask me for permission and give credit. Your pleb won't mind seeing an option that isn't 100% yours, right? Same goes to all others out there wanting this option like this.

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by SunBeam »

ComManDerBG wrote:
Thu Oct 03, 2019 9:14 pm
I didnt mean anything so much, just ability to add weapons and maybe blueprints, that's it. like the weapons from the battle pass or any hidden weapons that were removed after the OTT. if its too much i understand.
It is. My list is full of games I paid for to reverse/play and have only gotten to release tools for OTHERS to use, not myself. That changes now. Sick of addressing others' requests while not tending to my "backlog".

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by SunBeam »

As I was saying 2 posts above, place a breakpoint at "No Recoil" function's epilogue and exit the function (check [rsp] for the return address). Once out scroll a bit till here:

Code: Select all

GRB_UPP.exe+1CDEB879 - 80 7B 20 00           - cmp byte ptr [rbx+20],00 { 0 }
GRB_UPP.exe+1CDEB87D - 74 1B                 - je GRB_UPP.exe+1CDEB89A
GRB_UPP.exe+1CDEB87F - 40 84 F6              - test sil,sil
GRB_UPP.exe+1CDEB882 - 75 2F                 - jne GRB_UPP.exe+1CDEB8B3
GRB_UPP.exe+1CDEB884 - 48 8B 03              - mov rax,[rbx]
Right-click the line with CMP, then "Find out what addresses this instruction accesses". From your list copy-paste to a text editor (Notepad++) only those that don't show 0. Now.. subtract 0x20 from each, then read the address you get ([]), then go to member-function 0xB8 ([[]+B8]) and check them one by one. All addresses you copied belong to your player because ALL of those -0x20 pointers have at 0x8 offset your player's Entity :) Note the functions are shared (AI also have recoil, accuracy, etc.). Now you know what the check should be :P ([ptr+0x8] == Entity from [ Debug ] section in the table).

So that's how I found this:

Code: Select all

GRB_UPP.exe+1CDDE2C0 - 48 89 5C 24 20        - mov [rsp+20],rbx
GRB_UPP.exe+1CDDE2C5 - 57                    - push rdi
GRB_UPP.exe+1CDDE2C6 - 48 83 EC 60           - sub rsp,60 { 96 }
GRB_UPP.exe+1CDDE2CA - 49 83 78 18 00        - cmp qword ptr [r8+18],00 { 0 }
GRB_UPP.exe+1CDDE2CF - 4C 89 C7              - mov rdi,r8
GRB_UPP.exe+1CDDE2D2 - 48 89 CB              - mov rbx,rcx
GRB_UPP.exe+1CDDE2D5 - 0F84 65020000         - je GRB_UPP.exe+1CDDE540
GRB_UPP.exe+1CDDE2DB - 49 83 78 10 00        - cmp qword ptr [r8+10],00 { 0 }
GRB_UPP.exe+1CDDE2E0 - 0F84 5A020000         - je GRB_UPP.exe+1CDDE540
GRB_UPP.exe+1CDDE2E6 - 48 89 6C 24 70        - mov [rsp+70],rbp
GRB_UPP.exe+1CDDE2EB - 48 89 74 24 78        - mov [rsp+78],rsi
RET it and see what it does for testing. I'll tell you what - No Scope Sway (no sway at all when zoomed). No need for "hold your breath" shit anymore.

Steal away.

BR,
Sun

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by SunBeam »

^ Updated main post with a table containing the 2-3 items above.

User avatar
Poyzion
Expert Cheater
Expert Cheater
Posts: 66
Joined: Sat May 18, 2019 8:51 pm
Reputation: 2

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by Poyzion »

SunBeam wrote:
Thu Oct 03, 2019 11:20 pm
^ Updated main post with a table containing the 2-3 items above.
Thank you so much for all the work you have done for us (the community)!
If you have method to donate i would do it because many of your tables helped me in the past :)

Keep up the great work you are doing as long as it makes fun for you / you are like it :)

But one question: Do i guess right the steps to bypass be needs to be done before every gamestart if we want to use the table in this session?
And is it still undetected by Battleeye because did the google search you mentioned for the team / person created the bypass and there is a post form beginning of september where they wrote that this doesn‘t work anymore / got detected and fixed (at least with the files there).
Or did i find a wrong article/post? (Its directly at CE Website). If so could you send me a link via pn because as i read posting such links is not allowed.
Just ask because would really like to have god mode in Singleplayer but don‘t want to get banned because all of my Games are on that a account so that would be terrible loosing them.
Or would it be better doing all of that while Uplay is in Offline Mode? Because maybe they can‘t detect it then or at least the message can‘t be send to them.
I know the only 100% safe option is to not use a cheattable but would be really great if it would work without a risk or a very very low risk (~ 0,0001% ;)). at least for Singleplayer because i play multiplayer 1 hour per Month or so so that would be no problem and cheats in common should be kept out of Multiplayer Mode (Just my opinion but think many will agree with that :)

EDIT: Never mind. The Thread i found was for the game zula and in that game it‘s no longer working.
Do i quess right that the files you posted the link to are other/updated file? (The driver loaded in the last step i mean)

User avatar
SunBeam
Administration
Administration
Posts: 4704
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4287

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by SunBeam »

^ The bypass works for Breakpoint. It's the same identical one as on UC. Those posts (about it not working) refer to active online games that regularly update their BattlEye client with newer detection signatures.

User avatar
sebastianyyz
Expert Cheater
Expert Cheater
Posts: 315
Joined: Sun Jul 09, 2017 3:33 am
Reputation: 53

Re: Tom Clancy's Ghost Recon: Breakpoint [Engine:AnvilNEXT64]

Post by sebastianyyz »

Thank you so much for the table SunBeam

Post Reply

Who is online

Users browsing this forum: AhrefsBot, Baidu [Spider], bugmenot123, Daz, Devilswarchild, DotBot, Dr4gongu4rd, flarejune, Google [Bot], Impala, indent, InfinityArts, mcneil_1, Player360, prayerger, rakumaru88, romilius, sonwolf, ZKK