[Request] Dynasty Warrior 9 Empire

[Algester]

Here's my take on the tables as for Officer checking their relationship value is found in Offset CB

I find it also funny how they got the Gem Effect of lowering cooldown for every 100 chain also works on all cooldown (so your cards also cool down faster as you chain more attacks thats logically funny)... but my issue is I do not know the values for the special attack trigger HUE HUE -_- all I know it starts at 0 and goes back to 0

Spoiler

DW9Empires.CT

(70.05 KiB) Downloaded 330 times

DW9Emp.CT

Minor fixes to the Gem list but still needs to be filled in other than that infinite musou?

(523.6 KiB) Downloaded 247 times

DW9Emp.CT

More deets on the tables as far as I could find take that what you will (special skill cooldown is also implemented)

(577.78 KiB) Downloaded 214 times

DW9Emp.CT

Weapon Proficiency is now identified

(586.78 KiB) Downloaded 223 times

DW9Emp.CT

Infinite Jump added

(666.32 KiB) Downloaded 240 times

DW9Emp.CT

got equipment pointers "demystified" the Officer Pointers to a certain extent

(550.12 KiB) Downloaded 245 times

DW9Emp.CT

also another minor update to just "consolidate" officer data not really needed unless you like it

(710.07 KiB) Downloaded 389 times

so I still need to find Fatigue, dash count (this has largely changed from DW9) and Secret Skills cooldown but I do not know where to start I think I have a hunch for Fatigue but not confident

correction about "fatigue" this is no longer a major gameplay mechanic in DW9 your strength is now determined by how much troops you have this number dwindles everytime you go into invasion

if anyone is still interesting in hacking this game open I'm open for it (I still do not know where or how Secret Plans is loaded)

Secret plan gauges are 2 bytes and they are basically x100 of the listed cost so if it says cost is 1 that means the gauge's max filled value is 100

[Algester]

Ohh wow the trigger attack didnt change much....

if anyone wants to know the value its 1800 float for empty meter then it counts to 0

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>476</ID>
      <Description>"Special Attack instant cooldown"</Description>
      <LastState Activated="1"/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>{ Game   : DW9Emp.exe
  Version: 
  Date   : 2023-01-12
  Author : Algester

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(TriggerCooltime,DW9Emp.exe,F3 0F 11 41 0C 72) // should be unique
alloc(newmem,$1000,TriggerCooltime)

label(code)
label(return)

newmem:

code:
  movss [rcx+0C],xmm0
  mov [rcx+0C],(float)0.0
  jmp return

TriggerCooltime:
  jmp newmem
return:
registersymbol(TriggerCooltime)

[DISABLE]

TriggerCooltime:
  db F3 0F 11 41 0C

unregistersymbol(TriggerCooltime)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: DW9Emp.exe+CE496

DW9Emp.exe+CE46B: 41 0F 47 D0           - cmova edx,r8d
DW9Emp.exe+CE46F: 8B 84 02 54 B7 04 00  - mov eax,[rdx+rax+0004B754]
DW9Emp.exe+CE476: 89 41 0C              - mov [rcx+0C],eax
DW9Emp.exe+CE479: 48 8B 01              - mov rax,[rcx]
DW9Emp.exe+CE47C: C6 41 08 00           - mov byte ptr [rcx+08],00
DW9Emp.exe+CE480: 48 FF A0 B0 00 00 00  - jmp qword ptr [rax+000000B0]
DW9Emp.exe+CE487: F3 0F 10 41 0C        - movss xmm0,[rcx+0C]
DW9Emp.exe+CE48C: 0F 57 D2              - xorps xmm2,xmm2
DW9Emp.exe+CE48F: F3 0F 5C C1           - subss xmm0,xmm1
DW9Emp.exe+CE493: 0F 2F D0              - comiss xmm2,xmm0
// ---------- INJECTING HERE ----------
DW9Emp.exe+CE496: F3 0F 11 41 0C        - movss [rcx+0C],xmm0
// ---------- DONE INJECTING  ----------
DW9Emp.exe+CE49B: 72 07                 - jb DW9Emp.exe+CE4A4
DW9Emp.exe+CE49D: 89 51 0C              - mov [rcx+0C],edx
DW9Emp.exe+CE4A0: C6 41 08 01           - mov byte ptr [rcx+08],01
DW9Emp.exe+CE4A4: F3 0F 10 41 30        - movss xmm0,[rcx+30]
DW9Emp.exe+CE4A9: F3 0F 5C C1           - subss xmm0,xmm1
DW9Emp.exe+CE4AD: 0F 2F D0              - comiss xmm2,xmm0
DW9Emp.exe+CE4B0: F3 0F 11 41 30        - movss [rcx+30],xmm0
DW9Emp.exe+CE4B5: 72 0D                 - jb DW9Emp.exe+CE4C4
DW9Emp.exe+CE4B7: 48 8B 01              - mov rax,[rcx]
DW9Emp.exe+CE4BA: 89 51 30              - mov [rcx+30],edx
}
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

still trying to look for the secret plans but I seriously don't know how to go about it

[Algester]

so while the Officer data is "working" you can not freely fudge the values until I can find a way to do that I guess

IE move officers from one place to another change their rank

here is my observation for Defense Level (its loaded) immediately per territory (its 1-2 steps up from Money and Food output of the area) and is a static address meaning I can not find a reliable way to fudge up the numbers for you... without actually affecting every single territory

based on fearlessrevolution's trainer this is where the secret plan is being executed
DW9Emp.exe+57AB99: 0F B7 84 2A 6A 05 00 00 - movzx eax,word ptr [rdx+rbp+0000056A]

I tried everything I know nothing seems to stick based on my observation he pretty much turns the offset 568 into 1 that being the "max" value of the plans

my base is
DW9Emp.exe+4A220C: 66 89 47 FE - mov [rdi-02],ax

since rdi-04 is the max value I just used it as the ax value but this means you can not "spam" secret plans because its an "on hit" execution

this is just me brain farting my way to make an "officer mover"

Code: Select all

[ENABLE]

aobscanmodule(INJECT,DW9Emp.exe,88 91 BB 00 00 00) // should be unique
alloc(newmem,$1000,INJECT)

label(code)
label(return)
registersymbol(OfficerLocation)
label(OfficerLocation)
newmem:

code:
  push rdi
  lea rdi,[rcx+000000BB]
  mov eax,[OfficerLocation]
  mov [rcx+000000BB],eax
  pop rdi
  jmp return
OfficerLocation:
  db 00
INJECT:
  jmp newmem
  nop
return:
registersymbol(INJECT)

[DISABLE]

INJECT:
  db 88 91 BB 00 00 00

unregistersymbol(INJECT)
unregistersymbol(OfficerLocaion)
dealloc(newmem)

[Algester]

Spouse and PC sibblings
are generated by activating the Officer Pointers and then adding
[genderofficerptr2]+A8 as an address or
add address manually set genderofficerptr2 as the offset and then A8 to AE offset
each 2byte

[jmkam]

Has anyone discovered a way to edit our arrow amounts? Limiting us to 10 or 30 arrows sucks; I want to play an archer but the limitations make this impossible. Would also just kinda like to be able to carpet bomb everything with explosive dispersion arrows too lol. I tried scanning for the number of the ED Arrows I had, buying one, scanning again, etc but I am not having any luck finding the actual figures Last time I actually used CE was over a decade ago for BYOND games.

[Algester]

my cheat table already gives you infinite arrows ja?

IIRC arrow count is 2 bytes big

[krogine1]

i cant get the CAW relationship/player info editor to work. everything else toggles fine

*edit*

says it's missing "_hOnUpdatePlayerChar" or that it cant find it

[jmkam]

my cheat table already gives you infinite arrows ja?

IIRC arrow count is 2 bytes big

I see now. Apologies, didn't see it mentioned in a post so didn't think it would be included! Crazy how much this game slows down when Explosive Arrows are spammed lol

I was playing with Trigger/Flow range an set it to the limit per gem (1198%) and it doesn't seem the game really registers anything above a certain amount, certainly not 12x the base value or more. I think it's limited to doubling the range on things or just very slightly more than that Was really hoping I could turn some of the staff/fan triggers into massive attacks.

[Algester]

my cheat table already gives you infinite arrows ja?

IIRC arrow count is 2 bytes big

I see now. Apologies, didn't see it mentioned in a post so didn't think it would be included! Crazy how much this game slows down when Explosive Arrows are spammed lol

I was playing with Trigger/Flow range an set it to the limit per gem (1198%) and it doesn't seem the game really registers anything above a certain amount, certainly not 12x the base value or more. I think it's limited to doubling the range on things or just very slightly more than that Was really hoping I could turn some of the staff/fan triggers into massive attacks.

the largest change between DW9 and DW9E is how the value of the gems is now 2 byte by 2 byte as opposed to 2 byte by float (IIRC it was 8 bytes minimum in DW9)

if you do not want 999 arrows you can easily change the logic by adding // on mov [r8+rbx*2],dx same goes to mov dx,#999 and then reversing the logic under that... so the code becomes mov dx,[r8+rbx*2]

i cant get the CAW relationship/player info editor to work. everything else toggles fine

*edit*

says it's missing "_hOnUpdatePlayerChar" or that it cant find it

I didnt change the logic on CAW / Player Info so thats probably on your copy? having a different AoB ?


another set of findings Secret Plans level start at 0 = 1 star and maxes out at 4 = double star its probably 4 bytes maybe 2 or maybe 1
this is currently what I know based on what is accessing this address

[Algester]

Code: Select all

{ Game   : DW9Emp.exe
  Version: 
  Date   : 2023-02-16
  Author : Algester

  This script does blah blah blah
}

[ENABLE]

aobscanmodule(ActionPoints,DW9Emp.exe,41 88 40 01 C3 CC CC CC CC) // should be unique
alloc(newmem,$1000,ActionPoints)

label(code)
label(return)

newmem:
  mov al,#6
code:
  mov al,[r8+01]
  //mov [r8+01],al
  ret 
  jmp return

ActionPoints:
  jmp newmem
return:
registersymbol(ActionPoints)
//
aobscanmodule(recruit_ap,DW9Emp.exe,41 88 40 01 4D 85 D2) // should be unique
alloc(_recruitmem,$1000,recruit_ap)

label(_recruitcode)
label(_recruitreturn)

_recruitmem:
  mov al,#6
_recruitcode:
  //mov [r8+01],al
  mov al,[r8+01]
  test r10,r10
  jmp _recruitreturn

recruit_ap:
  jmp _recruitmem
  nop 2
_recruitreturn:
registersymbol(recruit_ap)
[DISABLE]

ActionPoints:
  db 41 88 40 01 C3

unregistersymbol(ActionPoints)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: DW9Emp.exe+6116AF

DW9Emp.exe+61168F: 41 8B D3     - mov edx,r11d
DW9Emp.exe+611692: 41 8B CA     - mov ecx,r10d
DW9Emp.exe+611695: 0F 45 D0     - cmovne edx,eax
DW9Emp.exe+611698: 41 3B D2     - cmp edx,r10d
DW9Emp.exe+61169B: 0F 42 CA     - cmovb ecx,edx
DW9Emp.exe+61169E: 41 2B C9     - sub ecx,r9d
DW9Emp.exe+6116A1: 41 0F 48 CB  - cmovs ecx,r11d
DW9Emp.exe+6116A5: 41 3B CA     - cmp ecx,r10d
DW9Emp.exe+6116A8: 0F B6 C1     - movzx eax,cl
DW9Emp.exe+6116AB: 41 0F 47 C2  - cmova eax,r10d
// ---------- INJECTING HERE ----------
DW9Emp.exe+6116AF: 41 88 40 01  - mov [r8+01],al
// ---------- DONE INJECTING  ----------
DW9Emp.exe+6116B3: C3           - ret 
DW9Emp.exe+6116B4: CC           - int 3 
DW9Emp.exe+6116B5: CC           - int 3 
DW9Emp.exe+6116B6: CC           - int 3 
DW9Emp.exe+6116B7: CC           - int 3 
DW9Emp.exe+6116B8: CC           - int 3 
DW9Emp.exe+6116B9: CC           - int 3 
DW9Emp.exe+6116BA: CC           - int 3 
DW9Emp.exe+6116BB: CC           - int 3 
DW9Emp.exe+6116BC: CC           - int 3 
}
//
recruit_ap:
  db 41 88 40 01 4D 85 D2

unregistersymbol(recruit_ap)
dealloc(_recruitmem)

{
// ORIGINAL CODE - INJECTION POINT: DW9Emp.exe+8703DF

DW9Emp.exe+8703C1: 85 C0                       - test eax,eax
DW9Emp.exe+8703C3: 41 8B D4                    - mov edx,r12d
DW9Emp.exe+8703C6: 0F 45 C8                    - cmovne ecx,eax
DW9Emp.exe+8703C9: 41 3B CC                    - cmp ecx,r12d
DW9Emp.exe+8703CC: 0F 42 D1                    - cmovb edx,ecx
DW9Emp.exe+8703CF: 41 2B D1                    - sub edx,r9d
DW9Emp.exe+8703D2: 0F 48 D7                    - cmovs edx,edi
DW9Emp.exe+8703D5: 41 3B D4                    - cmp edx,r12d
DW9Emp.exe+8703D8: 0F B6 C2                    - movzx eax,dl
DW9Emp.exe+8703DB: 41 0F 47 C4                 - cmova eax,r12d
// ---------- INJECTING HERE ----------
DW9Emp.exe+8703DF: 41 88 40 01                 - mov [r8+01],al
// ---------- DONE INJECTING  ----------
DW9Emp.exe+8703E3: 4D 85 D2                    - test r10,r10
DW9Emp.exe+8703E6: 74 16                       - je DW9Emp.exe+8703FE
DW9Emp.exe+8703E8: 45 3B B2 50 43 01 00        - cmp r14d,[r10+00014350]
DW9Emp.exe+8703EF: 8B C7                       - mov eax,edi
DW9Emp.exe+8703F1: 41 0F 42 C6                 - cmovb eax,r14d
DW9Emp.exe+8703F5: 42 C6 84 10 E4 3B 01 00 01  - mov byte ptr [rax+r10+00013BE4],01
DW9Emp.exe+8703FE: 4C 89 AC 24 E8 01 00 00     - mov [rsp+000001E8],r13
DW9Emp.exe+870406: E8 E5 15 E0 FF              - call DW9Emp.exe+6719F0
DW9Emp.exe+87040B: BF FF FF FF FF              - mov edi,FFFFFFFF
DW9Emp.exe+870410: 8B EF                       - mov ebp,edi
}

modified it to be "better" I guess?

so there are 2 logic codes running when interacting and "hiring" officers

[maximus_erectus]

Recently started another playthrough of the game, and I decided to update my table with a few more features:
+ Added an option to remove turn limits (Game will no longer end on turn 600)
+ Added some options for troops in-battle
+ Added a tool to import/export CaW characters
+ Added more pointers to the CaW editor
* Changed the Merit script to be more robust, and added some more filters
* Improved Resource script to more reliably affect only your own faction

[bn_511x]

whats the latest version of the table here cause i saw many tables thanks to all of you but i hope that there was one table and in main post pinned for easy access thanks