Middle-earth: Shadow of War (PATCH 11.10.2017)

[unmog]

WRAITH
[*]Treasure Hunter No conflict, no problem.

Does the mind breaker in treasure hunter perk do anything? I got it mostly hoping to dominate grunts faster and if theres any sort of increase I'm not seeing it... I figured itd let me dominate minions as fast as it lets me dominate worms.

Edit: I should note, that it seems to improve the speed of dominating/draining people when Im doing missions of Celebrimbors past. Unless he just gets a bonus for no reason

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[predprey]

Use Army of One's mount cooldown script to speed up testing for mounts.

Was doing some tests last night, trying to figure out how Focus gets refilled. And I found a location (it's global, for multiple events) where a timer is generated using base floats. For Focus, value is 12.0. Can you name some other situations where there's timers, apart from the summon cooldown? (reason I mentioned this is you referred that part I quoted; I will do my due diligence and try out the spot I found with summoning, might affect it as well). Will report findings in my topic in Show Your Skills section

The celebrimblr challenges timers? And also some weapn effects have a timer e.g. set enemy on fire every 42s.

Anyway didn't you already find the 4 booleans for controlling focus might etc.? So now you're just reversing the focus algorithmns put of curiosity? Because toggling the booleans were by far the cleanest solution already.

[stealthcl0wn]

WRAITH
[*]Treasure Hunter No conflict, no problem.

Does the mind breaker in treasure hunter perk do anything? I got it mostly hoping to dominate grunts faster and if theres any sort of increase I'm not seeing it... I figured itd let me dominate minions as fast as it lets me dominate worms.

It does not, it only lets you dominate worms/broken captains faster.

[predprey]

The table doesn't work anymore. It gives errors or crashes the game. 'expected process = TEW2.exe.'

TEW2 is the evil within 2. That was just a check added by Kalas as shouldnt crash the game.

[Formous]

I keep trying to use the No Mount Cooldown Skill cheat, but it has no effect on my game, despite being enabled. Anyone able to help? Neither follower or mounts recharge instantly. Also, when attempting to use cheats, the game now crashes frequently. I only had 2 active in my last crash, Unlimited might (brutal executions) and No Mount Cooldown Skill(which was still not working).

[unmog]

WRAITH
[*]Treasure Hunter No conflict, no problem.

Does the mind breaker in treasure hunter perk do anything? I got it mostly hoping to dominate grunts faster and if theres any sort of increase I'm not seeing it... I figured itd let me dominate minions as fast as it lets me dominate worms.

It does not, it only lets you dominate worms/broken captains faster.

But is that intentional? Worms already get dominanted rediculously fast and you dont need it for when a captain is hurt 9 times out of 10. The description states "Increases domination speed", it doesn't say anything about just worms and broken captains cuz then whats the point? I really hope they fix that ability, it certainly cant be working as intended and if it is they should make a note that it doesnt work on grunts :/

Is there a way to speed up domination speeds, or instant dominante etc?

Edit: Apparently when playing in the past missions as Celebrimbor, it does greatly speed up dominating grunts. Either that or theres some other factor at play which does.

[glitch83]

Does anybody knows how to make more bodyguards with unlimitted health.....

[teinousi]

my turn , my turn , my turn for request >w<

Does anybody know how to make "push any button" on the title menu , then u push u will clear the game ?

[stealthcl0wn]

my turn , my turn , my turn for request >w<

Does anybody know how to make "push any button" on the title menu , then u push u will clear the game ?

ゲームクリア　おめでとうですわ～！このファックキークズ～！

Yeah it's the counter button and the dodge button.

[predprey]

How about you read this? -> viewtopic.php?p=20613#p20613.

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>1945</ID>
      <Description>"Developer Booleans"</Description>
      <Options moHideChildren="1"/>
      <LastState/>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
{$lua}
local aob_devBool = AOBScan("48 8D 0D * * * * E8 * * * * 84 C0 74 37 48 8B CB","+X-W-C")
if (aob_devBool ~= nil) then
  local baseAddr = tonumber(aob_devBool[0],16)
  local offset = readInteger(baseAddr+3)
  registerSymbol("ptr_devBool",baseAddr+offset+7)
end
aob_devBool:destroy()
{$asm}
[DISABLE]
{$lua}
unregisterSymbol("ptr_devBool")
{$asm}

{
// ORIGINAL CODE - INJECTION POINT: ShadowOfWar.AK::SoundEngine::SetRTPCValue+160E5

"ShadowOfWar.exe"+F95DC5: 83 FE 05              -  cmp esi,05
"ShadowOfWar.exe"+F95DC8: 75 4E                 -  jne ShadowOfWar.exe+F95E18
"ShadowOfWar.exe"+F95DCA: 4C 8B 05 FF 49 44 01  -  mov r8,[ShadowOfWar.exe+23DA7D0]
"ShadowOfWar.exe"+F95DD1: 48 8D 55 68           -  lea rdx,[rbp+68]
"ShadowOfWar.exe"+F95DD5: 45 33 C9              -  xor r9d,r9d
"ShadowOfWar.exe"+F95DD8: 48 8D 4D 00           -  lea rcx,[rbp+00]
"ShadowOfWar.exe"+F95DDC: 4C 21 4D 68           -  and [rbp+68],r9
"ShadowOfWar.exe"+F95DE0: 4D 8B 40 08           -  mov r8,[r8+08]
"ShadowOfWar.exe"+F95DE4: 4C 89 45 00           -  mov [rbp+00],r8
"ShadowOfWar.exe"+F95DE8: E8 C7 B8 24 FF        -  call ShadowOfWar.exe+1E16B4
// ---------- INJECTING HERE ----------
"ShadowOfWar.exe"+F95DED: 84 C0                 -  test al,al
"ShadowOfWar.exe"+F95DEF: 74 21                 -  je ShadowOfWar.exe+F95E12
"ShadowOfWar.exe"+F95DF1: 4C 21 4D 68           -  and [rbp+68],r9
// ---------- DONE INJECTING  ----------
"ShadowOfWar.exe"+F95DF5: 45 0B 48 20           -  or r9d,[r8+20]
"ShadowOfWar.exe"+F95DF9: 48 8D 55 68           -  lea rdx,[rbp+68]
"ShadowOfWar.exe"+F95DFD: 4D 8B 40 08           -  mov r8,[r8+08]
"ShadowOfWar.exe"+F95E01: 48 8D 4D 00           -  lea rcx,[rbp+00]
"ShadowOfWar.exe"+F95E05: 4C 89 45 00           -  mov [rbp+00],r8
"ShadowOfWar.exe"+F95E09: E8 A6 B8 24 FF        -  call ShadowOfWar.exe+1E16B4
"ShadowOfWar.exe"+F95E0E: 84 C0                 -  test al,al
"ShadowOfWar.exe"+F95E10: 75 E3                 -  jne ShadowOfWar.exe+F95DF5
"ShadowOfWar.exe"+F95E12: 41 F7 D1              -  not r9d
"ShadowOfWar.exe"+F95E15: 41 23 D9              -  and ebx,r9d
}
</AssemblerScript>
      <CheatEntries>
        <CheatEntry>
          <ID>1946</ID>
          <Description>"ptr_devBool"</Description>
          <VariableType>Array of byte</VariableType>
          <ByteLength>4</ByteLength>
          <Address>ptr_devBool</Address>
          <CheatEntries>
            <CheatEntry>
              <ID>1947</ID>
              <Description>"Focus"</Description>
              <DropDownList ReadOnly="1" DisplayValueAsItem="1">1:On
0:Off
</DropDownList>
              <VariableType>Byte</VariableType>
              <Address>+0</Address>
            </CheatEntry>
            <CheatEntry>
              <ID>1948</ID>
              <Description>"Might"</Description>
              <DropDownList ReadOnly="1" DisplayValueAsItem="1">1:On
0:Off
</DropDownList>
              <VariableType>Byte</VariableType>
              <Address>+1</Address>
            </CheatEntry>
            <CheatEntry>
              <ID>1949</ID>
              <Description>"Elf Shot"</Description>
              <DropDownList ReadOnly="1" DisplayValueAsItem="1">1:On
0:Off
</DropDownList>
              <VariableType>Byte</VariableType>
              <Address>+2</Address>
            </CheatEntry>
            <CheatEntry>
              <ID>1950</ID>
              <Description>"Wrath"</Description>
              <DropDownList ReadOnly="1" DisplayValueAsItem="1">1:On
0:Off
</DropDownList>
              <VariableType>Byte</VariableType>
              <Address>+3</Address>
            </CheatEntry>
          </CheatEntries>
        </CheatEntry>
      </CheatEntries>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

Script for the developer boolean values SunBeam found.

[vondree]

Hello guys,

i have question, can edit value of skill points? im max level 60 and i have 8 skill points. I need edit points to 0.
How can do it?
Thanks

[predprey]

Code: Select all

<?xml version="1.0" encoding="utf-8"?>
<CheatTable>
  <CheatEntries>
    <CheatEntry>
      <ID>1951</ID>
      <Description>"Multi Skill Upgrade Toggle (Modifier Key Ctrl/L2)"</Description>
      <LastState/>
      <Color>FF8000</Color>
      <VariableType>Auto Assembler Script</VariableType>
      <AssemblerScript>[ENABLE]
aobscanmodule(aob_controllerState,ShadowOfWar.exe,0F 11 87 40 01 00 00 48 8D)
registersymbol(aob_controllerState)
alloc(newmem_controllerState,1024,ShadowOfWar.exe)
alloc(ptr_controllerState,8,ShadowOfWar.exe)
label(return_controllerState)

newmem_controllerState:
  lea rbp,[rdi+00000140]
  mov [ptr_controllerState],rbp
  movups [rdi+00000140],xmm0
  jmp long return_controllerState

aob_controllerState:
  jmp newmem_controllerState
  nop
  nop
return_controllerState:

//====================================================================================================

aobscanmodule(aob_MultiSkillUpgrade,ShadowOfWar.exe,49 8B 16 45 8B C7)
alloc(newmem_MultiSkillUpgrade,1024,ShadowOfWar.exe)
label(backup_MultiSkillUpgrade)
label(return_MultiSkillUpgrade)
registersymbol(aob_MultiSkillUpgrade)
registersymbol(backup_MultiSkillUpgrade)

newmem_MultiSkillUpgrade:
  sub rsp,28
//Keyboard Modifier
  push rax
  push rcx
  push rdx
  push r8
  push r9
  push r10
  push r11
  mov rcx,11 //VK_CONTROL = 0x11
  call GetAsyncKeyState
  test ax,ax
  pop r11
  pop r10
  pop r9
  pop r8
  pop rdx
  pop rcx
  pop rax
  js short @f
//Gamepad Modifier
  push rax
  mov rax,[ptr_controllerState]
  cmp byte ptr [rax+6],0
  pop rax
  jne short @f
  add rsp,28
//Original Code
  reassemble(aob_MultiSkillUpgrade+9)
  jmp long return_MultiSkillUpgrade
@@:
  add rsp,28
  jmp long return_MultiSkillUpgrade
backup_MultiSkillUpgrade:
  readmem(aob_MultiSkillUpgrade+9,5)

aob_MultiSkillUpgrade+9:
  jmp newmem_MultiSkillUpgrade
return_MultiSkillUpgrade:

[DISABLE]
aob_MultiSkillUpgrade+9:
  readmem(backup_MultiSkillUpgrade,5)

unregistersymbol(aob_MultiSkillUpgrade)
unregistersymbol(backup_MultiSkillUpgrade)
dealloc(newmem_MultiSkillUpgrade)

{
// ORIGINAL CODE - INJECTION POINT: ShadowOfWar.AK::StreamMgr::SetFileLocationResolver+8A184A

"ShadowOfWar.exe"+18572C5: 48 8B 8E A0 03 00 00  -  mov rcx,[rsi+000003A0]
"ShadowOfWar.exe"+18572CC: 48 85 C9              -  test rcx,rcx
"ShadowOfWar.exe"+18572CF: 74 21                 -  je ShadowOfWar.exe+18572F2
"ShadowOfWar.exe"+18572D1: 4C 39 61 40           -  cmp [rcx+40],r12
"ShadowOfWar.exe"+18572D5: 74 1B                 -  je ShadowOfWar.exe+18572F2
"ShadowOfWar.exe"+18572D7: 48 8B 0D 02 3D AD 00  -  mov rcx,[ShadowOfWar.exe+232AFE0]
"ShadowOfWar.exe"+18572DE: BA 08 00 00 00        -  mov edx,00000008
"ShadowOfWar.exe"+18572E3: 4D 8B 06              -  mov r8,[r14]
"ShadowOfWar.exe"+18572E6: 48 8B 89 18 6D 00 00  -  mov rcx,[rcx+00006D18]
"ShadowOfWar.exe"+18572ED: E8 76 86 F6 FF        -  call ShadowOfWar.exe+17BF968
// ---------- INJECTING HERE ----------
"ShadowOfWar.exe"+18572F2: 49 8B 16              -  mov rdx,[r14]
"ShadowOfWar.exe"+18572F5: 45 8B C7              -  mov r8d,r15d
// ---------- DONE INJECTING  ----------
"ShadowOfWar.exe"+18572F8: 48 8B CE              -  mov rcx,rsi
"ShadowOfWar.exe"+18572FB: E8 68 72 C7 FE        -  call ShadowOfWar.exe+4CE568
"ShadowOfWar.exe"+1857300: 49 83 C6 08           -  add r14,08
"ShadowOfWar.exe"+1857304: 48 FF C7              -  inc rdi
"ShadowOfWar.exe"+1857307: 48 3B FB              -  cmp rdi,rbx
"ShadowOfWar.exe"+185730A: 75 A7                 -  jne ShadowOfWar.exe+18572B3
"ShadowOfWar.exe"+185730C: 8B 85 90 01 00 00     -  mov eax,[rbp+00000190]
"ShadowOfWar.exe"+1857312: 48 8D 8D 98 01 00 00  -  lea rcx,[rbp+00000198]
"ShadowOfWar.exe"+1857319: 49 8B FC              -  mov rdi,r12
"ShadowOfWar.exe"+185731C: 4C 8D B5 98 01 00 00  -  lea r14,[rbp+00000198]
}

//====================================================================================================

aob_controllerState:
  db 0F 11 87 40 01 00 00

unregistersymbol(aob_controllerState)
unregistersymbol(ptr_controllerState)
dealloc(newmem_controllerState)
dealloc(ptr_controllerState)
{
// ORIGINAL CODE - INJECTION POINT: ShadowOfWar.AK::MemoryMgr::Free+8E792

"ShadowOfWar.exe"+245989: 41 56                 -  push r14
"ShadowOfWar.exe"+24598B: 41 57                 -  push r15
"ShadowOfWar.exe"+24598D: 48 83 EC 30           -  sub rsp,30
"ShadowOfWar.exe"+245991: 48 8B F9              -  mov rdi,rcx
"ShadowOfWar.exe"+245994: 48 8D 91 18 01 00 00  -  lea rdx,[rcx+00000118]
"ShadowOfWar.exe"+24599B: 48 8D 48 18           -  lea rcx,[rax+18]
"ShadowOfWar.exe"+24599F: E8 8C B5 B8 00        -  call ShadowOfWar.exe+DD0F30
"ShadowOfWar.exe"+2459A4: 0F 10 87 90 01 00 00  -  movups xmm0,[rdi+00000190]
"ShadowOfWar.exe"+2459AB: 4C 8D B7 80 01 00 00  -  lea r14,[rdi+00000180]
"ShadowOfWar.exe"+2459B2: 4C 8D 7F 08           -  lea r15,[rdi+08]
// ---------- INJECTING HERE ----------
"ShadowOfWar.exe"+2459B6: 0F 11 87 40 01 00 00  -  movups [rdi+00000140],xmm0
// ---------- DONE INJECTING  ----------
"ShadowOfWar.exe"+2459BD: 48 8D 6C 24 70        -  lea rbp,[rsp+70]
"ShadowOfWar.exe"+2459C2: 0F 10 8F A0 01 00 00  -  movups xmm1,[rdi+000001A0]
"ShadowOfWar.exe"+2459C9: 0F 11 8F 50 01 00 00  -  movups [rdi+00000150],xmm1
"ShadowOfWar.exe"+2459D0: 0F 10 87 B0 01 00 00  -  movups xmm0,[rdi+000001B0]
"ShadowOfWar.exe"+2459D7: 0F 11 87 60 01 00 00  -  movups [rdi+00000160],xmm0
"ShadowOfWar.exe"+2459DE: 0F 10 8F C0 01 00 00  -  movups xmm1,[rdi+000001C0]
"ShadowOfWar.exe"+2459E5: 0F 11 8F 70 01 00 00  -  movups [rdi+00000170],xmm1
"ShadowOfWar.exe"+2459EC: 8B 87 D0 01 00 00     -  mov eax,[rdi+000001D0]
"ShadowOfWar.exe"+2459F2: 89 44 24 70           -  mov [rsp+70],eax
"ShadowOfWar.exe"+2459F6: 33 C0                 -  xor eax,eax
}
</AssemblerScript>
    </CheatEntry>
  </CheatEntries>
</CheatTable>

Multi Skill Upgrade Toggle (Modifier Key Ctrl/L2) - Self-explanatory. Retains normal game behavior if modifier key is not pressed.

[predprey]

So now you're just reversing the focus algorithmns put of curiosity? Because toggling the booleans were by far the cleanest solution already.

That is exactly what I am doing, since there's no visible value on screen (remember Batman at least told you some numbers for durations). As far as the bools, let's say if the devs remove them and assuming one's not smart enough to patch the ASM spots, it falls back to timers I changed the Focus one for testing purposes from 12.0 to 0.0. As soon as you stop using it, it starts refilling. No delay. Another I wanna learn is the fill amount - I think it's 40.0. Drain amount is 3, turned into 0.03 subtracted from Focus. Also.. Health has a refill timer as well, when critical. Imagine setting timer and amount and getting critical'd by a Captain Instant heal. Yes, I know there's God Mode, but am curious how the params work. Oh, and I've not found a similar bool for Health. Not to mention the Health sub routine is shared.

After delving into the game's code, I too was curious about the game engine actually. It seems most of the vital game functions have the symbols associated with the WWise Audio Engine namespaces which leads me to think that the game is heavily tied to its audio engine. Not sure if that's a correct conclusion to draw though as I am not familiar with what namespaces are.

[predprey]

@predprey: I scrolled a bit through the code and saw this: "mov dword ptr [result_keypressCheck],1". Was about to say: "why the F didn't you use a thread instead of check-up bools?" Then I took another look Fun times with Dick and Jane (my left and right eye)

haha my original plan was to do everything without threads but within the code cave.....but somehow GetAsyncKeyState doesn't seem to work if i write it within the hook. i posed a question on CEF hoping for answers.

Code: Select all

http://forum.cheatengine.org/viewtopic.php?t=606044

so in the end the only way was to setup a separate thread and get the result from there so ended up this roundabout way. if someone could tell me why it's not working the way i hoped it should, then i could streamline the script better.

[Megasder]

Does the mind breaker in treasure hunter perk do anything? I got it mostly hoping to dominate grunts faster and if theres any sort of increase I'm not seeing it... I figured itd let me dominate minions as fast as it lets me dominate worms.

It does not, it only lets you dominate worms/broken captains faster.

But is that intentional? Worms already get dominanted rediculously fast and you dont need it for when a captain is hurt 9 times out of 10. The description states "Increases domination speed", it doesn't say anything about just worms and broken captains cuz then whats the point? I really hope they fix that ability, it certainly cant be working as intended and if it is they should make a note that it doesnt work on grunts :/

Is there a way to speed up domination speeds, or instant dominante etc?

Edit: Apparently when playing in the past missions as Celebrimbor, it does greatly speed up dominating grunts. Either that or theres some other factor at play which does.

Aparently right now is bugged, i went to some reddit and the people all question the same, "why it seems that mind breaker does nothing?", i said that there is no problem because when I tested it it seemed to me that when the skill alone and the skill with the 3 upgrades had the same speed, but yes is bugged, hope they update the game, also the celebrimbor misions have a custom drain speed, so is normal that in that mission drain is faster.