FearLess Cheat Engine

Posted: **Tue Oct 20, 2020 12:23 am**

Space Crew can be found here

Crew/Ship Scripts

-Max Health

-Lock Health

-Max Shields

-Lock Shields

-No Ability Cooldown

-Extreme Gameplay

Currency Scripts

-Lock Credits

-Lock Research

Enemy Scripts

-Enemy Crew One Hit Kill

-Shields One Hit Destroy

-Armor One Hit Destroy

Cheat Engine Scripts

-Compact Mode

-Speedhack x0.5

-Speedhack x1

-Speedhack x3

Other

-Values

(Update 1) Crewmember Health codes should no longer effect enemy boarders.

(Update 2) Big thanks to cfemen for teaching me more about mono. Made table more reliable so it should work on all computers. Also made Max Health completely reliable, though had to remove Lock Health till I can find or think up a proper method to get a compare to work with it. Since Extreme Gameplay is a signature I left it in, though it will now effect everyone equally.

(Update 3) Re-added Lock Health and made it more reliable. Made Extreme Gameplay reliable. Added Lock Shields, Enemy Crew One Hit Kill, and Enemy Shields One Hit Destroy.

(Update 4) With cfemen's help, added a means to easily exit the game once the table's been activated. Added Armor One Hit Destroy so enemy ships are easier to destroy. Modified Max Shields so it won't manipulate shields that are at 0, this is to prevent an issue which would make these shields permanently deactivated.
This will likely be the last update unless the table breaks.

(Update 5) Fixed table after recent game update.
Same deal as before, last update unless table breaks.

(Update 6) Fixed table after game update.

Posted: **Tue Oct 20, 2020 1:17 am**

Max Health also effect enemy warrior，please fix it

Posted: **Tue Oct 20, 2020 5:11 am**

Update's out.

TOGHOUL wrote: ↑
Tue Oct 20, 2020 1:17 am
Max Health also effect enemy warrior，please fix it

Should be fixed.

Posted: **Tue Oct 20, 2020 8:02 am**

thank you

Posted: **Tue Oct 20, 2020 9:51 am**

What does "Extreme Gameplay" mean?

Posted: **Tue Oct 20, 2020 2:20 pm**

@Dread_Pony_Roberts
I have the game v11850 and can't activate the table. It says "The bytes at CurrencyCountedDisplay:GetValue+6d are not what was expected".

Posted: **Tue Oct 20, 2020 3:08 pm**

TOGHOUL wrote: ↑
Tue Oct 20, 2020 9:51 am
What does "Extreme Gameplay" mean?

It's a personal signature I put in all my tables, it makes the player characters die upon taking the slightest damage. I'd normally pair this with a one hit kill against enemies, but I don't know how well my filter works and for all I know it may target characters you don't want killed.

I would normally make a bigger table, but the way control is so indirect makes it a bit difficult to test for most things.

krmit wrote: ↑
Tue Oct 20, 2020 2:20 pm
@Dread_Pony_Roberts
I have the game v11850 and can't activate the table. It says "The bytes at CurrencyCountedDisplay:GetValue+6d are not what was expected".

Odd, I'm using the same version and it works just fine for me. You using Steam or from another digital store?

Posted: **Tue Oct 20, 2020 3:12 pm**

@Dread_Pony_Roberts
Mine from Steam too.

Posted: **Tue Oct 20, 2020 7:29 pm**

krmit wrote: ↑
Tue Oct 20, 2020 3:12 pm
@Dread_Pony_Roberts
Mine from Steam too.

I have an idea which may solve it, and make the table more stable for future updates. I'll have to experiment with it though.

Posted: **Tue Oct 20, 2020 9:41 pm**

Dread_Pony_Roberts wrote: ↑
Tue Oct 20, 2020 7:29 pm

krmit wrote: ↑
Tue Oct 20, 2020 3:12 pm
@Dread_Pony_Roberts
Mine from Steam too.
I have an idea which may solve it, and make the table more stable for future updates. I'll have to experiment with it though.

Hi Dread_Pony_Roberts,

[Link]
use this for mono stuff

errors like the one posted from krmit "The bytes at CurrencyCountedDisplay:GetValue+6d are not what was expected" will be fixed.
he probably has the same AOBs but its on a slightly difference offset, and your script is using a assert to make sure +6d has this bytes.

JIT code differences are often only very slightly, but with AobScanRegion you can scan for very small amount of AOBs.
JIT will have things that won't be difference on other systems, as example a mov eax,[rax+xx] or movss xmm0,[rax+xx] will be the same on all systems = perfect AOBs

and dont forget to allocate the codecave near the inject point, otherwise it will generate a oversized jmp.

another good technique on mono code -> injecting at the beginning of a function/method without any AOBs.
you can probably get most of the pointers there.

as example,i dont have the game but i assume this:
your hook at SystemTimedSkill:Update+0xdc has on RSI the time struct.
if you inject at SystemTimedSkill:Update+0x00 then its most likely on RCX.

or sometimes you will find public static functions like "GetMainPlayer" that you can [Link]to get a pointer to your current player, or you can search for the 8 Byte Static Address that contains the structs ( note : static addresses will always lead to a crash if you dissect it with cheat engine,coz cheat engine cant handle a native address if its expecting mono)
to read the 8 Bytes you can use lua (readQword and save it on allocated memory) or AutoAssembler (Alloc + ReadMem )
afterwards read the NativePointer on 0x00 and you get a valid Mono Struct.

so in short:
use AobScanRegion with very shorts AOBs on opcodes that won't be difference on other systems
or inject at the beginning of a function/method( to make it perfect you can also use ReadMem )

//

btw if you plan to do some things with positions in unity (like a noclip or teleport)
then you should know that scanning for any positions in Unity is pointless.
why:
all positions are part of the Transform component, and all of them gets calculated as native code in the UnityPlayer.dll
to get the player pos you need to call UnityEngine:Component:GetTransform with 1 argument ( your player address )
it will return the Transform component of your player.
you cant dissect components with the cheat engines mono struct dissector (it will crash same like i explained before with the static address)
the transform component has a nativePtr that contains the X Y Z position floats (mostly somewhere in the nativePtr+0x10 struct - it depends on the unity engine)

there is way more specific unity stuff(like AOBs/Symbols to find the button delegate for Mono or IL2CPP, that leads to the functions that gets executed if you click a button and so on ) but i guess thats enough infos for now ^^

BR
cfemen

Posted: **Tue Oct 20, 2020 11:15 pm**

Update's out.

For people wondering what compare I'm searching for for the Lock Health script, I'll try to explain it but it's a bit technical. Basically I have an address which always finds the player bases, problem is that I need to save each of those addresses to compare in a later script. I also need it to remove any saved address if it is no longer being referenced. Someone may have made it already, but I may have to think it up myself.

cfemen wrote: ↑
Tue Oct 20, 2020 9:41 pm

Big thanks. Was planning on aobscanregion but I'm glad to know why the original didn't work. Probably should have started my first unity coding on an fps since I'm more familiar with them, but in the end it's a learning experience one way or the other. I'll study up on your unity tutorials.
Also a bit disappointing the lack of coordinate manipulation, but I'll take what I can get.

Posted: **Wed Oct 21, 2020 12:17 am**

cfemen wrote: ↑
Tue Oct 20, 2020 9:41 pm

While I'm thinking of it I'd like to ask, is it possible to prevent the game from freezing upon exiting with MonoDataCollector enabled? I hope to make something better than a warning.

Posted: **Wed Oct 21, 2020 1:02 am**

Dread_Pony_Roberts wrote: ↑
Wed Oct 21, 2020 12:17 am

cfemen wrote: ↑
Tue Oct 20, 2020 9:41 pm

While I'm thinking of it I'd like to ask, is it possible to prevent the game from freezing upon exiting with MonoDataCollector enabled? I hope to make something better than a warning.

yeah that sucks :/
i've also looked already for a solution for that, back then i created something that works semi

lua:

Code: Select all

pQuit = getAddressSafe( "UnityEngine:Application:Quit" )

function debugger_onBreakpoint()
  debug_continueFromBreakpoint( co_run )
  return 1
end


debugProcess(2)
debug_setBreakpoint( pQuit )

breakpoint will be executed if the game closes, the attached debugger will force cheat engine to disable mono features and the game should close without freeze.
on some games it works very nice and on some its like 50/50 chance.

thats the only thing i figured out that can work

Posted: **Wed Oct 21, 2020 2:07 am**

cfemen wrote: ↑
Wed Oct 21, 2020 1:02 am

A bit disappointing but at least it's nice to know that I'm not the only one struggling with it.

I tried plugging in the code but I guess it doesn't work for this game, oh well.

If it helps at all, DB talked on discord of a command which also disables Cheat Engine's mono features. I don't know lua so I wouldn't know how to insert it in your code, but you might find a use for it.

Code: Select all

monopipe.destroy()

Posted: **Wed Oct 21, 2020 4:38 am**

Update's out. Re-added Lock Health and made it more reliable. Made Extreme Gameplay reliable. Added Lock Shields, Enemy Crew One Hit Kill, and Enemy Shields One Hit Destroy.

Enemy one hit kill/destroy scripts will effect everything that's not your ship and crew, so be careful if you have a VIP on board.

FearLess Cheat Engine

Space Crew +15 [Update 6]

Space Crew +15 [Update 6]

Re: Space Crew +11

Re: Space Crew +11 [Update 4]

Re: Space Crew +11 [Update 1]

Re: Space Crew +11 [Update 1]

Re: Space Crew +11 [Update 1]

Re: Space Crew +11 [Update 1]

Re: Space Crew +11 [Update 1]

Re: Space Crew +11 [Update 1]

Re: Space Crew +11 [Update 1]

Re: Space Crew +10 [Update 2]

Re: Space Crew +10 [Update 2]

Re: Space Crew +10 [Update 2]

Re: Space Crew +10 [Update 2]

Re: Space Crew +14 [Update 3]