SenorPlebeian wrote: ↑Fri Dec 29, 2023 5:26 am
ctulloch137 wrote: ↑Thu Dec 28, 2023 8:54 pm
Is the last trade vendor cheat working for anyone? most everything else seems to still be working fine for me, but I use that one when I encounter new vendors to be able to go through their full stock (resetting), and clicking it in cheat engine now just does nothing, doesnt expand the options.
Hasn't been working on my end either.
Not entirely sure how the AOB for the ActivateTrade function was found as I've mostly only dabbled in finding AOBs via it accessing a value in memory, which in this case I've found 100+ results for a vendor's UUID when doing a string search. The string it's referencing may very well be a value in RAM that's swiftly getting overwritten after the time of the function call and well after my scan, so I haven't really attempted to try to brute force through all the results for a hit. I figured since it hasn't been brought up in the last 100 or so pages on this thread, no one else was running into the issue and it might have just been the table I downloaded down, so I haven't attempted to fix it beyond that.
Thus far my short-term workaround has been to set up the script to instead let me input in the vendor's UUID which I grab off of the unpacked gustav dev files and have the script call the console commands with that instead. Unfortunately, this is a bit of a cumbersome experience without a proper mapping of the vendor to their UUID.
In further examination of this, I think I figured out how to fix Last Trade Vendor's AOB. After downgrading my version of BG3 to when the script last worked to try to reverse engineer how the function was originally found, I ended up actually looking through Zanzer's script for loading console commands and it made me realize I could just follow the function of ActivateTrade to its function in memory via the address he loads in the register symbol. Sure enough I realized only then (or perhaps it's some strange remnant of the many times I was running through trying to dissect the code) that it also just straight up puts a reference to ActivateTrade for Goto Address.
I think that this should have enough wildcards in its AOB to work, I only tested this against one merchant with a few restarts with the sleep deprivation that comes with being up at 4 AM, but I think I managed to get the script working again on my end:
Code: Select all
{ ActivateTrade(
Player, Trader, CanSell, TradeMode,
InitiallySelectedTradeObject, ItemsTagFilter
) }
[ENABLE]
aobscanmodule(trade,$process,48 33 ?? 48 89 ?? ?? 48 8B ?? 48 8B ?? E8 ?? ?? ?? ?? ?? 8B ?? 48 8D ?? ?? E8 ?? ?? ?? ?? 4C 8B F8)
alloc(newmem,$1000,trade)
label(tradePC)
label(tradeNPC)
label(tradeBkp)
label(return)
newmem:
mov rbx,tradePC
mov rax,[rdx+08]
test rax,rax
je @f
mov rcx,[rax+00]
mov [rbx+00],rcx
mov rcx,[rax+08]
mov [rbx+08],rcx
mov rcx,[rax+10]
mov [rbx+10],rcx
mov rcx,[rax+18]
mov [rbx+18],rcx
mov rcx,[rax+20]
mov [rbx+20],rcx
mov rcx,[rax+28]
mov [rbx+28],rcx
mov rcx,[rax+30]
mov [rbx+30],rcx
mov rcx,[rax+38]
mov [rbx+38],rcx
mov rbx,tradeNPC
mov rax,[rdx+18]
test rax,rax
je @f
mov rcx,[rax+00]
mov [rbx+00],rcx
mov rcx,[rax+08]
mov [rbx+08],rcx
mov rcx,[rax+10]
mov [rbx+10],rcx
mov rcx,[rax+18]
mov [rbx+18],rcx
mov rcx,[rax+20]
mov [rbx+20],rcx
mov rcx,[rax+28]
mov [rbx+28],rcx
mov rcx,[rax+30]
mov [rbx+30],rcx
mov rcx,[rax+38]
mov [rbx+38],rcx
mov rcx,[rax+40]
mov [rbx+40],rcx
mov rcx,[rax+48]
mov [rbx+48],rcx
mov rcx,[rax+50]
mov [rbx+50],rcx
mov rcx,[rax+58]
mov [rbx+58],rcx
tradeBkp:
readmem(trade+07,6)
jmp return
align 10
tradePC:
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
tradeNPC:
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
dq 0
trade+07:
jmp newmem
nop
return:
registersymbol(trade)
registersymbol(tradeBkp)
registersymbol(tradePC)
registersymbol(tradeNPC)
[DISABLE]
trade+07:
readmem(tradeBkp,6)
unregistersymbol(trade)
unregistersymbol(tradeBkp)
unregistersymbol(tradePC)
unregistersymbol(tradeNPC)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: bg3.exe+1431352
bg3.exe+143132F: 55 - push rbp
bg3.exe+1431330: 41 54 - push r12
bg3.exe+1431332: 41 55 - push r13
bg3.exe+1431334: 41 56 - push r14
bg3.exe+1431336: 41 57 - push r15
bg3.exe+1431338: 48 8D 6C 24 C9 - lea rbp,[rsp-37]
bg3.exe+143133D: 48 81 EC A0 00 00 00 - sub rsp,000000A0
bg3.exe+1431344: 48 8B 05 AD F0 1F 04 - mov rax,[bg3.exe+56303F8]
bg3.exe+143134B: 48 33 C4 - xor rax,rsp
bg3.exe+143134E: 48 89 45 2F - mov [rbp+2F],rax
// ---------- INJECTING HERE ----------
bg3.exe+1431352: 48 8B DA - mov rbx,rdx
// ---------- DONE INJECTING ----------
bg3.exe+1431355: 33 D2 - xor edx,edx
bg3.exe+1431357: 48 8B CB - mov rcx,rbx
bg3.exe+143135A: E8 91 0A CA FF - call bg3.exe+10D1DF0
bg3.exe+143135F: 4C 8B E0 - mov r12,rax
bg3.exe+1431362: 48 8D 4B 10 - lea rcx,[rbx+10]
bg3.exe+1431366: 33 D2 - xor edx,edx
bg3.exe+1431368: E8 83 0A CA FF - call bg3.exe+10D1DF0
bg3.exe+143136D: 4C 8B F8 - mov r15,rax
bg3.exe+1431370: 4D 85 E4 - test r12,r12
bg3.exe+1431373: 0F 84 CD 01 00 00 - je bg3.exe+1431546
}
I am using dx11, so I'm not sure if that changes anything with the functions its calling, but replacing the existing script with this worked on my end.