Horizon Zero Dawn [Engine:Decima]

[ODimm]

Work in progress, sorry for the long wait. But there will be some goodies inside



BR,
Sun

Hi SunBeam!

really impressive work with mapping out the engine structure!

may i ask you if you plan to explain some of the reversing process?( e.g how you find the gDebugSettings struct)
i tried to find it by myself but i failed...i'v found a gDebugSettings string, and it gets accessed at:
game-start
load-save
open-menu
-
but i didn't manage to find any struct that contains the gDebugSettings

-

currently im looking for the [0008] gDebugSettings bool...got a trace that it does somethings with the player camera...if i find out what it does then i will write it

thanks for you work and all your teaching stuff, it helped me a lot to learn about game hacking!

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[HerbertGWells]

As I know nothing about how cheat engine works, is there any way for me to make this work with the Epic Store version of HZD?

[Griffihn]

As I know nothing about how cheat engine works, is there any way for me to make this work with the Epic Store version of HZD?

look at the exe name and change accordingly in the scripts provided. usually, that's all there is to it since all scripts are AOB types.

[rambo99jose]

As I know nothing about how cheat engine works, is there any way for me to make this work with the Epic Store version of HZD?

ok so usually you try to find location by search for near bytes:

suppose this was original script

Spoiler

Code: Select all

// ORIGINAL CODE - INJECTION POINT: "HorizonZeroDawn.exe"+FE52C0

"HorizonZeroDawn.exe"+FE528E: 88 45 88                 -  mov [rbp-78],al
"HorizonZeroDawn.exe"+FE5291: 0F B6 45 48              -  movzx eax,byte ptr [rbp+48]
"HorizonZeroDawn.exe"+FE5295: 88 45 89                 -  mov [rbp-77],al
"HorizonZeroDawn.exe"+FE5298: 44 89 65 80              -  mov [rbp-80],r12d
"HorizonZeroDawn.exe"+FE529C: 89 75 84                 -  mov [rbp-7C],esi
"HorizonZeroDawn.exe"+FE529F: 44 88 75 8A              -  mov [rbp-76],r14l
"HorizonZeroDawn.exe"+FE52A3: E8 68 72 BC FF           -  call HorizonZeroDawn.exe+BAC510
"HorizonZeroDawn.exe"+FE52A8: 4C 8B B4 24 F0 00 00 00  -  mov r14,[rsp+000000F0]
"HorizonZeroDawn.exe"+FE52B0: 48 8B BC 24 08 01 00 00  -  mov rdi,[rsp+00000108]
"HorizonZeroDawn.exe"+FE52B8: 48 8B B4 24 10 01 00 00  -  mov rsi,[rsp+00000110]
// ---------- INJECTING HERE ----------
"HorizonZeroDawn.exe"+FE52C0: 41 39 5F 58              -  cmp [r15+58],ebx
"HorizonZeroDawn.exe"+FE52C4: 75 39                    -  jne HorizonZeroDawn.exe+FE52FF
// ---------- DONE INJECTING  ----------
"HorizonZeroDawn.exe"+FE52C6: 38 1D 40 7C 13 06        -  cmp [HorizonZeroDawn.exe+711CF0C],bl
"HorizonZeroDawn.exe"+FE52CC: 49 8B 4F 48              -  mov rcx,[r15+48]
"HorizonZeroDawn.exe"+FE52D0: 75 04                    -  jne HorizonZeroDawn.exe+FE52D6
"HorizonZeroDawn.exe"+FE52D2: 48 8D 59 50              -  lea rbx,[rcx+50]
"HorizonZeroDawn.exe"+FE52D6: 48 81 C1 F8 01 00 00     -  add rcx,000001F8
"HorizonZeroDawn.exe"+FE52DD: C6 44 24 20 00           -  mov byte ptr [rsp+20],00
"HorizonZeroDawn.exe"+FE52E2: 4D 8B CF                 -  mov r9,r15
"HorizonZeroDawn.exe"+FE52E5: 4C 8D 05 64 7A 6C 01     -  lea r8,[HorizonZeroDawn.exe+26ACD50]
"HorizonZeroDawn.exe"+FE52EC: 48 8B D3                 -  mov rdx,rbx
"HorizonZeroDawn.exe"+FE52EF: E8 FC 12 BE FF           -  call HorizonZeroDawn.exe+BC65F0

then you do an Array of Bytes Search for"41 39 5F 58 75 39", make sure all squares have black boxes, which allows for read-only memory search

Spoiler

[Link]

• If you found just 1 then you gonna inject on that location with AOB template.
• If you get multiple matches then you have to disassembly each hit and compare the instructions with original script (- cmp [r15+58],ebx jne HorizonZeroDawn.exe+FE52FF) and the neighboring ones.
• If you don't get a match then try searching for neighboring bytes instead (38 1D 40 7C 13 06 49 8B 4F 48). This is biggest tip i can give you to update scripts.
  • An alternative is to 'wildcard' common changed bytes (41 39 5F 58 75 39)
  • Could wildcard 58 if only memory offset changed (41 39 5F ?? 75 39)

Someone else can probably explain it better

[hellbound73]

no materials need for crafting and stealth pls

Sure, can read what you say, evaluate, then determine if feasible. Just know I don't take in requests AND you shouldn't behave like on trainer making forums who provide a "request your shit" service Just my 2c. If this discussion escalates, I will clean it up once the game-related content starts flocking in. Let's keep it on point.

THNX for all the Excellent work man

[Diamond_Sutra]

Awesome tables folks; thank you so much everyone for putting these together.

Question. I have noticed on some of these games that the speed hack doesn't seem to work on some engines; Horizon Zero Dawn is one. I am curious if there is a way to make it operate during gameplay.

I was curious about this one too. It seems like the Speedhack doesn't work in the H:ZD gameplay parts. But for some reason it DOES work/activate during the FMV sequences.

Indeed, is there any way to force the game itself to speedhack? I want to fight giant robots in slow motion!

[Apache81]

First is a script that finds the current amount of inventory spaces

Nicely done! Using your inventory space AOB, I found the offsets for weapons, armor, and modifications. Now you can go ham with all of them.

Yhò guys !!
Have you found a way to track down the Special Items section in the inventory?
I was messing around with an experimental item script but I collected 1 Metal Flower and, stupidly, I saved the game... now I have 50 of them already -_-"
Because of the full inventory slot, I cannot collect new ones now... this is annoying
It's easy to track down the other item quantities because you can interact with them by collecting and discarding some, but for the special items this is not possible because they don't change.
I've been trying to mess around with pointers and I think I found something connected to the UI populating itself when the gui is triggered from the game (I could see the description of the items even localized and also some other info) but I wasn't able to find the pointer to the item in the inventory when the cursor is over one...

I'll keep trying, maybe I will have more luck later

[bluepanda]

Game version: CDX day1
Table Version: 20200809_v0.4

.:|FEATURES|:.

• Ammo (activate only 1)
  • Unlimited Ammo
  • Unlimited Ammo + Rapid fire + Multishot
• Unlimited Skillpoints (spend some to update)
• playerHP pointer (freeze value, if pointer doesn't work try another from screenshot)
  alternate player HP pointers

  

.:|NOTES|:.

• "Unlimited Ammo" - arrow added just before it checks if quiver is empty
• "Unlimited Ammo + Rapid fire + Multishot" - IS VERY CHEATY, USE ONLY IF YOU WANT TO NUKE ROBOTS

.:|CHANGELOG|:.
v0.2: fixed unlimited health
v0.3: just realized you can upgrade quiver, so now setting 99 arrows with "Unlimited Ammo" script to prevent waste
v0.4: removed AOB to find hp, that location was shared with enemies and not safe to freeze (hp bar glitch). Use pointer to freeze player hp, if it doesn't work try another [if you prefered old way which let you easily detect enemies its under DO NOT TOUCH]

There is still a big flaw in your Unlimited Ammo script. You are also taking metal shards into consideration of manipulating. Money gets also fixed to 99 - which in most cases renders buying more expensive things impossible.

[rambo99jose]

There is still a big flaw in your Unlimited Ammo script. You are also taking metal shards into consideration of manipulating. Money gets also fixed to 99 - which in most cases renders buying more expensive things impossible.

when does that happen? I haven't made it that far in game (just rescued the spear)

[bluepanda]

There is still a big flaw in your Unlimited Ammo script. You are also taking metal shards into consideration of manipulating. Money gets also fixed to 99 - which in most cases renders buying more expensive things impossible.

when does that happen? I haven't made it that far in game (just rescued the spear)

The moment where you enable the script, it will set the metal shards to 99 (noticeable in shops), same as intended for the ammo count.
I've just noticed it as I got one resource for an armor but noticed, that my 999,999 shards went away.

[Drazerak]

Try mine Inf Resources script. It should put max item value to current

[David LionHeart]

SunBeam is there a way to collect all collectables of the game? Maybe when find their id and then put in a table? I finish the game many times on ps4 pro, 4/5 times because this is a great game but every time we start a new run (either if we select new game plus too), the collectables are gone and we must find them another time....
So i’m asking if there will be a possibility of add all collectables with cheat engine. In this way, i and others like me maybe, we can start a new game again without the effort to find them every time.
Anyway thanks to all for tables and yours time

[cfemen]

"GPU Driver mismatch" message at game start

even though my GPU driver is up2date...
(and im not the only one, a friend of mine had the same message at each start)

so at first i patched the .exe but then i thought AOB method would be nicer.

created a d3d11.dll proxy but it gets loaded after the check.
dxgi.dll didn't work, not sure why but always crashed the game.

so i decided to use the steam dll.

//

how to use:
Open HZD folder and rename steam_api64.dll to steam_api64_org.dll
Copy my steam_api64.dll into the folder
Game now starts without GPU mismatch message

its just a very small fix but maybe someone can need it

[NukeZen]

Work in progress, sorry for the long wait. But there will be some goodies inside



BR,
Sun

Aaaaah... what a lovely vision, total modding. May I humbly know if, by any chance, you have also found a way to change the values for armor, weapons and mods?

[rambo99jose]

The moment where you enable the script, it will set the metal shards to 99 (noticeable in shops), same as intended for the ammo count.
I've just noticed it as I got one resource for an armor but noticed, that my 999,999 shards went away.

ah i see now, yeah theres something fucky about arrows, seems when i enable freebuy in stores also activated rapidshot