Chernobylite [Engine:Unreal 4.21] - Console enabler, Dumper and more..

[SunBeam]

[ 29 Mar 20 - First Release ]

Game Name: Chernobylite
Game Vendor: Steam
Game Version: Revision: 25359 [ you can see this in main menu, bottom-left ]
Game Process: ChernobylGame-Win64-Shipping.exe
Game File Version: 4.21.2.0



Hello folks.

Attached below is a DLL that will do the following:

• Run threaded UE4 code to create the UConsole UObject, member of GameViewportClient; you may then use Tilde (~) key to open up the console. As far as what you can or can't do with the console, well.. I'm not the game developer You'll have to google around for commands, test stuff out and return with feedback. As opposed to just asking "what are the commands?" and doing shit about it, waiting to be spoon-fed.

• Will dump the UE4 FNameArray and UObjectArray, along with their addresses. What this means is you can then know what the fuck you're looking at in memory, when debugging/tracing or mapping structures, and come up with your own conclusions. Just like I did with my table below.

Chernobylite_Console_Dumper.rar

password: sunbeam

(182.19 KiB) Downloaded 288 times

Instructions:

• Download the archive; extract content to a folder of your choice.

• Run the game, get to main menu.

• Run IGCSInjector.exe. You can close it when asked.

• Takes 1-2 seconds for the DLL to find the stuff, StaticCreate the Console UObject and dump Names/Objects to disk in the Win64 folder.

• You may then use Tilde (~) key to open up the console in-game.

Notes:

• The dump location is your game folder (e.g.: C:\SteamLibrary\steamapps\common\Chernobylite\ChernobylGame\Binaries\Win64). You will find 2 files there: NamesDump.txt and ObjectsDump.txt. You'll be very interested in the 2nd one

• The .txt files are generated at "run-time". What this means is if you transition in-game from one map to another or from main menu to game world and backwards, you need to re-dump them. Why? UE4 destroys and recreates UObjects; re-initialization. To re-dump the .txt files press Numpad / (no, key can't be changed).

Commands:

• god
  Makes you invulnerable. You'll need to re-enable it if you exit to main menu, then back in-game, load a save/quicksave or transition in any other way that makes the loading screen show up. Why; re-initialization. The god flag is a BOOL within your Character structure. When you reload the game, all structure are re-initialized by the Engine and their default statuses set in place. Which means your god bool will be reset. NOTE that if you enable god and save your game with it enabled, the next time you reload, it will be enabled State seems to be saved in the save file.

• slomo <float>
  Slows down, accelerates or sets game speed back to normal, depending on the value you give it. (e.g.: slomo 0.5; slomo 1; slomo 1.5)

• teleport
  Will teleport your character to the location appointed by your mouse pointer. Simply aim some spot, then ~ and teleport [Enter]. You'll instantly get to your targeted location.

• playersonly
  Currently is designed to freeze any AI in place, including yourself. In older versions of the Engine, this was freezing everything but you. Guess Epic changed their mind. Could probably be tweaked through code hooks to exclude the player Character from the list of frozen entities.

• toggledebugcamera
  This will detach current camera from the player (in reality, it changes controller to the newly created camera UObject) letting you fly around and explore the area. You can use it together with 'teleport', for example, to move your player to the location where the camera is pointing. Just type it in the console once you've decided for the spot. Also.. using 'slomo 0' I was able to take these screenshots, basically stopping the cut-scenes while they were playing:
  
  
  
  
  
  

• summon <blueprint_name>
  Probably the most powerful command one can use. It's designed to spawn/generate in front of your view an UObject defined by the Blueprint's name you've typed in. What you can do with this is simply use it in conjunction with either extracting the game's .pak archive (\Chernobylite\ChernobylGame\Content\Paks\*.pak) or with the ObjectsDump.txt file (\Chernobylite\ChernobylGame\Binaries\Win64\ObjectsDump.txt). I'll describe the 2nd one, as it's faster:
  
  - get in-game, inject the DLL
  - hit Numpad / just to make sure you have the latest .txt dumps
  - open ObjectsDump.txt in Notepad++ and search for "Package BP_"
  - everything that you see now can be summoned in-game, condition being you suffix them with a "_C"

Apart from the above, here's also a cheat table for the game, which I've put several hours into, as not all things are simple as they seem (fly, ghost, walk). The table contains the following features:

• Hook UCheatManager execs (execFly, execGhost, execWalk)
  The script hooks the CheatManager wrappers calling the UCheatManager::Fly, UCheatManager::Ghost and UCheatManager::Walk function, replacing them with the ones I've rebuilt. Why rebuilt? Because Shipping releases by design come with the core code not compiled. Thus it needs restoration.

• Hijack MoveForward/MoveRight
  Now, even with the above script active and functions restored, you still can't fly properly. That's because the Z-axis is not processed in the mouse orientation + movement. As such, I had to find the movement functions (ACGBaseCharacterMovement::Global_Movement_UpDown, ACGBaseCharacterMovement::Global_Movement_RightLeft) and hook them, conditioning that when UCharacterMovementComponent::IsFlying is happening, that's when the ripped-and-restored code would execute, thus allowing you free movement on all axis. In short, you get fly and ghost working (aka noclip). To turn them off, type 'walk' in the console.

ChernobylGame-Win64-Shipping.CT

1.0 - most engine goodies

(43.98 KiB) Downloaded 200 times

BR,
Sun

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[SunBeam]

Another thing I've been wanting to do since day one was to get the Environmental Analyzer to show everything. Currently, by default, it shows this:



So the AI standing there to the left is not highlighted. However, if I were to take him down silently, thus incapacitate him, it will show up in light blue-ish color when scanning occurs. So.. goal now is to get the tool to highlight ANYTHING, regardless of the choice you've set it to scan for, as well as LIVING AIs.

Be back with more.

BR,
Sun

P.S.: You can later highlight them with the use of a gadget (Mind Control) applied to your PDA. However, I still am not sure what's the flag in an AI Pawn that needs to be flipped to get the detection Sphere to include it in the interpolation. Or maybe it's something related to the actual PDA (a flag in the Item structure)..

[cfemen]

hmmm dont think its a flag:

i used the ret on AMainPawnCpp::GetCurrentResourceType to get here while using the Geiger-Analyzer :

ARadarSphere::NotifyActorBeginOverlap

then its checks for the "green extra highlight" based on the selected resource-type

//

Beginning of NotifyActorBeginOverlap if a actor is hit there are 2 checks that needs to be true:

Code: Select all

ChernobylGame-Win64-Shipping.exe+6DF789 - 48 8B D0              - mov rdx,rax
ChernobylGame-Win64-Shipping.exe+6DF78C - 48 8B CB              - mov rcx,rbx
ChernobylGame-Win64-Shipping.exe+6DF78F - E8 4CDF1F00           - call ChernobylGame-Win64-Shipping.exe+8DD6E0 // = UClass::ImplementsInterface
ChernobylGame-Win64-Shipping.exe+6DF794 - 84 C0                 - test al,al 
ChernobylGame-Win64-Shipping.exe+6DF796 - 0F84 F2010000         - je ChernobylGame-Win64-Shipping.exe+6DF98E 
ChernobylGame-Win64-Shipping.exe+6DF79C - 48 8B CF              - mov rcx,rdi
ChernobylGame-Win64-Shipping.exe+6DF79F - E8 5CFC0600           - call ChernobylGame-Win64-Shipping.exe+74F400 // =  Execute_ShouldBeHightlighted
ChernobylGame-Win64-Shipping.exe+6DF7A4 - 84 C0                 - test al,al 

RCX holds blueprint generated classes of the hitted actor
RDX = Class ChernobylGame.ScannableObject

if RCX is blueprint generated class of Placeable_Loot or PickableItem

then ImplementsInterface returns true

the second call is : Execute_ShouldBeHightlighted

if its true then it checks for the extra highlight (the GetCurrentResourceType return) and goes on - near the end of NotifyActorBeginOverlap:

Code: Select all

C6 83 28030000 01     - mov byte ptr [rbx+00000328],01 
E8 BADDFFFF            - call ChernobylGame-Win64-Shipping.exe+6DD740 // = RadarAfterImage::Initialize

RadarAfterImage::Initialize:
does a lots of mesh checks(GetComponentsByClass /GetNumOfMaterials and so on) and eventually:

A call to UMeshComponent::SetMaterial

if i only NOP this call = nothing gets highlighted

//

looks like the item needs the ChernobylGame.ScannableObject class that the SetMaterial in RadarAfterImage::Initialize gets executed
unfortunately it does not work to return true for the first 2 checks (ImplementsInterface / Execute_ShouldBeHightlighted)
RadarAfterImage::Initialize does not execute the SetMaterial call, and to force it causes that SetMaterial gets null-pointer.

[SunBeam]

^ That with the resources I was able to do. Regardless of what you filter in the scanner to detect, it would show ALL resource types in green. However, for AI, they're only shown if knocked out and carry resources of types on them. If they become containers of resources. Like I said.. later on in the story you have a choice to either blow up Duga or gain the technology. That will show AI (just soldiers, not Shadows) as well when you scan.

[KyleKatarn]

Console Enabler and Dumper Confirmed working on GOG.com version.

[KyleKatarn]

Oof... Table doesn't work on GOG version. I am using Cheat Engine 7.0
Am I missing something here?
The Console Enabler and Dumper works fine.

Bought Steam Version too. Will test.

Table works fine (for the most part, debug is what it is) on Steam Version.
No real mystery there, Table was made for Steam, it's in the Title.

[spydir]

The dumper and the table are both, obviously, not working on Revision 31663.

The dumper, specifically, gives this error if you don't run it in Admin mode:

[Link]

If you DO run it as admin, the dos window says it's fine:

[Link]

BUT it gives a secondary error pop-up that says "NamesStore:::Initialized failed." which I can't get a shot of.

[SunBeam]

Running it as Admin is fine. Your problem is UAC without it. As far as the error, the devs might've upgraded the Engine version (used 4.21, now perhaps uses 4.25). Else I can't explain why the NameStore specifically isn't found. Lastly and "obviously", I don't track games, as I would need 23891279382179312 TB of disk space to keep all of them installed. I have no intention to revisit the title till it gets all the bugs sorted out. The developers were fun to talk to, but they're like everyone else: they've still not included the console and what I asked them to do in the public build. So hard pass here. Cheers.