Le_Vagabond wrote: ↑Wed Dec 23, 2020 9:36 am
I'm gonna try to see if it applies to the ingame inventory too, that way we'd have a method to get hashes for items already obtained
You can always do what I did in the beginning: search for a known hash, then debug all found addresses till you find one that pops instructions in the debug window. I wouldn't rely on the same spot used with the Store, as I doubt it's used with normal items. Especially since there's no Preview.
So.. I opened up the
Swords window and searched for the hash of the first Sword on my end:
Challenger Sword (000001D10B517467). Found 3 addresses and debugged them. The first one shows this:
So I picked the first address in the list:
Code: Select all
ImmortalsFenyxRising.exe+292C2E4 - 4C 8B 41 10 - mov r8,[rcx+10]
And did the same -> right-click > "Find out what addresses this instruction accesses" > Double > Show as hexadecimal. Whenever you hover the mouse over each item in that tab, the instruction is hit. But it will always show the
item that is equipped. So clicking to equip each sword leads to this:
So here you go, the hashes for all the Swords in that tab displayed on the
Value column of that CE window.
The location doesn't work for Visual Customizations; I mean, you will always see the hash of the actively equipped object popping up every time you change the visual.
However.. the same location.. ImmortalsFenyxRising.exe+292C2E4.. will list all of the Visual Customizations hashes 1 time when you hit F on the item you equipped. So:
- go to:
Code: Select all
ImmortalsFenyxRising.exe+292C2E4 - 4C 8B 41 10 - mov r8,[rcx+10]
- right-click > "Find out what addresses this instruction accesses" > Double > Show as hexadecimal
- move mouse around so windows starts getting filled up with accesses of the same item (the active one)
- now press F on it and you'll see the window being filled with a lot of shit:
So that's how you get the Visual Customizations. The only thing is you need to grab them and sort them out
Also noticed this in the code:
Code: Select all
ImmortalsFenyxRising.exe+292C2E4 - 4C 8B 41 10 - mov r8,[rcx+10]
ImmortalsFenyxRising.exe+292C2E8 - 48 8B 4D B8 - mov rcx,[rbp-48]
ImmortalsFenyxRising.exe+292C2EC - 48 03 D1 - add rdx,rcx
ImmortalsFenyxRising.exe+292C2EF - 48 3B CA - cmp rcx,rdx
ImmortalsFenyxRising.exe+292C2F2 - 74 14 - je ImmortalsFenyxRising.exe+292C308
ImmortalsFenyxRising.exe+292C2F4 - 4C 39 01 - cmp [rcx],r8
ImmortalsFenyxRising.exe+292C2F7 - 0F84 2E010000 - je ImmortalsFenyxRising.exe+292C42B
ImmortalsFenyxRising.exe+292C2FD - 48 83 C1 08 - add rcx,08 { 8 }
ImmortalsFenyxRising.exe+292C301 - FF C0 - inc eax
ImmortalsFenyxRising.exe+292C303 - 48 3B CA - cmp rcx,rdx
ImmortalsFenyxRising.exe+292C306 - 75 EC - jne ImmortalsFenyxRising.exe+292C2F4
ImmortalsFenyxRising.exe+292C308 - 33 D2 - xor edx,edx
ImmortalsFenyxRising.exe+292C30A - 4C 89 74 24 28 - mov [rsp+28],r14
ImmortalsFenyxRising.exe+292C30F - 48 B8 98EBBFE8D7010000 - mov rax,000001D7E8BFEB98 { -390075496 }
ImmortalsFenyxRising.exe+292C319 - C7 45 88 00000B00 - mov [rbp-78],000B0000 { 720896 }
ImmortalsFenyxRising.exe+292C320 - 48 89 44 24 30 - mov [rsp+30],rax
ImmortalsFenyxRising.exe+292C325 - 48 8D 4D 80 - lea rcx,[rbp-80]
ImmortalsFenyxRising.exe+292C329 - 48 B8 AAEBBFE8D7010000 - mov rax,000001D7E8BFEBAA { -390075478 }
ImmortalsFenyxRising.exe+292C333 - C7 44 24 20 08000000 - mov [rsp+20],00000008 { 8 }
ImmortalsFenyxRising.exe+292C33B - 48 89 44 24 38 - mov [rsp+38],rax
ImmortalsFenyxRising.exe+292C340 - 44 8D 4A 08 - lea r9d,[rdx+08]
ImmortalsFenyxRising.exe+292C344 - 48 B8 9BFBBFE8D7010000 - mov rax,000001D7E8BFFB9B { -390071397 }
ImmortalsFenyxRising.exe+292C34E - 44 8D 42 05 - lea r8d,[rdx+05]
ImmortalsFenyxRising.exe+292C352 - 48 89 44 24 40 - mov [rsp+40],rax
ImmortalsFenyxRising.exe+292C357 - 48 B8 86EBBFE8D7010000 - mov rax,000001D7E8BFEB86 { -390075514 }
ImmortalsFenyxRising.exe+292C361 - 48 89 44 24 48 - mov [rsp+48],rax
ImmortalsFenyxRising.exe+292C366 - 48 B8 89FBBFE8D7010000 - mov rax,000001D7E8BFFB89 { -390071415 }
Curious what those 5 hashes are
EDIT: Ah, they're from the Adventure Time Bundle, which we already have.
..and the script:
Code: Select all
{$lua}
if syntaxcheck then return end
function stopExec( s )
error( print( string.format( "\r\n>> %s <<", s ) ) )
end
function aobScanEx( aob )
-- thanks panraven for this function!
-- https://forum.cheatengine.org/viewtopic.php?t=577536
-- simplified for my needs
local p, a, n, s, e = nil or '*X*W', nil or fsmNotAligned, nil or '0', getAddress( process ) or 0x0, ( getAddress( process ) + getModuleSize( process ) ) or 0xffffffffffffffff
local ms = pb and createMemScan( pb ) or createMemScan()
local fl = createFoundList( ms )
ms.firstScan( soExactValue, vtByteArray, nil, aob, nil, s, e, p, a, n, true, false, false, false )
ms.waitTillDone()
fl.initialize()
local result = nil
if fl ~= nil and fl.getCount() > 0 then
result = createStringlist()
for i = 1, fl.getCount() do result.add( fl.getAddress( i - 1 ) ) end
end
fl.destroy()
ms.destroy()
return result
end
function debugger_onBreakpoint()
local Hash = R8
print( string.format( "%016X", Hash ) )
debug_continueFromBreakpoint( co_run )
return 1
end
[ENABLE]
debugProcess()
local sym_HashOnItemAccess = getAddressSafe( "HashOnItemAccess" )
if sym_HashOnItemAccess == nil then
local aob_HashOnItemAccess = "4C8B41??488B4D??4803D1483BCA74??4C39010F"
sl = aobScanEx( aob_HashOnItemAccess )
if not sl or sl.Count < 1 then stopExec( "'aob_HashOnItemAccess' not found." ) end
t = tonumber( sl[0], 16 ) + 0x4
unregisterSymbol( "HashOnItemAccess" )
registerSymbol( "HashOnItemAccess", t, true )
end
HashOnItemAccess = getAddressSafe( "HashOnItemAccess" )
if HashOnItemAccess ~= nil then
debug_setBreakpoint( HashOnItemAccess )
end
[DISABLE]
debugger_onBreakpoint = nil
if HashOnItemAccess ~= nil then
debug_removeBreakpoint( HashOnItemAccess )
end
--[[
ImmortalsFenyxRising.exe+292C2E4 - 4C 8B 41 10 - mov r8,[rcx+10]
ImmortalsFenyxRising.exe+292C2E8 - 48 8B 4D B8 - mov rcx,[rbp-48]
ImmortalsFenyxRising.exe+292C2EC - 48 03 D1 - add rdx,rcx
ImmortalsFenyxRising.exe+292C2EF - 48 3B CA - cmp rcx,rdx
ImmortalsFenyxRising.exe+292C2F2 - 74 14 - je ImmortalsFenyxRising.exe+292C308
ImmortalsFenyxRising.exe+292C2F4 - 4C 39 01 - cmp [rcx],r8
ImmortalsFenyxRising.exe+292C2F7 - 0F84 2E010000 - je ImmortalsFenyxRising.exe+292C42B
ImmortalsFenyxRising.exe+292C2FD - 48 83 C1 08 - add rcx,08 { 8 }
ImmortalsFenyxRising.exe+292C301 - FF C0 - inc eax
ImmortalsFenyxRising.exe+292C303 - 48 3B CA - cmp rcx,rdx
ImmortalsFenyxRising.exe+292C306 - 75 EC - jne ImmortalsFenyxRising.exe+292C2F4
ImmortalsFenyxRising.exe+292C308 - 33 D2 - xor edx,edx
ImmortalsFenyxRising.exe+292C30A - 4C 89 74 24 28 - mov [rsp+28],r14
ImmortalsFenyxRising.exe+292C30F - 48 B8 98EBBFE8D7010000 - mov rax,000001D7E8BFEB98 { -390075496 }
ImmortalsFenyxRising.exe+292C319 - C7 45 88 00000B00 - mov [rbp-78],000B0000 { 720896 }
ImmortalsFenyxRising.exe+292C320 - 48 89 44 24 30 - mov [rsp+30],rax
ImmortalsFenyxRising.exe+292C325 - 48 8D 4D 80 - lea rcx,[rbp-80]
ImmortalsFenyxRising.exe+292C329 - 48 B8 AAEBBFE8D7010000 - mov rax,000001D7E8BFEBAA { -390075478 }
ImmortalsFenyxRising.exe+292C333 - C7 44 24 20 08000000 - mov [rsp+20],00000008 { 8 }
ImmortalsFenyxRising.exe+292C33B - 48 89 44 24 38 - mov [rsp+38],rax
ImmortalsFenyxRising.exe+292C340 - 44 8D 4A 08 - lea r9d,[rdx+08]
ImmortalsFenyxRising.exe+292C344 - 48 B8 9BFBBFE8D7010000 - mov rax,000001D7E8BFFB9B { -390071397 }
ImmortalsFenyxRising.exe+292C34E - 44 8D 42 05 - lea r8d,[rdx+05]
ImmortalsFenyxRising.exe+292C352 - 48 89 44 24 40 - mov [rsp+40],rax
ImmortalsFenyxRising.exe+292C357 - 48 B8 86EBBFE8D7010000 - mov rax,000001D7E8BFEB86 { -390075514 }
ImmortalsFenyxRising.exe+292C361 - 48 89 44 24 48 - mov [rsp+48],rax
ImmortalsFenyxRising.exe+292C366 - 48 B8 89FBBFE8D7010000 - mov rax,000001D7E8BFFB89 { -390071415 }
ImmortalsFenyxRising.exe+292C370 - 48 89 44 24 50 - mov [rsp+50],rax
ImmortalsFenyxRising.exe+292C375 - 48 8D 45 90 - lea rax,[rbp-70]
ImmortalsFenyxRising.exe+292C379 - 48 89 45 80 - mov [rbp-80],rax
]]
BR,
Sun