Assassin's Creed: Origins - Animus Control Panel (ACP)

[SunBeam]

Kindly DO NOT POST this integrally (or the attachments) on other forums/communities (e.g.: Nexus). You may post a link to this topic instead (hopefully, FRF isn't blacklisted there). Same as you prefer those places, I prefer FRF and I made this specifically for this community! If you want to share the news, do send those users to FRF instead. Thank you for respecting my choice!

Hello folks.

I remember using this - the Animus Control Panel (short ACP) - back in Origins days, but since I finished the game and found nothing else interesting to do with it -OR- some other game was released, I haven't had the time to have at it again. Then there's the discussion started here: viewtopic.php?p=205736#p205736. Which got me back to look at it.

What is ACP?

It's a way in which you can control several parameters in the game's world to make your gaming experience customizable. The description video directly from the makers:




How can I access ACP?

Well.. ever since Ubisoft transitioned from UPlay client to Ubisoft Connect client, there's no means for you to access it from the UI. The code they've implemented in the game Engine, however, is still there. It reads and checks the ACP settings file (ACP.ini) and will apply them if the file's timestamp is modified (as in: if you make a change and save the file).


Where is ACP.ini?

Click Start, then Run (or WinKey+R) and copy-paste this in, followed by Enter:

%USERPROFILE%\Documents\Assassin's Creed Origins

In here you should see a file called ACP.ini, as well as a folder called Animus Control Panel.


Really there's no way to access ACP from the UI in-game?

Well.. now that you know where ACP.ini is for later inspection, I can tell you that THERE IS A WAY. But it will require some steps from your end.

• First-up, know that you will have to install the UPlay client (which isn't available anymore from Ubisoft). The installer can be downloaded from this link: [Link].

• In order to do that, you will first have to uninstall your Ubisoft Connect client (make sure NOT to tick removal of games and saves!). Why? Because when you launch the UPlay installer, it will whine there's a new version already installed and close.

• BEFORE installing it, keep this in mind: once the installer's finished, DO NOT RUN UPlay! So untick "Run Uplay", then exit. I will explain why in a sec.

• Once installed, if you've clicked Next Next .., you will find it in the default folder here:

  C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher

• Why not run it? Because as soon as you launch it, it will go "Looking for patches", download and install Ubisoft Connect all over again.

• To not let it update, we want to do the following:
  • Disable full internet access by WinKey+R > ncpa.cpl [Enter]. Right-click your current network adapter and Disable.
    
    P.S.: No, it doesn't work to block UPlay.exe or similar via Windows Firewall, tried it. Also no, it doesn't work to block static3.cdn.ubi.com or similar hosts UPlay connects to in system32/drivers/etc/hosts file, tried it.
  • Run UbisoftGameLauncher.exe (C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe). The login window will open.
  • Enable network adapter to have internet access again. Type in your credentials, tick "Remember me" and click "Log in". If you have 2-Step Verification active, you'll get an email with a security code for logging in. Once in, you can start Origins from your list of games.
    
    P.S.: If you don't see Origins in the Installed Games list, find it in My Games list, click on it, then under Download button there will be a "Locate installed files" and point UPlay to the folder where you have the game installed.
  • And in-game, at main menu, you will see these:
    
    
    
    
    
    • You will notice you can't activate drop-down lists (e.g.: clicking Controllable Character doesn't open the list from the video to pick from). So that's one mild inconvenience. Why? Because if you click the field and use Up and Down arrow keys, you will be able to select an option
    • You can reset everything to the Default preset by clicking the "Reset" button.
    NOTE: If you close the game, you need to re-run it from within UPlay UI. If you close the client from the taskbar (right-click > Quit), then you will have to do the disable internet > open Launcher > enable internet steps again. If you don't do that, UPlay will download Connect and overwrite the client. So be aware of this.

Where are actually the ACP UI details stored?

I initially wanted to make up an Excel file in which I'd store the settings, options, current and max values, descriptions, whether or not they require a world reset and their ACP.ini parameter name. All by typing this into Excel. BUT.. I thought "hey, this is a freakin' Chrome interface, the XML or JSON file should be somewhere in the UPlay folder". Took me a bit and voila:

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\cache\assets\4446eed9bc6caee120fb0f4b01f99870

In there you will find 1 single file: model.json. It contains everything you see in the interface and the reason it's this BIG is cuz everything is also translated into several other languages.



You can see in the below the PRESETS from the presentation video at the top of the page:



More as I progress. Intention is to publish everything there is to know about ACP, how it works, how it stores the values in Anvil and how it applies them and to which data structures (e.g.: GamePlaySettings) and so on

BR,
Sun

[mitsunari3]

thank you SunBeam

[SunBeam]

UPDATE #1:

If you don't want UPlay to convert to Ubisoft Connect as soon as you open it, then please follow the steps below

• Open UPlay and let it update to Ubisoft Connect.

• Once the update finishes and the Ubisoft Connect window opens, close it.

• Go into your Ubisoft Game Launcher folder (e.g.: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher) and open version.txt file.
  
  In my case, at the time of writing this post, I see:
  

  10647

  That is the current internal version which is checked at start-up. If this version matches the latest on the server, no update occurs. No matter which client you have installed, UPlay or Ubisoft Connect

So.. now.. uninstall Ubisoft Connect (keeping savegames) and reinstall UPlay with the installer I linked earlier. Do not let it run when the install finishes. Go into your Ubisoft Game Launcher folder, open version.txt and change it to 10647 (note that this value might change if you're reading this way in the future). Save file. Open UPlay and you'll see checking for updates is skipped and you're landed straight at the login window



There you have it, no need to disable your network adapter anymore

[SunBeam]

UPDATE #2:

Upon analyzing upc.exe (x86 binary, VMProtect-ed), I found several string references for "version.txt". With the help of ScyllaHide I am able to run upc.exe from x32dbg (the x86 version of x64dbg). The debugger can be downloaded from [Link] and ScyllaHide plugin from the [Link].

The references I found are these:

Code: Select all

upc.exe+E872C5 - 68 00334102 - push upc.exe+2013300 { ("version.txt") }
upc.exe+363AEF - 68 00334102 - push upc.exe+2013300 { ("version.txt") }
upc.exe+EC1E72 - 68 00334102 - push upc.exe+2013300 { ("version.txt") }
upc.exe+D107D2 - 68 00334102 - push upc.exe+2013300 { ("version.txt") }
upc.exe+D132AB - 68 00334102 - push upc.exe+2013300 { ("version.txt") }

I've set a hardware breakpoint on each and tested which one breaks as upc.exe runs (as the GUI opens up). Note that you can't use software breakpoints (so don't do F2 on those addresses), as the executable is also packed. Aside from anti-debug, Ubisoft also ticked the packing feature of VMProtect. So, before you see executable code in the first section of the binary, VMProtect has to unpack it. Since there are also integrity checks, placing a software breakpoint would cause an invisible 0xCC byte write at the address(es) of interest. You don't see that in the debugger, but check the address with CE:



What this will do is trigger a checksum fail message and VMProtect will show a message box stating that the file might've been modified or is infected (since your 0xCCs changed the whole file's checksum).

Back on track.. out of all those 5 locations I've set hardware breakpoints on (another thing to note is you can't break on all 5 in one go, as you can use only 4 hardware breakpoints at a time!), only two break as UPlay opens up:

< this breaks before UPlay window is even created >

Code: Select all

012C1E72 | 68 00334102   | PUSH upc.2413300              | 2413300:"version.txt"
012C1E77 | 89B5 5CFFFFFF | MOV DWORD PTR SS:[EBP-A4],ESI |
012C1E7D | E8 3E5DFCFF   | CALL upc.1287BC0              |

< this breaks as UPlay GUI opens and "Looking for patches" is shown at the bottom of the window >

Code: Select all

011132AB | 68 00334102 | PUSH upc.2413300 | 2413300:"version.txt"
011132B0 | 8BC8        | MOV ECX,EAX      |
011132B2 | E8 F9541700 | CALL upc.12887B0 |

So upc.exe+EC1E72 and upc.exe+D132AB (wrote it down as process name + offset, in case ASLR makes it so your address will show differently; read some more on ASLR with the help of google, won't explain here).


upc.exe+EC1E72


Starting with the first one, tracing through the code, I see this:



Remember UPDATE #1 and me mentioning 10647? That CALL there reads the file content.

Going through the code I see they log a lot of information and that information is written to this file:

C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\logs\launcher_log.txt

You can find the version.txt value on the line saying:

Installed version: 10647

After tracing for a little bit longer, I deduced that the only thing happening in that function is logging information. The 10647 value is not computed to some other form or checked against a server value. Aim here is to figure out where is upc.exe determining that is should (check for an) update. In short, not the spot of interest for this exercise.

However.. continuing to trace, I landed inside this function:



In here, UplayService.exe is launched with a command-line: -uplayservice_perform_updates. I wonder what happens if I don't let it launch with that argument. To try later

Past that call, the GUI is initialized here:



You will find that the function is virtualized through VMProtect. So I set a breakpoint at the RET below the CALL and ran the program. Because I have the other hardware breakpoint set on upc.exe+D132AB, x32dbg stopped there, while showing the GUI:



So one thing's for certain, the check we are looking for isn't in this paragraph.


upc.exe+D132AB


With x32dbg stopped at the second break, I traced for a bit to see what's going on. Much like the previous break, the 10647 value is read from version.txt:



Past that, inside this function, the "10647" string is converted to decimal/hex:



So this piece of code should be interpreted as str2hex:

Code: Select all

0128A740 | E8 AB000000 | CALL upc.128A7F0 | converts string to hex
0128A745 | 85D2        | TEST EDX,EDX     | is string NULL?
0128A747 | 75 05       | JNE upc.128A74E  |
0128A749 | 83F8 FF     | CMP EAX,FFFFFFFF | checks if -1
0128A74C | 76 03       | JBE upc.128A751  |
0128A74E | 83C8 FF     | OR EAX,FFFFFFFF  | returns -1, if so
0128A751 | C3          | RET              | else, the converted value is in EAX

The value is then stored in ECX+C8 at the location below:



In the same picture above you can also see a reference of the word "patchOnlyUpwards". Based on the result of the CALL right below it the TEST AL,AL + JE will jump over the next piece of code or run it:

Code: Select all

011133C4 | 68 E0F49B02   | PUSH upc.29BF4E0               | 29BF4E0:&"patchOnlyUpwards"
011133C9 | 8BC8          | MOV ECX,EAX                    |
011133CB | E8 D0B71700   | CALL upc.128EBA0               |
011133D0 | 84C0          | TEST AL,AL                     |
011133D2 | 74 11         | JE upc.11133E5                 |
011133D4 | 8B4E 40       | MOV ECX,DWORD PTR DS:[ESI+40]  |
011133D7 | 8B81 2C010000 | MOV EAX,DWORD PTR DS:[ECX+12C] |
011133DD | 3B81 C8000000 | CMP EAX,DWORD PTR DS:[ECX+C8]  |
011133E3 | 76 15         | JBE upc.11133FA                | is the version.txt value <= value we want to know where it comes from?
011133E5 | 8B4E 40       | MOV ECX,DWORD PTR DS:[ESI+40]  |
011133E8 | 8B81 2C010000 | MOV EAX,DWORD PTR DS:[ECX+12C] |
011133EE | 3B81 C8000000 | CMP EAX,DWORD PTR DS:[ECX+C8]  |
011133F4 | 0F85 34FFFFFF | JNE upc.111332E                | is the version.txt value != value we want to know where it comes from?

A few notes:

• 1) The "value we want to know where it comes from" is in [ecx+12C]. That ecx comes from [esi+40]. That's what I started figuring out later on in the analysis

• 2) 0x29BF4E0 is a pointer. In my case, it contains the address of 0x60D7C10 (this changes with every run, because it's an allocation). What I wanted to do is change "patchOnlyUpwards" with another word I found by searching for "patch"-related strings: noStartupPatching or noBackgroundPatching.

Regarding 2):

The write to 0x29BF4E0 is done here:



If I go outside the function, I see this:



So upc.exe is using fixed, static locations. Which means 0x2409C40 is where "patchOnlyUpwards" comes from. And if I take a look at that address, in dump, I see several key words:



Among them, as mentioned, I also found:



So what happens if we change our pointer from pointing to "patchOnlyUpwards" to pointing to "noPatching"?

Another thing, while breaking at the "patchOnlyUpwards" address, I saw this in the registers pane:



So that's where, if the checks succeed, UPlay is going to get the client files and update UPlay to Ubisoft Connect.

What upc.exe does with this string is to compute a hash of it using [Link] (see FNV prime and FNV offset basis at the bottom of the page, in the table, for 'Size in bits' = 32):



Then it performs a look-up based on this hash against some configuration table. You can already see me in the above letting upc.exe hash "noPatching" instead of "patchOnlyUpwards" In my run, I crashed, because I need a pointer to pointer and that location with "noPatching" is the pointer to the string, not the pointer to the pointer to the string

For "patchOnlyUpwards" the resulting hash is 0x1DF6DF51. You can compute it here as well -> [Link].

With the default left in place, the CALL will return 0. The JE will jump over here:

Code: Select all

011133E5 | 8B4E 40       | MOV ECX,DWORD PTR DS:[ESI+40]  |
011133E8 | 8B81 2C010000 | MOV EAX,DWORD PTR DS:[ECX+12C] |
011133EE | 3B81 C8000000 | CMP EAX,DWORD PTR DS:[ECX+C8]  |
011133F4 | 0F85 34FFFFFF | JNE upc.111332E                |

And the str2hex value from version.txt is compared against the "value we want to know where it comes from". Since they're matching, the next JNE is not jumping, so the GUI will show you directly the login window. No patching will be required, thus no downloading of Ubisoft Connect files.

And that's the explanation of why changing the client version in version.txt doesn't trigger the update anymore

My intention is to code a proxy DLL that patches upc.exe so it doesn't do any updates ever. Which means you won't need to do whatever I wrote in the post above this one.

Hold tight.

[SunBeam]

UPDATE #3:

I've managed to put together a nice DLL that patches the JE right before the CALL that uses "patchOnlyUpwards"..

from:



to:



This forces the UPlay client to just skip directly to login window, with no downloading of the most recent client files Even though it gets ready to download the files to C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\patch\10647 folder.

Also understood what the "value we want to know where it comes from" is: it's the version read from the version.txt file on the Orbit repository ([Link]). You won't be able to browse the content, as it requires logging in with a certificate that's decoded internally. Of course, via VMProtect. Or maybe I didn't understand it properly, too tired at this hour.

The proxy DLL is capable of being renamed in several ways (big thanks to emoose for his [Link], which I've adapted in my project). UPlay (like most binaries on Windows 10 x64) loads dxgi.dll and dinput8.dll by default. Naming it the first causes UplayWebCore.exe to crash constantly, restarting the main GUI every 1-2 seconds, which is annoying. Naming it the second throws some initialization error (right after the GUI shows up). I guess they've taken precautions so one would not use proxy DLLs. Or maybe I'm missing some APIs that should get resolved.

What did work.. was seeing in the folder xinput1_3.dll Which the DLL can mimic as well.

upc.exe is an x86 process. It's VMProtect-ed, it contains integrity checks over the VMProtect executable code and game's executable code. The first part is checked before unpacking the game's executable code. The game executable code is then checked before hitting the original entry point (OEP). After that, there's no checks whatsoever (I guess they thought it'd be overkill to implement a thread that actively performs integrity checks, like in Unity or Syndicate). On top of that, they've decided to HOOK some core APIs, among which ZwVirtualProtectMemory. This is the ntdll API that calls syscall with a signal number. Why do I need it? To unprotect the memory at the patching spot in the 2 pictures above.

To solve that, I had to run around a bit, testing stuff I read from these articles/pages:

• [Link]

• [Link] (mid-page makes mention of the below)

• [Link]

The challenge was to dynamically get a syscall wrapper (so no hardcoding; that'd be easy ripping of the API's ASM) that gets the proper signal # for Nt/ZwVirtualProtectMemory. This was achieved using SysWhispers2_x86_WOW64Gate part of SysWhispers2. Which is for an x86 binary running on an x64 OS.

The code itself, simple:

Code: Select all

#include <windows.h>
#include <stdint.h>
#include <stdio.h>
#include <psapi.h>
#include <cstdint>
#include <cstdio>
#include "proxy.h"
#include "syscalls.h"

HMODULE ourModule = 0;
MODULEINFO moduleInfo = { 0 };
DWORD lpflOldProtect = 0;
DWORD dwCheckAddress = NULL;
DWORD dwPatchAddress = NULL;

extern "C"
{
	LPVOID internal_cleancall_wow64_gate = nullptr;
}

void PatchMe()
{
	do
	{
		Sleep( 10 );
	}
	while( *(DWORD *)( dwCheckAddress + 0x00 ) == 0x0 );
	internal_cleancall_wow64_gate = (void*)__readfsdword(0xC0);
	const static auto CurrentProcess = reinterpret_cast<HANDLE>(-1);
	const auto gameMemoryPointer = reinterpret_cast<void *>(dwPatchAddress);
	const std::uint32_t gameMemorySize = 2;
	auto alignedPointer = gameMemoryPointer;
	auto alignedSize = gameMemorySize;
	std::uint32_t oldAccess = 0;
	NtProtectVirtualMemory( CurrentProcess, &alignedPointer, (PSIZE_T)&alignedSize, PAGE_EXECUTE_READWRITE, (PULONG)&oldAccess );
	*(BYTE *)( dwPatchAddress + 0x00 ) = 0xEB;
	*(BYTE *)( dwPatchAddress + 0x01 ) = 0x26;
	NtProtectVirtualMemory( CurrentProcess, &alignedPointer, (PSIZE_T)&alignedSize, oldAccess, nullptr );
}

BOOL APIENTRY DllMain( HMODULE hModule, int ul_reason_for_call, LPVOID lpReserved )
{
	if( ul_reason_for_call == DLL_PROCESS_ATTACH )
	{
		ourModule = hModule;
		Proxy_Attach();
		GetModuleInformation( GetCurrentProcess(), GetModuleHandle( NULL ), &moduleInfo, sizeof(MODULEINFO) );
		dwCheckAddress = (DWORD)moduleInfo.lpBaseOfDll + 0x25BF4E0;
		dwPatchAddress = (DWORD)moduleInfo.lpBaseOfDll + 0xD133D2;
		CreateThread( NULL, 0, reinterpret_cast<LPTHREAD_START_ROUTINE>( PatchMe ), hModule, 0, NULL );
	}
	if( ul_reason_for_call == DLL_PROCESS_DETACH )
		Proxy_Detach();

	return TRUE;
}

With this I can then avoid calling VirtualProtect or ZwVirtualProtectMemory (which is hooked by Ubi) directly and instead run the core of it through syscall(0x50) on Windows 10 x64


Download

xinput1_3.rar

password: sunbeam

(10.4 KiB) Downloaded 1627 times

Instructions

1) Go to your Ubisoft Game Launcher folder (e.g.: C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher).
2) Rename xinput1_3.dll to xinput1_3.dll.BAK.
3) Extract the DLL from the archive. 'Yes', if asked security questions.
4) Run UPlay either via the Desktop shortcut or upc.exe.
5) Enjoy


Notes

• The DLL was tested and works successfully on Windows 10 x64. If you have Windows 11 or some version before 10, 64-bit, please test the DLL and report. Till proven otherwise, the DLL will probably not work.

• The DLL will only work with the upc.exe from the installer I linked in the first post of this topic. IT WILL NOT WORK WITH ANY OTHER VERSION! Why? Because I've used hardcoded addresses in the cpp code, not to mention the game's executable code is packed. So no point wasting more time creating a method to aobscan stuff or wait for unpacking. It is what it is.

• You don't need to do the steps in UPDATE #1 post anymore, as there can be any value (not blank) in version.txt

[OnyxDragon]

I do not know if it is a Win 11 issue or not however, it will not let me save the version file when changing it.

[F3pro]

....wo....

[SunBeam]

I do not know if it is a Win 11 issue or not however, it will not let me save the version file when changing it.

Please read the NOTES section. If you can confirm it works on Windows 11, that'd be nice

[fafal]

Can I post it on the mod forum?

[SunBeam]

Can I post it on the mod forum?

No, you may not. Note the big red text atop the first post.

You can, however, give the link to those who need it. Or post the link to this post; but do not copy paste the content integrally or post the attachments from this topic anywhere else. If you enjoy my work, please also respect it and my decisions. Thank you.

[NotsomuchAsian]

Hello. I would like to say thank you to Sunbeam for making this I enjoyed it so much and thank you for bringing out a wonderful game back to life.
I am writing this becuase I am runnig in a bit of a problem. As of now May 28th 2022 I cannot use this workaround, after pasting the modded DLL I get a pop-up saying "Uplay is too old to connect to the server. If the problem persists please contact support." The only option I have is a blue "Ok" button which if I press it takes me back to the log in screen. What do you think about it?

[SunBeam]

Nothing I can think of for now. Once I return to the game, will let you know.

[NotsomuchAsian]

Thank you for the fast reply. Now that I have a bit of time I want to give a little bit of more data on the steps that I have done

- I uninstalled Ubisoft connect
- Installed Uplay from the provided link
- I did not tick Run Uplay
- Copy and pasted the provided DLL to the root directory and added .bak to the one that was already there (tried this both with the internet on and off I even tried messing with the version.txt to see if I get different results)
- Opened Uplay from the shortcut created on the desktop
-Logged in with my credentials

This is not the first time I try, it worked like a charm until now, I will upload a printscreen of the message and a video capture

Video:
[Link]

Photo:
[Link]

[SunBeam]

...

Yes, it's been patched as the version of the installer seems too old. They either did that on purpose -OR- this "too old" thingie was already in to begin with. There's no fix I can think of for the time being so that's that. You'll have to use the other method, with ACP.ini file changes.

[adasmit]

...

Yes, it's been patched as the version of the installer seems too old. They either did that on purpose -OR- this "too old" thingie was already in to begin with. There's no fix I can think of for the time being so that's that. You'll have to use the other method, with ACP.ini file changes.

How to use the other method?