Watch Dogs: Legion [Engine:Disrupt 2]

[SunBeam]

[ 31 Oct 20 - Hit #1 ]

! THIS IS NOT MEANT FOR <<UPLAY PLUS>> !

Game Name: Watch Dogs: Legion
Game Vendor: UPlay
Game Version: -
Game Process: WatchDogsLegion.exe [ DuniaDemo_clang_64_dx11.dll/DuniaDemo_clang_64_dx12.dll ] [ -BattlEyeLauncher ]
Game File Version: 0.1.0.1

[Link]

Hello folks.

Late to the party, but I've been busy Mainly with learning what I'm about to post. Without any further ado, let's go. I'm going to gradually outline the information and why you (might) need it. With explanations. Whoever wants to skip to the table, please don't. I won't be lenient when you start asking stupid questions due to not reading T_T.

[1] The Disrupt 2 Engine is an upgrade to the one used in Watch Dogs & Watch Dogs 2. Apart from that, it's a branch of Dunia (Far Cry 4, 5, New Dawn, most likely in upcoming 6 as well). That's why you've been seen the name flaunted around here and there:



* * *

[2] Pretty much like with any other Dunia games, Ekey on XeNTaX community has already started compiling the list of file names for his .dat/.fat file extractor. You can find more information here: [Link]. Sir Kane posted an updated extractor, while Ekey's updated file list can be found on page 2. I won't hotlink to the file downloads, as it wouldn't be nice of me. So please visit the forum if you're interested. Why am I talking about this? Because Dunia comes with a Lua Engine. It's called Domino. And this Engine runs .lua scripts. Guess where these scripts are. You guessed.. in the .dat files in Watch Dogs Legion\data_win64 folder.

The one I found the domino scripts in: Watch Dogs Legion\data_win64\worlds\london\london.dat. The .lua files have to be extracted from the london.dat file by the means I've mentioned in the above (XeNTaX). Note they are encoded, so if you want to see what's in there, they need to be decoded first. Wonder which tool to use.. Ah! See below.

* * *

[3] 2 years ago I posted a LUA Cleaner/Dumper for Far Cry 5 in this topic: viewtopic.php?t=6474. Guess what?.. It will work with these .lua files too. Or so I thought. The file header says Lua 5.1 (LuaQ) and no container anymore (no LUAC). So I've adjusted the tool a bit for this scenario:

WDL.Lua.zip

pass: sunbeam

(166.75 KiB) Downloaded 977 times

THE TOOL ABOVE IS NOT TO BE USED WITH .DAT FILES !

* * *

[4] For those of you lazy enough to extract the data and decode the .lua scripts, here's an archive containing what I've gathered so far: [Link] (pass: sunbeam)

THE FILE ABOVE CONTAINS THE ALREADY DECOMPILED LUA FILES !

* * *

[5] Norway-_-1999 posted a tool called "Script Loader" for Far Cry 5 and Far Cry New Dawn. He was kind enough to share some information with me, as to how he was able to use the game's Lua Engine (Domino) to run Lua commands/scripts, how to dump the Lua globals and other insight. I've obtained his permission to adjust and release his tool for WDL as well, so expect feedback in a little while.

* * *

[6] With the above information I was able to create the table below:

WatchDogsLegion.CT

(13.12 KiB) Downloaded 1337 times

Which can be used as follows:

• Start the game without BattlEye; here's how:
  
  

• Open Cheat Engine 7.1+, target the game (WatchDogsLegion.exe) and open/load the script you've just downloaded.

• Activate [ Enable ] script. Now you can use CE's Lua Engine console to type stuff in (CE > Memory View > Ctrl+L). Alternately, you can use the already existing scripts in the table to some extent.

• command( "command_text" ) -- for simple 1-line commands

• script( "path_to_script" ) -- for scripts that are more complex

Examples:

• command( "FelonySystemEnable(0)" )

• script( "C:/Users/SunBeam/Desktop/god.lua" ) -- where the script contains this code:
  

  Code: Select all

  local player = GetLocalPlayerEntityId();
   
  if player ~= nil then
      local localpawn = GetPawnIdFromPlayerId(GetLocalPlayerId());
      
      if localpawn ~= nil then
          ActivateInvincibility(localpawn);
      end
  end
  

In case you wonder where the Lua you see in 2nd post comes from, know that it's from: the decompiled files + the game's history + various online posts (past research on the series).

Credits:

• Norway-_-1999

• s0beit

• Ekey

• Sir Kane

• < online communities with old research: UC, guru3D, etc. >

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[SunBeam]

Dump Globals
Credits: Norway-_-1999

Code: Select all

local dump = io.open("D:/dump.txt", "w")
 
local aprased = {}
 
function tab_find_exists(tab,data)
    for k,v in pairs(tab) do
        if v == data then
            return true
        end
    end
    return false
end
 
function dump_table(fi,tab,depth)
    table.insert(aprased,tab)
    for k,v in pairs(tab) do
        if type(v) == "table" and not tab_find_exists(aprased,v) then
            for i=1,depth,1 do
                fi:write("  ")
            end
            fi:write(tostring(k),":\n")
            dump_table( fi, v, depth+1 )
        else
            for i=1,depth,1 do
              fi:write("  ")
            end
            fi:write( tostring(k),"\n" );
        end
    end
    fi:write("\n")
    fi:flush()
end
 
dump_table( dump ,_G ,0 )
dump:flush()
dump:close()

Copy the script above to a file (e.g.: dump.lua), then run script( "C:/Users/SunBeam/Desktop/dump.lua" ) in CE > Memory View > Ctrl+L. Note the folder path I used in the example doesn't have to be identical to mine. Same goes for "D:/dump.txt" in the script itself. You can change these to your liking.

The execution will create a file - dump.txt - containing this information:

dump.txt

(39.01 KiB) Downloaded 231 times

From here on, you can combine the content of that dump (the functions) with the decompiled .lua files (I use Ctrl+F to search commands and check where they're used in the decompiled .lua files) and figure out on your own how the Domino commands work and what you can do with them Possibilities are endless.

* * *

God Mode
Credits: s0beit; [Link]

command:

Code: Select all

ActivateInvincibility( GetEntityIdFromPlayerIndex( GetLocalPlayerId() ) ); -- enables invincibility

Code: Select all

RemoveInvincibility( GetEntityIdFromPlayerIndex( GetLocalPlayerId() ) ); -- disables invincibility

- or -

script:

Code: Select all

local player = GetLocalPlayerEntityId();
 
if player ~= nil then
  local localpawn = GetPawnIdFromPlayerId( GetLocalPlayerId() );
 
  if localpawn ~= nil then
    ActivateInvincibility( localpawn ); -- or RemoveInvincibility( localpawn )
  end
end

EDIT: Also via SetInvincibility(1) (and 0 for off).

* * *

Disable Police
Credits: s0beit; [Link]

command:

Code: Select all

FelonySystemEnable( 0 )

You can re-enable it with 1 instead of 0.

* * *

Remove Wanted Level
Credits: s0beit

script:

Code: Select all

local player = GetLocalPlayerEntityId();
 
if player ~= nil then
  FelonySetHeat( player, 0 );
end

This can be simplified into one command: FelonySetHeat( GetLocalPlayerEntityId(), 0 ).

EDIT: The above didn't work for me, but found an alternative -> FelonyEndChase( GetLocalPlayerEntityId() ). This works.

* * *

Disable ctOS Movement
Credits: SK83RJOSH

command:

Code: Select all

SetPatrolSpeed( 0 )

* * *

Infinite Ammo
Credits: CoMPMStR

command:

Code: Select all

ModifyBulletsInClip( GetLocalPlayerEntityId(), 1, 99, 0 )

^ Doesn't seem to work for me. I'll check decompiled .lua files.

OK, so there's this in weaponcontroller.lua:

Code: Select all

WeaponController = {ItemDB = nil}
function WeaponController:Create(cbox)
end
function WeaponController:GetWeaponTypeID(weaponType)
  if weaponType == "Holster" then
    return -1
  elseif weaponType == "OneHanded" then
    return 0
  elseif weaponType == "Asault" then
    return 1
  elseif weaponType == "ShotGun" then
    return 2
  elseif weaponType == "Sniper" then
    return 3
  end
  return -1
end
function WeaponController:SetClipBullets()
  self.BulletCount = self.BulletCount or 0
  self.pawn = self.pawn or GetLocalPlayerEntityId()
  ModifyBulletsInClip(self.pawn, self:GetWeaponTypeID(self.Weapontype), self.BulletCount, 0)
  self:Out()
end
function WeaponController:AddClipBullets()
  self.BulletCount = self.BulletCount or 0
  self.pawn = self.pawn or GetLocalPlayerEntityId()
  ModifyBulletsInClip(self.pawn, self:GetWeaponTypeID(self.Weapontype), self.BulletCount, 1)
  self:Out()
end
export = WeaponController
WeaponController = nil

Which means.. the code is fine.. but doesn't do anything. Hmm..

* * *

Slow Motion

command:

Code: Select all

SetSlomoFactor(0.5); -- default is 1

* * *

< < in progress > >

[acecel]

Thanks a lot for the work you are doing regarding this game, and for the explanation in the first post.

[SunBeam]

You might want to also check this page: [Link]

[BeefingtonsBay]

Is it possible to edit a character's information such as perks, appearance and weapon choices? I'm not great with this stuff, but after losing all my progress (and favourite characters) to a crash I'm hoping for a speedy way to get back on track.

[kastov]

Is it possible to edit a character's information such as perks, appearance and weapon choices? I'm not great with this stuff, but after losing all my progress (and favourite characters) to a crash I'm hoping for a speedy way to get back on track.

Who knows is it possible?

[sebastianyyz]

Thank you SunBeam

[holdthecheese]

I am hoping to help someone work out a script to add and remove perks to operators. (Willing to donate/contribute) Here are some useful finds from Sunbeam's dump:

WDL.london.dat\london.dat\domino\system\perkcontroller

perkcontroller has AddPerk() / RemovePerk() functions. I am looking for a perk list, I will edit this if I find it.

WDL.london.dat\london.dat\domino\system\perkmonitor (This one may be useless)



Edit: Sunbeam gave a heads-up that upluy+ wasn't supported but for those trouble running the CT within CE using uplay+ version DX12 Ultimate edition. It kept giving a gameModule error when looking for the .dll files on line 143 (variable gameModule being declared). In case anyone else runs into this my fix was this:

line15

Code: Select all

local moduleBase = getAddressSafe( "DuniaDemo_clang_64_dx11.dll" ) or getAddressSafe( "DuniaDemo_clang_64_dx12.dll" ) 

change to
line15

Code: Select all

local moduleBase = getAddressSafe( "DuniaDemo_clang_64_dx11.dll" ) or getAddressSafe( "DuniaDemo_clang_64_dx12.dll" ) or getAddressSafe( "DuniaDemo_clang_64_dx11_plus.dll" ) or getAddressSafe( "DuniaDemo_clang_64_dx12_plus.dll" ) 

and

line16

Code: Select all

local moduleSize = getModuleSize( "DuniaDemo_clang_64_dx11.dll" ) or getModuleSize( "DuniaDemo_clang_64_dx12.dll" )

change to
line16

Code: Select all

local moduleSize = getModuleSize( "DuniaDemo_clang_64_dx11.dll" ) or getModuleSize( "DuniaDemo_clang_64_dx12.dll" ) or getModuleSize( "DuniaDemo_clang_64_dx11_plus.dll" ) or getModuleSize( "DuniaDemo_clang_64_dx12_plus.dll" )

and

line143

Code: Select all

local gameModule = getAddressSafe( "DuniaDemo_clang_64_dx11.dll" ) or getAddressSafe( "DuniaDemo_clang_64_dx12.dll" )

change to
line143

Code: Select all

local gameModule = getAddressSafe( "DuniaDemo_clang_64_dx11.dll" ) or getAddressSafe( "DuniaDemo_clang_64_dx12.dll" ) or getAddressSafe( "DuniaDemo_clang_64_dx11_plus.dll" ) or getAddressSafe( "DuniaDemo_clang_64_dx12_plus.dll" )

EDIT2:

Cannot get perk related functions to work, its possible because I am calling them incorrectly. No errors but has no effect on my operator.

I tried these:

Code: Select all

command("ResetPerks()")
command("ResetPerks(GetEntityIdFromPlayerIndex( GetLocalPlayerId() ))")
command("ResetPerksForPlayer( GetEntityIdFromPlayerIndex( GetLocalPlayerId() ) )")
command("GetEntityIdFromPlayerIndex( GetLocalPlayerId() ).LuaLibCore:ResetPerks()") <-- this ones a real hail mary
command("GetPawnIdFromPlayerId(GetLocalPlayerId())ResetPerkForPlayer()")

Also, tried as a script(copying sunbeam's stuff).

Code: Select all

local player = GetLocalPlayerEntityId();

if player ~= nil then
    local localpawn = GetPawnIdFromPlayerId(GetLocalPlayerId());
    
    if localpawn ~= nil then
        ResetPerk(localpawn);
    end
end

EDIT3:

Still nothing on perks, I think the missing ingredient here is a perk ID list.

I did find this which was cool:
WDL.london.dat\london.dat\domino\system\inventorycontroller_v2.lua

Code: Select all

EquipItem(self.ItemDB)

Maybe it can be used to equip a silenced P9, given the correct ItemDB?

[Expired6978]

Haven't got any of the item or perk related functions to work, needs more testing.

Here's some that do work:

Hacking Drones to Disable, and Cars to go Chaotically

Code: Select all

-- Hacks
--    DroneHijack
--    Attract
--    LockBrakes
--    LockLeftWheel
--    LockRightWheel
--    EngineOverheat
--    IngredientTrigger
--    Any
--    Download
--    DroneDisable
--    RCHijack
--    RCJumperDockSpawn

local player = GetLocalPlayerEntityId()
local playerVehicle = GetCurrentVehicleEntityId(player)

local droneList = CAIAgentManager_GetInstance():GetAIDronesFromLUA("All", "", 1)
for i, v in ipairs(droneList) do
	TryTriggerHack("DroneDisable", player, v)
end

local vehicleList = CAIAgentManager_GetInstance():GetAIAgentsOfGroupFromLUA_v2("Vehicle", 0, "", 0, 0)
for i, v in ipairs(vehicleList) do
	if v ~= playerVehicle then
		TryTriggerHack("EngineOverheat", player, v) -- Seems to actually be Forward
		TryTriggerHack("LockBrakes", player, v)     -- Seems to actually be Backward
		TryTriggerHack("LockLeftWheel", player, v)
		TryTriggerHack("LockRightWheel", player, v)
	end
end

Exploding all cars

Code: Select all

local vehicleList = CAIAgentManager_GetInstance():GetAIAgentsOfGroupFromLUA_v2("Vehicle", 0, "", 0, 0)
for i, v in ipairs(vehicleList) do
	ExplodeVehicle(v)
end

Code: Select all

ForceVehicleStop
ShutdownVehicleEngine

didn't seem to do anything

Code: Select all

StartEntityHighlight(player, 4)
StopEntityHighlight(player)

Player highlighting works

Code: Select all

StartBlackoutV2

didn't seem to do anything

While it's probably not the fastest method of making money if you recruit an operative with the hacks occasionally give ETO you can drive around spamming distract on every pedestrian in the area. The availability overrides don't seem to work, was hoping I could stay in the same place. You'll eventually crash if you do it too often though.

Code: Select all

local pedList = CAIAgentManager_GetInstance():GetAIAgentsOfGroupFromLUA_v2("Human", 0, "", 0, 0)
for i, v in ipairs(pedList) do
	--AddHackingAvailabilityOverride(v, "Enable")
	--AddHackCategoryAvailabilityOverride(v, "Distract", "Enable")
	TryTriggerHack("Distract", player, v)
	--RemoveHackCategoryAvailabilityOverride(v, "Distract")
	--RemoveHackingAvailabilityOverride(v)
end

[kastov]

Code: Select all

command("SetProfilerOn(GetLocalPlayerEntityId(), 1)")

-- sets profiler ON

Code: Select all

command("SetProfilerOn(GetLocalPlayerEntityId(), 0)")

-- sets profiler OFF

Code: Select all

command("SetFaceMaskAllowed(GetLocalPlayerEntityId(), 0)")

- turns off mask whem aiming

Code: Select all

command("SetCharacterAbilitiesEnabled(GetLocalPlayerEntityId(), 0)")

- disable characher abilities and gadgets( 1 to enable)



interesting file changeplayergkmodelfromhumanconfig.lua(in folder system)
maybe someone who better knows all details can look at this file? maybe it is a way to change voice on our operatives?

[SunBeam]

I've also left you guys some links to Norway's stuff in Far Cry 5 and New Dawn There are some extra commands in there, check if they work with Legion or how the syntax looks like. Hope it leads to something nice.

[Expired6978]

Haven't had time to look at the inner workings, would be nice to actually decode the item registry so we can resolve what items are what but I am not really that invested atm. I had hoped GetItemId would just take the lib name but that didn't seem to yield anything, though I had no way to verify as I have no way to see output (I couldnt write to file for some reason). Maybe attach debugger and hook print function to redirect to std out (unless it already goes to std out and I just wasn't looking).

You'd get the most from hooking the game's Lua functions and printing known parameters to see what sort of data is flowing and reverse from there, at least without the item registry.

Here's a quick hook function to dump parameters from functions:

Code: Select all

function CreateHook(obj, functionName, callback)
	if obj[functionName] ~= nil then
		if obj[functionName .. '_Original'] == nil then
			obj[functionName .. '_Original'] = obj[functionName]
		end
		obj[functionName] = function(...)
			local dump = io.open("C:/Legion/Scripts/" .. functionName .. "_Hooked.txt", "a+")
			local t = {}
			for k,v in ipairs(arg) do
				t[#t+1] = tostring(v)
			end
			
			local result = nil
			if obj[functionName .. '_Original'] ~= nil then
				result = obj[functionName .. '_Original'](unpack(arg))
			end

			dump:write(table.concat(t,", ") .. ", Result: " .. result .. "\n")
			dump:flush()
			dump:close()

			if callback ~= nil then
				result = callback(unpack(arg))
			end

			return result
		end
	end
end

CreateHook(_G, 'TryTriggerHack')

local player = GetLocalPlayerEntityId()
local pedList = CAIAgentManager_GetInstance():GetAIAgentsOfGroupFromLUA_v2("Human", 0, "", 0, 0)
for i, v in ipairs(pedList) do
	TryTriggerHack("Distract", player, v)
end

[ceso97]

I understand that it will be a long thing before someone can figure out how to edit the characters...
If only I were able to do it I would fiddle with it as much as possible, but I don't really understand these things.
Yesterday I tried to look at some of the files that Sun posted in the first message, but it's already a miracle that I managed to create the Dump.txt ahahahah

I just hope someone gets it before November 10th, to be able to try it before AC:V completely absorbs me ahah

Good luck to everyone

[Otis_Inf]

@Expired6978 Is there any way to get the address in memory of the function that's called by a lua function? My stuff works at the C++/asm level and I can't find a way to get the lua stuff in memory, e.g. the CEnvironmentManager_getinstance singleton function's location would be nice... so if I have the location in memory it would be easy peasy, but it seems you can't get from the lua to the asm. Do you know a way? TIA!

[Expired6978]

@Expired6978 Is there any way to get the address in memory of the function that's called by a lua function? My stuff works at the C++/asm level and I can't find a way to get the lua stuff in memory, e.g. the CEnvironmentManager_getinstance singleton function's location would be nice... so if I have the location in memory it would be easy peasy, but it seems you can't get from the lua to the asm. Do you know a way? TIA!

Lua functions usually just wrap the native function so you'd have to look at the implementation of that, so yeah usually you can get it by viewing that function unless the Lua C function inlined the original native function, in which case you're just looking at the literal function itself. It's quite annoying to follow Lua calls to the native implementation through debugging as it's running its own script stack. The best way imo would be either static analysis to find the massive initialization of where they bind the natives to Lua or you could also most likely find that initialization just searching the function name. Most of the Lua natives will very loosely look something like this:

Code: Select all

BindFunction(Lua, "MyLuaName", functionImplementationAddress);

(I haven't looked at base Lua native function registration in a long time so this is super paraphrased by memory) where the implementation function is a C function containing the Lua state object, then parameters get unpacked and/or converted to engine equivalents, then the actual native is called. Maybe some extra parameters here and there but usually the function name strings will be hardcoded.

You could also theoretically inject your own dll containing custom Lua natives (if you know the exact Lua version used and it isn't heavily modified you can usually link your dll against the base Lua library), then hook the Lua function registry and register your custom natives, in which case you could execute the Lua, call the GetInstance, then pass the result into your custom native. When I dumped some functions the GetInstance functions returned "userdata" which usually indicates it's not a lua field/table and it's just a pointer to something, possible it's a literal pointer to that object if they weren't too concerned about typesafety or object lifetime.

I found hooking a good chunk of the existing Lua functions the game doesn't seem to call them from Lua that often, you'd get more information hooking the natives that are wrapped by the Lua functions. There's also probably a lot more actual natives that simply aren't implemented, the ones dumped here don't seem to interact with all the meat and seem to be mainly intended for quest/objective/mission scripting but not the actual rewarding or progression of those.