Far Cry 5 Megathread - EAC Bypass & Table Compilation

[bonzay0]

Edit:
Inf Oxygen + 1 Hit kill (might get ur friendly npc killed as well so be careful)

I will add an god mode to it as well in a few hours. I seem to get crushes from BooBoo script.

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>17</ID>
      <Description>"Enabler"</Description>
      <LastState Activated="1"/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : FarCry5.exe
  Version: 1.2.0
  Date   : 2018-03-31
  Author : bonzay0

  Enabler}

[ENABLE]
aobscanmodule(Enabler,FC_m64.dll,48 81 EC 00 01 00 00 F3 0F 10 41 1C 48 8B F9 F3 0F 10 59 18 F3 0F 5D C1 0F 2E C3 0F 84 BD 01 00 00 F3 0F 11 41 18) // should be unique
registersymbol(Enabler)
registersymbol(infoxygen)
registersymbol(onehit)
alloc(newmem,2048,FC_m64.dll)
label(returnhere)
label(checkwhatitis)
label(checkenemy)
label(checkonehit)
label(checkoxygen)
label(originalcode)
label(infoxygen)
label(onehit)

newmem: //this is allocated memory, you have read,write,execute access
je originalcode
jp originalcode
jnc originalcode
jmp checkwhatitis

originalcode:
movss [rcx+18],xmm0
jmp returnhere

checkwhatitis:
cmp r12,0xFFFFFFFFFFFFFFFF
je checkenemy
cmp r10,0x000FFFFFFFFFFFFF
jne checkoxygen
jmp originalcode

checkenemy:
cmp r8,0
jne checkonehit
jmp originalcode

checkonehit:
cmp byte [onehit],0
jz originalcode
movss [rcx+18],xmm0
cmp [rcx+18],(float)1
jle returnhere
mov [rcx+18],(float)1
jmp returnhere

checkoxygen:
cmp byte [infoxygen],0
jz originalcode
cmp r8,0x0
jne originalcode
mov [rcx+18],(float)100
jmp returnhere

infoxygen:
db 00

onehit:
db 00

Enabler+21:
jmp newmem

returnhere:




[DISABLE]
Unregistersymbol(Enabler)
dealloc(newmem)
Enabler:
db 48 81 EC 00 01 00 00 F3 0F 10 41 1C 48 8B F9 F3 0F 10 59 18 F3 0F 5D C1 0F 2E C3 0F 84 BD 01 00 00 F3 0F 11 41 18
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>168</ID>
          <Description>"Inf Oxygen"</Description>
          <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Disable
1:Enable
</DropDownList>
          <LastState Value="0" RealAddress="7FFC7A6500AF"/>
          <VariableType>Byte</VariableType>
          <Address>infoxygen</Address>
        </CheatEntry>
        <CheatEntry>
          <ID>169</ID>
          <Description>"1 Hit Kill"</Description>
          <DropDownList ReadOnly="1" DescriptionOnly="1" DisplayValueAsItem="1">0:Disable
1:Enable
</DropDownList>
          <LastState Value="1" RealAddress="7FFC7A6500B0"/>
          <VariableType>Byte</VariableType>
          <Address>onehit</Address>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[budabum]

@STN

that is updated version of "Inf Ammo" which budabum provided and qweasdzxc17 improved.
I suggest removing 2 old records and replace with this one. update includes 3 more items in filter: Money, Grenade, Melee

other 1-byte cheats affect all items, e.g. player can't sell trinkets if 1-byte cheat is enabled,
the cheat provided filters items and does not block player from selling them.

Copy/Paste into CE.

Inf. Ammo (Everything) / Money

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>152</ID>
      <Description>"Inf. Ammo (Everything) / Money"</Description>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : FarCry®5
  Version:
  Date   : 2018-03-30
  Author : budabum and qweasdzxc17
}

[ENABLE]

aobscanmodule(InfAmmoBet,FC_m64.dll,75 0D 8B 57 4C 39 D3 0F 42 D3 29 57 4C 89 D3)
alloc(infammomem,$1000,InfAmmoBet)
registersymbol(InfAmmoBet)

label(return)
label(money)

infammomem:
  reassemble(InfAmmoBet)   //jne 7FFAB333A14B
  mov edx,[rdi+4C]
  cmp ebx,edx
  cmovb edx,ebx
  //filtered injection
    cmp r12d, B3F8DE3E //Pistols
    jz @f
    cmp r12d, DB72B88A //Rifle
    jz @f
    cmp r12d, DB4CB05F //Smoke Grenade
    jz @f
    cmp r12d, 83021337 //Molotov
    jz @f
    cmp r12d, EC1A4BAB //Explosive Arrow
    jz @f
    cmp r12d, EC18BEA6 //Flame Arrow
    jz @f
    cmp r12d, B3F9885B //Arrow
    jz @f
    cmp r12d, B3F944C4 //Shotgun Shell
    jz @f
    cmp r12d, 1B93266E //Shotgun Flame Shell
    jz @f
    cmp r12d, DB707C3F //Shotgun Slug
    jz @f
    cmp r12d, DB75CA49 //Sniper .50 Cal
    jz @f
    cmp r12d, DB75EF64 //Sniper .50 Cal Piercing
    jz @f
    cmp r12d, DB6FDC2C //Pistol Piercing
    jz @f
    cmp r12d, B3F8942E //Remote Explosive
    jz @f
    cmp r12d, B3F9C0EB //Proximity Explosive
    jz @f
    cmp r12d, 8302EC24 //Throwing Knife
    jz @f
    cmp r12d, 83037F62 //Bait
    jz @f
    cmp r12d, 9AE00408 //Dynamite
    jz @f
    cmp r12d, 5BD2B432 //Pipe Bomb
    jz @f
    cmp r12d, B3FA4191 //Grenade Launcherr
    jz @f
    cmp r12d, B3F97273 //SMG Ammo
    jz @f
    cmp r12d, DB701FDD //SMG Piercing
    jz @f
    cmp r12d, DB72E621 //Rifle Piercing
    jz @f
    cmp r12d, B3F959AC //LMG Ammo
    jz @f
    cmp r12d, DB745A94 //LMG Piercing
    jz @f
    cmp r12d, 7A75CFE2 //Rocket Cluster Ammo
    jz @f
    cmp r12d, DB78B52A //Rocket Flame Cluster Ammo
    jz @f
    cmp r12d, B3F9A6CB //Rocket Launcher Ammo
    jz @f
    cmp r12d, B3FA1F5A //Flame Thrower Ammo
    jz @f
    cmp r12d, 8300A884 //Grenade
    jz @f
    cmp r12d, 8B75D981 //Melee: Aluminium Bat
    jz @f
    cmp r12d, 239E3150 //Money
    jz money
  sub [rdi+4C],edx
@@:
  mov ebx,edx
  jmp return
money:
  mov [rdi+4C], #100000
  mov ebx,edx
  jmp return

InfAmmoBet:
  jmp far infammomem //14 bytes jump
  nop
return:


[DISABLE]

InfAmmoBet:
  db 75 0D 8B 57 4C 39 D3 0F 42 D3 29 57 4C 89 D3

unregistersymbol(InfAmmoBet)
dealloc(infammomem)

{
// ORIGINAL CODE - INJECTION POINT: "FC_m64.dll"+AFDA13C

"FC_m64.dll"+AFDA118: 0F 1F 84 00 00 00 00 00  -  nop [rax+rax+00000000]
"FC_m64.dll"+AFDA120: 48 89 5C 24 08           -  mov [rsp+08],rbx
"FC_m64.dll"+AFDA125: 57                       -  push rdi
"FC_m64.dll"+AFDA126: 48 83 EC 20              -  sub rsp,20
"FC_m64.dll"+AFDA12A: 48 8B 41 40              -  mov rax,[rcx+40]
"FC_m64.dll"+AFDA12E: 48 89 CF                 -  mov rdi,rcx
"FC_m64.dll"+AFDA131: 48 83 C1 40              -  add rcx,40
"FC_m64.dll"+AFDA135: 89 D3                    -  mov ebx,edx
"FC_m64.dll"+AFDA137: FF 50 18                 -  call qword ptr [rax+18]
"FC_m64.dll"+AFDA13A: 84 C0                    -  test al,al
// ---------- INJECTING HERE ----------
"FC_m64.dll"+AFDA13C: 75 0D                    -  jne FC_m64.dll+AFDA14B
"FC_m64.dll"+AFDA13E: 8B 57 4C                 -  mov edx,[rdi+4C]
"FC_m64.dll"+AFDA141: 39 D3                    -  cmp ebx,edx
"FC_m64.dll"+AFDA143: 0F 42 D3                 -  cmovb edx,ebx
"FC_m64.dll"+AFDA146: 29 57 4C                 -  sub [rdi+4C],edx
"FC_m64.dll"+AFDA149: 89 D3                    -  mov ebx,edx
// ---------- DONE INJECTING  ----------
"FC_m64.dll"+AFDA14B: 85 DB                    -  test ebx,ebx
"FC_m64.dll"+AFDA14D: 74 15                    -  je FC_m64.dll+AFDA164
"FC_m64.dll"+AFDA14F: 44 8B 47 4C              -  mov r8d,[rdi+4C]
"FC_m64.dll"+AFDA153: 48 89 F9                 -  mov rcx,rdi
"FC_m64.dll"+AFDA156: 4C 8B 0F                 -  mov r9,[rdi]
"FC_m64.dll"+AFDA159: 41 8D 14 18              -  lea edx,[r8+rbx]
}
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

[gir489]

Updated Unlock all skills to not start a random mission when enabling. It's suggested you only turn it on from the roster menu. Click on Perks. Select/unselect the perk until it allows you to unlock the ones you want. Then disable the feature.

Code: Select all

{ Game   : FarCry5.exe
  Version: 1.2.0
  Date   : 2018-03-31
  Author : gir489

  Unlocks Health 3 and 4 and Weapon slot 4 perk at any point in the game.}
[ENABLE]
aobscanmodule(SkillCheck,FC_m64.dll,48 8B 41 60 8B 04 D0) // should be unique
registersymbol(SkillCheck)
alloc(newmem,$1000,"FC_m64.dll")
label(code)
label(return)

newmem:

code:
mov rax,[rcx+60]
mov eax,[rax+rdx*8]
cmp edx, 0x1000
jl return
mov eax,#999
jmp return

SkillCheck:
jmp newmem
nop
nop
return:

[DISABLE]
unregistersymbol(SkillCheck)
dealloc(newmem)

SkillCheck:
mov rax,[rcx+60]
mov eax,[rax+rdx*8]

[mflvs]

I will add an god mode to it as well in a few hours. I seem to get crushes from BooBoo script.

This is the orignal posted by BooBoo the one in the current table crashes

Code: Select all

/*
aob->E8 ?? ?? ?? ?? F3 0F 10 0D ?? ?? ?? ?? 0F 2F C1 77 ?? 0F 2F F1 77
-7 bytes
*/
[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048,"FC_m64.dll"+8CB23B6)
label(returnhere)
label(originalcode)
label(exit)

newmem+80: //this is allocated memory, you have read,write,execute access
//place your code here

pushfq

test rcx,rcx
je short _MyExit

movss xmm0,[rcx+1C]
movss [rcx+18],xmm0

_MyExit:
popfq

originalcode:
mov rcx,[rbx+50]
movaps xmm6,xmm0

exit:
jmp returnhere

"FC_m64.dll"+8CB23B6:
jmp newmem+80
nop
nop
returnhere:


[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
"FC_m64.dll"+8CB23B6:
mov rcx,[rbx+50]
movaps xmm6,xmm0
//Alt: db 48 8B 4B 50 0F 28 F0

[gir489]

Code: Select all

{ Game   : FarCry5.exe
  Version: 1.2.0
  Date   : 2018-03-31
  Author : gir489

  Infinite Armor
}

[ENABLE]
aobscanmodule(Armor,FC_m64.dll, F3 0F 11 41 18 45) // should be unique
aobscanmodule(ReturnAddress,FC_m64.dll,84 C0 74 48 48 8B 05 1B 08 12 FC) // should be unique
alloc(newmem,$1000,"FC_m64.dll")
registersymbol(Armor)
label(return)

newmem:
movss [rcx+18],xmm0
push r8
mov r8, ReturnAddress
cmp [rsp+A0],r8
pop r8
jne return
mov [rcx+18],(float)100
jmp return

Armor:
jmp newmem
return:

[DISABLE]
unregistersymbol(Armor)
dealloc(newmem)

Armor:
movss [rcx+18],xmm0

[SunBeam]

Am also working on this.

Fixed God (noticed it crashed when you failed a missing or went to main menu, whoever copied it from my original post fucked it up a bit. The alloc is missing:



Also found a way to get CBaseEntity (and CPawn, CPlayer derivatives). Which means we can now filter shit so it's player-sided only (enemy won't benefit from it).

Fixed God:

Code: Select all

[ENABLE]

aobscanmodule( _Health, FC_m64.dll, 488B4B500F28F0E8 )
registersymbol( _Health )
alloc( Health, 256, FC_m64.dll )
label( Health_orig )
registersymbol( Health_orig )

Health:
cmp dword ptr [rcx+10],CEDA2313 // Health
jne short @f
  movss xmm1,[rcx+1C]
  movss [rcx+18],xmm1
@@:
Health_orig:
readmem( _Health, 7 )
jmp _Health+7

_Health:
jmp Health
db 90 90

[DISABLE]

_Health:
readmem( Health_orig, 7 )

unregistersymbol( Health_orig )
dealloc( Health )
unregistersymbol( _Health )

/*
FC_m64.dll+8CB23A0 - 53                    - push rbx
FC_m64.dll+8CB23A1 - 48 83 EC 30           - sub rsp,30
FC_m64.dll+8CB23A5 - 48 89 CB              - mov rbx,rcx
FC_m64.dll+8CB23A8 - 0F29 74 24 20         - movaps [rsp+20],xmm6
FC_m64.dll+8CB23AD - 48 8B 49 48           - mov rcx,[rcx+48]
FC_m64.dll+8CB23B1 - E8 EA732DF9           - call FC_m64.dll+1F897A0
FC_m64.dll+8CB23B6 - 48 8B 4B 50           - mov rcx,[rbx+50] <--
FC_m64.dll+8CB23BA - 0F28 F0               - movaps xmm6,xmm0 <--
FC_m64.dll+8CB23BD - E8 DE732DF9           - call FC_m64.dll+1F897A0
FC_m64.dll+8CB23C2 - F3 0F10 0D 9AC02EFB   - movss xmm1,[FC_m64.dll+3F9E464]
FC_m64.dll+8CB23CA - 0F2F C1               - comiss xmm0,xmm1
FC_m64.dll+8CB23CD - 77 22                 - ja FC_m64.dll+8CB23F1
FC_m64.dll+8CB23CF - 0F2F F1               - comiss xmm6,xmm1
FC_m64.dll+8CB23D2 - 77 1D                 - ja FC_m64.dll+8CB23F1
FC_m64.dll+8CB23D4 - 48 8B 03              - mov rax,[rbx]
FC_m64.dll+8CB23D7 - 48 89 D9              - mov rcx,rbx
FC_m64.dll+8CB23DA - FF 90 28010000        - call qword ptr [rax+00000128]
FC_m64.dll+8CB23E0 - 84 C0                 - test al,al
FC_m64.dll+8CB23E2 - 75 0D                 - jne FC_m64.dll+8CB23F1
FC_m64.dll+8CB23E4 - B0 01                 - mov al,01
FC_m64.dll+8CB23E6 - 0F28 74 24 20         - movaps xmm6,[rsp+20]
FC_m64.dll+8CB23EB - 48 83 C4 30           - add rsp,30
FC_m64.dll+8CB23EF - 5B                    - pop rbx
FC_m64.dll+8CB23F0 - C3                    - ret
FC_m64.dll+8CB23F1 - 30 C0                 - xor al,al
FC_m64.dll+8CB23F3 - 0F28 74 24 20         - movaps xmm6,[rsp+20]
FC_m64.dll+8CB23F8 - 48 83 C4 30           - add rsp,30
FC_m64.dll+8CB23FC - 5B                    - pop rbx
FC_m64.dll+8CB23FD - C3                    - ret
*/

To everyone contributing to this thread with `scriptalia`: good job (have tested some of them, might fine work).

[SunBeam]

...

Why are you injecting at a JE instruction? You could've gone 1 line below it; close to FC_m64.dll allocations as you're doing require 5 bytes, not 14. Unless I am missing something?.. If CE allocates far from the module, then you can use static spots (like MZ header + 0x500, after you've assigned read/write permissions).

[bonzay0]

My bad might be me when I was messing around with the scripts from you & BooBoo.

CBaseEntity would help a tons! Already can't wait for instructions how to get/use it.

[SunBeam]

My bad might be me when I was messing around with the scripts from you & BooBoo.

No worries, can happen; my bad I was swamped in CH drama and didn't check these out; I often do detective work and spot out what may go wrong or improvements (if I find any). All's OK

[bonzay0]

STN Updated the table with a more organized one that I sent him.

It have all the scripts until this post. We will have to wait for SendMe127.0.0.1 to come back and update the text on the first post.

Any way, the new options that are not mentioned in the first post are:
*God Mode - Fixed
*Infinite Armor
*Unlocks Health 3 and 4 and Weapon slot 4 perk at any point in the game - Fixed
* 1 Hit Kill + Inf Oxygen (Enable and then select which one you want)
* Infinite Ammo/Money

[budabum]

...

Why are you injecting at a JE instruction? You could've gone 1 line below it; close to FC_m64.dll allocations as you're doing require 5 bytes, not 14. Unless I am missing something?.. If CE allocates far from the module, then you can use static spots (like MZ header + 0x500, after you've assigned read/write permissions).

ah, damn wrong (c) . 14 bytes jumps is a habit from ACO time, where CE was jumpy while allocating memory (5 or 14 bytes jumps). prefer to control what kind of jump I use. mz+500 is a good spot, there is always room for improvement.

for Inf. ammo i believe one clause with CPlayer will be even more elegant than gazillion of cmp/jz.

[gir489]

STN Updated the table with a more organized one that I sent him.

It have all the scripts until this post. We will have to wait for SendMe127.0.0.1 to come back and update the text on the first post.

Any way, the new options that are not mentioned in the first post are:
*God Mode - Fixed
*Infinite Armor
*Unlocks Health 3 and 4 and Weapon slot 4 perk at any point in the game - Fixed
* 1 Hit Kill + Inf Oxygen (Enable and then select which one you want)
* Infinite Ammo/Money

He has Unlock all skills on there twice. It should just be Unlock health 3/4 and Weapon slot 4.

[bonzay0]

STN Updated the table with a more organized one that I sent him.

It have all the scripts until this post. We will have to wait for SendMe127.0.0.1 to come back and update the text on the first post.

Any way, the new options that are not mentioned in the first post are:
*God Mode - Fixed
*Infinite Armor
*Unlocks Health 3 and 4 and Weapon slot 4 perk at any point in the game - Fixed
* 1 Hit Kill + Inf Oxygen (Enable and then select which one you want)
* Infinite Ammo/Money

He has Unlock all skills on there twice. It should just be Unlock health 3/4 and Weapon slot 4.

I just double checked. There is only 1 "Unlocks Health 3 and 4 and Weapon slot 4 perk at any point in the game".
(in the first post table)

[gir489]

I just doubled checked. There is only 1 "Unlocks Health 3 and 4 and Weapon slot 4 perk at any point in the game".
(in the first post table)

gir489
Infinite Ammo
No Spread
No Recoil
Infinite Stamina
Unlock All Skills
Infinite Armor
Unlocks Health 3 and 4 and Weapon slot 4 perk at any point in the game.

[bonzay0]

I just doubled checked. There is only 1 "Unlocks Health 3 and 4 and Weapon slot 4 perk at any point in the game".
(in the first post table)

gir489
Infinite Ammo
No Spread
No Recoil
Infinite Stamina
Unlock All Skills
Infinite Armor
Unlocks Health 3 and 4 and Weapon slot 4 perk at any point in the game.

Oh you mean the text lol
I meant the table has only one.

I did not tell him what to write