Assassin's Creed Odyssey v1.3.0/v1.5.1 +21 (table Update18.3)

[Timone]

Is it possible to swap armor/weapon appearance without touching hashid at all? It seems anytime i mess around with hashid to swap appearances it permanently affects similar gear in the game both in inventory, and in the store. It also to some extent seems to save onto older saves?

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[SunBeam]

Alright. Here goes another nice tutorial Changing weapon's WeaponTypeAttackDamageModifier in the WeaponTypeAttackDamageModifierList. Also known as One Hit Kill

I studied a bit the behavior of the One Hit Kill developer debug menu option in Syndicate, but I could not find the same relationship in Origins or Odyssey. Simply because some objects/structures are missing (or were removed from being compiled in these games). What happened in Syndicate is once enabling this feature, this path was queried and toggled: GamePlaySettings -> FightSettings -> ACVIFightSettings -> ACVIFightDebugSettings + 0x7C == 1. This lil' bool then allowed setting another bool in NPC's health structure which instructed the engine to "kill" the target when a hit event occurred. That being said, target could also die from bumping a moving object (chariot, horse, etc.)

Now.. I followed somewhat the same logic in Odyssey. I got as far as: GamePlaySettings -> FightSettings -> ACEFightSettings. There's no ACEFightDebugSettings in this one to be able to toggle that bool. At first I was like "well, can't do anything about this, won't be able to come up with a clean, nice one hit kill". Didn't abandon the fight though, so I started to poke around ACEFightSettings, using exception breakpoints across the entire structure (well, a wide range of it) and found a list of instructions being triggered on access/write.

First-up, this is my structure and its address/hash/etc.:

Code: Select all

IStruct:  0x7AADB9D0 
IName:    0x144F2AB10 
ObjStr:   ACEFightSettings 
ObjHash:  0xB523F455

Then this is the debug list I got:



Starting from the instruction accessed 7 times going down are the instructions being run when I hit something So I studied each and every one of them till I got to that CMP. Which I manually traced and found this:



Traced from that CMP all the way down till the CALL. Went in (RCX == 0x7AADB9D0, my ACEFightSettings) and found this function:





All good and dandy, but..

- you will notice the JE after "cmp [rbx+20],r9d" is never taken; what if we force it?
- you will notice the CALL before "test al,al" always returns 1; what if we NOP the JNE so [rbx+24] is always put in xmm0?
- you will notice [rbx+24] holds 1.0 as float; what if we make it 100.0?

Regarding the 3rd observation above -- I believe this is a multiplier, because when function exits, this happens:

Code: Select all

ACOdyssey.exe+1EF990E - E8 FD363D00           - call ACOdyssey.exe+22CD010 <-- our function
ACOdyssey.exe+1EF9913 - F3 0F59 F0            - mulss xmm6,xmm0 <-- multiplication

So.. that being said.. patching those spots and changing float to 100.0 from 1.0 will give you damage x 100 when you start an attack of course, you can skip patching inside the function and change xmm0 to whatever amount past the call above Easier to hook.

This is one good spot to hook:

Code: Select all

ACOdyssey.exe+1EF9927 - F3 0F10 85 D8000000   - movss xmm0,[rbp+000000D8]

JMP to your cave and "movss xmm6,[your_multiplier]".

Before:



After:



Enjoy

BR,
Sun

P.S.#1: Note that even Ikraos can now do 1 hit kills when engaging soldiers That dead soldier on the right was killed instantly right as I was trying to get the screenshot done

P.S.#2: This CALL here:

Code: Select all

ACOdyssey.exe+1EF991E - E8 5DC88700           - call ACOdyssey.exe+2776180 <--
ACOdyssey.exe+1EF9923 - 8B 4C 24 38           - mov ecx,[rsp+38]

What it does is to check your CharacterAI structure for Poison/Fire effects. If any of the two stats are active (as in, your player is on fire or poisoned), then the damage you deal is reduced through this function:

Code: Select all

ACOdyssey.exe+217784C - 80 7B 28 00           - cmp byte ptr [rbx+28],00   // is on fire or poisoned? (!= 0)
ACOdyssey.exe+2177850 - 45 0F57 C0            - xorps xmm8,xmm8
ACOdyssey.exe+2177854 - 74 27                 - je ACOdyssey.exe+217787D
ACOdyssey.exe+2177856 - F3 0F10 8F E0010000   - movss xmm1,[rdi+000001E0]  // [PlayerProgressionManager + 1E0] == 0.3
ACOdyssey.exe+217785E - 41 0F2F C8            - comiss xmm1,xmm8
ACOdyssey.exe+2177862 - 73 06                 - jae ACOdyssey.exe+217786A
ACOdyssey.exe+2177864 - 41 0F28 C8            - movaps xmm1,xmm8
ACOdyssey.exe+2177868 - EB 08                 - jmp ACOdyssey.exe+2177872
ACOdyssey.exe+217786A - 0F2F CF               - comiss xmm1,xmm7
ACOdyssey.exe+217786D - 76 03                 - jna ACOdyssey.exe+2177872
ACOdyssey.exe+217786F - 0F28 CF               - movaps xmm1,xmm7
ACOdyssey.exe+2177872 - 0F28 C7               - movaps xmm0,xmm7
ACOdyssey.exe+2177875 - F3 0F5C C1            - subss xmm0,xmm1            // damage multiplier reduced from normal 1.0 to 0.7
ACOdyssey.exe+2177879 - F3 0F59 F0            - mulss xmm6,xmm0

P.S.#3: And no, you don't have to re-equip a weapon/item to apply the effect. Just hook the spot and you're set.

[Exosq]

Hi everyone, first i want to say thanks to Cielos and budabum for their tables and to Sunbeam for all this knowledge he's giving us .

Second is just to let everyone know (maybe someone already said it ?) that if you launch the game offline and then use budabum's table you won't get many adresses result when you search for an eStore item.

In my case when i searched for all the eStore HashID i did get many results, but as soon as i launched the game offline (i disabled the wifi) and then researched every items i only got 1 values everytime.

(Sorry if there is some writing errors i'm French )

[SunBeam]

Here you go, toss this in a script and assign it to your table:

Code: Select all

[ENABLE]

{$lua}

if not syntaxcheck then
  unregisterSymbol( "Hook_AOB" )
  autoAssemble([[
    aobscanmodule( Hook_AOB, ACOdyssey.exe, 636F6D7061746962696C6974793E3C2F617373656D626C793E )
    registersymbol( Hook_AOB )
  ]])

  local t = getAddress( "Hook_AOB" ) + 0x70
  unregisterSymbol( "Hook_AOB" )
  unregisterSymbol( "DamageMultiplierHook" )
  registerSymbol( "DamageMultiplierHook", t, true )

  unregisterSymbol( "DamageMultiplier" )
  autoAssemble([[
    aobscanmodule( DamageMultiplier, ACOdyssey.exe, F30F1085????????F30F108D????????894D??8B4C24??F30F1145??F3 )
    registersymbol( DamageMultiplier )
  ]])

  unregisterSymbol( "ChangePageProtect" )
  t = allocateMemory( 100 )
  --print( string.format( "0x%X", t ) )
  registerSymbol( "ChangePageProtect", t, true )

  autoAssemble([[
    ChangePageProtect:
    sub rsp,28
    lea r9,[ChangePageProtect+50]
    mov r8d,40
    mov rdx,30
    mov rcx,DamageMultiplierHook
    call VirtualProtect
    add rsp,28
    ret
  ]])

  executeCode( getAddress( "ChangePageProtect" ) )
  deAlloc( "ChangePageProtect" )
  unregisterSymbol( "ChangePageProtect" )

  autoAssemble([[
    label( DamageMultiplier_o )
    registersymbol( DamageMultiplier_o )
    label( dmg_mult )
    registersymbol( dmg_mult )

    DamageMultiplierHook:
    DamageMultiplier_o:
    readmem( DamageMultiplier, 8 )
    movss xmm6,[dmg_mult]
    jmp back

    dmg_mult:
    dd (float)10.0

    DamageMultiplier:
    jmp DamageMultiplierHook
    db 90 90 90
    back:
  ]])
end

[DISABLE]

{$lua}

if not syntaxcheck then
  autoAssemble([[
    DamageMultiplier:
    readmem( DamageMultiplier_o, 8 )
  ]])

  for i=0,48-1,1 do
    writeBytes( getAddress( "DamageMultiplierHook" ) + i, 0 )
  end

  autoAssemble([[
    unregistersymbol( dmg_mult )
    unregistersymbol( DamageMultiplier )
    unregistersymbol( DamageMultiplierHook )
  ]])
end

Then add dmg_mult address via its symbol, as float. This is what you should see once you set it up:



Note I set it to 10.0 in the above, but you may change it as you please

Attached the table for who's lazy

BR,
Sun

[marsstorm2000]

@ Sunbeam thanks for your work, and contribution to the thread. Also The sun symbol played a great role in Hellenistic [ Greek Macedonian Sparta Illyrian] world as well in the mythological world.
@Cielos great work and thank your for the updates on the tables.
@ budabum Thank you for the table and to all the rest who contributed with hash Addressees.

If anyone has addresses for regular legendary and Epic weapons and gear do share it [because not all paid are good, the underworld was whacky and out of place IMO] (thanks for sharing though).
P.S Oikos of the Olympians has good stuff if anyone has any item from him share if you want.

Some of my stuff

Torso :
Jason's Golden Fleece ItemHashId 0000018562B344CE pPerk1 Hash 0000018C024A5E9F pPerk3 Hash 000000014533AF08 [Legendary]

Head :
Helmet of Ares ItemHashId 0000018562B7939C pPerk1 Hash 0000018C024A5E56 pPerk3 Hash 0000018052315F0E pPerk4 Hash 0000017F15C93D42 [Epic]

Arena Fighter's Helmet ItemHashId 00000175F0EF3863 pPerk1 Hash 0000018C024A5E9F pPerk3 Hash 0000017FC7ECC374 [Legendary]


Hands:
Arena Fighter's Gauntlets ItemHashId 00000175F0EF38833 pPerk1 Hash 0000018C024A5E9F pPerk3 Hash 000000012E7AE9C8 [Legendary]

Waist :
Arena Fighter's Waistband ItemHashId 00000175F0EF3893 pPerk1 Hash 0000018C024A5E9F pPerk3 Hash 000001825F87B9C8 [Legendary]

[SunBeam]

Updated a bit the script in the previous post, just so fearlessrevolution trainer doesn't crash your ass with this enabled

[AkashiGamer]

In the trainer from fearlessrevolution there is an unlock function for all engravings, there is one legendary engraving that makes it clear that ubisoft is planning to introduce another set of armor into the store, since this engraving is not yet in the game, but you can apply it with the trainer

[SunBeam]

@AkashiGamer: What's also clear to me is you people are kind of obsessed with in-game shiny things. Much like Smeagol There are plenty of scripts, tables, trainers to help you progress faster through the game - - even a dealt damage multiplier mod now - - but we both know that's not what you're after. You wanna look cool in your fantasy world; not finish the game. "Then what?" - - I ask again.

[SunBeam]

One more update of the table in this post. Removed the need for VirtualProtect after a quick talk with Dark Byte Kept it there, commented, just in case others need the method.

[TagoKG]

waiting for the ship inventory swap

[net201]

Hey Guys! I know a lot of you wanted this Set!

SPARTAN WAR HERO SET (Alexios)

0000018562B793FB helmet
0000018562B793E8 gauntlet
0000018562B793D5 armor
0000018562B793C2 belt
0000018562B793AF boots

achilles set

00000175F0EED1E9 sandal
00000175F0EED1C9 arm
00000175F0EE9F33 armor
00000175F0EED1D9 waist
00000175F0EE9F23 helmet

Enjoy! Thanks To Budabum, Ceilos and the mighty sunbeam! Charie!

[ResidentMedievil]

In any case the swap thing doesn't work, at least for me.... when i search the hex value it finds too many addresses, it is impossible to know which one is the correct

[Exosq]

In any case the swap thing doesn't work, at least for me.... when i search the hex value it finds too many addresses, it is impossible to know which one is the correct

Try to launch the game without internet and retry searching an hex value, then report here if it worked for you please

[acecel]

In any case the swap thing doesn't work, at least for me.... when i search the hex value it finds too many addresses, it is impossible to know which one is the correct

Try to launch the game without internet and retry searching an hex value, then report here if it worked for you please

I was about to say : try with uplay in offline mode, it's enough to fix it.

[cocotoon]

One more update of the table in this post. Removed the need for VirtualProtect after a quick talk with Dark Byte Kept it there, commented, just in case others need the method.

Well done, there is no way for these changes to be permanently inscribed in the game?