Assassin's Creed Brotherhood [aob All Versions]

[reverser69]

^ok, that helps as that is ......

in this case, it was dying but I think it would occur on loading for any reason.
yeah, I'm using your tip at the moment.

for ps2 : I'm using CE's break on exception while debugging.

for ps3: i don't know when this will happen again given the fact that I'm mostly playing on fullscreen and if the game breaks i cant see the CE window ( any workaround for this?)

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[Paul44]

^ I will try to reproduce, but I do remember dying quite a few times (who knew, right ?) while testing; no crashing then...
(ps2): did not know that, will look into it. thx.
(ps3): you can either use DxWin (with fullscreen resolution set; should work) or - if on Win10 - 'create a new Desktop' and launch in 2 seperate Desktops (if you follow the "Windowed" link, it was suggested there), Never really used this in practice; just did a test and it did its thing just fine...
I will look into this issue surely this weekend, and get back to you (will probably pm you trial_table)...


@Sunbeam: I am/was kinda counting on CEs errrorException routine; and the game itself doing its prechecks... (plus never got this myself). A bit of a pain in that routine, since it collects all main ptrs... Anyways: "Que sera, ..."

[reverser69]

^ I will try to reproduce, .....

thanks, man, this kind of support for a free table is most appreciated.
but as i said it is not regular, i guess there's a function that uses this injection point but the game does not call it regularly, sometimes too often sometimes not so. i think its better to counter the problem rather finding its source. manual exception handling if possible cuz testing all pointers one by one ..... gonna take time to write its AA.

im sending you my exe, maybe its a problem on my side only.


btw, about the quest items, i asked in my previous post; i found some interesting stuff in the contract structure i hope you make something out of it:

Code: Select all

160 (hex) 0004BBEA  ---->> always this value for missions having items
164 (hex) 0004Cxxx   ----->>> ????
168 (hex)  FFxxxxxx  ------>>> changing last bytes changes item. (its a pointer- object maybe?! because items cant be found by value search)
16c  (hex) 00100100  ----->>> always this value for missions having items but changing the first 01 (+16e offset)changes the item

i couldn't figure out how long the ID is or how it works, copying these values does not give the same item so there is another deciding offset?!?! ( edit: copying sometimes gives the same results. gold ingot for example)
careful when changing them. not recognized ID = crash.
tested it with a non-item giving mission and it worked.

[reverser69]

found these but there are more. important ones are missing.....

[reverser69]

finally, found the shop quest item boolean.
tested it and the purchase will be permanent.
here is the full code in case of creating AOB.

assassin creed brotherhood shop quest cheat:

Code: Select all

ACBSP.exe+9AE516 - 50               	 - push eax
ACBSP.exe+9AE517 - E8 E4810000           - call ACBSP.exe+9B6700
ACBSP.exe+9AE51C - 83 F8 02              - cmp eax,02 { 2 }
ACBSP.exe+9AE51F - 75 23              	 - jne ACBSP.exe+9AE544
ACBSP.exe+9AE521 - 8B 45 08              - mov eax,[ebp+08]
ACBSP.exe+9AE524 - 83 F8 01              - cmp eax,01 { 1 }
ACBSP.exe+9AE527 - 74 14                 - je ACBSP.exe+9AE53D
ACBSP.exe+9AE529 - 83 F8 03              - cmp eax,03 { 3 }
ACBSP.exe+9AE52C - 74 0F                 - je ACBSP.exe+9AE53D
ACBSP.exe+9AE52E - 83 F8 02              - cmp eax,02 { 2 }
ACBSP.exe+9AE531 - 74 0A                 - je ACBSP.exe+9AE53D
ACBSP.exe+9AE533 - 83 F8 19              - cmp eax,19 { 25 }
ACBSP.exe+9AE536 - 74 05                 - je ACBSP.exe+9AE53D
ACBSP.exe+9AE538 - 83 F8 16              - cmp eax,16 { 22 }
ACBSP.exe+9AE53B - 75 07                 - jne ACBSP.exe+9AE544
ACBSP.exe+9AE53D - B0 01                 - mov al,01 { 1 }
ACBSP.exe+9AE53F - 5E                    - pop esi
ACBSP.exe+9AE540 - 5D                    - pop ebp
ACBSP.exe+9AE541 - C2 0800               - ret 0008 { 8 }
ACBSP.exe+9AE544 - 32 C0                 - xor al,al ------->> change to mov al,1 . buy then disable when you're done to see " completed "
ACBSP.exe+9AE546 - 5E                    - pop esi
ACBSP.exe+9AE547 - 5D                    - pop ebp
ACBSP.exe+9AE548 - C2 0800               - ret 0008 { 8 }

[Paul44]

^ "can you help with shopquest items?!": I completely missed (forgot ) that one already. I will definitely look into it as well. Can't grasp its added value right now, but sounds great. I'll add it to my table for sure then... thx
As for the ptr-checks: yep, not overly enthousiastic either... (but "a (wo)man has to do..." etc)

fyi: inventory items (besides your typical weaponry items) is on my todo list. I already found out that the 'total' of each of such items (like them quest items - eg 'Shrunken Head' - are actually 'composed' of 1 InventoryItem and x number of ItemSettings records ~ well, at least in AC3, but I assume this also applies to pre/post versions). Just try to find the total of such item, and it will only return visual counters... Basically: for each InvItem, it loops through them ItemSets and counts "linked" records (= total InvItem)... (I'll get there eventually )

[reverser69]

looking forward to seeing your table updates.
btw is it possible for you to make a series of tutorials on how you traced and found pointers?

[reverser69]

@Paul44
update on crash:
Error Statistics as you requested.
> Main scripts (ptrs) = 7
others = 0

[reverser69]

update on crash:
(let me know if I'm messing with this thread, would you receive notifications if i update my posts?!)

> Main scripts (ptrs) 4
> Teleport & Coordinates 0
> Map Waypoint Teleport 1 --->>> i think this caused crash. as soon as i pressed the hotkey game crashed.

trying to find the guilty code......

[Paul44]

^ Teleport will always turn to '1' the 1st time you use it, and then (should) stay that way (no matter how many times you teleport thereafter ~ which applies to all my AC tables btw)... I did some research back then, and could not figure out what caused it to up (perhaps the pcall itself triggers that, when called upon the 1st time?!).
As for 'hotkey', you mean "Shift+T" ?

ps: i'm set to only receive notif's for pm's; so no worries.

[reverser69]

hi again
im trying to make a super speed cheat but i have two problems: it doesn't work properly and it affects all NPCs.

Code: Select all

aobscanmodule(ezioSuperSpeed,$process,D0 0F 29 86 A0 00 00 00 0F 28) 
newmem:
cmp byte ptr [ecx+94],1   -----> here im using PlayerID you provided?! am i doing it correct?
jne code
movaps xmm0,[esi+000000A0]
movss xmm7, [speedMul]
punpckldq xmm7, xmm7
punpckldq xmm7, xmm7
mulps xmm0,xmm7
movaps [esi+000000A0],xmm0      --------> player doesnt move. probably i don't know the right instructions.

code:
  movaps [esi+000000A0],xmm0
  jmp return

speedMul:
dd (float)3.0

ezioSuperSpeed+01:
  jmp newmem
  nop 2
return:

i think you can do it in a whole other way. heres some information:

Code: Select all

// get entity...
  mov ebx,[eax+8]   ------->>> here EAX itself is a structure. dont know what is it called.
  mov [pEntity],ebx
  
  [pEntity]+68  is player size. affects movement and speed.
  
  

now:

Code: Select all

EAX + A0 ---->>  X   delta
EAX + A4 ---->>  Y   delta
EAX + A8 ---->>  Z   delta

[reverser69]

^ Teleport will always turn to '1' the 1st time you use it, and then (should) stay that way (no matter how many times you teleport thereafter ~ which applies to all my AC tables btw)... I did some research back then, and could not figure out what caused it to up (perhaps the pcall itself triggers that, when called upon the 1st time?!).
As for 'hotkey', you mean "Shift+T" ?

ps: i'm set to only receive notif's for pm's; so no worries.

yeah, "Shift+T".
don't know about the pcall but ill send you the code causing it if i catch it.

and thanks for the relief.

[reverser69]

finally, ACB super speed is done.
float commands nearly killed me. decided to do it singularly. works like a charm (for now).
thx for the PlayerID, without that, it couldn't have been possible.

assassin's creed brotherhood super movement speed:

Spoiler

Code: Select all

[ENABLE]

aobscanmodule(speed,$process,0F 28 86 A0 00 00 00 0F 29 85 50)
alloc(newmem,$1000)

label(code)
label(return)
label(speedMul)

newmem:
push ebx
mov ebx,[esi+8]
cmp byte ptr [ebx+94],1
jne code

xorps xmm0,xmm0
movss xmm0,[speedMul]

{
cmp [esi+78],3F4CCCCD     // if in water. in case want super speed in the water.
je @f                     //but it's buggy when coming out of the water, turn it off when near an edge.
}

cmp word ptr [esi+90],0000 // buggy when jumping ( checking if not on the ground ). so jump ...
je code                   // ( may be useful in some very high places but be careful game will crash)

movss xmm2,[esi+000000A8] //avoiding any change to Z axis when in water
mulss xmm2,,xmm0
movss [esi+000000A8],xmm2

@@:

movss xmm2,[esi+000000A0]
mulss xmm2,,xmm0
movss [esi+000000A0],xmm2

movss xmm2,[esi+000000A4]
mulss xmm2,,xmm0
movss [esi+000000A4],xmm2


code:
pop ebx
  movaps xmm0,[esi+000000A0]
  jmp return

speedMul:
dd (float)3.0

speed:
  jmp newmem
  nop 2
return:
registersymbol(speed)

[DISABLE]
speed:
  db 0F 28 86 A0 00 00 00

unregistersymbol(speed)
dealloc(newmem)

more info for AOB:

Spoiler

Code: Select all

ACBSP-wnd.exe+1C3C61: 52                       - push edx
ACBSP-wnd.exe+1C3C62: 51                       - push ecx
ACBSP-wnd.exe+1C3C63: E8 38 3D 91 01           - call ACBSP-wnd.exe+1AD79A0
ACBSP-wnd.exe+1C3C68: 83 C4 10                 - add esp,10
ACBSP-wnd.exe+1C3C6B: 8B 45 E4                 - mov eax,[ebp-1C]
ACBSP-wnd.exe+1C3C6E: 8B 4D E0                 - mov ecx,[ebp-20]
ACBSP-wnd.exe+1C3C71: 0F 57 C0                 - xorps xmm0,xmm0
ACBSP-wnd.exe+1C3C74: 0F 29 85 40 FF FF FF     - movaps [ebp-000000C0],xmm0
ACBSP-wnd.exe+1C3C7B: F3 0F 10 43 10           - movss xmm0,[ebx+10]
ACBSP-wnd.exe+1C3C80: F3 0F 11 45 84           - movss [ebp-7C],xmm0
// ---------- INJECTING HERE ----------
ACBSP-wnd.exe+1C3C85: 0F 28 86 A0 00 00 00     - movaps xmm0,[esi+000000A0]
// ---------- DONE INJECTING  ----------
ACBSP-wnd.exe+1C3C8C: 0F 29 85 50 FF FF FF     - movaps [ebp-000000B0],xmm0
ACBSP-wnd.exe+1C3C93: 0F 28 05 70 AD C2 02     - movaps xmm0,[ACBSP-wnd.exe+261AD70]
ACBSP-wnd.exe+1C3C9A: 0F 29 85 70 FF FF FF     - movaps [ebp-00000090],xmm0
ACBSP-wnd.exe+1C3CA1: F3 0F 10 05 94 BB 5F 02  - movss xmm0,[ACBSP-wnd.exe+1FEBB94]
ACBSP-wnd.exe+1C3CA9: 0F C6 C0 00              - shufps xmm0,xmm0,00
ACBSP-wnd.exe+1C3CAD: 89 45 8C                 - mov [ebp-74],eax
ACBSP-wnd.exe+1C3CB0: 8D 78 04                 - lea edi,[eax+04]
ACBSP-wnd.exe+1C3CB3: 33 C0                    - xor eax,eax
ACBSP-wnd.exe+1C3CB5: 0F 29 85 60 FF FF FF     - movaps [ebp-000000A0],xmm0
ACBSP-wnd.exe+1C3CBC: F3 0F 10 86 18 05 00 00  - movss xmm0,[esi+00000518]

[Paul44]

^ I have poured both scripts from #reverser69 into a table, as not everyone is up to the task for it. Enjoy...
Features:
* Superspeed
* Shop Quests (ignore prerequisites)

[hoangvjppro]

AC Brotherhood - Deluxe Edition v1.03 - Octobre 2017 (Uplay & Steam)

- Health: incl godmode, invisible, notoriety
- Inventory Supplies
- Teleport & Coordinates (incl teleport, free roam, cam distance)
- One Hit Kill & Friendly godmode (gives friendlies max_health)
- Tank Status (Leonardo submission)
- Freeze Mission Timer: 3 variants (check script for details)
- Manage Assassins (& Contracts)
- Abstergo Challenges (edit/complete most/any challenge)
- Time Of Day
- Cheats menu (in Options): dis/enable at will
- Tools: Build Icon Lists...

+ Compact View mode (set as default): incl info button, referring to this topic


-UPDATE-
- added God Mode (can not even die from great height falls) and Invisibility
- updated Inventory (based on experience with other AC titles)
- added 'Teleport & Coordinates...' (based on experience with other AC titles)
Updated [Readme] file accordingly; read that first (!) before asking questions...

RE info on "finds": read here [ fearlessrevolution.com/threads/assassins-creed-4-black-flag.2356/ ]
(I kept the prev table, just in case)

- UPDATE 2 -
- finetuned Health collect values (will/should load fine even when cheats were enabled before loading save)
- added Invisibility
- finetuned Teleport script (thx to experience with other AC titles)
as always: if something does not add up, pm me... (and check Readme file first)

- IMPORTANT UPDATE - v3.8
I learned from the AC 2 title that 'editing' the knifes value makes the game crash... guaranteed ! (Knifes is a special case since it does some "xor & and" stuff using a different field then the other items?). Need to do some more testing, but lack the time at the moment. Basically, I have removed this item from the inventory list for now...

- UPDATE3 - v4.0
Based on #Exeter's feedback, I solved the conflict with Brutes (and some other enemies). I now also clearly show (*) which scripts depend on correct DRM selection. That said: some Steam versions will only work when {Uplay} is enabled (iow check your selection with one of the *-scripts first)

- UPDATE4 - v4.4
Major update: most main struct ptrs now collected via 1 main script. This increases chances of having it working with your game's exe vs!
Again: did not play the game extensively; just some run-testing with several saves. Also verified/working 2 uplay & 2 Steam vs
New: Free Roam & Cam Distance (FOV)
Also added batchfile to create Windowed version (but probably more 'manageable' using DxWnd). See also here: [ viewtopic.php?f=23&t=11869 ] (you'll need to download SFK = Swiss File Knife yourself)

(removed prev table ~ "old" & obsolete now)

- UPDATE 5 - v4.7
Added: Build icon list... This feature will allow you to get coordinates for most/all Collectibles; and have them shown on the map. (did not touch anything else)

- UPDATE 6 - v4.9
* Revamped 'Freeze Mission timer' (based on my ACU experience ~ for details: [ viewtopic.php?p=138872#p138872 ]).
Note: the previous table also included a 'Stopwatch Timer', but I have no idea where it is used. If you come across it, let me know...
* Solved a serious bug/crash in 'steam' version;cleaned up now.

- UPDATE 7 - v4.91
* Found/added 2nd timer routine
* Also updated tool script for Steam version

- UPDATE 8 - v5.2
* Added: Tank status, Time of day, Compact View mode (GUI changed considerably)
* serious update for 'One Hit Kill' (still not perfect though)

- UPDATE 9 - v5.3
Added: Abstergo Challenges (edit/complete most/any challenge ~ based on ACS experience). see also:
> [ [Link] ]
> [ [Link] ]
Minor updates (related to CE pre-v7.x)
GUI update: based on AC BF experience (see also readme file)

- UPDATE 10 - v5.4
Added: Timer III (takes care of Thief Challenges, incl full sync - see resp. scripts for details) ~ see also pg 3
Important update related to GUI and 'auto-attach': have been working on this for the last 2-3 weeks (see also readme)
(nothing has been touched "cheat-wise"; except added additional ptr-checks in Timer scripts ~ if you still crash after Reload Memory, let me know...)

- UPDATE 11 - v5.5
Added: manage Assassins & Contracts (edit params such as Skill & Level; and change Contract params such as Money & Duration ~ based on my AC RV experience)

- UPDATE 12 - v5.7
Added: access to Cheats menu (via Options). Check Readme for more details (and info link below)
Note: I replayed 3 missions, 1 progress mission & bought several inventory items, with everything saving fine.
That said: I obviously can not tell if certain (sub)missions will not save and/or cause issues...


Cheats menu - How flags are set/managed in AC BR: [ [Link] ]

excuse me what is the extract password