Watch Dogs: Legion [Engine:Disrupt 2]

Upload your cheat tables here (No requests)
User avatar
SunBeam
Administration
Administration
Posts: 4915
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4608

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by SunBeam »

Otis_Inf wrote:
Mon Nov 02, 2020 10:20 am
Is there any way to get the address in memory of the function that's called by a lua function?
There is. You can read it in the actual globals processing; the problem is Lua doesn't work with pointers, so custom adjustments have to be made to list the hexa of the address. Adjusted this implementation from " u nknowncheats.me/forum/986704-post47.html " (full credits to CoMPMStR user):

Code: Select all

local tDumpCFn = true  -- C Functions
local tDumpLFn = false -- LUA Functions
local tDumpDat = false -- UserData
local tDumpUnk = false -- Others (strings, numbers)
 
local tDumpedTables = {}
local tFile = nil
 
local function OpenFile(name)
    if (tFile == nil) then
        tFile = io.open(name, "w")
    end
end
 
local function CloseFile()
    if (tFile ~= nil) then
        tFile:close()
        tFile = nil
    end
end
 
local function PrintLine(text)
    if (tFile ~= nil) then
        tFile:write(text .. "\n")
    end
end
 
local function GetLFnParams(fn)
    if (fn == nil) then return end
    local co = coroutine.create(fn)
    local paramStr = "("
 
    debug.sethook(co, function()
	local idx = 0
	while true do
            idx = idx+1
	    local n, v = debug.getlocal(co, 2, idx)
	    if not n then break end
	    if (n ~= "(*temporary)") then
                paramStr = paramStr .. n .. ", "
	    end
	end
    end, "c")
 
    local ret, err = coroutine.resume(co)
 
    if (string.len(paramStr) > 1) then
        paramStr = string.sub(paramStr, 1, string.len(paramStr) - 2) .. ")"
    else
        paramStr = paramStr .. ")"
    end
 
    return paramStr
end
 
local function DumpTableList(tbl)
    for k, v in pairs(tbl) do
        PrintLine(v)
    end
end
 
local function DumpTable(name, tbl)
    local tableString = tostring(tbl)
 
    if (tDumpedTables[tableString] == nil) then
        tDumpedTables[tableString] = tbl
    else return end
 
    local tableList = {}
    local cfnList = {}
    local cfnCount = 0
    local lfnList = {}
    local lfnCount = 0
    local datList = {}
    local datCount = 0
    local unkList = {}
    local unkCount = 0
 
    for k, v in pairs(tbl) do
        local itemNameString = tostring(k)
        local itemString = tostring(v)
        local itemType = type(v)
 
        if (itemType == "table" and tableList[itemNameString] == nil) then
            tableList[itemNameString] = v
        elseif (itemType == "function") then
            local funcInfo = debug.getinfo(v, 'S')
 
            if (funcInfo.what == "C") then -- C Function
                if (tDumpCFn == true) then
                    cfnList[itemNameString] = "\tCFN: " .. itemNameString .. " - " .. itemString
                    cfnCount = cfnCount + 1
                end
            else -- Lua function
                if (tDumpLFn == true) then
                    lfnList[itemNameString] = "\tLFN: " .. itemNameString .. " - " .. itemString .. " " .. GetLFnParams(v)
                    lfnCount = lfnCount + 1
                end
            end
        elseif (itemType == "userdata") then
            if (tDumpDat == true) then
                datList[itemNameString] = "\tDAT: " .. itemNameString .. " - " .. itemString
                datCount = datCount + 1
            end
        else
            if (tDumpUnk == true) then
                unkList[itemNameString] = "\tUNK: ( " .. itemType .. " ) " .. itemNameString .. " - " .. itemString
                unkCount = unkCount + 1
            end
        end
    end
 
    if (cfnCount > 0 or lfnCount > 0 or datCount > 0 or unkCount > 0) then
        PrintLine(tableString .. " [ " .. name .. " ]:")
        DumpTableList(cfnList)
        DumpTableList(lfnList)
        DumpTableList(datList)
        DumpTableList(unkList)
        PrintLine("")
    end
 
    for k, v in pairs(tableList) do
        DumpTable(name .. "." .. k, v)
    end
end
 
local function DumpAllTables()
    OpenFile("D:/lua_dump.txt")
    DumpTable("_G", _G)
    CloseFile()
end

local success, result = xpcall(DumpAllTables, function(err) return debug.traceback(err) end)
Copy that to a file (e.g.: dumpex.lua) and run it with script( "C:/Users/SunBeam/Desktop/dumpex.lua" ). Oh, and change the output location in the above -> line 128: OpenFile("D:/lua_dump.txt"). I tested it with CE on CE :) And it works fine:

Image

Image

As far as function's arguments, like Norway said, you can use pcall with a print:

Code: Select all

print(pcall(SpawnEntityFromArchetype))
Simply triggering a call with the args not properly supplied will have Lua tell you those args|types. Sure, in a more cryptic way, but it's still something. The problem is where the emit goes, as I noticed "fputs" API doesn't break when I run command( "print(pcall(SpawnEntityFromArchetype))" ), so I never get the error message Lua returns.

I'll see if I can simplify the code with just a regular interface (not a DX-based one), as I can't get the damn DX11 hook to render ImGUI content.

How to use this cheat table?
  1. Install Cheat Engine
  2. Double-click the .CT file in order to open it.
  3. Click the PC icon in Cheat Engine in order to select the game process.
  4. Keep the list.
  5. Activate the trainer options by checking boxes or setting values from 0 to 1

Otis_Inf
Expert Cheater
Expert Cheater
Posts: 54
Joined: Sat May 06, 2017 8:04 am
Reputation: 35

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by Otis_Inf »

Thanks :) The lua init code is quite verbose in the game, at least to me, and it wasn't clear to me where the addresses are, so it's not a simple Bind() call sadly. But I'll see what I can dig up, thanks :)

Shainz
Noobzor
Noobzor
Posts: 5
Joined: Sat Sep 28, 2019 12:35 am
Reputation: 1

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by Shainz »

Is it possible to revive a dead agent?

ceso97
Cheater
Cheater
Posts: 33
Joined: Sat Aug 31, 2019 3:55 pm
Reputation: 2

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by ceso97 »

Still nothing on the editing side? i mean, is anyone working on it?

User avatar
Csimbi
RCE Fanatics
RCE Fanatics
Posts: 933
Joined: Sat Apr 29, 2017 9:04 pm
Reputation: 1309

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by Csimbi »

Get the source code.

lol3003
Expert Cheater
Expert Cheater
Posts: 87
Joined: Fri Mar 10, 2017 6:44 pm
Reputation: 17

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by lol3003 »

Csimbi wrote:
Tue Nov 03, 2020 6:46 pm
Get the source code.
they impled that they have the source code but have not released it but they have release internal ubisoft tools and editors so you can porbably access the console now very easylie

User avatar
SunBeam
Administration
Administration
Posts: 4915
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4608

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by SunBeam »

How about we drop the speculation? And to that user bitching, go pray? It's always the new users having a frustrated-like attitude and ironic remarks, yet nothing to contribute to FRF.. Cheers.

ceso97
Cheater
Cheater
Posts: 33
Joined: Sat Aug 31, 2019 3:55 pm
Reputation: 2

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by ceso97 »

Sorry Sun and yes, as a new user I feel sued. I didn't want to be rude or sarcastic or anything like that, I was really wondering if anyone was going in that direction...

Also, tonight I thought about a "cheat", but I don't know about coding and the like, so I don't know if it could be more or less feasible than an editor:
Modify the npc spawn criteria so that only a certain type of recruits spawn, like only hitmen, only sirs agents or only beekeepers.
Doing so would make it easier, albeit laborious, to find an ideal recruit in terms of perk and appearance.

It's just a little idea, and if that message was about me, I'm sorry again, I didn't want to be an asshole, maybe I expressed myself badly (English is not my first language)

Evoc
Novice Cheater
Novice Cheater
Posts: 23
Joined: Sat Oct 31, 2020 5:12 am
Reputation: 9

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by Evoc »

ceso97 wrote:
Wed Nov 04, 2020 9:02 am
Sorry Sun and yes, as a new user I feel sued. I didn't want to be rude or sarcastic or anything like that, I was really wondering if anyone was going in that direction...

Also, tonight I thought about a "cheat", but I don't know about coding and the like, so I don't know if it could be more or less feasible than an editor:
Modify the npc spawn criteria so that only a certain type of recruits spawn, like only hitmen, only sirs agents or only beekeepers.
Doing so would make it easier, albeit laborious, to find an ideal recruit in terms of perk and appearance.

It's just a little idea, and if that message was about me, I'm sorry again, I didn't want to be an asshole, maybe I expressed myself badly (English is not my first language)
I've had a flick through, there's a few functions I managed to get working such as disabling detection etc but nothing worth noting, I did look into currency and operator perks but no joy. What I found interesting when reading through what Sunbeam kindly shared was how the ModifyBulletsInClip didn't work. After I read the lua script it intrigued me so I pressed buttons and smacked my keyboard to find that setting the value to 0 actually works weirdly.

I looked but honestly I'm not expierenced enough to find anything useful, I usually just hover to try learn bit by bit and in this case, providing Sunbeam has an interest to continue poking about knowing him it'll be something crazy.

Phnxsmv
Noobzor
Noobzor
Posts: 6
Joined: Fri Jun 21, 2019 12:53 am
Reputation: 3

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by Phnxsmv »

Could this be of any help? [Link]

User avatar
SunBeam
Administration
Administration
Posts: 4915
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4608

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by SunBeam »

Phnxsmv wrote:
Thu Nov 05, 2020 6:57 pm
Could this be of any help? [Link]
Partially.. I see Gibbed also doesn't have the full list for data content -> 596162/1690671 (35%). Similar to what's going on on XeNTaX :) Guess they're waiting on one another..

User avatar
SunBeam
Administration
Administration
Posts: 4915
Joined: Sun Feb 04, 2018 7:16 pm
Reputation: 4608

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by SunBeam »

Here's some more information I dug out. I'm playing/looking at the DX11 version; so.. in case you want to replicate some of the stuff to DX12, please have a look at DX11, compute some arrays of bytes and look them up to find the equivalent spots in the DX12 version. I won't post stuff for both versions, as it's cumbersome. That being said..
  • FUCKS GIVEN: ZERO: Ubisoft has not fucking check in place to determine if you're running an older version of the game. I simply swapped the just updated DLL with the one from the first version ever released. I saw no objections, logging in went smoothly, no function in the game told me "hey, you're running an older version".. Stupid, if you ask me. But thanks, Ubi!
  • ANTI-DEBUG: This has nothing to do with CE; don't tell me you can debug with CE + VEH, cuz I know that already T_T. Keep reading before you start posting comments.. In case you've wondered why x64dbg crashes after a while past the attach moment, well, it's cuz the keep alive function Ubi uses to log you in + update online status (not to mention cycling the main menu's bottom-right ads) contains VMProtect anti-debug. I know the game uses Denuvo, but hey.. in case you didn't know, Denuvo heavily relies on VMProtect. There's been a nice fiasco 1-2 years ago when they've not paid their dues to VMProtect and suddenly several games got fast cracks or their binaries posted clean (with no Denuvo on them) on the internet :) Not to mention a keygen for Denuvo.. Revenge? Read this: [Link]. Fun, fun, fun -- I tell you ;)

    I had the spot in Update #1, but since the game just updated - silently - I had to re-find it. Now.. how do you find that spot? Simple. Open up x64dbg and make sure don't have any exceptions set to be ignored. I usually keep it like this, as it would conflict with CE debugging with VEH or break constantly on any crappy exception:

    Image

    If it looks like the above, then:

    Image

    And you should see this:

    Image

    Click OK. Then attach to Watch Dogs Legion:

    Image

    Note: I really hope you've launched the game with "-BattlEyeLauncher -dx11" params. If not:

    Image

    So.. once you attach to the game.. it will take a few seconds till this happens:

    Image

    If it doesn't, then alt-tab to the game and back. I don't know if game's window needs to be in focus.

    The typical VMProtect anti-debugs usually end in that kind of exception, whereas if the checks find something they don't like (hooked APIs, debug flags changed, etc.), they'll branch out in the VM to a path that leads to a forced fake read instruction, which will fail. Ending up in exception 0xC0000005 (access violation). So.. what to do now? Follow the address in the stack. In my case, here's the information:

    Code: Select all

    000000A0615FF278  00007FFCA7FAC891     return to duniademo_clang_64_dx11.00007FFCA7FAC891 from duniademo_clang_64_dx11.00007FFCA7FAC680
    
    Caller is one line above 00007FFCA7FAC891:

    Image

    And if we go inside the function, we see the typical Denuvo relocation (the JMP):

    Image

    What Denuvo does is it parses the binary code + pdb and if a function size is > 0x5 in compiled ASM, it will copy it to its large section and replace the original function with a JMP + CC bytes :) Pimp, right? Since they don't know how much space they need.. they add a very large section. That + the fact that mutation/virtualization is used.. ends-up in HUGE sizes for the enveloped binary. In this case, DuniaDemo_clang_64_dx11.dll is 574 MB T_T.. Jesus Christ Santa Maria Madre de Dios!..

    Rant over, follow the JMP:

    Image

    Now.. see this spaghetti ASM you don't understand? Well, you're at the starting point of a virtual machine handler :) In short, the original function that was here was marked to be virtualized by Denuvo's VMProtect module. Using the [Link]. See Code markers -> VMProtectBeginVirtualization.

    While running this VM, there's a check "somewhere" that determines whether or not you're debugging the game. I don't know if it's related to a debugger flag or simply a hooked API check (I'm using ScyllaHide, which modifies some APIs to prevent detection). Point is somewhere in there this exception is triggered and game freezes.

    How to patch? Simply "plant" a RET instruction and you're done:

    Image

    You will need to do this patch every time you open the game. I suggest you do it from CE, like this:

    Image

    So after you open the game, after you get past the intros, after you're logged in.. head to CE and change 0x68 to 0xC3. Then you can attach x64dbg and safely debug the game :P Yes, I prefer x64dbg to CE when debugging. I'm more comfortable with it.

    Lastly, since I've not tested this thoroughly, it's possible disabling this function will also kill your sync with Ubisoft servers. Don't worry, it doesn't affect save-games or progression. Just make sure you detach x64dbg first, else.. crash :) I'm sure whoever is playing the game and cares for their progression/account and likes to be paranoid won't ever attempt any of the above. Ultimately, this is for people who really like reversing, not for regular users who think this will help them hack the game and get whateverthefuck stats/customizations/etc. they want. Conclusion: if you're just a casual user/player, this is not for you. So please no "can you do this crap stuff in game?" questions. Thanks!
  • WHY THAT FUCKING LEAK IS USEFUL: The majority of the population reading into the subject loves to speculate and emit their opinion on why and how the leak would help overall. And they're saying to crack the game. False :) The knowledge level they posses makes them believe that. But in reality, the content, although 7 months old, comes with debug symbols. What are these good for? Well.. let's see how I can make use of both the current game version (DuniaDemo_clang_64_dx11.dll) and the leak (DuniaDemo_rt64.dll + DuniaDemo_rt64.pdb) combined.

    First-up, big thanks to those who've made this possible! You know who you are :)

    One paragraph above I mentioned the anti-debug. That leads into a function that's virtualized. Out of it, we were looking at a spot that's not virtualized, with a CALL and other non-spaghetti ASM:

    Image

    So what stops me from selecting a few rows, copy their bytes into an array and look it up in DuniaDemo_rt64.dll? Nothing, nada.. So:

    Image

    And:

    Image

    So.. that function that is virtualized and is throwing an exception at some point is.. none other than:

    Image

    Function: ubiservices::SslCertificateValidator_BF::verifyPinning.

    A special note to those saying "the data is kinda old": FUCK YOU :) Old or not, that's how useful it is to navigate and figure shit out.
  • LOVE SWAPPIN': <- That sounds.. weird :) What I mean by that.. In case you don't want to RET the function I mentioned 2 paragraphs above, you can freakin' swap it with its clean version. How.. here:

    Code: Select all

    function stopExec( s )
      error( print( string.format( "\r\n>> %s <<", s ) ) )
    end
    
    function aobScanEx( aob )
      -- thanks panraven for this function!
      -- https://forum.cheatengine.org/viewtopic.php?t=577536
      -- simplified for my needs
      local moduleBase = getAddressSafe( "DuniaDemo_clang_64_dx11.dll" ) or getAddressSafe( "DuniaDemo_clang_64_dx12.dll" )
      local moduleSize = getModuleSize( "DuniaDemo_clang_64_dx11.dll" ) or getModuleSize( "DuniaDemo_clang_64_dx12.dll" )
      local p, a, n, s, e = nil or '*X*W', nil or fsmNotAligned, nil or '0', ( moduleBase + 0x1000 ) or 0x0, ( moduleBase + moduleSize - 0x1000 ) or 0xffffffffffffffff
      local ms = pb and createMemScan( pb ) or createMemScan()
      local fl = createFoundList( ms )
      ms.firstScan( soExactValue, vtByteArray, nil, aob, nil, s, e, p, a, n, true, false, false, false )
      ms.waitTillDone()
      fl.initialize()
      local result = nil
      if fl ~= nil and fl.getCount() > 0 then
        result = createStringlist()
        for i = 1, fl.getCount() do result.add( fl.getAddress( i - 1 ) ) end
      end
      fl.destroy()
      ms.destroy()
      return result
    end
    
    function string.fromhex( s )
      return ( s:gsub( '..', function ( cc )
        return string.char( tonumber( cc, 16 ) )
      end ) )
    end
    
    function aobScanSmall( aob, s, e )
      local i = byteTableToString( readBytes( s, e, true ) ):find( string.fromhex( aob ), 1, true )
      if i == nil then i = 1 end
      return ( s + i - 1 )
    end
    
    -- ubiservices::SslCertificateValidator_BF::isPinningValid
    local aob_in_isPinningValid = "8BCB41B9????????C1E105"
    sl = aobScanEx( aob_in_isPinningValid )
    if not sl or sl.Count < 1 then stopExec( "'aob_in_isPinningValid' not found." ) end
    local t = tonumber( sl[0], 16 )
    --print( string.format( "%X", t ) )
    --[[
    DuniaDemo_clang_64_dx11.dll+8BDC826 - 8B CB                 - mov ecx,ebx
    DuniaDemo_clang_64_dx11.dll+8BDC828 - 41 B9 0000C040        - mov r9d,40C00000
    DuniaDemo_clang_64_dx11.dll+8BDC82E - C1 E1 05              - shl ecx,05
    ]]
    t = aobScanSmall( "498BCC", t, 0x100 )
    --print( string.format( "%X", t ) )
    --[[
    DuniaDemo_clang_64_dx11.dll+8BDC884 - 49 8B CC              - mov rcx,r12
    DuniaDemo_clang_64_dx11.dll+8BDC887 - 48 8D 54 24 20        - lea rdx,[rsp+20]
    ]]
    local verifyPinning = aobScanSmall( "E8", t, 0x100 ) -- yeah, I'm aware there can be additional 0xE8 bytes between previous stop and my CALL :P
    --print( string.format( "%X", t ) )
    --[[
    DuniaDemo_clang_64_dx11.dll+8BDC88C - E8 EFFDFFFF           - call DuniaDemo_clang_64_dx11.dll+8BDC680 <--
    DuniaDemo_clang_64_dx11.dll+8BDC891 - 48 8B 6C 24 20        - mov rbp,[rsp+20]
    ]]
    unregisterSymbol( "verifyPinning" )
    registerSymbol( "verifyPinning", verifyPinning, true )
    
    local gameModule = getAddressSafe( "DuniaDemo_clang_64_dx11.dll" ) or getAddressSafe( "DuniaDemo_clang_64_dx12.dll" )
    local offset = 0x900
    local naked_verifyPinning = gameModule + offset
    fullAccess( naked_verifyPinning, 0x1000 - offset )
    unregisterSymbol( "naked_verifyPinning" )
    registerSymbol( "naked_verifyPinning", naked_verifyPinning, true )
    
    autoAssemble([[
    
    label( @L00000001 )
    label( @L00000002 )
    label( @L00000003 )
    label( @L00000004 )
    label( @L00000005 )
    label( @L00000006 )
    
    naked_verifyPinning:
    
    	mov [rsp+8],rbx
    	mov [rsp+10],rsi
    	mov [rsp+18],rdi
    	mov rax,[rdx]
    	mov rdi,r8
    	mov rbx,[r8+8]
    	mov rsi,rcx
    	sub rbx,[r8]
    	mov rdx,[rdx+8]
    	cmp rax,rdx
    
    @L00000001:
    	mov rcx,[rax+8]
    	sub rcx,[rax]
    	cmp rcx,rbx
    	jne short @L00000005
    	xor r10d,r10d
    	test rbx,rbx
    	je short @L00000004
    	xor ecx,ecx
    
    @L00000002:
    	mov r8,[rax]
    	mov r9,[rdi]
    	movzx r11d,byte ptr [rcx+r9]
    	xor r11l,[r8+rcx]
    	mov r8,[rsi]
    	add r8,10
    	cmp qword ptr [r8+18],10
    	jb short @L00000002
    	mov r8,[r8]
    
    @L00000003:
    	cmp r11l,[rcx+r8]
    	jne short @L00000005
    	inc r10d
    	mov ecx,r10d
    	cmp rcx,rbx
    	jb short @L00000002
    
    @L00000004:
    	xor eax,eax
    	mov rbx,[rsp+8]
    	mov rsi,[rsp+10]
    	mov rdi,[rsp+18]
    	ret
    
    @L00000005:
    	add rax,20
    	cmp rax,rdx
    	jne short @L00000001
    
    @L00000006:
    	mov rbx,[rsp+8]
    	mov eax,122
    	mov rsi,[rsp+10]
    	mov rdi,[rsp+18]
    	ret
    
    verifyPinning:
    
    	call naked_verifyPinning
    
    ]])
    
    Copy the above, open Memory View, Ctrl+L, paste the stuff in the input box and Execute :) Done. Now you can rest easy as the VMProtect anti-debug stuff isn't running anymore. At least in the context of that function. Don't know if there are any other triggers in-game, from other functions, but will check later.
More to follow.

BR,
Sun

EDIT #1: Yeaps, guess I spoke too soon. There are other virtualized functions who will leads to exceptions when you debug with x64dbg :) Ubi made sure to envelope a shit ton.. One such function hits when you click "CAMPAIGN".

EDIT #2: Hi, Ubi! :) That crash I got when I posted the comment above.. That's in CSaveGameBufferObfuscator::DeobfuscateBuffer function. Also used in CSaveGameBufferObfuscator::ObfuscateBuffer. Pimp, eh? I've managed to map quite a lot to current build ;) Fun times.

EDIT #3: Hmm, there's actually no anti-debug. Let's call it anti-trace. In the sense that as long as a breakpoint (in x64dbg, meaning a superficial 0xCC byte is written to be caught) is set, the mutated/virtualized function checks the VM's integrity. This can be done by either a clock-check or simply hashing the function's bytes. You can imagine that your 0xCC will interfere with what's expected as the VM's checksum value; when that happens, a 0 is pushed onto stack, making the return of the function.. well.. return to 0 :) Not to mention the whole checksum thingie ends-up in a 0xDEADC0DE value ;) To fix this, one can use the run trace (to file) in x64dbg and parkour the VM. Trace will stop when the exception is hit (which is close to the RET out of the VM). Once there, do another POP to RAX, then set the expected return value (al/eax = 1 usually) and you're set :)

These, so far:

Code: Select all

ubiservices::SslCertificateValidator_BF::isPinningValid    | virtualization
CSaveGameBufferObfuscator::DeobfuscateBuffer               | mutation
CSaveGameBufferObfuscator::ObfuscateBuffer                 | virtualization
Don't know yet if there are others. Point is I managed to get in-game with x64dbg and no exceptions or crashes, while letting Disrupt read/write the save-game :P

reg2k
Noobzor
Noobzor
Posts: 7
Joined: Thu Nov 12, 2020 4:55 pm
Reputation: 14

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by reg2k »

Thanks for the work with the script loader, Sunbeam!

Add Cargo Drone Summon Ability

Code: Select all

command('SetItem("Items.9223372234313232334", 1)')
Gives your operative the ability to summon cargo drones. Activate it from your equipment wheel - make sure you have a free slot available.

After running the command, switch to a different operative, then switch back for the equipment wheel to refresh. It's saved into your operative's inventory so you only have to do this once. Set the value to 0 if you want to remove it.

Immortal Mode (Can take damage but cannot die)

Code: Select all

command('SetPawnImmuneToDeath(GetLocalPlayerEntityId(), 1)')
Last edited by reg2k on Fri Nov 27, 2020 1:14 pm, edited 1 time in total.

r123t
What is cheating?
What is cheating?
Posts: 2
Joined: Sat Oct 31, 2020 10:27 pm
Reputation: 1

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by r123t »

reg2k wrote:
Fri Nov 20, 2020 2:52 pm
Thanks for the work with the script loader, Sunbeam!

Cargo Drone Summon

Code: Select all

command('SetItem("Items.9223372234313232334", 1)')
Gives your operative the ability to summon cargo drones. Activate it from your equipment wheel - make sure you have a free slot available.

After running the command, switch to a different operative, then switch back for the equipment wheel to refresh. It's saved into your operative's inventory so you only have to do this once. Set the value to 0 if you want to remove it.

Immortal Mode (Can take damage but cannot die)

Code: Select all

command('SetPawnImmuneToDeath(GetLocalPlayerEntityId(), 1)')
Hope you don't mind me asking, but how did you figure out the item id for the cargo drone? :)

jonasbeckman
Expert Cheater
Expert Cheater
Posts: 307
Joined: Sat May 06, 2017 1:26 pm
Reputation: 22

Re: Watch Dogs: Legion [Engine:Disrupt 2]

Post by jonasbeckman »

[Link]

Title update 2.20 is out and makes for some really sad reading the game should not have shipped with some of these issues still unresolved.

Post Reply

Who is online

Users browsing this forum: admantx, Aesarius, AhrefsBot, Arasev, Bloodybone, ctl3d32, danes890, Google [Bot], Google Adsense [Bot], kaoxss, Locke_Smithy, Tw1tche5, Z3dkx