Assassin's Creed 1 Director's Cut Dx10 (Steam & GOG)

[Paul44]

Assassin's Creed 1 Director's Cut Dx10 - Steam & GOG
(no difference between 2 vs except for steam stub in game launcher)


Features:
- Player status (health, godmode, invisible, lock consumables, knifes, no fall damage)
- 1-Hit Kill
- Teleport & Coordinates (incl free roam, cam distance, icon teleport, save/restore coordinates)
- Freeze mission timer


- UPDATE 1 - v3.4:
- no Fall damage (when falling from heights)

- UPDATE 2 - v3.6
Added:
- Free Roam (in analogy to AC BF for example)
- Cam Distance (FOV)
ps: did not play game; just tested on both DX9/10. Everything stayed pretty much the same, except for Teleport routine. On just 1 occassion, this script would not enable and made the game crash (but that happened during all sorts of testing). Anyways: report if you're getting issues...

- UPDATE 3 - v3.8
Added: Build icon list... This feature will allow you to get coordinates for both flags & templars. Unfortunately, I have not (yet) found a way to have them shown on the map (works quite differently compared to future titles).
ps: only added list; nothing else has been touched and should still work fine.

- UPDATE 4 - v4.1
* Updated health script (was still given some probs during certain mission); should be ok now... finally.
* Update Freeze timer, based on my ACU/S experience
* Added: list (xls) of all flags/templar coordinates (for use w/ teleport): [ [Link] ]
(tip: use xls to note down which ones you've collected already; or you still need to revisit each and everyone again...!)

- UPDATE 5 - v4.2
Minor/important updates (related to CE pre-v7.x ~ Tools crash solved)
GUI update: based on AC BF experience (see also readme file)

- UPDATE 6 - v4.6
Changed:
* No Fall Damage (previously called Godmode, which is was not actually)
* 1-Hit Kill cheat: NPCs are no longer "touched"
Note: if you come across an enemy NOT handled, let me know...! (I possibly need to include his identifier)
* Teleport: solved a bug in combo with No Fall Damage
* Freeze Timer: did not seem to work anymore on my PC (if it stops working on your side now, let me know)
* Tools: added additional tests, and 'simple teleport' option
* Table updated to my latest framework/featureset

- UPDATE 7 - v5.0
* Icon Teleport ~ Build Icon Lists: completely revamped (far more practical, using Form !)
* GUI backend updated to latest release
* Note: only extensively tested icon teleport (did not touch anything else)
-EDIT-
* some minor updates (more conform with my other AC tables)
* Icon Teleport: now running async

- UPDATE 8 - v5.1
* GUI backend updated to latest release
* complete revamp of Free Roam feature (mouse-controlled now)
* added: save & restore coordinates

- UPDATE 9 - v5.2
* added: godmode
* changed: using [Ctrl+T] now to teleport
* changed: removed check teleport (seems more "stable" ?!)
* added: skip Bink videos
-EDIT-
* reshuffled cheat list (makes more sense)
* updated: collect health (caused occassional crashes during free roam)
* updated: bink skip auto-close
* updated: system timer mechanism (~ show info)
=> do report back if you get more crashes; you should have less if any now !

- UPDATE 10 - v5.4b
* impossible to hide while 'invisibible' fixed (reported by #RandomCOG)


- Readme updated accordingly !

If you are using a different vs, and the table works for you, let us know. If it doesn't, upload game exe so that I can have a look at it... (additional info is added, primarily in scripts)
Please, report back when having crashing issues. And make sure you can reproduce it; so that I have something to go on !

ps: no longer supporting DX9 vs; too much hazzle and nobody will/should be using it anyways...

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[paul44frf]

Other table by #HeyImKilian: [ viewtopic.php?f=4&t=1997 ]

[x-hex-x]

I made a table for super speed and super jump. The basis for super speed is a post about AC: Brotherhood's super speed from user reverser69 (viewtopic.php?p=174091#p174091), a lot of thanks to him.

Super speed code:

Code: Select all

{
  Author : hex
}

[ENABLE]

aobscanmodule(pSpeed,AssassinsCreed_Dx9.exe,F3 0F 10 46 7C 89)
alloc(newmem,$1000)
alloc(bSuperSpeed,1)
alloc(pSpeedValue,4)

registersymbol(bSuperSpeed)
registersymbol(pSpeedValue)

label(code)
label(lJump)
label(return)

//Need to replace the jne opcode with jmp, otherwise the game will change the value to the default value of 1.00.
pSpeed+F:
db EB

bSuperSpeed:
db 1

pSpeedValue:
dd (float)1.75

newmem:
cmp byte ptr [bSuperSpeed],01
jne code
cmp byte ptr [esi+A8],01
jne code
movss xmm0,[pSpeedValue]
jmp lJump

code:
  movss xmm0,[esi+7C]

lJump:
  jmp return

pSpeed:
  jmp newmem
return:
registersymbol(pSpeed)

[DISABLE]

pSpeed+F:
db 75

pSpeed:
  db F3 0F 10 46 7C

unregistersymbol(*)
dealloc(*)

{
// ORIGINAL CODE - INJECTION POINT: AssassinsCreed_Dx9.exe+E53B2

AssassinsCreed_Dx9.exe+E5386: 81 EC F4 00 00 00        - sub esp,000000F4
AssassinsCreed_Dx9.exe+E538C: 53                       - push ebx
AssassinsCreed_Dx9.exe+E538D: 8B D9                    - mov ebx,ecx
AssassinsCreed_Dx9.exe+E538F: F6 83 4C 01 00 00 08     - test byte ptr [ebx+0000014C],08
AssassinsCreed_Dx9.exe+E5396: 56                       - push esi
AssassinsCreed_Dx9.exe+E5397: 57                       - push edi
AssassinsCreed_Dx9.exe+E5398: 0F 84 C8 03 00 00        - je AssassinsCreed_Dx9.exe+E5766
AssassinsCreed_Dx9.exe+E539E: F6 83 F8 09 00 00 02     - test byte ptr [ebx+000009F8],02
AssassinsCreed_Dx9.exe+E53A5: 8B 83 A0 01 00 00        - mov eax,[ebx+000001A0]
AssassinsCreed_Dx9.exe+E53AB: 8B B4 83 6C 01 00 00     - mov esi,[ebx+eax*4+0000016C]
// ---------- INJECTING HERE ----------
AssassinsCreed_Dx9.exe+E53B2: F3 0F 10 46 7C           - movss xmm0,[esi+7C]
// ---------- DONE INJECTING  ----------
AssassinsCreed_Dx9.exe+E53B7: 89 74 24 2C              - mov [esp+2C],esi
AssassinsCreed_Dx9.exe+E53BB: F3 0F 11 44 24 0C        - movss [esp+0C],xmm0
AssassinsCreed_Dx9.exe+E53C1: 75 0E                    - jne AssassinsCreed_Dx9.exe+E53D1
AssassinsCreed_Dx9.exe+E53C3: F3 0F 10 05 90 0F 68 01  - movss xmm0,[AssassinsCreed_Dx9.exe+1280F90]
AssassinsCreed_Dx9.exe+E53CB: F3 0F 11 44 24 0C        - movss [esp+0C],xmm0
AssassinsCreed_Dx9.exe+E53D1: 8D 4C 24 60              - lea ecx,[esp+60]
AssassinsCreed_Dx9.exe+E53D5: 51                       - push ecx
AssassinsCreed_Dx9.exe+E53D6: 8B 8B 80 01 00 00        - mov ecx,[ebx+00000180]
AssassinsCreed_Dx9.exe+E53DC: E8 FF DC 00 00           - call AssassinsCreed_Dx9.exe+F30E0
AssassinsCreed_Dx9.exe+E53E1: F3 0F 10 40 08           - movss xmm0,[eax+08]
}

Super jump code:

Code: Select all

{
  Author : hex
}

[ENABLE]

aobscanmodule(pJump,AssassinsCreed_Dx9.exe,F3 0F 10 25 ?? ?? ?? ?? F3 0F 5A D1)
alloc(newmem,$100,pJump)
alloc(bSuperJump,1)
alloc(pJumpValue,4)

registersymbol(bSuperJump)
registersymbol(pJumpValue)

label(code)
label(lJump)
label(return)
label(origCode)
registersymbol(origCode)

bSuperJump:
db 1

pJumpValue:
dd (float)7.00

newmem:
cmp byte ptr [bSuperJump],01
jne code
movss xmm4,[pJumpValue]
jmp lJump
code:
readmem(pJump,8)
lJump:
  jmp return

origCode:
readmem(pJump,8)

pJump:
  jmp newmem
  nop 3
return:
registersymbol(pJump)

[DISABLE]

pJump:
  readmem(origCode,8)

unregistersymbol(*)
dealloc(*)

{
// ORIGINAL CODE - INJECTION POINT: AssassinsCreed_Dx9.exe+71F88E

AssassinsCreed_Dx9.exe+71F865: F2 0F 5C D3                 - subsd xmm2,xmm3
AssassinsCreed_Dx9.exe+71F869: F3 0F 5A 9C 24 8C 00 00 00  - cvtss2sd xmm3,[esp+0000008C]
AssassinsCreed_Dx9.exe+71F872: F2 0F 59 D3                 - mulsd xmm2,xmm3
AssassinsCreed_Dx9.exe+71F876: 0F 57 DB                    - xorps xmm3,xmm3
AssassinsCreed_Dx9.exe+71F879: F2 0F 5E CA                 - divsd xmm1,xmm2
AssassinsCreed_Dx9.exe+71F87D: F2 0F 5A C9                 - cvtsd2ss xmm1,xmm1
AssassinsCreed_Dx9.exe+71F881: F3 0F 5A D1                 - cvtss2sd xmm2,xmm1
AssassinsCreed_Dx9.exe+71F885: 66 0F 2F DA                 - comisd xmm3,xmm2
AssassinsCreed_Dx9.exe+71F889: 72 03                       - jb AssassinsCreed_Dx9.exe+71F88E
AssassinsCreed_Dx9.exe+71F88B: 0F 57 C9                    - xorps xmm1,xmm1
// ---------- INJECTING HERE ----------
AssassinsCreed_Dx9.exe+71F88E: F3 0F 10 25 90 0F 68 01     - movss xmm4,[AssassinsCreed_Dx9.exe+1280F90]
// ---------- DONE INJECTING  ----------
AssassinsCreed_Dx9.exe+71F896: F3 0F 5A D1                 - cvtss2sd xmm2,xmm1
AssassinsCreed_Dx9.exe+71F89A: 66 0F 2F 15 98 0F 68 01     - comisd xmm2,[AssassinsCreed_Dx9.exe+1280F98]
AssassinsCreed_Dx9.exe+71F8A2: 72 05                       - jb AssassinsCreed_Dx9.exe+71F8A9
AssassinsCreed_Dx9.exe+71F8A4: 0F 28 DC                    - movaps xmm3,xmm4
AssassinsCreed_Dx9.exe+71F8A7: EB 03                       - jmp AssassinsCreed_Dx9.exe+71F8AC
AssassinsCreed_Dx9.exe+71F8A9: 0F 28 D9                    - movaps xmm3,xmm1
AssassinsCreed_Dx9.exe+71F8AC: F3 0F 10 4C 24 70           - movss xmm1,[esp+70]
AssassinsCreed_Dx9.exe+71F8B2: F3 0F 10 54 24 68           - movss xmm2,[esp+68]
AssassinsCreed_Dx9.exe+71F8B8: 0F 5A F1                    - cvtps2pd xmm6,xmm1
AssassinsCreed_Dx9.exe+71F8BB: 0F 5A FA                    - cvtps2pd xmm7,xmm2
}

Super jump note: this function works not only for Altair, but for all NPCs, if anyone succeeds in "separating" the player from the rest of the NPCs, it will be just great, but I couldn't do that, even with the use of "dissect data/structures". Also, sometimes the jump may not work correctly if you are jumping off a ledge.
I also hope that someone will be able to modify code for a super jump and make it only better, so that the jump works like a super jump in AC III or AC: Black Flag

[Paul44]

^ nice job. did a quick try last night. if you replace 'AssassinsCreed_Dx9.exe' by '$process' the table will work for both exe's !
I recall testing that for AC2, but had to finetune the code for situations like swimming, hiding_spots, etc; causing "can't recall what exactly" behaviour

[x-hex-x]

^ nice job. did a quick try last night. if you replace 'AssassinsCreed_Dx9.exe' by '$process' the table will work for both exe's !
I recall testing that for AC2, but had to finetune the code for situations like swimming, hiding_spots, etc; causing "can't recall what exactly" behaviour

Thanks, i'd be very grateful if u could add these two functions to your great table : D
I also have a super speed and super jump table for the rest of the game series, up to AC: Syndicate. I will share soon

[Sumber]

Good work for your cheat table, all functionalities work like a charm, extending the FOV however causes the picture to stutter (i play in 4k, if that matters). Would be great if you could fix that.

But above all, you should implement the possibility of extending the look-up of the camera. It is insanely limited in the game.

Thank you again for your efforts.

[Paul44]

^ that kind of 'technicality' is not really my forte (nor in my interestzone); can't even remember how/where i got it from.
As for the stutter, that could mean a few things (!?), including the game simply not able to coop with that resolution (don't ask, don't know). a "simple" test - bring down your actual screenres to 1920x1280 for example - might tell you more...

[Sumber]

Well, I have already thought to see if the issue persists in a lower resolution, but… I want to play only in 4K.

Anyway, switching to a lower resolution doesn’t resolve this problem for me. So the cause of this issue muss be addressed elsewhere.

Since this problem seems to only affect my computer, you should better not worry about it too much. However, the horrible glowing on enemies that is used by the game for targeting them affects all players and if you could do something against it, I think the whole community would be very thankful for that.

[Gear2ndGandalf]

I did find a way to let you look up further and the glow on the enemies and players is a mechanic of the game that we have to live with and is fine lol.

But I cannot seem to find the flag collectibles I keep scanning for 4 byte addresses every time I pick one up it’s driving me nuts.

Nice table btw it has a lot and is really advanced LUA scripting. Though I can’t seem to get the main script or any scripts to activate. IDK it may be my AMD Ryzen 9 7950x processor. I could not get this game to even run for the longest time because my CPU is new and I had to find a work-around using power shell to launch the game’s dx10.exe.

That’s probably why I can’t get the scripts to function.

Update: Running table 5.1 btw

[Paul44]

^ if a script does not enable, right-click it which will/should show you an error (most of the time). My educated guess is that it will give you an AOB error... which basically means CE can not find that byte-string in memory... which usually indicates you are running a different game vs/exe ?! So:
a. get me that error (or a link to prtscrn)
b. tell me which game vs you are running (if cracked, which one) ? if you do run a Director vs, upload your exe, and pm link.
(just an fyi: i won't be doing any work on other vs then the Director one)

ps: we'll tackle the "flag collectibles" (?) issue once we get you running...

[Gear2ndGandalf]

A.

B. Steam Director's Cut version "AssassinsCreed_Dx10.exe" [Not Cracked]

The error is on line 18. It is also on every line in every script that has globalalloc command.

[Paul44]

^ that should not happen at all. did a quick search @CEF, nothing related. But... [ viewtopic.php?t=13926&start=750 ] this came up as well ?! Iow disable your AV and see what happens. If it got solved, then add the AC folder to your 'exclusion list' (which should be done by default for all your games btw ~ which is why i always work with a main Game folder, and install every game as subfolder; since only 1 folder to add to your AV then)... (you might need to reboot)

ps: if that did not help, remove the ',$process' from that line, press [ok] to save; and enable again. if you get to the next alloc line, then do this for all other allocs...

[Gear2ndGandalf]

I placed my steam library in the exclusion zone for Windows Defender but I also had to erase ,$process on line 18 and your table worked. I really do like that free roam script it's really an amazing thing!


BTW, here's some stuff you might find interesting.

NPC Codes

Force NPCs To Walk: [Line 22: 0 = Walk | 1 = Run]

Code: Select all

{ Game   : AssassinsCreed_Dx10.exe
  Version: 1.0
  Date   : 2023-05-12
  Author : Gear2

  Force NPC to walk.
}

[ENABLE]

assert("AssassinsCreed_Dx10.exe"+B4DD44,F3 0F 10 8E E8 05 00 00 0F)
define(movement_mode,"AssassinsCreed_Dx10.exe"+B4DD44)
registersymbol(movement_mode)
alloc(newmem,$1000)

label(code)
label(return)

newmem:
  cmp [esi+6C8],0
  je code
  mov [esi+5E8],0 // 0=Walk 1=Run
  movss xmm1,[esi+000005E8]
  jmp return

code:
  movss xmm1,[esi+000005E8]
  jmp return

movement_mode:
  jmp newmem
  nop 3
return:

[DISABLE]

movement_mode:
  db F3 0F 10 8E E8 05 00 00

unregistersymbol(movement_mode)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: AssassinsCreed_Dx10.exe+B4DD44

AssassinsCreed_Dx10.exe+B4DD21: 8B 8C 24 E4 00 00 00     - mov ecx,[esp+000000E4]
AssassinsCreed_Dx10.exe+B4DD28: 64 89 0D 00 00 00 00     - mov fs:[00000000],ecx
AssassinsCreed_Dx10.exe+B4DD2F: 5F                       - pop edi
AssassinsCreed_Dx10.exe+B4DD30: 5E                       - pop esi
AssassinsCreed_Dx10.exe+B4DD31: 5B                       - pop ebx
AssassinsCreed_Dx10.exe+B4DD32: 8B E5                    - mov esp,ebp
AssassinsCreed_Dx10.exe+B4DD34: 5D                       - pop ebp
AssassinsCreed_Dx10.exe+B4DD35: C3                       - ret 
AssassinsCreed_Dx10.exe+B4DD36: F3 0F 10 25 C4 7F 68 01  - movss xmm4,[AssassinsCreed_Dx10.exe+1287FC4]
AssassinsCreed_Dx10.exe+B4DD3E: F3 0F 10 44 24 28        - movss xmm0,[esp+28]
// ---------- INJECTING HERE ----------
AssassinsCreed_Dx10.exe+B4DD44: F3 0F 10 8E E8 05 00 00  - movss xmm1,[esi+000005E8]
// ---------- DONE INJECTING  ----------
AssassinsCreed_Dx10.exe+B4DD4C: 0F 5A D9                 - cvtps2pd xmm3,xmm1
AssassinsCreed_Dx10.exe+B4DD4F: F3 0F 5A D0              - cvtss2sd xmm2,xmm0
AssassinsCreed_Dx10.exe+B4DD53: F2 0F 5C D3              - subsd xmm2,xmm3
AssassinsCreed_Dx10.exe+B4DD57: F2 0F 10 1D 20 BF 68 01  - movsd xmm3,[AssassinsCreed_Dx10.exe+128BF20]
AssassinsCreed_Dx10.exe+B4DD5F: F2 0F 5A D2              - cvtsd2ss xmm2,xmm2
AssassinsCreed_Dx10.exe+B4DD63: F3 0F 5A D2              - cvtss2sd xmm2,xmm2
AssassinsCreed_Dx10.exe+B4DD67: 66 0F 54 D3              - andpd xmm2,xmm3
AssassinsCreed_Dx10.exe+B4DD6B: F3 0F 10 1D 68 96 68 01  - movss xmm3,[AssassinsCreed_Dx10.exe+1289668]
AssassinsCreed_Dx10.exe+B4DD73: F2 0F 5A D2              - cvtsd2ss xmm2,xmm2
AssassinsCreed_Dx10.exe+B4DD77: 0F 2F DA                 - comiss xmm3,xmm2
}

Raining NPCs:

Code: Select all

{ Game   : AssassinsCreed_Dx10.exe
  Version: 1.0
  Date   : 2023-05-12
  Author : Gear2

  Only affects NPC while they are moving.
}

[ENABLE]

assert("AssassinsCreed_Dx10.exe"+157DF2,0F 28 40 30 F3 0F 10 15 C4 7F 68 01)
define(teleport_npc,"AssassinsCreed_Dx10.exe"+157DF2)
registersymbol(teleport_npc)
alloc(newmem,$1000)
alloc(more_height,$16)

label(code)
label(return)

more_height:
  db (float)5

newmem:
  cmp [eax+BC],0
  je code
  fld [eax+38]
  fadd [more_height]
  fstp [eax+38]
  movaps xmm0,[eax+30]
  movss xmm2,[AssassinsCreed_Dx10.exe+1287FC4]
  jmp return

code:
  movaps xmm0,[eax+30]
  movss xmm2,[AssassinsCreed_Dx10.exe+1287FC4]
  jmp return

teleport_npc:
  jmp newmem
  nop 7
return:

[DISABLE]

teleport_npc:
  db 0F 28 40 30 F3 0F 10 15 C4 7F 68 01

unregistersymbol(teleport_npc)
dealloc(newmem)
dealloc(more_height)

{
// ORIGINAL CODE - INJECTION POINT: AssassinsCreed_Dx10.exe+157DF2

AssassinsCreed_Dx10.exe+157DCE: 0F 55 E6                 - andnps xmm4,xmm6
AssassinsCreed_Dx10.exe+157DD1: 0F 56 CC                 - orps xmm1,xmm4
AssassinsCreed_Dx10.exe+157DD4: 0F 29 44 24 30           - movaps [esp+30],xmm0
AssassinsCreed_Dx10.exe+157DD9: 0F 29 54 24 40           - movaps [esp+40],xmm2
AssassinsCreed_Dx10.exe+157DDE: 0F 29 4C 24 50           - movaps [esp+50],xmm1
AssassinsCreed_Dx10.exe+157DE3: 74 07                    - je AssassinsCreed_Dx10.exe+157DEC
AssassinsCreed_Dx10.exe+157DE5: E8 A6 56 FD FF           - call AssassinsCreed_Dx10.exe+12D490
AssassinsCreed_Dx10.exe+157DEA: EB 03                    - jmp AssassinsCreed_Dx10.exe+157DEF
AssassinsCreed_Dx10.exe+157DEC: 8D 46 10                 - lea eax,[esi+10]
AssassinsCreed_Dx10.exe+157DEF: 0F 57 C9                 - xorps xmm1,xmm1
// ---------- INJECTING HERE ----------
AssassinsCreed_Dx10.exe+157DF2: 0F 28 40 30              - movaps xmm0,[eax+30]
// ---------- DONE INJECTING  ----------
AssassinsCreed_Dx10.exe+157DF6: F3 0F 10 15 C4 7F 68 01  - movss xmm2,[AssassinsCreed_Dx10.exe+1287FC4]
AssassinsCreed_Dx10.exe+157DFE: 8B 4E 50                 - mov ecx,[esi+50]
AssassinsCreed_Dx10.exe+157E01: 85 C9                    - test ecx,ecx
AssassinsCreed_Dx10.exe+157E03: 0F 29 44 24 20           - movaps [esp+20],xmm0
AssassinsCreed_Dx10.exe+157E08: 0F 28 05 D0 BB 68 01     - movaps xmm0,[AssassinsCreed_Dx10.exe+128BBD0]
AssassinsCreed_Dx10.exe+157E0F: F3 0F 11 4C 24 2C        - movss [esp+2C],xmm1
AssassinsCreed_Dx10.exe+157E15: F3 0F 11 4C 24 18        - movss [esp+18],xmm1
AssassinsCreed_Dx10.exe+157E1B: F3 0F 11 4C 24 14        - movss [esp+14],xmm1
AssassinsCreed_Dx10.exe+157E21: F3 0F 11 4C 24 10        - movss [esp+10],xmm1
AssassinsCreed_Dx10.exe+157E27: F3 0F 11 54 24 1C        - movss [esp+1C],xmm2
}

Move NPCs To Me:

Code: Select all

{ Game   : AssassinsCreed_Dx10.exe
  Version: 1.0
  Date   : 2023-05-12
  Author : Gear2

  Dogpile on the assassin is the only way to beat him!
}

[ENABLE]

assert("AssassinsCreed_Dx10.exe"+6F069,0F 28 40 30 8B 45 08)
define(teleport_npc,"AssassinsCreed_Dx10.exe"+6F069)
alloc(newmem,$1000)

label(code)
label(return)

newmem:
  cmp [eax+BC],0
  je code
  movss xmm7,[[[[[["AssassinsCreed_Dx10.exe"+0159E93C]+0]+54]+34]+6C]+20]
  movss [eax+30],xmm7
  movss xmm7,[[[[[["AssassinsCreed_Dx10.exe"+0159E93C]+0]+54]+34]+6C]+24]
  movss [eax+34],xmm7
  movss xmm7,[[[[[["AssassinsCreed_Dx10.exe"+0159E93C]+0]+54]+34]+6C]+28]
  movss [eax+38],xmm7
  movaps xmm0,[eax+30]
  mov eax,[ebp+08]
  jmp return

code:
  movaps xmm0,[eax+30]
  mov eax,[ebp+08]
  jmp return

teleport_npc:
  jmp newmem
  nop 2
return:
registersymbol(teleport_npc)

[DISABLE]

teleport_npc:
  db 0F 28 40 30 8B 45 08

unregistersymbol(teleport_npc)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: AssassinsCreed_Dx10.exe+6F069

AssassinsCreed_Dx10.exe+6F050: 55              - push ebp
AssassinsCreed_Dx10.exe+6F051: 8B EC           - mov ebp,esp
AssassinsCreed_Dx10.exe+6F053: 83 E4 F0        - and esp,-10
AssassinsCreed_Dx10.exe+6F056: 8B C1           - mov eax,ecx
AssassinsCreed_Dx10.exe+6F058: 8B 48 50        - mov ecx,[eax+50]
AssassinsCreed_Dx10.exe+6F05B: 85 C9           - test ecx,ecx
AssassinsCreed_Dx10.exe+6F05D: 74 07           - je AssassinsCreed_Dx10.exe+6F066
AssassinsCreed_Dx10.exe+6F05F: E8 2C E4 0B 00  - call AssassinsCreed_Dx10.exe+12D490
AssassinsCreed_Dx10.exe+6F064: EB 03           - jmp AssassinsCreed_Dx10.exe+6F069
AssassinsCreed_Dx10.exe+6F066: 83 C0 10        - add eax,10
// ---------- INJECTING HERE ----------
AssassinsCreed_Dx10.exe+6F069: 0F 28 40 30     - movaps xmm0,[eax+30]
// ---------- DONE INJECTING  ----------
AssassinsCreed_Dx10.exe+6F06D: 8B 45 08        - mov eax,[ebp+08]
AssassinsCreed_Dx10.exe+6F070: 0F 29 00        - movaps [eax],xmm0
AssassinsCreed_Dx10.exe+6F073: 0F 57 C0        - xorps xmm0,xmm0
AssassinsCreed_Dx10.exe+6F076: F3 0F 11 40 0C  - movss [eax+0C],xmm0
AssassinsCreed_Dx10.exe+6F07B: 8B E5           - mov esp,ebp
AssassinsCreed_Dx10.exe+6F07D: 5D              - pop ebp
AssassinsCreed_Dx10.exe+6F07E: C2 04 00        - ret 0004
AssassinsCreed_Dx10.exe+6F081: CC              - int 3 
AssassinsCreed_Dx10.exe+6F082: CC              - int 3 
AssassinsCreed_Dx10.exe+6F083: CC              - int 3 
}

Move NPCs To Waypoint:

Code: Select all

{ Game   : AssassinsCreed_Dx10.exe
  Version: 1.0
  Date   : 2023-05-12
  Author : Gear2

  Dogpile on the assassin is the only way to beat him!
}

[ENABLE]

assert("AssassinsCreed_Dx10.exe"+6F069,0F 28 40 30 8B 45 08)
define(teleport_npc,"AssassinsCreed_Dx10.exe"+6F069)
alloc(newmem,$1000)
alloc(more_height,$16)

label(code)
label(return)

more_height:
  db (float)180

newmem:
  cmp [eax+BC],0
  je code
  movss xmm7,[[["AssassinsCreed_Dx10.exe"+0159EBC0]+0]+D54]
  movss [eax+30],xmm7
  movss xmm7,[[["AssassinsCreed_Dx10.exe"+0159EBC0]+0]+D58]
  movss [eax+34],xmm7
  fld [eax+38]
  fadd [more_height]
  fstp [eax+38]
  movaps xmm0,[eax+30]
  mov eax,[ebp+08]
  jmp return

code:
  movaps xmm0,[eax+30]
  mov eax,[ebp+08]
  jmp return

teleport_npc:
  jmp newmem
  nop 2
return:
registersymbol(teleport_npc)

[DISABLE]

teleport_npc:
  db 0F 28 40 30 8B 45 08

unregistersymbol(teleport_npc)
dealloc(newmem)
dealloc(more_height)

{
// ORIGINAL CODE - INJECTION POINT: AssassinsCreed_Dx10.exe+6F069

AssassinsCreed_Dx10.exe+6F050: 55              - push ebp
AssassinsCreed_Dx10.exe+6F051: 8B EC           - mov ebp,esp
AssassinsCreed_Dx10.exe+6F053: 83 E4 F0        - and esp,-10
AssassinsCreed_Dx10.exe+6F056: 8B C1           - mov eax,ecx
AssassinsCreed_Dx10.exe+6F058: 8B 48 50        - mov ecx,[eax+50]
AssassinsCreed_Dx10.exe+6F05B: 85 C9           - test ecx,ecx
AssassinsCreed_Dx10.exe+6F05D: 74 07           - je AssassinsCreed_Dx10.exe+6F066
AssassinsCreed_Dx10.exe+6F05F: E8 2C E4 0B 00  - call AssassinsCreed_Dx10.exe+12D490
AssassinsCreed_Dx10.exe+6F064: EB 03           - jmp AssassinsCreed_Dx10.exe+6F069
AssassinsCreed_Dx10.exe+6F066: 83 C0 10        - add eax,10
// ---------- INJECTING HERE ----------
AssassinsCreed_Dx10.exe+6F069: 0F 28 40 30     - movaps xmm0,[eax+30]
// ---------- DONE INJECTING  ----------
AssassinsCreed_Dx10.exe+6F06D: 8B 45 08        - mov eax,[ebp+08]
AssassinsCreed_Dx10.exe+6F070: 0F 29 00        - movaps [eax],xmm0
AssassinsCreed_Dx10.exe+6F073: 0F 57 C0        - xorps xmm0,xmm0
AssassinsCreed_Dx10.exe+6F076: F3 0F 11 40 0C  - movss [eax+0C],xmm0
AssassinsCreed_Dx10.exe+6F07B: 8B E5           - mov esp,ebp
AssassinsCreed_Dx10.exe+6F07D: 5D              - pop ebp
AssassinsCreed_Dx10.exe+6F07E: C2 04 00        - ret 0004
AssassinsCreed_Dx10.exe+6F081: CC              - int 3 
AssassinsCreed_Dx10.exe+6F082: CC              - int 3 
AssassinsCreed_Dx10.exe+6F083: CC              - int 3 
}

Move NPCs To Camera:

Code: Select all

{ Game   : AssassinsCreed_Dx10.exe
  Version: 1.0
  Date   : 2023-05-12
  Author : Gear2

  Dogpile on the assassin is the only way to beat him!
}

[ENABLE]

assert("AssassinsCreed_Dx10.exe"+6F069,0F 28 40 30 8B 45 08)
define(teleport_npc,"AssassinsCreed_Dx10.exe"+6F069)
alloc(newmem,$1000)

label(code)
label(return)

newmem:
  cmp [eax+BC],0
  je code
  movss xmm7,[[[[[["AssassinsCreed_Dx10.exe"+0159E93C]+0]+54]+34]+6C]+20]
  movss [eax+30],xmm7
  movss xmm7,[[[[[["AssassinsCreed_Dx10.exe"+0159E93C]+0]+54]+34]+6C]+24]
  movss [eax+34],xmm7
  movss xmm7,[[[[[["AssassinsCreed_Dx10.exe"+0159E93C]+0]+54]+34]+6C]+28]
  movss [eax+38],xmm7
  movaps xmm0,[eax+30]
  mov eax,[ebp+08]
  jmp return

code:
  movaps xmm0,[eax+30]
  mov eax,[ebp+08]
  jmp return

teleport_npc:
  jmp newmem
  nop 2
return:
registersymbol(teleport_npc)

[DISABLE]

teleport_npc:
  db 0F 28 40 30 8B 45 08

unregistersymbol(teleport_npc)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: AssassinsCreed_Dx10.exe+6F069

AssassinsCreed_Dx10.exe+6F050: 55              - push ebp
AssassinsCreed_Dx10.exe+6F051: 8B EC           - mov ebp,esp
AssassinsCreed_Dx10.exe+6F053: 83 E4 F0        - and esp,-10
AssassinsCreed_Dx10.exe+6F056: 8B C1           - mov eax,ecx
AssassinsCreed_Dx10.exe+6F058: 8B 48 50        - mov ecx,[eax+50]
AssassinsCreed_Dx10.exe+6F05B: 85 C9           - test ecx,ecx
AssassinsCreed_Dx10.exe+6F05D: 74 07           - je AssassinsCreed_Dx10.exe+6F066
AssassinsCreed_Dx10.exe+6F05F: E8 2C E4 0B 00  - call AssassinsCreed_Dx10.exe+12D490
AssassinsCreed_Dx10.exe+6F064: EB 03           - jmp AssassinsCreed_Dx10.exe+6F069
AssassinsCreed_Dx10.exe+6F066: 83 C0 10        - add eax,10
// ---------- INJECTING HERE ----------
AssassinsCreed_Dx10.exe+6F069: 0F 28 40 30     - movaps xmm0,[eax+30]
// ---------- DONE INJECTING  ----------
AssassinsCreed_Dx10.exe+6F06D: 8B 45 08        - mov eax,[ebp+08]
AssassinsCreed_Dx10.exe+6F070: 0F 29 00        - movaps [eax],xmm0
AssassinsCreed_Dx10.exe+6F073: 0F 57 C0        - xorps xmm0,xmm0
AssassinsCreed_Dx10.exe+6F076: F3 0F 11 40 0C  - movss [eax+0C],xmm0
AssassinsCreed_Dx10.exe+6F07B: 8B E5           - mov esp,ebp
AssassinsCreed_Dx10.exe+6F07D: 5D              - pop ebp
AssassinsCreed_Dx10.exe+6F07E: C2 04 00        - ret 0004
AssassinsCreed_Dx10.exe+6F081: CC              - int 3 
AssassinsCreed_Dx10.exe+6F082: CC              - int 3 
AssassinsCreed_Dx10.exe+6F083: CC              - int 3 
}

NPC Spawn To Waypoint Screenshot

Good work for your cheat table, all functionalities work like a charm, extending the FOV however causes the picture to stutter (i play in 4k, if that matters). Would be great if you could fix that.

But above all, you should implement the possibility of extending the look-up of the camera. It is insanely limited in the game.

Thank you again for your efforts.

Cam Codes

FOV Script Without The Stutter:

Code: Select all

{ Game   : AssassinsCreed_Dx10.exe
  Version: 1.0
  Date   : 2023-05-14
  Author : Gear2

  Set FOV value on line 22.
}

[ENABLE]

assert("AssassinsCreed_Dx10.exe"+1001A5,F3 0F 10 8E A0 00 00 00 0F 29)
define(FOV,"AssassinsCreed_Dx10.exe"+1001A5)
registersymbol(FOV)
alloc(newmem,$1000)

label(code)
label(return)

newmem:

code:
  mov [esi+000000A0],(float)2 // FOV default=0.8
  movss xmm1,[esi+000000A0]
  jmp return

FOV:
  jmp newmem
  nop 3
return:

[DISABLE]

FOV:
  db F3 0F 10 8E A0 00 00 00

unregistersymbol(FOV)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: AssassinsCreed_Dx10.exe+1001A5

AssassinsCreed_Dx10.exe+100185: 0F C6 C0 00              - shufps xmm0,xmm0,00
AssassinsCreed_Dx10.exe+100189: 0F 5C CA                 - subps xmm1,xmm2
AssassinsCreed_Dx10.exe+10018C: 51                       - push ecx
AssassinsCreed_Dx10.exe+10018D: 8D 54 24 4C              - lea edx,[esp+4C]
AssassinsCreed_Dx10.exe+100191: 0F 59 C1                 - mulps xmm0,xmm1
AssassinsCreed_Dx10.exe+100194: 0F 58 C2                 - addps xmm0,xmm2
AssassinsCreed_Dx10.exe+100197: 52                       - push edx
AssassinsCreed_Dx10.exe+100198: 0F 29 44 24 40           - movaps [esp+40],xmm0
AssassinsCreed_Dx10.exe+10019D: E8 7E 09 FD FF           - call AssassinsCreed_Dx10.exe+D0B20
AssassinsCreed_Dx10.exe+1001A2: 0F 28 00                 - movaps xmm0,[eax]
// ---------- INJECTING HERE ----------
AssassinsCreed_Dx10.exe+1001A5: F3 0F 10 8E A0 00 00 00  - movss xmm1,[esi+000000A0]
// ---------- DONE INJECTING  ----------
AssassinsCreed_Dx10.exe+1001AD: 0F 29 44 24 30           - movaps [esp+30],xmm0
AssassinsCreed_Dx10.exe+1001B2: F3 0F 10 86 D0 00 00 00  - movss xmm0,[esi+000000D0]
AssassinsCreed_Dx10.exe+1001BA: 0F 5A D0                 - cvtps2pd xmm2,xmm0
AssassinsCreed_Dx10.exe+1001BD: 0F 5A C9                 - cvtps2pd xmm1,xmm1
AssassinsCreed_Dx10.exe+1001C0: F2 0F 5C CA              - subsd xmm1,xmm2
AssassinsCreed_Dx10.exe+1001C4: F3 0F 5A 55 08           - cvtss2sd xmm2,[ebp+08]
AssassinsCreed_Dx10.exe+1001C9: 8D 44 24 30              - lea eax,[esp+30]
AssassinsCreed_Dx10.exe+1001CD: 50                       - push eax
AssassinsCreed_Dx10.exe+1001CE: 8D 4C 24 44              - lea ecx,[esp+44]
AssassinsCreed_Dx10.exe+1001D2: 0F 5A C0                 - cvtps2pd xmm0,xmm0
}

Cam Look Up Higher:

Code: Select all

{ Game   : AssassinsCreed_Dx10.exe
  Version: 1.0
  Date   : 2023-05-12
  Author : Gear2

  Free camera pitch view up.
}

[ENABLE]

assert("AssassinsCreed_Dx10.exe"+2CF53F,66 0F 2F DA 77 0D)
define(free_pitch,"AssassinsCreed_Dx10.exe"+2CF53F)
registersymbol(free_pitch)

alloc(newmem,$1000)
alloc(increase,$16)

label(code)
label(return)

increase:
  db (float)0

newmem:

code:
  movss xmm2,[increase]
  comisd xmm3,xmm2
  ja AssassinsCreed_Dx10.exe+2CF552
  jmp return

free_pitch:
  jmp newmem
  nop
return:

[DISABLE]

free_pitch:
  db 66 0F 2F DA 77 0D

unregistersymbol(free_pitch)
dealloc(newmem)
dealloc(increase)

{
// ORIGINAL CODE - free_pitchION POINT: AssassinsCreed_Dx10.exe+2CF53F

AssassinsCreed_Dx10.exe+2CF51B: FF D0                    - call eax
AssassinsCreed_Dx10.exe+2CF51D: D9 5C 24 14              - fstp dword ptr [esp+14]
AssassinsCreed_Dx10.exe+2CF521: 8B 4C 24 10              - mov ecx,[esp+10]
AssassinsCreed_Dx10.exe+2CF525: 51                       - push ecx
AssassinsCreed_Dx10.exe+2CF526: E8 95 C9 EB FF           - call AssassinsCreed_Dx10.exe+18BEC0
AssassinsCreed_Dx10.exe+2CF52B: F3 0F 10 45 00           - movss xmm0,[ebp+00]
AssassinsCreed_Dx10.exe+2CF530: F3 0F 10 4C 24 18        - movss xmm1,[esp+18]
AssassinsCreed_Dx10.exe+2CF536: 83 C4 04                 - add esp,04
AssassinsCreed_Dx10.exe+2CF539: 0F 5A D0                 - cvtps2pd xmm2,xmm0
AssassinsCreed_Dx10.exe+2CF53C: 0F 5A D9                 - cvtps2pd xmm3,xmm1
// ---------- free_pitchING HERE ----------
AssassinsCreed_Dx10.exe+2CF53F: 66 0F 2F DA              - comisd xmm3,xmm2
// ---------- DONE free_pitchING  ----------
AssassinsCreed_Dx10.exe+2CF543: 77 0D                    - ja AssassinsCreed_Dx10.exe+2CF552
AssassinsCreed_Dx10.exe+2CF545: F3 0F 10 0D C4 7F 68 01  - movss xmm1,[AssassinsCreed_Dx10.exe+1287FC4]
AssassinsCreed_Dx10.exe+2CF54D: 0F 2F C1                 - comiss xmm0,xmm1
AssassinsCreed_Dx10.exe+2CF550: 76 03                    - jna AssassinsCreed_Dx10.exe+2CF555
AssassinsCreed_Dx10.exe+2CF552: 0F 28 C1                 - movaps xmm0,xmm1
AssassinsCreed_Dx10.exe+2CF555: F3 0F 11 45 00           - movss [ebp+00],xmm0
AssassinsCreed_Dx10.exe+2CF55A: 80 7F 04 00              - cmp byte ptr [edi+04],00
AssassinsCreed_Dx10.exe+2CF55E: 0F 85 8E 00 00 00        - jne AssassinsCreed_Dx10.exe+2CF5F2
AssassinsCreed_Dx10.exe+2CF564: 80 BB 62 02 00 00 00     - cmp byte ptr [ebx+00000262],00
AssassinsCreed_Dx10.exe+2CF56B: 0F 84 81 00 00 00        - je AssassinsCreed_Dx10.exe+2CF5F2
}

Note: Was able to find FOV thanks to Paul44's v5.1 table. Awesome find btw!

[Paul44]

^ "Defender": would probably not have made any difference, excluded or not. So in your case, memory management is somewhat/how different (kinda bizar for a 32b game; meaning everything should "stick" within the 2GB boundary)...

* Free roam routine: see here [ viewtopic.php?p=266512#p266512 ]. The routine is "standard" in my table, and used for all my games (with that feature). If you'd like more info, just pm or discuss in aforementioned topic.
ps: #amorrow28 is far more knowledgeable regarding the ins/outs of camera mechanisms game-wise.

* extra stuff: do "dump" this in a table, as most gamers will not know what to do with it. Npc stuff is not interesting to me, but will definitely look into FOV. I have no stutter whatsoever, so surely resolution/framerate related. That lookup is a good find; will check that out as well.

and thx for reporting back; always appreciated !

[Gear2ndGandalf]

The stuttering happens to me when I set the float value high near 2 or higher. 1080p 60hz

Also, there is an actual address for pitch up and pitch down limits that I have just found. I will edit this post with a snapshot of a good pointer to it today. It’s near camera base address and is a float of --0.6981316805. You can change to -1.3 to look up all the way flawlessly.

I am currently building a table for all of these things btw so yeah.