Star Wars Jedi: Fallen Order [Engine:Unreal 4.21] - Console enabler, Dumper and more..

[SunBeam]

^ While for some games the change of console key works, others just make use of the internal Input.ini (in the .pak file(s)). I've yet to figure out why or where this happens, or if some there's some code to restore that allows reading the .ini from "%appdata%\Local\SwGame\Saved\Config\WindowsNoEditor".

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[NongFahsai]

I can't open console window for some reason. I pressed Tilde key and nothing happened. I try to fix it with

[/Script/Engine.InputSettings]
ConsoleKey=Tilde

And it still doesn't work. Any idea, guys ?

First, have you used the console unlocker ?

Second, are you using a non-us keyboard layout ? Try setting your windows keyboard language to ENG and then hit the key right under ESC (for me it's §).
You may have to change your keyboard layout before you open the game, not entirely sure.

Yeah, i'm using non-US keyboard layout. i changed my input method to Windows key + Space instead of Tilde and it worked, thanks man.

[KS212]

HI, everyone
Returning to the NG+ topic, I've found some flags in game dumps, by setting which we can manipulate the abilities and loadout..
I think the most interesting are

[00032019] ERsHeroLoadoutFlags::StaffLightsaberUnlocked
[00032020] ERsHeroLoadoutFlags::TwinLightsaberUnlocked
and
[00032006] ERsHeroLoadoutFlags::WallRunUnlocked
[00032007] ERsHeroLoadoutFlags::DoubleJumpUnlocked

there also some HeroUpgradeFlags, you can find them yourself in dumps file, they are responsible for upgrades mostly.

There are also some functions for setting such flags.. somewhere for now I've found:
[00033995] 00000000222C8E00 Function SwGame.SwPlayerOverrideSettingsLibrary.GetOverrideHeroLoadoutFlags
[00033997] 00000000222C8D40 Function SwGame.SwPlayerOverrideSettingsLibrary.GetOverrideHeroUpgradeFlags

But invoking them via console has no effect.

Maybe some of you could help with finding theese flags' values in memory? I'm a bit stuck with it now..

Just gotta be careful with unlocking abilities as it may cockblock progression. There's also no real need to force unlock the double bladed/saberstaff as immediately after the prologue you can go straight to Dathomir and get it. The dual wield special moves though are extreme endgame... not sure if that will cockblock the progression where you craft your own saber or not... We'd have to find a way to unlock it early then play all the way up to that part to find out.

[rambo99jose]

Found some mentions of unlocks but all show empty dissecting that structure




OHHH!!!! there is some sort of built in cheat panel, somone figure it out!

[SunBeam]

^ Is there an "Open" function for that widget? Cuz if it is I can call it just like I did in BL3

EDIT #1: Time to give it a go )

Code: Select all

0x0000000037E83640 Function UI_LoadableScreenWidget_Settings_Cheats.UI_LoadableScreenWidget_Settings_Cheats_C.ShowMenu

EDIT #2: You need to construct it first, but then again also track down each initializer along the way and feed the right Function pointer (not NULL) Will see what I can come up with.



EDIT #3: I think the answer is in finding the loop that processes all of these:

Code: Select all

[00052567] 0x00000000302202E0 PackageUI_LoadableScreenWidget_Settings_Visuals
[00052568] 0x0000000030220600 PackageUI_LoadableScreenWidget_Settings_Video
[00052569] 0x0000000030220880 PackageUI_LoadableScreenWidget_Settings_TagDebug
[00052570] 0x00000000302209C0 PackageUI_LoadableScreenWidget_Settings_Stat
[00052571] 0x0000000030220920 PackageUI_LoadableScreenWidget_Settings_LoadGame
[00052572] 0x0000000030220A60 PackageUI_LoadableScreenWidget_Settings_LevelSelect
[00052573] 0x0000000030220560 PackageUI_LoadableScreenWidget_Settings_Gameplay
[00052574] 0x0000000030223580 PackageUI_LoadableScreenWidget_Settings_Controls
[00052575] 0x0000000030223620 PackageUI_LoadableScreenWidget_Settings_CinematicSelect
[00052576] 0x00000000302238A0 PackageUI_LoadableScreenWidget_Settings_Cheats
[00052577] 0x0000000030223760 PackageUI_LoadableScreenWidget_Settings_Audio
[00052578] 0x00000000302236C0 PackageUI_LoadableScreenWidget_Settings_Account
[00052587] 0x0000000030223F80 PackageUI_LoadableScreenWidget_Settings_Gamma
[00056882] 0x00000000457A2B80 PackageUI_LoadableScreenWidget_Settings_UserAgreement
[00056883] 0x00000000457A2D60 PackageUI_LoadableScreenWidget_Settings_Privacy

Cuz, honestly, there is some sort of a check somewhere in there that doesn't initialize the Cheats one

[SunBeam]

The code that loads all those packages above can be adjusted to also load the Cheats package. Then in the initialization loop it will also create that menu I doubt each menu has a different setup (the core construct functions should be identical). Just have to find where these are processed and fake my way in. I'll try first swapping one menu with another (Visuals with Cheats). We'll see how this goes

P.S.: One more reason why mapping the function names is IMPORTANT (e.g.: UPlayer::Exec). Just so you know what the fuck you are looking at. Or at least make sense of the code from the composite callers.

[KS212]

Yeah powers can probably be given but will definitely break progression mostly coz the game is done in such a way that if you go into areas you're not supposed to, you'll break shit. If you deliberately do not go into areas you're not supposed to until you legitimately have X power then you can probably avoid it, but its way too easy to forget where you're actually supposed to go.

EDIT: @Sunbeam
Was it you who said it was weird the game doesn't read from .ini? Or someone else?
Apparently files need to be .pak'd this time round. Someone on RIN made an easymode ver here: [Link]

[SunBeam]

EDIT: @Sunbeam
Was it you who said it was weird the game doesn't read from .ini? Or someone else?
Apparently files need to be .pak'd this time round. Someone on RIN made an easymode ver here: [Link]

Thanks for mentioning. Will look into it, sounds quite nice.

On another note, I've started checking my demo game and see how the menu is created. Found this:





Star Wars should have similar creation code. The problem we have there though is there is no .pdb. As such, those names you see in my screenshot will not show up in x64dbg for SW. That's what I'm trying to achieve with the up-coming Cheat Engine plugin To give you folks the ability to recognize functions (will teach how) and build up a community-based collaborative database of any useful functions we can name-map for an UE4 game. This might go viral once released. So, yeah.. excuse me for not tackling this game destructo-mode like I did others Busy with bigger fish

BR,
Sun

P.S.#1: Try and look for string references and find out some of those menu names as strings. Then debug from there (you will need to attach the game as soon as the window is created; doing the attach or debug already at main menu won't help you break in the Construct function; the function will have already run by then).

P.S.#2: I wonder why he hasn't added-in the CheatMenu widget, that Drogon guy Why focus only on CVars when you can also add something like this?



Just sayin'

StaticCreate CheatManager makes my game instantly crash to desktop without any Crash Reporter popping up

The script is incomplete. Do open it and have a look; like I said, it's a work in progress and I've abandoned it due to: a) even if you create the CheatManager, you can only do "god" and perhaps "toggledebugcamera"; there are no other useful commands; b) I'm currently building up a scanner that will allow you to dump functions and names to then be mapped in x64dbg so you know what the fuck you're looking at when debugging

[SunBeam]

I'm going to post this here for reference, to continue on when I get back from Barcelona

ShooterGame:

1] public: void __cdecl FTicker::Tick(float) __ptr64

-> break at this function and on FIRST BREAKPOINT (not other breakpoints) start the trace
-> scroll till the 2nd dynamic call

Code: Select all

00007FF671F2EEC5 | 48:8B01        | MOV RAX,QWORD PTR DS:[RCX]
00007FF671F2EEC8 | FF50 20        | CALL QWORD PTR DS:[RAX+20]
00007FF671F2EECB | 84C0           | TEST AL,AL
00007FF671F2EECD | 0F84 8E000000  | JE shootergame-win64-shipping.7FF671F2EF61
00007FF671F2EED3 | 44:397F 40     | CMP DWORD PTR DS:[RDI+40],R15D
00007FF671F2EED7 | 74 06          | JE shootergame-win64-shipping.7FF671F2EEDF
00007FF671F2EED9 | 48:8B4F 38     | MOV RCX,QWORD PTR DS:[RDI+38]
00007FF671F2EEDD | EB 03          | JMP shootergame-win64-shipping.7FF671F2EEE2
00007FF671F2EEDF | 49:8BCF        | MOV RCX,R15
00007FF671F2EEE2 | 48:8B01        | MOV RAX,QWORD PTR DS:[RCX]
00007FF671F2EEE5 | 0F28CE         | MOVAPS XMM1,XMM6
00007FF671F2EEE8 | FF50 40        | CALL QWORD PTR DS:[RAX+40] // here
00007FF671F2EEEB | 84C0           | TEST AL,AL

2] enter above call and trace it to the JMP RAX

Code: Select all

00007FF671DD4710 | 40:53          | PUSH RBX
00007FF671DD4712 | 48:83EC 30     | SUB RSP,30
00007FF671DD4716 | 48:8BD9        | MOV RBX,RCX
00007FF671DD4719 | 0F297424 20    | MOVAPS XMMWORD PTR SS:[RSP+20],XMM6
00007FF671DD471E | 48:83C1 08     | ADD RCX,8
00007FF671DD4722 | 0F28F1         | MOVAPS XMM6,XMM1
00007FF671DD4725 | E8 867E3E00    | CALL <shootergame-win64-shipping.public: class UObject * __ptr64 __cdecl FWeakObjectPtr::Get
00007FF671DD472A | 0F1053 10      | MOVUPS XMM2,XMMWORD PTR DS:[RBX+10]
00007FF671DD472E | 0F28CE         | MOVAPS XMM1,XMM6
00007FF671DD4731 | 66:0F6FC2      | MOVDQA XMM0,XMM2
00007FF671DD4735 | 66:0F73D8 08   | PSRLDQ XMM0,8
00007FF671DD473A | 66:0F7EC1      | MOVD ECX,XMM0
00007FF671DD473E | 48:63C9        | MOVSXD RCX,ECX
00007FF671DD4741 | 48:03C8        | ADD RCX,RAX
00007FF671DD4744 | 6648:0F7ED0    | MOVQ RAX,XMM2
00007FF671DD4749 | 0F287424 20    | MOVAPS XMM6,XMMWORD PTR SS:[RSP+20]
00007FF671DD474E | 48:83C4 30     | ADD RSP,30
00007FF671DD4752 | 5B             | POP RBX
00007FF671DD4753 | 48:FFE0        | JMP RAX // here

3] the JMP RAX leads to this function

public: bool __cdecl UShooterGameInstance::Tick(float) __ptr64

4] inside here you'll find FNames to menu widgets (a FName is an id that gets converted to string via FName::ToString)

5] 2nd CALL in this function is a call to here:

Code: Select all

00007FF671F0C941 | 48:8B96 C8000000                       | MOV RDX,QWORD PTR DS:[RSI+C8]
00007FF671F0C948 | 4C:8BC3                                | MOV R8,RBX
00007FF671F0C94B | 48:8BCE                                | MOV RCX,RSI
00007FF671F0C94E | E8 5D98F7FF                            | CALL <shootergame-win64-shipping.private: void __cdecl UShooterGameInstance::BeginNewState | // here

6] that CALL leads to this:

Code: Select all

00007FF671E862F0 | 48:8987 C8000000                       | MOV QWORD PTR DS:[RDI+C8],RAX                                                                                             |
00007FF671E862F7 | E9 04010000                            | JMP shootergame-win64-shipping.7FF671E86400                                                                               |
00007FF671E862FC | 48:3B1D B584A102                       | CMP RBX,QWORD PTR DS:[<class FName const ShooterGameInstanceState::WelcomeScreen>]                                        |
00007FF671E86303 | 75 0A                                  | JNE shootergame-win64-shipping.7FF671E8630F                                                                               |
00007FF671E86305 | E8 C60E0000                            | CALL <shootergame-win64-shipping.private: void __cdecl UShooterGameInstance::BeginWelcomeScreenState(void) __ptr64>       |
00007FF671E8630A | E9 F1000000                            | JMP shootergame-win64-shipping.7FF671E86400                                                                               |
00007FF671E8630F | 48:3B1D AA84A102                       | CMP RBX,QWORD PTR DS:[<class FName const ShooterGameInstanceState::MainMenu>]                                             |
00007FF671E86316 | 75 0A                                  | JNE shootergame-win64-shipping.7FF671E86322                                                                               |
00007FF671E86318 | E8 53F8FFFF                            | CALL <shootergame-win64-shipping.private: void __cdecl UShooterGameInstance::BeginMainMenuState(void) __ptr64>            | // here
00007FF671E8631D | E9 DE000000                            | JMP shootergame-win64-shipping.7FF671E86400                                                                               |
00007FF671E86322 | 48:3B1D 9F84A102                       | CMP RBX,QWORD PTR DS:[<class FName const ShooterGameInstanceState::MessageMenu>]                                          |
00007FF671E86329 | 75 0A                                  | JNE shootergame-win64-shipping.7FF671E86335                                                                               |
00007FF671E8632B | E8 00FCFFFF                            | CALL <shootergame-win64-shipping.private: void __cdecl UShooterGameInstance::BeginMessageMenuState(void) __ptr64>         |
00007FF671E86330 | E9 CB000000                            | JMP shootergame-win64-shipping.7FF671E86400                                                                               |
00007FF671E86335 | 48:3B1D 9484A102                       | CMP RBX,QWORD PTR DS:[<class FName const ShooterGameInstanceState::Playing>]                                              |
00007FF671E8633C | 0F85 BE000000                          | JNE shootergame-win64-shipping.7FF671E86400                                                                               |

7] and that CALL leads to this:

Code: Select all

00007FF671E85E15 | FF50 08                                | CALL QWORD PTR DS:[RAX+8]                                                                                                |
00007FF671E85E18 | 49:8BD4                                | MOV RDX,R12                                                                                                              |
00007FF671E85E1B | 48:8D4D 30                             | LEA RCX,QWORD PTR SS:[RBP+30]                                                                                            |
00007FF671E85E1F | E8 0C633300                            | CALL <shootergame-win64-shipping.public: void __cdecl FWeakObjectPtr::operator=(class UObject const * __ptr64) __ptr64>  |
00007FF671E85E24 | 48:8BD6                                | MOV RDX,RSI                                                                                                              |
00007FF671E85E27 | 48:8D4D 38                             | LEA RCX,QWORD PTR SS:[RBP+38]                                                                                            |
00007FF671E85E2B | E8 00633300                            | CALL <shootergame-win64-shipping.public: void __cdecl FWeakObjectPtr::operator=(class UObject const * __ptr64) __ptr64>  |
00007FF671E85E30 | 49:8B0E                                | MOV RCX,QWORD PTR DS:[R14]                                                                                               |
00007FF671E85E33 | 4C:8D45 30                             | LEA R8,QWORD PTR SS:[RBP+30]                                                                                             |
00007FF671E85E37 | 48:8D55 38                             | LEA RDX,QWORD PTR SS:[RBP+38]                                                                                            |
00007FF671E85E3B | E8 F0C30000                            | CALL <shootergame-win64-shipping.public: void __cdecl FShooterMainMenu::Construct(struct TWeakObjectPtr<class UShooterGa | // here
00007FF671E85E40 | 49:8B0E                                | MOV RCX,QWORD PTR DS:[R14]                                                                                               |
00007FF671E85E43 | E8 88F0FFFF                            | CALL <shootergame-win64-shipping.public: void __cdecl FShooterMainMenu::AddMenuToGameViewport(void) __ptr64>             |

How all of the above ties back to Star Wars.. well, here's the cookie:

000000014A168B90 | 48:89E0 | MOV RAX,RSP | FTicker::Tick

Now trace all the way to the Construct of the menu, following the steps I mentioned

[KS212]

That Drogon guy added another post with all the other .ini's that are editable and repackable: [Link]

This is his file so credit goes to him. Is there anything we can add to these to make cheating easier?

[kay0]

...

He just uploaded the whole base config pack:

Can you add options to tweak the other .ini files like PlayerInput.ini, etc for binding keys through the config? The game barely lets you bind stuff through the menu. Would be super helpful!

Here's every base config file you can edit and throw into my INI mod kit generator folder

Fallen Order Base Config Pack

Code: Select all

https://drive.google.com/open?id=1s2lms7RuxFwK1j7dFeQo9BdPtxOX5WF_

[dirtydanisreal]

saw this in the BaseEngine.ini

[SystemSettings]
; the following 4 lines verify the console variable system behavior with the ECVF_Cheat flag
con.DebugEarlyDefault = True
con.DebugEarlyCheat = True
con.DebugLateDefault = True
con.DebugLateCheat = True

[duducasarotto]

^ It is possible, but like you said, it pushes progression. Game's designed to give you the abilities at certain points in the story. Not to mention having them might also break the progression, in the sense that the game will think you already have that ability and not "unlock" the next phase. So you will end-up with what you'll then call a bug and ask for save games from other people Better leave it as it is (unless you don't care for your progression)

That's exactly what happens.

Best example is on Dathomir, there's a jump section you're not supposed to pass before getting double jump/Jedi flip. But due to a glitch/mechanic abuse (you can dash into mid air and still jump off nothing), you can actually make that jump. However if you do, it seals off the return path as in the story if you actually make that jump it triggers something and you are no longer allowed to return until you pass the rest of the stage... but, you don't have the required abilities to pass the rest, so you're fucked.

Tho that's for abilities. We can probably safely unlock customization/databank and that's pretty much 'half' a New Game Plus as is

HI, everyone
Returning to the NG+ topic, I've found some flags in game dumps, by setting which we can manipulate the abilities and loadout..
I think the most interesting are

[00032019] ERsHeroLoadoutFlags::StaffLightsaberUnlocked
[00032020] ERsHeroLoadoutFlags::TwinLightsaberUnlocked
and
[00032006] ERsHeroLoadoutFlags::WallRunUnlocked
[00032007] ERsHeroLoadoutFlags::DoubleJumpUnlocked

there also some HeroUpgradeFlags, you can find them yourself in dumps file, they are responsible for upgrades mostly.

There are also some functions for setting such flags.. somewhere for now I've found:
[00033995] 00000000222C8E00 Function SwGame.SwPlayerOverrideSettingsLibrary.GetOverrideHeroLoadoutFlags
[00033997] 00000000222C8D40 Function SwGame.SwPlayerOverrideSettingsLibrary.GetOverrideHeroUpgradeFlags

But invoking them via console has no effect.

Maybe some of you could help with finding theese flags' values in memory? I'm a bit stuck with it now..

ok if it is possible please do it I know it might break the game but I know every part of the game and what you have to unlock etc I just want to make a normal story again but from the beggining with all the powers cause I think it would be cool and if possible only the powers and not the BD-1 upgrades cause most part the BD-1 upgrades do that and if you got stuck in some part by a glitch dont save and kill yourself you just go to the last save part

[duducasarotto]

HI, everyone
Returning to the NG+ topic, I've found some flags in game dumps, by setting which we can manipulate the abilities and loadout..
I think the most interesting are

[00032019] ERsHeroLoadoutFlags::StaffLightsaberUnlocked
[00032020] ERsHeroLoadoutFlags::TwinLightsaberUnlocked
and
[00032006] ERsHeroLoadoutFlags::WallRunUnlocked
[00032007] ERsHeroLoadoutFlags::DoubleJumpUnlocked

there also some HeroUpgradeFlags, you can find them yourself in dumps file, they are responsible for upgrades mostly.

There are also some functions for setting such flags.. somewhere for now I've found:
[00033995] 00000000222C8E00 Function SwGame.SwPlayerOverrideSettingsLibrary.GetOverrideHeroLoadoutFlags
[00033997] 00000000222C8D40 Function SwGame.SwPlayerOverrideSettingsLibrary.GetOverrideHeroUpgradeFlags

But invoking them via console has no effect.

Maybe some of you could help with finding theese flags' values in memory? I'm a bit stuck with it now..

Just gotta be careful with unlocking abilities as it may cockblock progression. There's also no real need to force unlock the double bladed/saberstaff as immediately after the prologue you can go straight to Dathomir and get it. The dual wield special moves though are extreme endgame... not sure if that will cockblock the progression where you craft your own saber or not... We'd have to find a way to unlock it early then play all the way up to that part to find out.

I just want to have more ways to kill my enemies in the beggining cause I think that when you get all the cool stuff the game ends and go after collectables is very boring sometimes the game could have more enemies and a dark side thing or powers and be bigger cause its to short I hope the game receive a expansion god of war you have ng+ but they locked the areas in a more clever way cause even if you have all powers/weapons you cant access some areas cause you need story related stuff instead of normal powers that you can use so yeah a ng+ with all powers will be cool just disable all bd1 upgrades except the stim quantity and we can play the game again in higher difficulty feeling more powerful cause play again feeling week is boring

[demorest]

That Drogon guy added another post with all the other .ini's that are editable and repackable: [Link]

This is his file so credit goes to him. Is there anything we can add to these to make cheating easier?

Where to put thuese inis?