Assassin's Creed Brotherhood [aob All Versions]

[reverser69]

^ok, that helps as that is ......

in this case, it was dying but I think it would occur on loading for any reason.
yeah, I'm using your tip at the moment.

for ps2 : I'm using CE's break on exception while debugging.

for ps3: i don't know when this will happen again given the fact that I'm mostly playing on fullscreen and if the game breaks i cant see the CE window ( any workaround for this?)

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[Paul44]

^ I will try to reproduce, but I do remember dying quite a few times (who knew, right ?) while testing; no crashing then...
(ps2): did not know that, will look into it. thx.
(ps3): you can either use DxWin (with fullscreen resolution set; should work) or - if on Win10 - 'create a new Desktop' and launch in 2 seperate Desktops (if you follow the "Windowed" link, it was suggested there), Never really used this in practice; just did a test and it did its thing just fine...
I will look into this issue surely this weekend, and get back to you (will probably pm you trial_table)...


@Sunbeam: I am/was kinda counting on CEs errrorException routine; and the game itself doing its prechecks... (plus never got this myself). A bit of a pain in that routine, since it collects all main ptrs... Anyways: "Que sera, ..."

[reverser69]

^ I will try to reproduce, .....

thanks, man, this kind of support for a free table is most appreciated.
but as i said it is not regular, i guess there's a function that uses this injection point but the game does not call it regularly, sometimes too often sometimes not so. i think its better to counter the problem rather finding its source. manual exception handling if possible cuz testing all pointers one by one ..... gonna take time to write its AA.

im sending you my exe, maybe its a problem on my side only.


btw, about the quest items, i asked in my previous post; i found some interesting stuff in the contract structure i hope you make something out of it:

Code: Select all

160 (hex) 0004BBEA  ---->> always this value for missions having items
164 (hex) 0004Cxxx   ----->>> ????
168 (hex)  FFxxxxxx  ------>>> changing last bytes changes item. (its a pointer- object maybe?! because items cant be found by value search)
16c  (hex) 00100100  ----->>> always this value for missions having items but changing the first 01 (+16e offset)changes the item

i couldn't figure out how long the ID is or how it works, copying these values does not give the same item so there is another deciding offset?!?! ( edit: copying sometimes gives the same results. gold ingot for example)
careful when changing them. not recognized ID = crash.
tested it with a non-item giving mission and it worked.

[reverser69]

found these but there are more. important ones are missing.....

[reverser69]

finally, found the shop quest item boolean.
tested it and the purchase will be permanent.
here is the full code in case of creating AOB.

assassin creed brotherhood shop quest cheat:

Code: Select all

ACBSP.exe+9AE516 - 50               	 - push eax
ACBSP.exe+9AE517 - E8 E4810000           - call ACBSP.exe+9B6700
ACBSP.exe+9AE51C - 83 F8 02              - cmp eax,02 { 2 }
ACBSP.exe+9AE51F - 75 23              	 - jne ACBSP.exe+9AE544
ACBSP.exe+9AE521 - 8B 45 08              - mov eax,[ebp+08]
ACBSP.exe+9AE524 - 83 F8 01              - cmp eax,01 { 1 }
ACBSP.exe+9AE527 - 74 14                 - je ACBSP.exe+9AE53D
ACBSP.exe+9AE529 - 83 F8 03              - cmp eax,03 { 3 }
ACBSP.exe+9AE52C - 74 0F                 - je ACBSP.exe+9AE53D
ACBSP.exe+9AE52E - 83 F8 02              - cmp eax,02 { 2 }
ACBSP.exe+9AE531 - 74 0A                 - je ACBSP.exe+9AE53D
ACBSP.exe+9AE533 - 83 F8 19              - cmp eax,19 { 25 }
ACBSP.exe+9AE536 - 74 05                 - je ACBSP.exe+9AE53D
ACBSP.exe+9AE538 - 83 F8 16              - cmp eax,16 { 22 }
ACBSP.exe+9AE53B - 75 07                 - jne ACBSP.exe+9AE544
ACBSP.exe+9AE53D - B0 01                 - mov al,01 { 1 }
ACBSP.exe+9AE53F - 5E                    - pop esi
ACBSP.exe+9AE540 - 5D                    - pop ebp
ACBSP.exe+9AE541 - C2 0800               - ret 0008 { 8 }
ACBSP.exe+9AE544 - 32 C0                 - xor al,al ------->> change to mov al,1 . buy then disable when you're done to see " completed "
ACBSP.exe+9AE546 - 5E                    - pop esi
ACBSP.exe+9AE547 - 5D                    - pop ebp
ACBSP.exe+9AE548 - C2 0800               - ret 0008 { 8 }

[Paul44]

^ "can you help with shopquest items?!": I completely missed (forgot ) that one already. I will definitely look into it as well. Can't grasp its added value right now, but sounds great. I'll add it to my table for sure then... thx
As for the ptr-checks: yep, not overly enthousiastic either... (but "a (wo)man has to do..." etc)

fyi: inventory items (besides your typical weaponry items) is on my todo list. I already found out that the 'total' of each of such items (like them quest items - eg 'Shrunken Head' - are actually 'composed' of 1 InventoryItem and x number of ItemSettings records ~ well, at least in AC3, but I assume this also applies to pre/post versions). Just try to find the total of such item, and it will only return visual counters... Basically: for each InvItem, it loops through them ItemSets and counts "linked" records (= total InvItem)... (I'll get there eventually )

[reverser69]

looking forward to seeing your table updates.
btw is it possible for you to make a series of tutorials on how you traced and found pointers?

[reverser69]

@Paul44
update on crash:
Error Statistics as you requested.
> Main scripts (ptrs) = 7
others = 0

[reverser69]

update on crash:
(let me know if I'm messing with this thread, would you receive notifications if i update my posts?!)

> Main scripts (ptrs) 4
> Teleport & Coordinates 0
> Map Waypoint Teleport 1 --->>> i think this caused crash. as soon as i pressed the hotkey game crashed.

trying to find the guilty code......

[Paul44]

^ Teleport will always turn to '1' the 1st time you use it, and then (should) stay that way (no matter how many times you teleport thereafter ~ which applies to all my AC tables btw)... I did some research back then, and could not figure out what caused it to up (perhaps the pcall itself triggers that, when called upon the 1st time?!).
As for 'hotkey', you mean "Shift+T" ?

ps: i'm set to only receive notif's for pm's; so no worries.

[reverser69]

hi again
im trying to make a super speed cheat but i have two problems: it doesn't work properly and it affects all NPCs.

Code: Select all

aobscanmodule(ezioSuperSpeed,$process,D0 0F 29 86 A0 00 00 00 0F 28) 
newmem:
cmp byte ptr [ecx+94],1   -----> here im using PlayerID you provided?! am i doing it correct?
jne code
movaps xmm0,[esi+000000A0]
movss xmm7, [speedMul]
punpckldq xmm7, xmm7
punpckldq xmm7, xmm7
mulps xmm0,xmm7
movaps [esi+000000A0],xmm0      --------> player doesnt move. probably i don't know the right instructions.

code:
  movaps [esi+000000A0],xmm0
  jmp return

speedMul:
dd (float)3.0

ezioSuperSpeed+01:
  jmp newmem
  nop 2
return:

i think you can do it in a whole other way. heres some information:

Code: Select all

// get entity...
  mov ebx,[eax+8]   ------->>> here EAX itself is a structure. dont know what is it called.
  mov [pEntity],ebx
  
  [pEntity]+68  is player size. affects movement and speed.
  
  

now:

Code: Select all

EAX + A0 ---->>  X   delta
EAX + A4 ---->>  Y   delta
EAX + A8 ---->>  Z   delta

[reverser69]

^ Teleport will always turn to '1' the 1st time you use it, and then (should) stay that way (no matter how many times you teleport thereafter ~ which applies to all my AC tables btw)... I did some research back then, and could not figure out what caused it to up (perhaps the pcall itself triggers that, when called upon the 1st time?!).
As for 'hotkey', you mean "Shift+T" ?

ps: i'm set to only receive notif's for pm's; so no worries.

yeah, "Shift+T".
don't know about the pcall but ill send you the code causing it if i catch it.

and thanks for the relief.

[reverser69]

finally, ACB super speed is done.
float commands nearly killed me. decided to do it singularly. works like a charm (for now).
thx for the PlayerID, without that, it couldn't have been possible.

assassin's creed brotherhood super movement speed:

Spoiler

Code: Select all

[ENABLE]

aobscanmodule(speed,$process,0F 28 86 A0 00 00 00 0F 29 85 50)
alloc(newmem,$1000)

label(code)
label(return)
label(speedMul)

newmem:
push ebx
mov ebx,[esi+8]
cmp byte ptr [ebx+94],1
jne code

xorps xmm0,xmm0
movss xmm0,[speedMul]

{
cmp [esi+78],3F4CCCCD     // if in water. in case want super speed in the water.
je @f                     //but it's buggy when coming out of the water, turn it off when near an edge.
}

cmp word ptr [esi+90],0000 // buggy when jumping ( checking if not on the ground ). so jump ...
je code                   // ( may be useful in some very high places but be careful game will crash)

movss xmm2,[esi+000000A8] //avoiding any change to Z axis when in water
mulss xmm2,,xmm0
movss [esi+000000A8],xmm2

@@:

movss xmm2,[esi+000000A0]
mulss xmm2,,xmm0
movss [esi+000000A0],xmm2

movss xmm2,[esi+000000A4]
mulss xmm2,,xmm0
movss [esi+000000A4],xmm2


code:
pop ebx
  movaps xmm0,[esi+000000A0]
  jmp return

speedMul:
dd (float)3.0

speed:
  jmp newmem
  nop 2
return:
registersymbol(speed)

[DISABLE]
speed:
  db 0F 28 86 A0 00 00 00

unregistersymbol(speed)
dealloc(newmem)

more info for AOB:

Spoiler

Code: Select all

ACBSP-wnd.exe+1C3C61: 52                       - push edx
ACBSP-wnd.exe+1C3C62: 51                       - push ecx
ACBSP-wnd.exe+1C3C63: E8 38 3D 91 01           - call ACBSP-wnd.exe+1AD79A0
ACBSP-wnd.exe+1C3C68: 83 C4 10                 - add esp,10
ACBSP-wnd.exe+1C3C6B: 8B 45 E4                 - mov eax,[ebp-1C]
ACBSP-wnd.exe+1C3C6E: 8B 4D E0                 - mov ecx,[ebp-20]
ACBSP-wnd.exe+1C3C71: 0F 57 C0                 - xorps xmm0,xmm0
ACBSP-wnd.exe+1C3C74: 0F 29 85 40 FF FF FF     - movaps [ebp-000000C0],xmm0
ACBSP-wnd.exe+1C3C7B: F3 0F 10 43 10           - movss xmm0,[ebx+10]
ACBSP-wnd.exe+1C3C80: F3 0F 11 45 84           - movss [ebp-7C],xmm0
// ---------- INJECTING HERE ----------
ACBSP-wnd.exe+1C3C85: 0F 28 86 A0 00 00 00     - movaps xmm0,[esi+000000A0]
// ---------- DONE INJECTING  ----------
ACBSP-wnd.exe+1C3C8C: 0F 29 85 50 FF FF FF     - movaps [ebp-000000B0],xmm0
ACBSP-wnd.exe+1C3C93: 0F 28 05 70 AD C2 02     - movaps xmm0,[ACBSP-wnd.exe+261AD70]
ACBSP-wnd.exe+1C3C9A: 0F 29 85 70 FF FF FF     - movaps [ebp-00000090],xmm0
ACBSP-wnd.exe+1C3CA1: F3 0F 10 05 94 BB 5F 02  - movss xmm0,[ACBSP-wnd.exe+1FEBB94]
ACBSP-wnd.exe+1C3CA9: 0F C6 C0 00              - shufps xmm0,xmm0,00
ACBSP-wnd.exe+1C3CAD: 89 45 8C                 - mov [ebp-74],eax
ACBSP-wnd.exe+1C3CB0: 8D 78 04                 - lea edi,[eax+04]
ACBSP-wnd.exe+1C3CB3: 33 C0                    - xor eax,eax
ACBSP-wnd.exe+1C3CB5: 0F 29 85 60 FF FF FF     - movaps [ebp-000000A0],xmm0
ACBSP-wnd.exe+1C3CBC: F3 0F 10 86 18 05 00 00  - movss xmm0,[esi+00000518]