Borderlands 3 [Engine:Unreal 4.20] - Console enabler, Dumper and more..

[Exfrost]

I'm currently able to run these kinds of commands -> "OakGame.OakDeveloperPerks.GrantLevels" Just increased my level real fast The Max seems to be 50.

What about
OakGame.OakDeveloperPerks.UnlockCustomizations
OakGame.OakDeveloperPerks.UnlockVehicleParts
OakGame.OakDeveloperPerks.UnlockWeaponSkins
OakGame.OakDeveloperPerks.UnlockWeaponTrinkets

Yup. "OakGame.OakDeveloperPerks.UnlockCustomizations" needs 'BPChar_Operative_C_0' as __this ptr and runs "OakGame.OakPlayerController.ClientUnlockCustomization" (in your PlayerController's context). I think there are 333 customizations o_O. After each loop, I can see the item's GearSerialNumber (the item hash)

And yes, it works

Hey, I cant get the Unlock Customization to work, what do you mean with "needs 'BPChar_Operative_C_0' as __this ptr" what do I have to write in the console ? thanks for your help

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[SunBeam]

Infinite Clip script:

Code: Select all

[ENABLE]

label( p )
registersymbol( p )

alloc( Hook, 0x1000, Borderlands3.exe )

Hook:
push rax
mov rax,[rcx+1A8]     // OakWeapon
test rax,rax
jne short @f
  mov rax,[rcx+118]   // OakWeapon
@@:
cmp [rax+4A0],0       // OakCharacter
je short @f
  mov rax,[rax+4A8]
  mov rax,[rax-8E8]   // OakPlayerController
  cmp rax,[OakPlayerController]
  jne short @f
    pop rax
    ret              // no ammo processing
@@:
pop rax
p:
readmem( Borderlands3.exe+2D669E0, 6 )
jmp Borderlands3.exe+2D669E6

Borderlands3.exe+2D669E0:
jmp Hook
db 90

[DISABLE]

Borderlands3.exe+2D669E0:
readmem( p, 6 )

dealloc( Hook )
unregistersymbol( p )

[SunBeam]

an over he shoulder 3rd person view?

Will think about it Hope there's some traces in the actual dump on this.

Hey, I cant get the Unlock Customization to work, what do you mean with "needs 'BPChar_Operative_C_0' as __this ptr" what do I have to write in the console ? thanks for your help

I mean: even if I explained this to you like to a child, you would still not be able to do anything about it and ask additional questions -> "OK, I understand now; but how do you work with it?" -> Sun explains -> "but how do I debug?" -> Sun explains etc. Like I said in a previous post, the table update will contain several other commands you can use in the console See the explanation in this post.

[Exfrost]

an over he shoulder 3rd person view?

Will think about it Hope there's some traces in the actual dump on this.

Hey, I cant get the Unlock Customization to work, what do you mean with "needs 'BPChar_Operative_C_0' as __this ptr" what do I have to write in the console ? thanks for your help

I mean: even if I explained this to you like to a child, you would still not be able to do anything about it and ask additional questions -> "OK, I understand now; but how do you work with it?" -> Sun explains -> "but how do I debug?" -> Sun explains etc. Like I said in a previous post, the table update will contain several other commands you can use in the console

hmm, okay, any chance then for a save game with all unlocked customizations ? Just want the heads and skins, I am able to do 3rd person camera and everything, only cant get unlock customizes to work which is what i want, thanks man for your fast replay and your hard work man

[SunBeam]

hmm, okay, any chance then for a save game with all unlocked customizations ? Just want the heads and skins, I am able to do 3rd person camera and everything, only cant get unlock customizes to work which is what i want, thanks man for your fast replay and your hard work man

Think it's time you learned what patience means Too-da-loo.

[Exfrost]

hmm, okay, any chance then for a save game with all unlocked customizations ? Just want the heads and skins, I am able to do 3rd person camera and everything, only cant get unlock customizes to work which is what i want, thanks man for your fast replay and your hard work man

Think it's time you learned what patience means Too-da-loo.

Haha, sure, thanks man

[SunBeam]

I'm interested in FloatProperty OakGame.ZoneMapGlobalsData.PlayerUnfogRadius
Can someone help me with some advice in order to be able to change the value?

Interesting Will give it a run-down.

EDIT #1:



The Property offset is at 0x44 in the UObject. That leads to 0x1F0 offset, which is the location in another UObject (perhaps OakGame), where you would find that Float. Will investigate more.

EDIT #2: Think I got it; should apply to this object, I believe:

"[00202430] ZoneMapGlobalsData ZoneMapGlobals.ZoneMapGlobals 0x00000000704BB5C0"



Time to test

EDIT #3: Aaaand.. it works I doubled it (3000->6000). Note that you have to leave to main menu and re-enter map (or travel to another map and back) for this to work. It's not applied in real-time, just at init-time. The locations where the Float is used in ASM are these; maybe someone wants to script them out

Code: Select all

[1]:
Borderlands3.exe+16CC51C0 - 40 53                 - push rbx
Borderlands3.exe+16CC51C2 - 48 83 EC 20           - sub rsp,20
Borderlands3.exe+16CC51C6 - 48 8B 05 0B4495EF     - mov rax,[Borderlands3.exe+66195D8] { (28111000) }
Borderlands3.exe+16CC51CD - 48 89 CB              - mov rbx,rcx
Borderlands3.exe+16CC51D0 - 48 85 C0              - test rax,rax
Borderlands3.exe+16CC51D3 - 75 0C                 - jne Borderlands3.exe+16CC51E1
Borderlands3.exe+16CC51D5 - E8 46FEDBEB           - call Borderlands3.exe+2A85020
Borderlands3.exe+16CC51DA - 48 8B 05 F74395EF     - mov rax,[Borderlands3.exe+66195D8] { (28111000) }
Borderlands3.exe+16CC51E1 - 48 8B 40 58           - mov rax,[rax+58]
Borderlands3.exe+16CC51E5 - 48 85 C0              - test rax,rax
Borderlands3.exe+16CC51E8 - 74 07                 - je Borderlands3.exe+16CC51F1
Borderlands3.exe+16CC51EA - 48 8B 80 70050000     - mov rax,[rax+00000570]
Borderlands3.exe+16CC51F1 - 48 85 C0              - test rax,rax
Borderlands3.exe+16CC51F4 - 74 16                 - je Borderlands3.exe+16CC520C
Borderlands3.exe+16CC51F6 - F3 0F10 80 F0010000   - movss xmm0,[rax+000001F0] <-- Float here
Borderlands3.exe+16CC51FE - F3 0F11 83 A8010000   - movss [rbx+000001A8],xmm0
Borderlands3.exe+16CC5206 - 48 83 C4 20           - add rsp,20
Borderlands3.exe+16CC520A - 5B                    - pop rbx
Borderlands3.exe+16CC520B - C3                    - ret 
Borderlands3.exe+16CC520C - 0F57 C0               - xorps xmm0,xmm0
Borderlands3.exe+16CC520F - F3 0F11 83 A8010000   - movss [rbx+000001A8],xmm0
Borderlands3.exe+16CC5217 - 48 83 C4 20           - add rsp,20
Borderlands3.exe+16CC521B - 5B                    - pop rbx
Borderlands3.exe+16CC521C - C3                    - ret

[2]:
..
..
Borderlands3.exe+16C9B89D - 48 8B 05 34DD97EF     - mov rax,[Borderlands3.exe+66195D8] { (28111000) }
Borderlands3.exe+16C9B8A4 - 48 8B 48 58           - mov rcx,[rax+58]
Borderlands3.exe+16C9B8A8 - 48 85 C9              - test rcx,rcx
Borderlands3.exe+16C9B8AB - 74 07                 - je Borderlands3.exe+16C9B8B4
Borderlands3.exe+16C9B8AD - 48 8B B9 70050000     - mov rdi,[rcx+00000570]
Borderlands3.exe+16C9B8B4 - 48 85 FF              - test rdi,rdi
Borderlands3.exe+16C9B8B7 - 74 0A                 - je Borderlands3.exe+16C9B8C3
Borderlands3.exe+16C9B8B9 - F3 0F10 87 F0010000   - movss xmm0,[rdi+000001F0] <-- Float
Borderlands3.exe+16C9B8C1 - EB 03                 - jmp Borderlands3.exe+16C9B8C6
Borderlands3.exe+16C9B8C3 - 0F57 C0               - xorps xmm0,xmm0
Borderlands3.exe+16C9B8C6 - 48 89 D9              - mov rcx,rbx
Borderlands3.exe+16C9B8C9 - F3 0F11 83 A8010000   - movss [rbx+000001A8],xmm0
Borderlands3.exe+16C9B8D1 - E8 4AC23EEA           - call Borderlands3.exe+1087B20
Borderlands3.exe+16C9B8D6 - F3 0F11 83 A4010000   - movss [rbx+000001A4],xmm0
Borderlands3.exe+16C9B8DE - 4C 8B 7C 24 70        - mov r15,[rsp+70]
Borderlands3.exe+16C9B8E3 - 48 8B 5C 24 78        - mov rbx,[rsp+78]
Borderlands3.exe+16C9B8E8 - 48 83 C4 40           - add rsp,40
Borderlands3.exe+16C9B8EC - 41 5E                 - pop r14
Borderlands3.exe+16C9B8EE - 5F                    - pop rdi
Borderlands3.exe+16C9B8EF - 5E                    - pop rsi
Borderlands3.exe+16C9B8F0 - C3                    - ret

I'll check if that [rbx+1A8] is something that is read in real-time. Maybe we don't need a re-run of the map after all

To anyone else reading this: the adjustment done here INCREASES your Unfog radius (unfogging the map/mini-map).

EDIT #4: Yeah, that RBX is this UObject:

"[00713375] FogOfDiscoveryComponent Sacrifice_P.Sacrifice_P.PersistentLevel.BPCont_Player_C_1.FoDComponent 0x0000000028F32400"

Add 28F32400+1A8 to your table, as Float, and play with it (note: 0x28F32400 will be different on your end). From what I can tell, it's read in real-time and you can adjust the unfog radius by changing the value of the Float. Easy peasy

Here's an example, I'm using 1 here



If I use 500, I get this:



If I use 1000, I get this:



For 3000:



And lastly, 6000:



BR,
Sun

P.S.: Watch the trainers now having an "Increase Unfog Radius" option T_T... I can expect anything from them.

[telosei]

so sunbeam how would we get the customize unlock to work? im kinda sorta retarded a bit i read ur posts was wonder just how to get them to work

Not yet available in the table. I did all of that manually, by running SetHUDVisible BPCont_Player_C_0 0 command, which will also not work for you. Most commands' flags are set in such a way that, even if the engine finds them in the various Classes, they won't run So I fixed that so they run. Then, once I got that working, in the actual command exec function I changed RIP to the Developer ones (I used ObjectsDump.txt to find out the function location). And had that execute instead (using the right UObject as __this pointer in RCX). That's the techy explanation.

I plan to update the table to include such commands in the next update. So, hold tight. Also wanna play the damn game for the time being

Hello and thanks you for your work

i'm currently trying to use the injector to get the objectsdump.txt

everything work so far except few things

i do injection on main menu then load my save , only things i need to avoid in order to keep the table from being changed is changing map or reloading the save right?
how do i update the objectsdump.txt? pressing numpad do nothing it seems? i'm confused
also some adresse i can find through memory viewers on weapon/grenade/class mod component are not in objectsdump.txt , is that normal?

trying to edit a grenade but it's really not a success so far because some adresse can't be found and it seems annointed adresse are not in it either, am i right?

thanks you in advance

You ask a lot of questions and express desire to get a lot of useless shit in this game, which makes me believe you have no clue what you're doing. Like I said in the video, if you move from main menu into the game world, you need to press Numpad / to re-dump NamesDump.txt and ObjectsDump.txt. And that is because the engine re-initializes non-Transient UObjects. The key works, the function works. If it doesn't for you, then disable your AV or anything conflicting with hotkey press detection. I really have no further observations regarding EDITING weapons and other crap. Not interested in it, check the other topic where Zanzer explains how and what to do.

My apologies.

Good evening.

[SunBeam]

Welp Enough said



Thank you, Gearbox!

[glyth]

Welp Enough said



Thank you, Gearbox!

how i see that:P

[SunBeam]

Unfortunately, "BuildGear" command isn't available. But "SpawnAwesomeItems" should work just like in BL2 Tinkering with it, as it also runs some UnrealScript under the hood

[vosszaa]

@SB

So the "Gear Building" menu is actually functioning or no?

[Hinki]

Hopefully we can get some fps gains from hidden commands game almost runs as good as I want

[SunBeam]

I've managed to get SpawnAwesomeItems command to work

[glyth]

I've managed to get SpawnAwesomeItems command to work

whn i try that it says not found