Finally figured out collisions fully. The following is a script for flying and noclipping (ghost).
SunBeam gets some credit for this because he helped me get to the bottom of how bActorEnableCollision works. Short of it is that the bitfield structure is not the same for every ue4 game like I had thought and I brainfarted and didn't try different structures until SunBeam confirmed that the offset that I found was correct. Anyway here it is, just enable the first script and then one of the other scripts (only 1 at a time please). I'm sure SunBeam will come out with his usual console command restoration table soon.
And as always, feel free to use this in your tables or trainers just give credit.
Code: Select all
<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
<CheatEntries>
<CheatEntry>
<ID>16327</ID>
<Description>"Get Pointer"</Description>
<Options moHideChildren="1"/>
<LastState/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>[ENABLE]
{$LUA}
-- Pointer Paths
muppetAPlayerController = 0x388 -- in APlayerCameraManager
muppetAPlayerState = 0x390 -- in APlayerController
muppetACharacter = 0x3C8 -- in APlayerController
muppetUCharacterMovementComponent = 0x3F8 -- in ACharacter
muppetUCapsuleComponent = 0x400 -- in ACharacter
muppetSpreadManagerComponent = 0xB08 -- in ACharacter
muppetPlayerInventoryComponent = 0xB30 -- in ACharacter
muppetEquipmentComponent = 0xBF8 -- in ACharacter
muppetCurrentHeldEquipment = 0x2D8 -- in EquipmentComponent
muppetStandardAmmoPool = 0x210 -- in CurrentHeldEquipment
muppetPlayerHealthComponent = 0xBE8 -- in ACharacter
muppetPlayerStatComponent_C = 0xC00 -- in ACharacter
muppetPlayerInfoComponent = 0xC08 -- in ACharacter
muppetCameraComponent = 0xED0 -- in ACharacter
muppetPlayerTargetingComponent = 0xEE0 -- in ACharacter
muppetPlayerInteractionComponent = 0x1430 -- in ACharacter
--muppetAPlayerController = '[muppetGetInjPoint]+388'
--muppetAPlayerState = ''
--print(muppetAPlayerController)
{$ASM}
aobscanmodule(getInjectPoint,IndianaEpicGameStore-Win64-Shipping.exe,F3 0F 10 B1 A4 03 00 00 33) // should be unique
alloc(newmem,$1000,"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1E1)
label(code)
label(return)
label(muppetGetInjPoint)
registersymbol(muppetGetInjPoint)
newmem:
push rdi
lea rdi,[rcx]
mov [muppetGetInjPoint],rdi
pop rdi
code:
movss xmm6,[rcx+000003A4]
jmp return
muppetGetInjPoint:
dq 0
getInjectPoint:
jmp newmem
nop 3
return:
registersymbol(getInjectPoint)
[DISABLE]
getInjectPoint:
db F3 0F 10 B1 A4 03 00 00
unregistersymbol(getInjectPoint)
unregistersymbol(muppetGetInjPoint)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: "IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1E1
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1BB: CC - int 3
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1BC: CC - int 3
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1BD: CC - int 3
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1BE: CC - int 3
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1BF: CC - int 3
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1C0: 48 81 EC 98 05 00 00 - sub rsp,00000598
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1C7: 0F 29 B4 24 80 05 00 00 - movaps [rsp+00000580],xmm6
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1CF: 48 8B 05 62 BE 13 02 - mov rax,[IndianaEpicGameStore-Win64-Shipping.exe+3D88038]
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1D6: 48 33 C4 - xor rax,rsp
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1D9: 48 89 84 24 70 05 00 00 - mov [rsp+00000570],rax
// ---------- INJECTING HERE ----------
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1E1: F3 0F 10 B1 A4 03 00 00 - movss xmm6,[rcx+000003A4]
// ---------- DONE INJECTING ----------
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1E9: 33 C0 - xor eax,eax
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1EB: 0F 57 C0 - xorps xmm0,xmm0
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1EE: 89 44 24 20 - mov [rsp+20],eax
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1F2: 0F 2F F0 - comiss xmm6,xmm0
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1F5: 77 18 - ja IndianaEpicGameStore-Win64-Shipping.exe+1C4C20F
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1F7: 48 8B 01 - mov rax,[rcx]
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1FA: 48 8D 54 24 30 - lea rdx,[rsp+30]
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C1FF: FF 90 28 07 00 00 - call qword ptr [rax+00000728]
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C205: F3 0F 10 70 18 - movss xmm6,[rax+18]
"IndianaEpicGameStore-Win64-Shipping.exe"+1C4C20A: B8 01 00 00 00 - mov eax,00000001
}
</AssemblerScript>
<CheatEntries>
<CheatEntry>
<ID>16328</ID>
<Description>"Fly"</Description>
<LastState/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>{$LUA}
if syntaxcheck then return end
[ENABLE]
local addressList = getAddressList()
local enableFirstRecord = addressList.getMemoryRecordByDescription("Get Pointer")
if enableFirstRecord ~= nil and enableFirstRecord.Active == false then
error('Activate Get Pointer')
end
-- MovementMode: 5 = Flying, 3 = Falling, 1 = Walking
-- bCheatFlying: 0 (4bytehex: 890) = Not Flying, 1 (4bytehex: 894) = Flying
-- MaxFlySpeed: Default is 600
-- MaxAcceleration: Default is 2048
-- bImmuneToFallDamage: 0 = Can take fall damage, 1 = Can not take fall damage
-- Offsets:
-- 388 = APlayerController; 3C8 = ACharacter; 3F8 = UCharacterMovementComponent
-- BE8 = HealthComponent
muppetMovementMode = '[[[[muppetGetInjPoint]+388]+3C8]+3F8]+1E8'
muppetbCheatFlying = '[[[[muppetGetInjPoint]+388]+3C8]+3F8]+3F4'
muppetMaxFlySpeed = '[[[[muppetGetInjPoint]+388]+3C8]+3F8]+218'
muppetMaxAcceleration = '[[[[muppetGetInjPoint]+388]+3C8]+3F8]+220'
muppetbImmuneToFallDamage = '[[[[muppetGetInjPoint]+388]+3C8]+BE8]+19E'
writeInteger(muppetMovementMode, 5)
writeInteger(muppetbCheatFlying, 0x894)
writeFloat(muppetMaxFlySpeed, 1200)
writeFloat(muppetMaxAcceleration, 20000)
writeInteger(muppetbImmuneToFallDamage, 1)
[DISABLE]
writeInteger(muppetMovementMode, 3)
writeInteger(muppetbCheatFlying, 0x890)
writeFloat(muppetMaxFlySpeed, 600)
writeFloat(muppetMaxAcceleration, 2048)
local muppetResetFallDamageImmunity = createTimer()
muppetResetFallDamageImmunity.Interval = 10000 -- 10000 = 10 seconds
muppetResetFallDamageImmunity.OnTimer = function(t)
muppetResetFallDamageImmunity.destroy()
writeInteger(muppetbImmuneToFallDamage, 0)
end
</AssemblerScript>
</CheatEntry>
<CheatEntry>
<ID>16329</ID>
<Description>"Fly & Noclip"</Description>
<LastState/>
<VariableType>Auto Assembler Script</VariableType>
<AssemblerScript>{$LUA}
if syntaxcheck then return end
[ENABLE]
local addressList = getAddressList()
local enableFirstRecord = addressList.getMemoryRecordByDescription("Get Pointer")
if enableFirstRecord ~= nil and enableFirstRecord.Active == false then
error('Activate Get Pointer')
end
-- MovementMode: 5 = Flying, 3 = Falling, 1 = Walking
-- bCheatFlying: 0 (4bytehex: 890) = Not Flying, 1 (4bytehex: 894) = Flying
-- MaxFlySpeed: Default is 600
-- MaxAcceleration: Default is 2048
-- bImmuneToFallDamage: 0 = Can take fall damage, 1 = Can not take fall damage
-- Offsets:
-- 388 = APlayerController; 3C8 = ACharacter; 3F8 = UCharacterMovementComponent
-- BE8 = HealthComponent
muppetMovementMode = '[[[[muppetGetInjPoint]+388]+3C8]+3F8]+1E8'
muppetbCheatFlying = '[[[[muppetGetInjPoint]+388]+3C8]+3F8]+3F4'
muppetbActorEnableCollision = '[[[muppetGetInjPoint]+388]+3C8]+9C'
muppetMaxFlySpeed = '[[[[muppetGetInjPoint]+388]+3C8]+3F8]+218'
muppetMaxAcceleration = '[[[[muppetGetInjPoint]+388]+3C8]+3F8]+220'
muppetbImmuneToFallDamage = '[[[[muppetGetInjPoint]+388]+3C8]+BE8]+19E'
writeInteger(muppetMovementMode, 5)
writeInteger(muppetbCheatFlying, 0x894)
writeFloat(muppetMaxFlySpeed, 1200)
writeFloat(muppetMaxAcceleration, 20000)
writeInteger(muppetbImmuneToFallDamage, 1)
writeInteger(muppetbActorEnableCollision, 0x0001040E)
[DISABLE]
writeInteger(muppetMovementMode, 3)
writeInteger(muppetbCheatFlying, 0x890)
writeFloat(muppetMaxFlySpeed, 600)
writeFloat(muppetMaxAcceleration, 2048)
writeInteger(muppetbActorEnableCollision, 0x0001044E)
local muppetResetFallDamageImmunity = createTimer()
muppetResetFallDamageImmunity.Interval = 10000 -- 10000 = 10 seconds
muppetResetFallDamageImmunity.OnTimer = function(t)
muppetResetFallDamageImmunity.destroy()
writeInteger(muppetbImmuneToFallDamage, 0)
end
</AssemblerScript>
</CheatEntry>
</CheatEntries>
</CheatEntry>
</CheatEntries>
</CheatTable>