Aquanox: Deep Descent [Engine:Unreal 4.20]

[SunBeam]

[ 17 Oct 20 - Hit #1 ]

Game Name: Aquanox: Deep Descent
Game Vendor: Steam [ won't work with Windows Store version! ]
Game Version: 33383 [ in-game, Esc and check bottom-right ]
Game Process: ANX-Win64-Shipping.exe
Game File Version: 4.20.3.0



Hello folks.

Attached below is a DLL that will do the following:

• Run threaded UE4 code to create the UConsole UObject, member of GameViewportClient; you may then use Tilde (~) key to open up the console. As far as what you can or can't do with the console, well.. I'm not the game developer You'll have to google around for commands, test stuff out and return with feedback. As opposed to just asking "what are the commands?" and doing nothing about it, waiting to be spoon-fed.

• Will dump the UE4 FNameArray and UObjectArray, along with their addresses. What this means is you can then know what the fuck you're looking at in memory, when debugging/tracing or mapping structures, and come up with your own conclusions. Just like I did with my table below.

AquanoxDeepDescent_Console_Dumper.zip

pass: sunbeam

(209.86 KiB) Downloaded 266 times

[ fixed the crashes ]


Instructions:

• Download the archive; extract content to a folder of your choice.

• Run the game, get to main menu.

• Run IGCSInjector.exe. You can close it when asked.

• Takes 1-2 seconds for the DLL to find the stuff, StaticCreate the Console UObject and dump Names/Objects to disk in the Win64 folder.

• You may then use Tilde (~) key to open up the console in-game.

Notes:

• The dump location is your game folder (e.g.: C:\SteamLibrary\steamapps\common\Aquanox Deep Descent\ANX\Binaries\Win64). You will find 2 files there: NamesDump.txt and ObjectsDump.txt. You'll be very interested in the 2nd one

• The .txt files are generated at "run-time". What this means is if you transition in-game from one map to another or from main menu to game world and backwards, you need to re-dump them. Why? UE4 destroys and recreates UObjects; re-initialization. To re-dump the .txt files press Numpad / (no, key can't be changed).

The below are ANX_CheatManager's own console commands. These translate to UFunctions being executed within the Engine, as you type and execute them in the console. Please be advised that:

• not all of them are guaranteed to do anything; I'm listing them cuz I found them in the dump

• no, I don't know what "X" command does; you will have to find out on your own; I should update the post later with what I discover

Cheats

AddPlayerKill --> works
AutoSave --> works
BuyAllShips --> works
BuyAllWeapons --> works
ChangeAimHelperAngle
ChangeMap <StrProperty> --> works; figure out the map names
ChangeZone
CompleteQuest
CopyPlayerPositionToClipboard
Debug_ShowLoadedLevel
DebugAimHelper
DebugTargetLock
DebugToggleShowActiveAI
DebugToggleShowActorNames
DebugToggleShowActors
DebugToggleShowDistanceFromWorldOrigin
DebugZoneMapVisited
DetectNewPersistentActors
DumpActorTypes
DumpAIStats
DumpComponentCount
DumpEmitterCount
EnableConversationDebugger
EnableQuestDebugging
EnableShip
EndMatch
FailQuest
FindRouteToZone
FlyAway
FlyBack
ForceCrash
ForceOriginShift
GameOver
Goto
Heal --> works
InfiniteAmmo --> doesn't do anything
Invincible --> works
Invisibility --> works
Kill
LoadCurrentZone
LoadGame
MakeAllZonesInvisibleButTheActiveOne
MakeAllZonesVisible
PERF_ToggleMinimap
PERF_ToggleMovement
PERF_ToggleShipTick
PickItem
PrintIgnoreActors
ResetMinimap
ResetQuests
ResetWorldOrigin
Respawn
Respawn_Coop
RestartMatch
SaveGame
SetDodgeImpulsePower
SetLastVisitedCheckpoint
SetPreset
SetStat
ShowCheckPoints
ShowLoadingScreen
ShowMouseHits
ShowQuestTrigger
SpawnActor
SpawnEnemy
StartMatch
StartQuest
StopCutscene
Suicide
Switch
TogglePause_Coop
Turbo --> works, but can't understand the effect
UnloadCurrentZone
UnlockAllItems --> works
WhoIsYourDaddy --> works, but can't understand the effect

Test them and report functionality (if they do anything or not).


Here's a helper table; it doesn't contain much but a useful hook and listing of some incipient stuff. More, later.

ANX-Win64-Shipping.CT

1.0

(16.93 KiB) Downloaded 239 times

BR,
Sun

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[ShadowRyku]

My game crashes when I start the IGCSInjector.exe

[SunBeam]

My game crashes when I start the IGCSInjector.exe

Thanks for literally saying nothing; it doesn't help me figure out a damn thing. I won't pull your tongue to provide more information, you know.. I can only ASSUME you're playing the Windows Store version..

5 downloads, 1 complaint. Let's see if this is a generic issue or isolated.

[Csimbi]

Hi SunBeam,
I have the crash, too.
What would you need from me to troubleshoot this?
Windows 7 says:
Problem signature:
Problem Event Name: APPCRASH
Application Name: ANX-Win64-Shipping.exe
Application Version: 4.20.3.0
Application Timestamp: 5f86f8af
Fault Module Name: ANX.dll
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 5f8aeb52
Exception Code: c0000005
Exception Offset: 000000000000b4c3
OS Version: 6.1.7601.2.1.0.256.1
Locale ID: 1033
Additional Information 1: f068
Additional Information 2: f068a113386cd0c510366cfde95557a3
Additional Information 3: de2d
Additional Information 4: de2df10fcf67be6aa769842523da7890
Thank you!

[ShadowRyku]

My game crashes when I start the IGCSInjector.exe

Thanks for literally saying nothing; it doesn't help me figure out a damn thing. I won't pull your tongue to provide more information, you know.. I can only ASSUME you're playing the Windows Store version..

5 downloads, 1 complaint. Let's see if this is a generic issue or isolated.

I can say much more, when I start the IGCSInjector.exe, Aquanox crashs and I cant send a report to the developers.
And I play the Steamversion.

[Csimbi]

Did some testing.
It crashes only in the Tutorial, it does not crash in the Campaign.
Is it crashing for any of you in the Campaign?

[SunBeam]

I can say much more, when I start the IGCSInjector.exe, Aquanox crashs and I cant send a report to the developers.
And I play the Steamversion.

Yes you can; you can tell me where you were in-game when you ran the injector. You seem to consider not sharing that information won't help, from the looks of it.

[ShadowRyku]

I can say much more, when I start the IGCSInjector.exe, Aquanox crashs and I cant send a report to the developers.
And I play the Steamversion.

Yes you can; you can tell me where you were in-game when you ran the injector. You seem to consider not sharing that information won't help, from the looks of it.

I was in the Main Menu, as you wrote in the instructions and I aslo tried in game.

[Csimbi]

Hi SunBeam,
great job with the dumper!
Here's the table I built with its help.

Note: CE 7.2 beta is required.
Those of you without it must do some work. Namely, replace these with the correct symbols in the script:

Code: Select all

unregistersymbol(*)
dealloc(*)

The table includes a single AOB script that should work with most versions out there.
The table gives you:
- Min. Money; your cash balance will be set to this value when smaller, while you are at the mechanic/store.
- Player Damage Mod; allows you to scale the damage done to your ship (not the shield, I could not care less about that).
- Non-player Damage Mod; allows you to scale the damage done ships other than yours (not the shield, I could not care less about that). This includes your allies, too!
- Infinite Ammo; no comment
- Deadeye; 100% accuracy
- No Recoil; disables camera shake on weapon fire
- Fire Delay Mod; allows you to scale the delay between shots.
- Reload Time Mod; allows you to scale the time it takes to chamber the next ammo (e.g. shotgun, breaker).
- Weapon Range Mod; allows you to scale the range of your weapons.
- Turn Rate Mod; allows you to scale the responsiveness of your ship
- Acceleration Mod; allows you to scale the responsiveness of your ship
- Deceleration Mod; allows you to scale the responsiveness of your ship. Ideally, this is set to the same value as Acceleration Mod.
- Max Speed Mod; allows you to scale the speed of your ship
- Boost Acceleration Mod; same as Acceleration Mod, but applies to boost only.
- Boost Speed Mod; same as Max Speed Mod, but applies to boost only.
- Boost Consumption Mod; allows you to scale the rate of boost energy consumption
- Scan Speed Mod; allows you to scale the rate at which deposits in range are scanned.

Done with the game, no more stuff from me.

Again, great stuff SunBeam, thanks!

Update #1
- Added Deceleration Mod
- Added No Recoil

Update #2
- Added Turn Rate Mod
- Added Boost Acceleration Mod
- Added Boost Speed Mod

Update #3
- Added Boost Consumption Mod - forgot to integrate with the previous table.

Update #4
- Added Weapon Range Mod.
- Added Scan Speed Mod.

Update #5
- Fixed a bug that prevented AI ships from moving properly at times.

Update #6
- Added Min. Money.

Update #7
- Added Reload Time Mod; got a shotgun so I could test this finally.

[SunBeam]

...

You can also add "Fire Range" to the above. It's at 0x7A0 in the Weapon structure; 0x7A4 is bInfiniteAmmo.



It's pimp to fire from faaaar away We're also missing a "ghost" functionality, that'd allow you to walk through walls. Some maps lock paths that you previously took, like here:



See the mini-map; I know you can go in there, cuz that's the Jelly-fish mission and I forgot to scan a resources deposit (yup, trying to clear entire map out). I'll see what I can do about it

EDIT #1: Never mind. Just use toggledebugcamera console command, go to the spot you want, then use teleport command. Then run toggledebugcamera again to disable it and you're in To make the camera move faster use the mouse wheel (wheel forward - increase speed; wheel backwards - decrease speed). Also note that teleport command will teleport your ship to the spot the camera points to; so try not to point in the ground, will you?

EDIT #2: You can also summon stuff. For example: summon BP_Commodity_PickupItem_Money_C will spawn and give you 1 Credit Not sure if you can manipulate how many you wanna spawn. Others are here:

Code: Select all

Line 43446: [00043445] 0x000001AE641A4980 Package BP_Commodity_ScrapMetal
Line 43447: [00043446] 0x000001AE641A5380 Package BP_Commodity_PolarizedNanoPlankton
Line 43448: [00043447] 0x000001AE641A52E0 Package BP_Commodity_Nickel
Line 43449: [00043448] 0x000001AE641A5600 Package BP_Commodity_NanoPlankton
Line 43450: [00043449] 0x000001AE641A7AE0 Package BP_Commodity_IronDeposit
Line 43451: [00043450] 0x000001AE641A7A40 Package BP_Commodity_GlowShard
Line 43452: [00043451] 0x000001AE641A79A0 Package BP_Commodity_Fuel
Line 43453: [00043452] 0x000001AE641A7B80 Package BP_Commodity_Cobalt
Line 43454: [00043453] 0x000001AE641A7900 Package BP_Commodity_BreathingGas
Line 43455: [00043454] 0x000001AE641A77C0 Package BP_Commodity_Acid
Line 62384: [00062383] 0x000001AE215AE700 Package BP_Commodity_PickupItem_Master
Line 65554: [00066577] 0x000001AE5E302A40 Package BP_Commodity_PickupItem_Acid
Line 65555: [00066578] 0x000001AE5E302B80 Package BP_Commodity_PickupItem_BreathingGas
Line 65556: [00066579] 0x000001AE5E302AE0 Package BP_Commodity_PickupItem_Cobalt
Line 65557: [00066580] 0x000001AE5E302C20 Package BP_Commodity_PickupItem_Fuel
Line 65558: [00066581] 0x000001AE4EB145C0 Package BP_Commodity_PickupItem_GlowShard
Line 65559: [00066582] 0x000001AE4EB143E0 Package BP_Commodity_PickupItem_IronDeposit
Line 65560: [00066583] 0x000001AE4EB14520 Package BP_Commodity_PickupItem_NanoPlankton
Line 65561: [00066584] 0x000001AE4EB14480 Package BP_Commodity_PickupItem_Nickel
Line 65562: [00066585] 0x000001AE4EB14200 Package BP_Commodity_PickupItem_PolarizedNanoplankton
Line 65563: [00066586] 0x000001AE4EB142A0 Package BP_Commodity_PickupItem_ScrapMetal

Remember they can only be spawned if suffixed with _C (see my example with Money).

EDIT #3: Yeah, you can't give it parameters, as it spawns just 1 Actor of that Class -> [Link]

EDIT #4: OK, so let's do this.. I found this CheatManager command:

Code: Select all

[00020098] 0x000001AE6138A3C0 Function ANX.ANX_CheatManager.PickItem
[00020099] 0x000001AE6136D200 StructProperty ANX.ANX_CheatManager.PickItem.NewItem
[00020100] 0x000001AE6136D180 ObjectProperty ANX.ANX_CheatManager.PickItem.Pawn

So the function would be PickItem( NewItem, Pawn ). Those are the function's arguments. Now.. in the console, you'd need to type them with one space between them -> PickItem <item> <ship>. We know Pawn is our Character, which is a ship. Meaning this:

Code: Select all

[00260212] 0x000001AE1CDD8080 BP_Ship_Player_Coop_C World.World.PersistentLevel.BP_Ship_Player_Coop_C_1

Since I don't want to be bothered finding out my Character's internal name, I will use the Server equivalent for the CheatManager function:

Code: Select all

[00023454] 0x000001AE61445080 Function ANX.ANX_PlayerController_Base.ServerPickItem
[00023455] 0x000001AE61434E00 StructProperty ANX.ANX_PlayerController_Base.ServerPickItem.NewItem

In case you didn't know, when you launch the game (at least on Steam), you run it as a server:



Back to our function, as you can see, there's just 1 parameter, "NewItem" and this is a StructProperty. Now if I check the memory of this StructProperty (address 1AE61434E00), I see this:



How did I know to look there? I didn't. I just checked the memory space to see what's useful. Saw that pointer and decided to look it up in my ObjectsDump.txt file. And found this for 000001AE60D5EC00:

Code: Select all

[00007189] 0x000001AE60D5EC00 ScriptStruct ANX.InventoryItem // <-- our address
[00007190] 0x000001AE60FBDA00 ClassProperty ANX.InventoryItem.ItemClass
[00007191] 0x000001AE60F0B7D0 IntProperty ANX.InventoryItem.Quantity

So the StructProperty requires 2 elements of InventoryItem type: Class and Quantity. So we'll need to provide those. The command then turns into: ServerPickItem NewItem and if I recall correctly, a struct in console is defined by (). Which means: ServerPickItem (ItemClass,Quantity). Do we have the class? We do; here's an example:

Code: Select all

[00043613] 0x000001AE63CFCD00 BlueprintGeneratedClass BP_Commodity_Cobalt.BP_Commodity_Cobalt_C

So this turns into: ServerPickItem (BP_Commodity_Cobalt_C,100). All fine and dandy, but it doesn't run:



The FIRST thing you should think about when an UFunction doesn't run is "is the function executable?". There is a flag in UE4 source code called UFUNC_Exec. Its value is 0x200. What we need to do is make the function executable. So, in my case:

Code: Select all

[00023454] 0x000001AE61445080 Function ANX.ANX_PlayerController_Base.ServerPickItem

Go to that address in memory and check offset 0xB0:



How did I know the offset? I didn't. From experience I know the function being executed is usually in that area (0xB0, 0xC0).

So where are the flags, you ask? Well.. offset 0x88. I also know this from experience; I know where to look:



Notice the last 2 bytes are 0CC0. We need to flip this to OR(0xCC0,0x200). I usually do OR as a PLUS. Meaning CC0+200. Meaning C+2 = E. So set that 0CC0 to 0EC0 and you're good to go:



Let's try that function now:



OK, now we know the function/command works. Still need to tweak the parameter. Hmm..

[Csimbi]

You can also add "Fire Range" to the above. It's at 0x7A0 in the Weapon structure; 0x7A4 is bInfiniteAmmo.

Thanks, seen it, but I am still in the area where the game starts - only one weapon, no real distance, just tight corridors.

I wasted a lot of time on interaction range.
What I wanted to achieve is picking up iron deposits from slightly longer distance.
I could hack the interaction range, but it won't trigger until the deposit is marked as 'completed' for scanning.
Not sure how the scanning works because it's only 5 steps or so - very hard to catch the value in action.

That Tut you posted above.
How do I get to the actual code? (that runs so I can debug?)
I found a bunch of interesting-sounding UFunctions, I set a BP for the code pointed to by its 0xB0 offset, but often times it won't run.
It it runs, but it seems to be doing something else than I expected.

[SunBeam]

^ Any UFunction in this game has its executable function (the real one) at offset oxB0 in the UObject. Find "Function" lines in the .txt, go to their addresses in memory. 0x88 represents the function flags, 0xB0 the execution function. When you get to the execution function you might see a wrapper, which exits with a JMP or has its last call leads to the actual function that runs. That's probably why you didn't get it to break.

Post here what you wanna test out, function name and all.

[Csimbi]

Post here what you wanna test out, function name and all.

Thanks!
Can't recall anymore, will do next time.
In the meantime, I added weapon range mod for you.
Does it work with weapons other than the machinegun? (that's the only one I have right now)

[Zanzer]

Added a few more offsets to various components on the Character object.

Haven't drilled down into them to see what types of variables they've got.

Saw a few things for scan range and harvest zones.

Haven't actually made it past the tutorial yet.

[Csimbi]

Added a few more offsets to various components on the Character object.

Haven't drilled down into them to see what types of variables they've got.

Saw a few things for scan range and harvest zones.

Haven't actually made it past the tutorial yet.

That Pawn.HarvestZone is only set when you are in it.
Pawn.ScanRange is not what you'd think.