Ghost of Tsushima [Steam]

[Impala]

.... revealing the map would be cool....

i second that
would be nice

I made a quick script to reveal the map, enable and switch to traveller's attire and then switch back to the armor you were wearing

Copy script and paste into cheat engine

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>686</ID>
      <Description>"Fog of War"</Description>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
//GhostOfTsushima.exe+923B04 - F3 42 0F11 B4 A3 A8430000  - movss [rbx+r12*4+000043A8],xmm6
aobscanmodule(fogofwar,GhostOfTsushima.exe,F3 42 0F 11 B4 A3 A8 43 00 00) // should be unique
alloc(newmem,$1000,fogofwar)

label(code)
label(return)

newmem:
  cmp r12,41
  je FogAddy
  jmp code

FogAddy:
  push r13
  mov r13,(float)550
  movq xmm6,r13
  movss [rbx+r12*4+000043A8],xmm6
  pop r13
  jmp return

code:
  movss [rbx+r12*4+000043A8],xmm6
  jmp return

fogofwar:
  jmp newmem
  nop 5
return:
registersymbol(fogofwar)
[DISABLE]
fogofwar:
  db F3 42 0F 11 B4 A3 A8 43 00 00
unregistersymbol(fogofwar)
dealloc(newmem)
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[sakuchi123]

.... revealing the map would be cool....

i second that
would be nice

I made a quick script to reveal the map, enable and switch to traveller's attire and then switch back to the armor you were wearing

Copy script and paste into cheat engine

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>686</ID>
      <Description>"Fog of War"</Description>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
//GhostOfTsushima.exe+923B04 - F3 42 0F11 B4 A3 A8430000  - movss [rbx+r12*4+000043A8],xmm6
aobscanmodule(fogofwar,GhostOfTsushima.exe,F3 42 0F 11 B4 A3 A8 43 00 00) // should be unique
alloc(newmem,$1000,fogofwar)

label(code)
label(return)

newmem:
  cmp r12,41
  je FogAddy
  jmp code

FogAddy:
  push r13
  mov r13,(float)550
  movq xmm6,r13
  movss [rbx+r12*4+000043A8],xmm6
  pop r13
  jmp return

code:
  movss [rbx+r12*4+000043A8],xmm6
  jmp return

fogofwar:
  jmp newmem
  nop 5
return:
registersymbol(fogofwar)
[DISABLE]
fogofwar:
  db F3 42 0F 11 B4 A3 A8 43 00 00

unregistersymbol(fogofwar)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GhostOfTsushima.exe+923B04

GhostOfTsushima.exe+923AC8: 48 8B CB                       - mov rcx,rbx
GhostOfTsushima.exe+923ACB: F3 44 0F 10 8B A4 43 00 00     - movss xmm9,[rbx+000043A4]
GhostOfTsushima.exe+923AD4: F3 44 0F 10 15 D3 F6 A6 00     - movss xmm10,[GhostOfTsushima.exe+13931B0]
GhostOfTsushima.exe+923ADD: F3 41 0F 58 C2                 - addss xmm0,xmm10
GhostOfTsushima.exe+923AE2: F3 44 0F 5C C8                 - subss xmm9,xmm0
GhostOfTsushima.exe+923AE7: E8 14 84 F4 FF                 - call GhostOfTsushima.exe+86BF00
GhostOfTsushima.exe+923AEC: F3 0F 10 83 44 46 00 00        - movss xmm0,[rbx+00004644]
GhostOfTsushima.exe+923AF4: 45 33 ED                       - xor r13d,r13d
GhostOfTsushima.exe+923AF7: F3 0F 10 BB A4 43 00 00        - movss xmm7,[rbx+000043A4]
GhostOfTsushima.exe+923AFF: F3 41 0F 58 C2                 - addss xmm0,xmm10
// ---------- INJECTING HERE ----------
GhostOfTsushima.exe+923B04: F3 42 0F 11 B4 A3 A8 43 00 00  - movss [rbx+r12*4+000043A8],xmm6
// ---------- DONE INJECTING  ----------
GhostOfTsushima.exe+923B0E: 48 39 1D 5B CD B9 02           - cmp [pPlayer],rbx
GhostOfTsushima.exe+923B15: F3 0F 5E F8                    - divss xmm7,xmm0
GhostOfTsushima.exe+923B19: 0F 85 F8 01 00 00              - jne GhostOfTsushima.exe+923D17
GhostOfTsushima.exe+923B1F: 41 8B CC                       - mov ecx,r12d
GhostOfTsushima.exe+923B22: 83 E9 41                       - sub ecx,41
GhostOfTsushima.exe+923B25: 0F 84 E4 01 00 00              - je GhostOfTsushima.exe+923D0F
GhostOfTsushima.exe+923B2B: 83 E9 43                       - sub ecx,43
GhostOfTsushima.exe+923B2E: 0F 84 8B 00 00 00              - je GhostOfTsushima.exe+923BBF
GhostOfTsushima.exe+923B34: 83 F9 23                       - cmp ecx,23
GhostOfTsushima.exe+923B37: 0F 85 DA 01 00 00              - jne GhostOfTsushima.exe+923D17
}
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

Can you make it to .exe?

[Impala]

Can you make it to .exe?

No sorry

[namloki18]

Good table, can you also add auto perfect evade, much appreciated ^^

[Wolfin2010]

I made a quick script to reveal the map, enable and switch to traveller's attire and then switch back to the armor you were wearing

Copy script and paste into cheat engine

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
 <CheatEntries>
 <CheatEntry>
 <ID>686</ID>
 <Description>"Fog of War"</Description>
 <VariableType>Auto Assembler Script</VariableType>
 <AssemblerScript>[ENABLE]
//GhostOfTsushima.exe+923B04 - F3 42 0F11 B4 A3 A8430000 - movss [rbx+r12*4+000043A8],xmm6
aobscanmodule(fogofwar,GhostOfTsushima.exe,F3 42 0F 11 B4 A3 A8 43 00 00) // should be unique
alloc(newmem,$1000,fogofwar)

label(code)
label(return)

newmem:
 cmp r12,41
 je FogAddy
 jmp code

FogAddy:
 push r13
 mov r13,(float)550
 movq xmm6,r13
 movss [rbx+r12*4+000043A8],xmm6
 pop r13
 jmp return

code:
 movss [rbx+r12*4+000043A8],xmm6
 jmp return

fogofwar:
 jmp newmem
 nop 5
return:
registersymbol(fogofwar)
[DISABLE]
fogofwar:
 db F3 42 0F 11 B4 A3 A8 43 00 00

unregistersymbol(fogofwar)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GhostOfTsushima.exe+923B04

GhostOfTsushima.exe+923AC8: 48 8B CB - mov rcx,rbx
GhostOfTsushima.exe+923ACB: F3 44 0F 10 8B A4 43 00 00 - movss xmm9,[rbx+000043A4]
GhostOfTsushima.exe+923AD4: F3 44 0F 10 15 D3 F6 A6 00 - movss xmm10,[GhostOfTsushima.exe+13931B0]
GhostOfTsushima.exe+923ADD: F3 41 0F 58 C2 - addss xmm0,xmm10
GhostOfTsushima.exe+923AE2: F3 44 0F 5C C8 - subss xmm9,xmm0
GhostOfTsushima.exe+923AE7: E8 14 84 F4 FF - call GhostOfTsushima.exe+86BF00
GhostOfTsushima.exe+923AEC: F3 0F 10 83 44 46 00 00 - movss xmm0,[rbx+00004644]
GhostOfTsushima.exe+923AF4: 45 33 ED - xor r13d,r13d
GhostOfTsushima.exe+923AF7: F3 0F 10 BB A4 43 00 00 - movss xmm7,[rbx+000043A4]
GhostOfTsushima.exe+923AFF: F3 41 0F 58 C2 - addss xmm0,xmm10
// ---------- INJECTING HERE ----------
GhostOfTsushima.exe+923B04: F3 42 0F 11 B4 A3 A8 43 00 00 - movss [rbx+r12*4+000043A8],xmm6
// ---------- DONE INJECTING ----------
GhostOfTsushima.exe+923B0E: 48 39 1D 5B CD B9 02 - cmp [pPlayer],rbx
GhostOfTsushima.exe+923B15: F3 0F 5E F8 - divss xmm7,xmm0
GhostOfTsushima.exe+923B19: 0F 85 F8 01 00 00 - jne GhostOfTsushima.exe+923D17
GhostOfTsushima.exe+923B1F: 41 8B CC - mov ecx,r12d
GhostOfTsushima.exe+923B22: 83 E9 41 - sub ecx,41
GhostOfTsushima.exe+923B25: 0F 84 E4 01 00 00 - je GhostOfTsushima.exe+923D0F
GhostOfTsushima.exe+923B2B: 83 E9 43 - sub ecx,43
GhostOfTsushima.exe+923B2E: 0F 84 8B 00 00 00 - je GhostOfTsushima.exe+923BBF
GhostOfTsushima.exe+923B34: 83 F9 23 - cmp ecx,23
GhostOfTsushima.exe+923B37: 0F 85 DA 01 00 00 - jne GhostOfTsushima.exe+923D17
}
</AssemblerScript>
 </CheatEntry>
 </CheatEntries>
</CheatTable>

Much appreciate it. would you be able to add your script with the cfemen's .ct file or help me understand how to do that?

[jonaaa]

I made a quick script to reveal the map, enable and switch to traveller's attire and then switch back to the armor you were wearing

Copy script and paste into cheat engine

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
 <CheatEntries>
 <CheatEntry>
 <ID>686</ID>
 <Description>"Fog of War"</Description>
 <VariableType>Auto Assembler Script</VariableType>
 <AssemblerScript>[ENABLE]
//GhostOfTsushima.exe+923B04 - F3 42 0F11 B4 A3 A8430000 - movss [rbx+r12*4+000043A8],xmm6
aobscanmodule(fogofwar,GhostOfTsushima.exe,F3 42 0F 11 B4 A3 A8 43 00 00) // should be unique
alloc(newmem,$1000,fogofwar)

label(code)
label(return)

newmem:
 cmp r12,41
 je FogAddy
 jmp code

FogAddy:
 push r13
 mov r13,(float)550
 movq xmm6,r13
 movss [rbx+r12*4+000043A8],xmm6
 pop r13
 jmp return

code:
 movss [rbx+r12*4+000043A8],xmm6
 jmp return

fogofwar:
 jmp newmem
 nop 5
return:
registersymbol(fogofwar)
[DISABLE]
fogofwar:
 db F3 42 0F 11 B4 A3 A8 43 00 00

unregistersymbol(fogofwar)
dealloc(newmem)
{
// ORIGINAL CODE - INJECTION POINT: GhostOfTsushima.exe+923B04

GhostOfTsushima.exe+923AC8: 48 8B CB - mov rcx,rbx
GhostOfTsushima.exe+923ACB: F3 44 0F 10 8B A4 43 00 00 - movss xmm9,[rbx+000043A4]
GhostOfTsushima.exe+923AD4: F3 44 0F 10 15 D3 F6 A6 00 - movss xmm10,[GhostOfTsushima.exe+13931B0]
GhostOfTsushima.exe+923ADD: F3 41 0F 58 C2 - addss xmm0,xmm10
GhostOfTsushima.exe+923AE2: F3 44 0F 5C C8 - subss xmm9,xmm0
GhostOfTsushima.exe+923AE7: E8 14 84 F4 FF - call GhostOfTsushima.exe+86BF00
GhostOfTsushima.exe+923AEC: F3 0F 10 83 44 46 00 00 - movss xmm0,[rbx+00004644]
GhostOfTsushima.exe+923AF4: 45 33 ED - xor r13d,r13d
GhostOfTsushima.exe+923AF7: F3 0F 10 BB A4 43 00 00 - movss xmm7,[rbx+000043A4]
GhostOfTsushima.exe+923AFF: F3 41 0F 58 C2 - addss xmm0,xmm10
// ---------- INJECTING HERE ----------
GhostOfTsushima.exe+923B04: F3 42 0F 11 B4 A3 A8 43 00 00 - movss [rbx+r12*4+000043A8],xmm6
// ---------- DONE INJECTING ----------
GhostOfTsushima.exe+923B0E: 48 39 1D 5B CD B9 02 - cmp [pPlayer],rbx
GhostOfTsushima.exe+923B15: F3 0F 5E F8 - divss xmm7,xmm0
GhostOfTsushima.exe+923B19: 0F 85 F8 01 00 00 - jne GhostOfTsushima.exe+923D17
GhostOfTsushima.exe+923B1F: 41 8B CC - mov ecx,r12d
GhostOfTsushima.exe+923B22: 83 E9 41 - sub ecx,41
GhostOfTsushima.exe+923B25: 0F 84 E4 01 00 00 - je GhostOfTsushima.exe+923D0F
GhostOfTsushima.exe+923B2B: 83 E9 43 - sub ecx,43
GhostOfTsushima.exe+923B2E: 0F 84 8B 00 00 00 - je GhostOfTsushima.exe+923BBF
GhostOfTsushima.exe+923B34: 83 F9 23 - cmp ecx,23
GhostOfTsushima.exe+923B37: 0F 85 DA 01 00 00 - jne GhostOfTsushima.exe+923D17
}
</AssemblerScript>
 </CheatEntry>
 </CheatEntries>
</CheatTable>

Much appreciate it. would you be able to add your script with the cfemen's .ct file or help me understand how to do that?

He said how... "Copy and Paste inside Cheat Engine", just copy the code and paste inside cfemen's.

[7zW9S5s6]

Good table, can you also add auto perfect evade, much appreciated ^^

How hard it is to read?
In first post, table maker posted this:
"So please no requests, I will ignore them."

[senseirain]

Unlock all outfit/Cosmetics pls?

[SunBeam]

...

Were those push/pop really necessary? If you take a look at the code flow:

00007FF709E73B04 | F342:0F11B4A3 A8430000 | movss dword ptr ds:[rbx+r12*4+43A8],xmm6 |
00007FF709E73B0E | 48:391D 5BCDB902 | cmp qword ptr ds:[7FF70CA10870],rbx |
00007FF709E73B15 | F3:0F5EF8 | divss xmm7,xmm0 |
00007FF709E73B19 | 0F85 F8010000 | jne ghostoftsushima.7FF709E73D17 |
00007FF709E73B1F | 41:8BCC | mov ecx,r12d |
..
..
00007FF709E73D17 | 48:8D4C24 60 | lea rcx,qword ptr ss:[rsp+60] |
00007FF709E73D1C | E8 FF63C3FF | call ghostoftsushima.7FF709AAA120 |
00007FF709E73D21 | 41:B8 0F000000 | mov r8d,F |

While I get you read someplace you always have to push/pop a register when using it "for best practices", it doesn't hurt to apply some own logic and realize a register following your hook may be overwritten. That means you can USE it before it's overwritten, so no more push/pop:

Code: Select all

mov rcx,(float)550
movq xmm6,rcx
movss [rbx+r12*4+000043A8],xmm6

And even better, you can avoid using registers altogether since you're dealing with SSE2 instructions in the end:

Code: Select all

movss xmm6,[fValue]
movss [rbx+r12*4+000043A8],xmm6

fValue:
dd (float)550.0

Just some tips for future reference.

[AlexDeyth]

Hello, thanks for the table

It is possible to add a option for the Legends mode, to bypass number of players ?

Mainly for opening the Oni chest or enabling the Gyozen's curse (i don't think it's possible to make playable the 4 players Raid in solo).

Something like the option to open 2 players vault in Helldivers 2.

[SunBeam]

There is a big ass pink gif in main post. I doubt you didn't see it.

[STN]

Someone stole this table and posted on Nexus

[thieves friendly website].com/ghostoftsushima/mods/66

And then I get asked why I have censored sites and warn when someone mentions them. This is why because I fucking hate thieves and the platforms that support thieves.

[Impala]

Fog of War / Full Map Reveal with sunbeams enchancements

I made a quick script to reveal the map, enable and switch to traveller's attire and then switch back to the armor you were wearing

Copy script and paste into cheat engine

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>686</ID>
      <Description>"Fog of War (Switch to and from traveller's armor)"</Description>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
//GhostOfTsushima.exe+923B04 - F3 42 0F11 B4 A3 A8430000  - movss [rbx+r12*4+000043A8],xmm6
aobscanmodule(fogofwar,GhostOfTsushima.exe,F3 42 0F 11 B4 A3 A8 43 00 00) // should be unique
alloc(newmem,$1000,fogofwar)

label(code)
label(return)

newmem:
  cmp r12,41
  je FogAddy
  jmp code

FogAddy:
  movss xmm6,[fValue]
  movss [rbx+r12*4+000043A8],xmm6
  jmp return

fValue:
  dd (float)550.0

code:
  movss [rbx+r12*4+000043A8],xmm6
  jmp return

fogofwar:
  jmp newmem
  nop 5
return:
registersymbol(fogofwar)
[DISABLE]
fogofwar:
  db F3 42 0F 11 B4 A3 A8 43 00 00

unregistersymbol(fogofwar)
dealloc(newmem)
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

[cfemen]

Made several updates and added some more stuff (Free-Cam,Dodge Script,Perfect Parry)

Newest table contains a Give Gear By Hash script, so you can add items directly to the inventory if you know the items hash.
The main post contains a txt file with hashes + names, it's unsorted and contains more than just the items.
So if we want a full list we should work together, I will start with a item-hash only list and I will add all contributions.

e.g:
5091342EE71AC35C = Archery Master's Attire
340170F3EB31048A = Curse of Frailty Charm

So yeah feel free to test hashes and post your results

[jomoroon]

CEE6E16F96FDA0C1 = ghost armor