Deathloop

[aSwedishMagyar]

Wanted to make my own table and already found some good stuff (so nice to have RTTI). Probably the first table that I didn't have to scan for anything (excluding mono and UE4 games).

You will need Sunbeam's bypass if you don't want it to crash which can be found here.

Current Table:

Deathloop.CT

22-09-2021
v1.708.4.34 content 467

(93.53 KiB) Downloaded 2776 times

Current Options:

• Pointers
  • arkPlayerController
    • Current Reprise
    • Max Reprise
    • arkCpntPlayerStateMachine
      • arkPlayerStateJumping
        • arkDeclPlayerStateJumping
          • Walk/Idle Jump Height
          • Sprint Jump Height
          • Crouch Jump Height
          • Second Jump Height
    • arkCpntPlayerPhysics
      • arkCpntPlayerProxy
        • X Position
        • Y Position
        • Z Position
    • arkPlayer
      • arkCpntPlayerIronSightJointsController
        • Sway Disabled
        • Sway Multiplier
      • arkCpntNavigation
        • arkCpntAttributes
          • Movement Speed Mult
          • Sprint Speed Mult
          • Look Sensitivity Mult
      • arkCpntMana
        • ManaBar
          • Section 1
          • Section 2
          • Section 3
        • arkCpntAttributes
          • Mana Regen Rate
      • arkCpntPlayerSensorHacking
        • arkCpntWaveMultiTool
          • arkDeclCpntWaveMultiTool
            • Hack Sphere Radius
      • arkCpntHealthEvolved
        • God Mode
        • Current Health
        • Max Health
    • Populate Inventory
  • arkLocalUserLocal
    • Residuum (In-Game)
    • Residuum (Infuse Menu)
• Scripts
  • God Mode
  • Inf Mana
  • Inf Reprise
  • Inf Ammo
  • Inf Residuum
  • Inf Double Jump
  • Modify Projectile Count
    • Multiplier
  • Modify Blink Distance
    • Multiplier
  • Modify Fire Rate
    • Multiplier
  • Super Accuracy
  • No Jam
  • No Recoil
  • No Aim Sway
  • No Spread Increase
  • Instant Hack

Links to other Tables:

• Sunbeam
• Zanzer

Table Updates:

1. Added Some more pointers/scripts and added a function to run whenever you open a Group Header that will update offsets (for the arkCpnt list) since they seem to move around as you progress through the game.
2. Updated to latest patch.
3. Added some more pointers and an Inf Double Jump script along with No Aim Sway.

Previous Tables

Deathloop.CT

19-09-2021
v1.708.3.34 content 467

(79.11 KiB) Downloaded 240 times

Deathloop.CT

19-09-2021
v1.708.0.34 content 467

(79.12 KiB) Downloaded 141 times

Deathloop.CT

18-09-2021
v1.708.0.34 content 467

(48.32 KiB) Downloaded 145 times

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[Ninomae Tako'nis]

I'm not sure if its because I'm on the beta branch or some other reason, but the table freezes after I enable it. The other two tables enable fine though, so I'm not sure if the beta is that different when it comes to this.

[aSwedishMagyar]

I'm not sure if its because I'm on the beta branch or some other reason, but the table freezes after I enable it. The other two tables enable fine though, so I'm not sure if the beta is that different when it comes to this.

Not sure why that would happen for you and not me but there is a big difference in the enable script that could cause that so I won't argue.

To fix it just change: createThread( function(th) onEnable() end ) to this: onEnable().

I'll see if I'm doing something wrong with createThread(). When I activate it CE does not freeze and the lua engine window comes up like normal and shows all the successful hook messages.

[SunBeam]

Not sure what you use for Infinite Mana, but I discovered that if you hook arkCpntMana::Update function, the game will crash on a map end (when you hit Enter to get back to Campaign menu). So I chose to kill about 4 mana functions: RequestManaDrain, AddOrLock, UseManaUnit and some other function that deals with Domino (it's still called like that internally), as in Nexus.

[aSwedishMagyar]

Not sure what you use for Infinite Mana, but I discovered that if you hook arkCpntMana::Update function, the game will crash on a map end (when you hit Enter to get back to Campaign menu). So I chose to kill about 4 mana functions: RequestManaDrain, AddOrLock, UseManaUnit and some other function that deals with Domino (it's still called like that internally), as in Nexus.

Yeah mine is only taking care of one of those I think since when I just tested the Nexus slab my mana still decreases. Need to get all of them and find something common.

Also, you probably already saw it but the arkCpntHealthEvolved has a byte value that functions similar to bCanBeDamaged in UE4 actor classes. Setting it to 0 will prevent you from taking any damage except for jumping off a cliff. Can't seem to get the cVars though, every time I think I found one it turns out to not be accessed.

[Ninomae Tako'nis]

I'm not sure if its because I'm on the beta branch or some other reason, but the table freezes after I enable it. The other two tables enable fine though, so I'm not sure if the beta is that different when it comes to this.

Not sure why that would happen for you and not me but there is a big difference in the enable script that could cause that so I won't argue.

To fix it just change: createThread( function(th) onEnable() end ) to this: onEnable().

I'll see if I'm doing something wrong with createThread(). When I activate it CE does not freeze and the lua engine window comes up like normal and shows all the successful hook messages.

Yeah, that worked. Now the LUA window pops up and it doesn't freeze. Thanks!

[SunBeam]

Can't seem to get the cVars though, every time I think I found one it turns out to not be accessed.

Some of them are still in-game and used, like gp_manaInfinite. Note that setting this to 1 will disable any mana drops etc., but it's a profiling CVar so it will affect some shit that causes your game to crash when you end a map.

Some are in, but they're not compiled in the functions their effect is supposed to apply.

Then lastly, debug CVars like ark_dbg_ghost are removed altogether.

[DarkThinkHuman]

Hi,

i was trying to make a NoClip ... but it ended into >Fly< script with a crappy floating control .... but maybe someone can need it:

>> how to add the script : Memory View > CTRl+A > Paste Code > File->Assign to current table <<

Code: Select all

[ENABLE]

aobscanmodule(aobReadCoords,Deathloop.exe,41 0F 10 A1 80 00 00 00) // should be unique
alloc(newmem,$1000,aobReadCoords)

label(code)
label(return)
label(pPlayerProxy)
registersymbol(pPlayerProxy)
label(fPosZ)
registersymbol(fPosZ)
label(bDone)

newmem:

code:
  cmp byte ptr[bDone],1
  je @f
    movss xmm4,[r9+88]
    push rax
    mov rax,fPosZ
    movss [rax],xmm4
    pop rax
    mov byte ptr[bDone],1
  @@:
  movups xmm4,[r9+00000080]
  mov [pPlayerProxy],r9
  jmp return
bDone:
db 0
fPosZ:
dd 0
pPlayerProxy:
dq 0

aobReadCoords:
  jmp newmem
  nop 3
return:
registersymbol(aobReadCoords)


// ----------------------------


globalalloc(KeyThread,$1000,Deathloop.exe)
createthread(KeyThread)

label(bStop)
label(Ending)
label(Start)
registersymbol(bStop)

KeyThread:
sub rsp,28
Start:
cmp byte ptr[bStop],1
je Ending
mov rdi,pPlayerProxy
mov rdi,[rdi]
test rdi,rdi
je Start
 mov rcx,20
 call GetAsyncKeyState
 test eax,eax
 je short @f
  mov rax,fPosZ
  movss xmm0,[rax]
  addss xmm0,[fUpSpeed]
  movss [rax],xmm0
 @@:
 mov rcx,11
 call GetAsyncKeyState
 test eax,eax
 je short @f
  mov rax,fPosZ
  movss xmm0,[rax]
  subss xmm0,[fUpSpeed]
  movss [rax],xmm0
 @@:
jmp Start
Ending:
add rsp,28
ret
bStop:
db 0
fUpSpeed:
dd (float)0.00001

// ----------------------------

aobscanmodule(aobWritePos,Deathloop.exe,0F 11 87 80 00 00 00 41 0F 11) // should be unique
alloc(newmem2,$1000,aobWritePos)

label(code2)
label(return2)

newmem2:

code2:
  movups [rdi+00000080],xmm0
  push rax
  mov rax,fPosZ
  mov eax,dword ptr[rax]
  test eax,eax
  je short @f
  mov [rdi+88],eax
  @@:
  pop rax
  jmp return2

aobWritePos:
  jmp newmem2
  nop 2
return2:
registersymbol(aobWritePos)

[DISABLE]
bStop:
db 1

aobReadCoords:
  db 41 0F 10 A1 80 00 00 00

unregistersymbol(aobReadCoords)
dealloc(newmem)
aobWritePos:
  db 0F 11 87 80 00 00 00

unregistersymbol(aobWritePos)
dealloc(newmem2)

controls:
Space = Up
CTRL = Down
-and in the air you can move forward/backwards as usual.

freaking Denuvo ... I can't even do any scans coz im always getting a "Scan error:controller:Failure allocating memory for copy" error ... guess my 12 GB Ram is not enough ... so i can't scan for the viewMatrix to move the player into view direction.

And I didn't find a normalized vector near the position value or in the camera transform , coz this my script is only a Fly mode ( but you can go through floors or ceiling with my Fly Script) and sadly im not an Expert at making NoClips but usually i can do that if im able to scan for the player direction ...

thats just pure BS that the Denuvo Big .Exe is preventing ppl from scanning/modding games.

@aSwedishMagyar
thanks for the table, really good stuff, it helped me to make the fly script coz i didn't need to scan for the XYZ or get the RTTI instances!

[SunBeam]

...

See if this helps

Code: Select all

{ Game   : Deathloop.exe
  Version:
  Date   : 2021-09-17
  Author : SunBeam

  This script does blah blah blah
}

define(address,"Deathloop.exe"+104CCD5)
define(bytes,80 B8 30 A7 06 00 00)

[ENABLE]

assert(address,bytes)
alloc(newmem,$1000,"Deathloop.exe"+104CCD5)

label(code)
label(return)

label( bGhost )
registersymbol( bGhost )

newmem:

code:
  lea rdx,[rbp-39]
  mov rcx,rbx
  call short UpdateGhost
@@:
  mov rax,Deathloop.exe+5A2C2B0 // gameLocal
  mov rax,[rax]
  cmp byte ptr [rax+6A730],0
  jmp return

align 10 CC

idQuat_idQuat:
  mov [rsp+8],rbx
  push rdi
  sub rsp,20
  movss xmm1,[r8]
  mov rbx,rdx
  mulss xmm1,[floatOne] // 1.0
  mov rdi,rcx
  movaps xmm0,xmm1
  call Deathloop.exe+1FFDC50 // __libm_sse2_sincosf_
  movaps xmm1,xmm0
  movaps xmm2,xmm0
  shufps xmm1,xmm0,1
  mov rax,rdi
  movss [rdi+C],xmm1
  movaps xmm1,xmm0
  mulss xmm1,[rbx]
  movss [rdi],xmm1
  mulss xmm2,[rbx+4]
  movss [rdi+4],xmm2
  mulss xmm0,[rbx+8]
  mov rbx,[rsp+30]
  movss [rdi+8],xmm0
  add rsp,20
  pop rdi
  ret

align 10 CC

UpdateGhost:
  push rbx
  sub rsp,40
  mov rax,[rcx+10]
  mov rbx,rdx
  mov rdx,[rax+70]
  cmp byte ptr [bGhost],0
  je @L00000003
  mov rax,[rax+8C0] // arkCpntPlayerCamera
  lea r8,[rsp+50]
  add rdx,354
  lea rcx,[rsp+2C]
  movss xmm0,[rax+34A1C] // float m_pitch
  movss [rsp+50],xmm0
  call short idQuat_idQuat
  mov rcx,rax
  lea rdx,[rsp+20]
  mov r8,rbx
  call Deathloop.exe+B23EA0 // idQuat::operator*
  mov edx,D
  mov ecx,[rax]
  mov [rbx],ecx
  mov ecx,[rax+04]
  mov [rbx+04],ecx
  mov eax,[rax+08]
  mov [rbx+08],eax
  call Deathloop.exe+B91360 // arkInputs::IsActionActive
  movss xmm2,[rbx]
  test al,al
  je @L00000001
  movss xmm1,[floatFour] // 4.0
  jmp @L00000002

@L00000001:
  movss xmm1,[floatTwo] // 2.0

@L00000002:
  movaps xmm0,xmm1
  mulss xmm2,xmm1
  mulss xmm0,[rbx+4]
  mulss xmm1,[rbx+8]
  movss [rbx+4],xmm0
  movss [rbx],xmm2
  movss [rbx+8],xmm1

@L00000003:
  add rsp,40
  pop rbx
  ret

align 10 CC

floatOne:
dd (float)1.0

align 10 CC

floatTwo:
dd (float)2.0

align 10 CC

floatFour:
dd (float)4.0

align 10 CC

bGhost:
db 1

align 10 CC

address:
  jmp newmem
  nop 2
return:

[DISABLE]

address:
  db bytes
  // cmp byte ptr [rax+0006A730],00

unregistersymbol( bGhost )

dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "Deathloop.exe"+104CCD5

"Deathloop.exe"+104CCA5: F3 0F 10 55 CB           -  movss xmm2,[rbp-35]
"Deathloop.exe"+104CCAA: 48 8B 05 FF F5 9D 04     -  mov rax,[Deathloop.exe+5A2C2B0]
"Deathloop.exe"+104CCB1: F3 0F 59 C6              -  mulss xmm0,xmm6
"Deathloop.exe"+104CCB5: F3 0F 59 C8              -  mulss xmm1,xmm0
"Deathloop.exe"+104CCB9: F3 0F 59 D0              -  mulss xmm2,xmm0
"Deathloop.exe"+104CCBD: F3 0F 11 4D C7           -  movss [rbp-39],xmm1
"Deathloop.exe"+104CCC2: F3 0F 10 4D CF           -  movss xmm1,[rbp-31]
"Deathloop.exe"+104CCC7: F3 0F 59 C8              -  mulss xmm1,xmm0
"Deathloop.exe"+104CCCB: F3 0F 11 55 CB           -  movss [rbp-35],xmm2
"Deathloop.exe"+104CCD0: F3 0F 11 4D CF           -  movss [rbp-31],xmm1
// ---------- INJECTING HERE ----------
"Deathloop.exe"+104CCD5: 80 B8 30 A7 06 00 00     -  cmp byte ptr [rax+0006A730],00
// ---------- DONE INJECTING  ----------
"Deathloop.exe"+104CCDC: 0F 84 AD 00 00 00        -  je Deathloop.exe+104CD8F
"Deathloop.exe"+104CCE2: 44 8B 45 CF              -  mov r8d,[rbp-31]
"Deathloop.exe"+104CCE6: 44 0B 45 C7              -  or r8d,[rbp-39]
"Deathloop.exe"+104CCEA: 44 0B 45 CB              -  or r8d,[rbp-35]
"Deathloop.exe"+104CCEE: 41 81 E0 FF FF FF 7F     -  and r8d,7FFFFFFF
"Deathloop.exe"+104CCF5: 41 0F 95 C7              -  setne r15l
"Deathloop.exe"+104CCF9: 44 38 7B 64              -  cmp [rbx+64],r15l
"Deathloop.exe"+104CCFD: 0F 84 8C 00 00 00        -  je Deathloop.exe+104CD8F
"Deathloop.exe"+104CD03: 48 63 43 74              -  movsxd  rax,dword ptr [rbx+74]
"Deathloop.exe"+104CD07: 83 F8 FF                 -  cmp eax,-01
}

Without disabling PlayerFallingState in PlayerStateMachine you will only get a double-speed effect See it as an increase speed feature

P.S.: Note that the hardcoded stuff might not be the same in the current version. I wrote this for the first version of the game released on the 12th. So aob the spot yourself using the code snippet at the bottom.

You can disable gravity strength this way:

Code: Select all

mov r8d,2
mov [rsp+30],rbx
mov rdx,Deathloop.exe+2DC3990           // p->"arkCpntPlayerPhysics"
call Deathloop.exe+CDB4F0               // idEntity::GetComponent

Then with the retrieved RAX:

Code: Select all

mov rcx,rax
call Deathloop.exe+817B2E0              // arkCpntPlayerPhysics::DisableGravityStrength

[DarkThinkHuman]

...

Hi!

Oh thank you for this code, its not working on the current version, but this will help me (with the code snippet) I need to analyze it first how your method works, I never did a NoClip this way

i can see that you are using sin/cos to do the math, thats really awesome to learn for me!

thanks again!

Edit:
may i ask how you get the function names (e.g idQuat::operator* or arkCpntPlayerPhysics::DisableGravityStrength ) ?
I thought RTTI is only working for instances of classes, im kinda new to RTTI stuff

[SunBeam]

...

idQuat::operator* -- go to prologue, scroll up

Code: Select all

F3 41 0F 59 C2 F3 44 0F 5C C0 0F 28 C3 F3 41 0F 59 C3 F3 45 0F 58 C9 F3 0F 5C F0 F3 45 0F 58 C0 41 0F 28 C9 F3 0F 59 CC F3 0F 58 F6 F3 0F 58 CB 41 0F 28 C0 F3 0F 59 C5 41 0F 28 D9 F3 45 0F 59 CB 0F 28 D6 F3 0F 59 DD F3 41 0F 59 D3

arkCpntPlayerPhysics::DisableGravityStrength

Code: Select all

8B 81 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 81 A0 00 00 00 31 D2 48 85 C0

Like I said, I'm still playing the first version ever released

Meanwhile...

[agb325]

Is there any cheat to change the hunter rank? I just want the colt cosmetics without playing this jank multiplayer.

[dirtydanisreal]

To get the rtti info in IDA, you used class informer? Did you have to do anything like use steamless?

[echogaming]

combined aSwedishMagyar's cheat table with DarkThinkHuman's fly code

[Darkedone02]

combined aSwedishMagyar's cheat table with DarkThinkHuman's fly code

This causes cheat engine itself to freeze up when I enabled the [Enabled] Script.