Tried to figure out a stable pointer to player data, and I think I've successfully done so. The following two pointers both point at the first entry in the guardian bonus stats structure, with each additional entry being another 0x20 offset:
Code: Select all
"Borderlands3.exe"+05D99F00 -> 8 > 270 -> 0 -> 300 -> 30 -> 188 + offset
"Borderlands3.exe"+065E2B60 -> 30 -> 300 -> 30 -> 188 + offset
The part [-> 188] is used to get the pointer to the guardian stats, which should mean that the actual player data is accessible through ["Borderlands3.exe"+065E2B60 -> 30 -> 300 -> 30].
Also just for completeness, here is what I've figured out about the guardian stat data structure. It is 32 bytes long, but may actually just be 16 bytes, with a 8 byte AOB at 0x00 and 0x10 that seem to denote something. In between those are 4 byte values at 0x08, 0x0C, 0x18 and 0x1C. Only 0x08 seems to hold actual meaning, 0x1C is always 4 so far, and 0x18 seems to switch between 1 and 3 (bitfield perhaps?). Here is the structure for importing into Cheat Engine:
Code: Select all
<Elements>
<Element Offset="28" Vartype="4 Bytes" Bytesize="4" Description="VUNK4" DisplayMethod="Unsigned Integer"/>
<Element Offset="24" Vartype="4 Bytes" Bytesize="4" Description="VUNK3" DisplayMethod="Unsigned Integer"/>
<Element Offset="16" Vartype="Array of byte" Bytesize="8" Description="UNK2" DisplayMethod="Hexadecimal"/>
<Element Offset="12" Vartype="4 Bytes" Bytesize="4" Description="VUNK2" DisplayMethod="Unsigned Integer"/>
<Element Offset="8" Vartype="4 Bytes" Bytesize="4" Description="VUNK1" DisplayMethod="Unsigned Integer"/>
<Element Offset="0" Vartype="Array of byte" Bytesize="8" Description="UNK1" DisplayMethod="Hexadecimal"/>
</Elements>
I haven't figured out if the 0x00 and 0x10 are actually pointers, which might be possible. The 8 byte AOB at 0x00 seems to be counting down by 0xA0 each 0x20 bytes, while the 8 byte AOB at 0x10 seems to be jumping around wildly. 0x10 might actually not be a single value, just an array of bytes with some meaning.
Edit: There is also an alternative pointer ["Borderlands3.exe"+065E2B60 -> 30 -> 2B0 -> C0 -> 188 + offset]. The reduction by 0x50 leads to an increase by more than 0x50 in the 0xC0/0x30 part, so I am unsure if this is actually a valid path. However it did survive the repeated scans, even in multiplayer, just like the other pointers.
Edit 2: This structure should allow sane editing of the guardian rank stats without crashing or any other issues:
[Link]
Edit 3: Further discoveries. The Luck Guardian Stat is read from and written two using rbx+08, which means that the structure offset is indeed at least 12 bytes long. Three instructions where seen repeatedly during testing:
cmp dword ptr [rbx+08],00 (testing against 0?),
mov r8d,[rbx+08] (writing new value?) and a very rare
mov [rbx+08],r14d (reading for some purpose - perhaps generating the luck % increase?).
