Kingdom Come Deliverance

[iicecube]

Do anyone come across on draw speed on the bow? like decreasing and increasing the speed.

KingdomComeDeliverance\Data\Scripts.pak\Scripts\Entities\Items\XML\Ammo\Arrow.xml

Code: Select all

26:  <param name="thrust" value="0" />

Oops, sorry, you wanted a draw speed, not arrow speed. But it will kinda work, try 400 thrust - it'll make basically any draw into max draw.

I tured out the arrow speed value already but I still finding Henry hand is too small to even draw a small bow to his standard.
It's like he was tied up with heavy stone while pulling the string.
Any luck you found any value that control the pulling part?

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[ReDragonInc]

Do anyone come across on draw speed on the bow? like decreasing and increasing the speed.

KingdomComeDeliverance\Data\Scripts.pak\Scripts\Entities\Items\XML\Ammo\Arrow.xml

Code: Select all

26:  <param name="thrust" value="0" />

Oops, sorry, you wanted a draw speed, not arrow speed. But it will kinda work, try 400 thrust - it'll make basically any draw into max draw.

I tured out the arrow speed value already but I still finding Henry hand is too small to even draw a small bow to his standard.
It's like he was tied up with heavy stone while pulling the string.
Any luck you found any value that control the pulling part?

Currently testing something right now.

[Expired6978]

Enable Console Functions:

Hopefully the aobscan works, whatever game version I am using seems to differ from everyone else's here.

Console Unlocker

Code: Select all

{ Game   : KingdomCome.exe
  Version: 
  Date   : 2018-02-18
  This script enables the KCD console for variables and functions that were dev disabled
}

[ENABLE]

aobscanmodule(VariableExec,WHGame.DLL,81 E3 02 00 00 03) // should be unique
alloc(newmem,$1000,"WHGame.DLL"+6F7882)

label(code)
label(return)

newmem:

code:
  and ebx,03000000
  jmp return

VariableExec:
  jmp newmem
  nop
return:
registersymbol(VariableExec)

aobscanmodule(FunctionExec,WHGame.DLL,F7 47 18 02 00 00 03) // should be unique
alloc(newmem2,$1000,"WHGame.DLL"+6F7AF8)

label(code2)
label(return2)

newmem2:

code2:
  test [rdi+18],3000000
  jmp return2

FunctionExec:
  jmp newmem2
  nop
  nop
return2:
registersymbol(FunctionExec)

[DISABLE]

VariableExec:
  db 81 E3 02 00 00 03

unregistersymbol(VariableExec)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "WHGame.DLL"+6F7882

"WHGame.DLL"+6F7861: 4D 8B F8                 -  mov r15,r8
"WHGame.DLL"+6F7864: 48 8B FA                 -  mov rdi,rdx
"WHGame.DLL"+6F7867: FF 90 88 00 00 00        -  call qword ptr [rax+00000088]
"WHGame.DLL"+6F786D: 4C 8B 0F                 -  mov r9,[rdi]
"WHGame.DLL"+6F7870: 48 8B CF                 -  mov rcx,rdi
"WHGame.DLL"+6F7873: 40 8A E8                 -  mov bpl,al
"WHGame.DLL"+6F7876: 41 FF 51 60              -  call qword ptr [r9+60]
"WHGame.DLL"+6F787A: 4C 8B 07                 -  mov r8,[rdi]
"WHGame.DLL"+6F787D: 48 8B CF                 -  mov rcx,rdi
"WHGame.DLL"+6F7880: 8B D8                    -  mov ebx,eax
// ---------- INJECTING HERE ----------
"WHGame.DLL"+6F7882: 81 E3 02 00 00 03        -  and ebx,03000002
// ---------- DONE INJECTING  ----------
"WHGame.DLL"+6F7888: 41 0F 95 C4              -  setne r12l
"WHGame.DLL"+6F788C: 41 FF 50 60              -  call qword ptr [r8+60]
"WHGame.DLL"+6F7890: 48 8B 17                 -  mov rdx,[rdi]
"WHGame.DLL"+6F7893: 48 8B CF                 -  mov rcx,rdi
"WHGame.DLL"+6F7896: 44 8B F0                 -  mov r14d,eax
"WHGame.DLL"+6F7899: 41 81 E6 00 08 00 00     -  and r14d,00000800
"WHGame.DLL"+6F78A0: 41 0F 95 C5              -  setne r13l
"WHGame.DLL"+6F78A4: FF 52 60                 -  call qword ptr [rdx+60]
"WHGame.DLL"+6F78A7: 25 00 00 00 40           -  and eax,40000000
"WHGame.DLL"+6F78AC: 0F 95 84 24 80 00 00 00  -  setne byte ptr [rsp+00000080]
}
FunctionExec:
  db F7 47 18 02 00 00 03

unregistersymbol(FunctionExec)
dealloc(newmem2)

{
// ORIGINAL CODE - INJECTION POINT: "WHGame.DLL"+6F7AF8

"WHGame.DLL"+6F7ACC: 48 8B 51 08                 -  mov rdx,[rcx+08]
"WHGame.DLL"+6F7AD0: 0F B6 05 31 06 77 01        -  movzx eax,byte ptr [WHGame.DLL+1E68108]
"WHGame.DLL"+6F7AD7: 44 0F B6 02                 -  movzx r8d,byte ptr [rdx]
"WHGame.DLL"+6F7ADB: 44 2B C0                    -  sub r8d,eax
"WHGame.DLL"+6F7ADE: 75 0F                       -  jne WHGame.DLL+6F7AEF
"WHGame.DLL"+6F7AE0: 44 0F B6 42 01              -  movzx r8d,byte ptr [rdx+01]
"WHGame.DLL"+6F7AE5: 0F B6 05 1D 06 77 01        -  movzx eax,byte ptr [WHGame.DLL+1E68109]
"WHGame.DLL"+6F7AEC: 44 2B C0                    -  sub r8d,eax
"WHGame.DLL"+6F7AEF: 45 85 C0                    -  test r8d,r8d
"WHGame.DLL"+6F7AF2: 0F 84 DA F3 A0 00           -  je WHGame.DLL+1106ED2
// ---------- INJECTING HERE ----------
"WHGame.DLL"+6F7AF8: F7 47 18 02 00 00 03        -  test [rdi+18],3000002
// ---------- DONE INJECTING  ----------
"WHGame.DLL"+6F7AFF: 0F 85 E2 F3 A0 00           -  jne WHGame.DLL+1106EE7
"WHGame.DLL"+6F7B05: 48 8B 47 20                 -  mov rax,[rdi+20]
"WHGame.DLL"+6F7B09: 48 85 C0                    -  test rax,rax
"WHGame.DLL"+6F7B0C: 0F 84 17 F4 A0 00           -  je WHGame.DLL+1106F29
"WHGame.DLL"+6F7B12: 48 8D 0D 97 08 78 01        -  lea rcx,[WHGame.DLL+1E783B0]
"WHGame.DLL"+6F7B19: 48 89 75 07                 -  mov [rbp+07],rsi
"WHGame.DLL"+6F7B1D: 48 89 4D F7                 -  mov [rbp-09],rcx
"WHGame.DLL"+6F7B21: 48 8D 4D D7                 -  lea rcx,[rbp-29]
"WHGame.DLL"+6F7B25: 48 89 4D FF                 -  mov [rbp-01],rcx
"WHGame.DLL"+6F7B29: 48 8D 4D F7                 -  lea rcx,[rbp-09]
}

Should allow you to use commands like:
wh_cheat_addItem
wh_cheat_money
It also allows setting of some cVars that are normally not allowed to be set, though it seems many of the interesting ones do nothing.

wh_cheat_addItem takes the item GUID, these can be found in
Data\Tables.pak\Libs\Tables\item\item.xml

For Example:
wh_cheat_addItem 57ace80d-3683-486a-93b1-1bbe4c21e598
Would give you a Yew Longbow

[exwhyzee]

Is it possible to set the difficulty for locks? I mean, if that were possible we could use that in conjunction with the nexus mods auto-lock pick "Very Easy" and just skip lock picking altogether. No more need to find lock picks to engage in a mini game otherwise relatively tedious.

Also would make it easier to complete a few quests that require you to lockpick.

[DrummerIX]

I bought this game also. Been watching some youtube of it to get a feel for it. I don't enjoy Western RPG's as well as some JRPG's, but I still enjoy some of them. I see you all have done well with getting started with some cheats. I may be interested in learning how to hack western style RPG's. Do you all still see things that need to be done cheat table wise and want some help?

[shuiko]

Enable Console Functions:

Hopefully the aobscan works, whatever game version I am using seems to differ from everyone else's here.

Spoiler

Code: Select all

{ Game   : KingdomCome.exe
  Version: 
  Date   : 2018-02-18
  This script enables the KCD console for variables and functions that were dev disabled
}

[ENABLE]

aobscanmodule(VariableExec,WHGame.DLL,81 E3 02 00 00 03) // should be unique
alloc(newmem,$1000,"WHGame.DLL"+6F7882)

label(code)
label(return)

newmem:

code:
  and ebx,03000000
  jmp return

VariableExec:
  jmp newmem
  nop
return:
registersymbol(VariableExec)

aobscanmodule(FunctionExec,WHGame.DLL,F7 47 18 02 00 00 03) // should be unique
alloc(newmem2,$1000,"WHGame.DLL"+6F7AF8)

label(code2)
label(return2)

newmem2:

code2:
  test [rdi+18],3000000
  jmp return2

FunctionExec:
  jmp newmem2
  nop
  nop
return2:
registersymbol(FunctionExec)

[DISABLE]

VariableExec:
  db 81 E3 02 00 00 03

unregistersymbol(VariableExec)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "WHGame.DLL"+6F7882

"WHGame.DLL"+6F7861: 4D 8B F8                 -  mov r15,r8
"WHGame.DLL"+6F7864: 48 8B FA                 -  mov rdi,rdx
"WHGame.DLL"+6F7867: FF 90 88 00 00 00        -  call qword ptr [rax+00000088]
"WHGame.DLL"+6F786D: 4C 8B 0F                 -  mov r9,[rdi]
"WHGame.DLL"+6F7870: 48 8B CF                 -  mov rcx,rdi
"WHGame.DLL"+6F7873: 40 8A E8                 -  mov bpl,al
"WHGame.DLL"+6F7876: 41 FF 51 60              -  call qword ptr [r9+60]
"WHGame.DLL"+6F787A: 4C 8B 07                 -  mov r8,[rdi]
"WHGame.DLL"+6F787D: 48 8B CF                 -  mov rcx,rdi
"WHGame.DLL"+6F7880: 8B D8                    -  mov ebx,eax
// ---------- INJECTING HERE ----------
"WHGame.DLL"+6F7882: 81 E3 02 00 00 03        -  and ebx,03000002
// ---------- DONE INJECTING  ----------
"WHGame.DLL"+6F7888: 41 0F 95 C4              -  setne r12l
"WHGame.DLL"+6F788C: 41 FF 50 60              -  call qword ptr [r8+60]
"WHGame.DLL"+6F7890: 48 8B 17                 -  mov rdx,[rdi]
"WHGame.DLL"+6F7893: 48 8B CF                 -  mov rcx,rdi
"WHGame.DLL"+6F7896: 44 8B F0                 -  mov r14d,eax
"WHGame.DLL"+6F7899: 41 81 E6 00 08 00 00     -  and r14d,00000800
"WHGame.DLL"+6F78A0: 41 0F 95 C5              -  setne r13l
"WHGame.DLL"+6F78A4: FF 52 60                 -  call qword ptr [rdx+60]
"WHGame.DLL"+6F78A7: 25 00 00 00 40           -  and eax,40000000
"WHGame.DLL"+6F78AC: 0F 95 84 24 80 00 00 00  -  setne byte ptr [rsp+00000080]
}
FunctionExec:
  db F7 47 18 02 00 00 03

unregistersymbol(FunctionExec)
dealloc(newmem2)

{
// ORIGINAL CODE - INJECTION POINT: "WHGame.DLL"+6F7AF8

"WHGame.DLL"+6F7ACC: 48 8B 51 08                 -  mov rdx,[rcx+08]
"WHGame.DLL"+6F7AD0: 0F B6 05 31 06 77 01        -  movzx eax,byte ptr [WHGame.DLL+1E68108]
"WHGame.DLL"+6F7AD7: 44 0F B6 02                 -  movzx r8d,byte ptr [rdx]
"WHGame.DLL"+6F7ADB: 44 2B C0                    -  sub r8d,eax
"WHGame.DLL"+6F7ADE: 75 0F                       -  jne WHGame.DLL+6F7AEF
"WHGame.DLL"+6F7AE0: 44 0F B6 42 01              -  movzx r8d,byte ptr [rdx+01]
"WHGame.DLL"+6F7AE5: 0F B6 05 1D 06 77 01        -  movzx eax,byte ptr [WHGame.DLL+1E68109]
"WHGame.DLL"+6F7AEC: 44 2B C0                    -  sub r8d,eax
"WHGame.DLL"+6F7AEF: 45 85 C0                    -  test r8d,r8d
"WHGame.DLL"+6F7AF2: 0F 84 DA F3 A0 00           -  je WHGame.DLL+1106ED2
// ---------- INJECTING HERE ----------
"WHGame.DLL"+6F7AF8: F7 47 18 02 00 00 03        -  test [rdi+18],3000002
// ---------- DONE INJECTING  ----------
"WHGame.DLL"+6F7AFF: 0F 85 E2 F3 A0 00           -  jne WHGame.DLL+1106EE7
"WHGame.DLL"+6F7B05: 48 8B 47 20                 -  mov rax,[rdi+20]
"WHGame.DLL"+6F7B09: 48 85 C0                    -  test rax,rax
"WHGame.DLL"+6F7B0C: 0F 84 17 F4 A0 00           -  je WHGame.DLL+1106F29
"WHGame.DLL"+6F7B12: 48 8D 0D 97 08 78 01        -  lea rcx,[WHGame.DLL+1E783B0]
"WHGame.DLL"+6F7B19: 48 89 75 07                 -  mov [rbp+07],rsi
"WHGame.DLL"+6F7B1D: 48 89 4D F7                 -  mov [rbp-09],rcx
"WHGame.DLL"+6F7B21: 48 8D 4D D7                 -  lea rcx,[rbp-29]
"WHGame.DLL"+6F7B25: 48 89 4D FF                 -  mov [rbp-01],rcx
"WHGame.DLL"+6F7B29: 48 8D 4D F7                 -  lea rcx,[rbp-09]
}

Should allow you to use commands like:
wh_cheat_addItem
wh_cheat_money
It also allows setting of some cVars that are normally not allowed to be set, though it seems many of the interesting ones do nothing.

wh_cheat_addItem takes the item GUID, these can be found in
Data\Tables.pak\Libs\Tables\item\item.xml

For Example:
wh_cheat_addItem 57ace80d-3683-486a-93b1-1bbe4c21e598
Would give you a Yew Longbow

oh shit! oh wonder if you can edit your Main level with this.

[Expired6978]

oh shit! oh wonder if you can edit your Main level with this.

Not from any of the commands I've seen so far. I haven't figured out how the wh_eval command works yet. I might be able to find an entry point for their Lua execution to allow execution of arbitrary Lua scripts. This would ultimately let you do anything since most of that stuff (including experience) is exposed to the script engine. You could probably make something like a cheat menu purely in Lua just by altering one of the main scripts to load your new script and then sink a bunch of native events to pick up trigger points. I'm not sure enough of the UI is exposed to Lua to let you draw elements onto the screen though.

Edit:
You can bring up the lua debugger using:
lua_debugger_show 1
This function doesnt appear to be disabled by default though. The buttons don't seem to have any icons, the second is continue game.
lua_dump_state
Will dump all the lua vars as is

[gideon25]

For Example:
wh_cheat_addItem 57ace80d-3683-486a-93b1-1bbe4c21e598
Would give you a Yew Longbow

Works well! Btw, just have to copy then use ctrl-V to paste these into the console into the game. So here are the best weapons in the game:

wh_cheat_addItem 57ace80d-3683-486a-93b1-1bbe4c21e598 ->Yew Longbow
wh_cheat_addItem c316062a-5633-4e1e-bea3-f226717c0258 ->Noble Short Sword
wh_cheat_addItem 214f7911-d9be-4260-b5cb-590f96ffde9a ->Stinger Short Sword
wh_cheat_addItem 9d2561cc-892f-4527-94cc-4fa607102949 ->Loginus Long Sword
wh_cheat_addItem 21afc054-37d2-4cce-928e-c7d0d2e295c5 ->Herod's Long Sword
wh_cheat_addItem db0725ac-c0e0-41db-b7a6-2887c57df612 ->St. Geroge's Long Sword (Best Longsword in game)
wh_cheat_addItem 14aaa78f-49fe-49aa-bf46-bc6b8b06a6b7 -> Bouche shield1
wh_cheat_addItem 375edea9-2d3c-4d1a-a6cc-e81ffa6bba26 -> Bouche shield2
wh_cheat_addItem d70b732b-c924-4dad-aa56-2f27e6e9c656 -> Bouche shield3

Best Arrows (Better piercing arrow):
wh_cheat_addItem a5b31bbc-1e11-4831-835b-c06d5b13a7da

[Expired6978]

lua_reload_script should also be enabled from the unlock script, I haven't gotten it to actually load my own script yet though, or even the base game scripts for that matter. I'll have to debug what it is actually doing when it tries to reload a script
lua_dump_state shouldn't be locked, but it is super useful as it will dump all the bound natives. If we can run our own scripts without adding a new line to an existing script we can pretty much just do whatever we want using the script engine.

[juggle]

Does someone find lockpick ID?
wh_cheat_addItem 8d7bd3f4-3906-4ffd-857c-585a522a3ce5 - it ID in the document, but it add nothing to inventory :/

upd: found it! wh_cheat_addItem 8d76f58e-a521-4205-a7e8-9ac077eee5f0 - lockpick

[Expired6978]

Does someone find lockpick ID?
wh_cheat_addItem 8d7bd3f4-3906-4ffd-857c-585a522a3ce5 - it ID in the document, but it add nothing to inventory :/

According to the utils script, it should be:
Utils.itemIDs.lockpick = '8d76f58e-a521-4205-a7e8-9ac077eee5f0'

Update:
I've made a patch to route file loading to the Filesystem instead of the Archive system, this lets you load scripts directly from disk, I would not recommend using it while you're doing anything important as it might try routing other files to disk and fail.

Make sure to disable when you're done.

Temporarily File Reroute

Code: Select all

{ Game   : KingdomCome.exe
  Version: 
  Date   : 2018-02-18

  This script sets lua scripts to be loaded from Disk
}

[ENABLE]

aobscanmodule(TestCryPak,WHGame.DLL,48 8B 8F 10 01 00 00 48 85 C9 0F) // should be unique
alloc(newmem,$1000,"WHGame.DLL"+23E718)

label(code)
label(return)

newmem:

code:
  mov rcx,0
  jmp return

TestCryPak:
  jmp newmem
  nop
  nop
return:
registersymbol(TestCryPak)

[DISABLE]

TestCryPak:
  db 48 8B 8F 10 01 00 00

unregistersymbol(TestCryPak)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "WHGame.DLL"+23E718

"WHGame.DLL"+23E6F1: 41 8B D6                 -  mov edx,r14d
"WHGame.DLL"+23E6F4: E8 2B 16 00 00           -  call WHGame.DLL+23FD24
"WHGame.DLL"+23E6F9: 33 DB                    -  xor ebx,ebx
"WHGame.DLL"+23E6FB: 48 39 9F 08 01 00 00     -  cmp [rdi+00000108],rbx
"WHGame.DLL"+23E702: 75 63                    -  jne WHGame.DLL+23E767
"WHGame.DLL"+23E704: 49 83 C9 FF              -  or r9,-01
"WHGame.DLL"+23E708: 4C 8D 44 24 20           -  lea r8,[rsp+20]
"WHGame.DLL"+23E70D: 49 8B D6                 -  mov rdx,r14
"WHGame.DLL"+23E710: 48 8B CF                 -  mov rcx,rdi
"WHGame.DLL"+23E713: E8 0C 16 00 00           -  call WHGame.DLL+23FD24
// ---------- INJECTING HERE ----------
"WHGame.DLL"+23E718: 48 8B 8F 10 01 00 00     -  mov rcx,[rdi+00000110]
// ---------- DONE INJECTING  ----------
"WHGame.DLL"+23E71F: 48 85 C9                 -  test rcx,rcx
"WHGame.DLL"+23E722: 0F 84 DA 4F D8 00        -  je WHGame.DLL+FC3702
"WHGame.DLL"+23E728: 48 8B 01                 -  mov rax,[rcx]
"WHGame.DLL"+23E72B: 48 8D 54 24 20           -  lea rdx,[rsp+20]
"WHGame.DLL"+23E730: 44 8B CD                 -  mov r9d,ebp
"WHGame.DLL"+23E733: 4C 8B C6                 -  mov r8,rsi
"WHGame.DLL"+23E736: FF 90 18 01 00 00        -  call qword ptr [rax+00000118]
"WHGame.DLL"+23E73C: 48 85 C0                 -  test rax,rax
"WHGame.DLL"+23E73F: 48 89 87 08 01 00 00     -  mov [rdi+00000108],rax
"WHGame.DLL"+23E746: 0F 95 C0                 -  setne al
}

Applying this patch will let you run scripts from disk, for example:
lua_reload_script Data/Scripts/TestScript.lua
Where the contents are just

Code: Select all

Utils.CreateInvItem(player, Utils.itemIDs.lockpick, 100, 10);

Or anything else script related.
You must already have the console unlocker patch from my previous post as lua_reload_script is a disabled console function.

You can run scripts this way without the patch but they must be in a pak archive to be loaded.

[gideon25]

Best Heavy Armor combination in the game:

wh_cheat_addItem 40edf98e-f577-4192-67cd-4f1776d14ea4 ->Body Plate Nurembergian Cuirass (1st - Beats Milanese by only one point)
wh_cheat_addItem 4964faf4-b122-9856-e3d4-7e026ce4a0a7 ->Body Plate Milanese Dyed Red
wh_cheat_addItem 4e0fbb0b-70c0-1ae3-da9c-fc74e2512193 ->Body Plate Milanese Dyed Black
wh_cheat_addItem 4d3eb06c-581c-72a2-acf5-07c56cbb47b4 ->Body Plate Milanese Dyed Dark Red
wh_cheat_addItem 4c8f4d4b-72d3-c337-ed0c-41225e7b2382 ->Body Plate Milanese Dyed Darker Red
wh_cheat_addItem 440074cf-4d3d-5d80-2944-f49d91d642a1 ->Body Plate Milanese Dyed Yellow
wh_cheat_addItem 4222ca69-3a10-91c1-91ff-26f36122b8a2 ->Body Plate Milanese Dyed White
wh_cheat_addItem 41e550e4-12df-49f0-3b05-74959224a8a5 ->Body Plate Milanese Standard Dark Brownish
wh_cheat_addItem 4c71ff43-0696-66e4-71d9-45f30cf05392 ->Body Plate Noble Cuirass (3rd Best - behind Milanese by one point)
wh_cheat_addItem 481cfd5b-b646-1c6b-ff58-af749941cf9e ->Helmet Warhorse Helmet (Beats Arching by one point but GOOFY!)
wh_cheat_addItem 421f173c-99b2-f030-cedd-0ba2a25270ac ->Helmet Arching Bascinet (2nd by One point behind warhorse)
wh_cheat_addItem 42ed6b9c-19c5-0b8c-5feb-bfe0d7001997 ->Arm Armor Magdeburg Plate Pauldrons
wh_cheat_addItem 4dc120cc-1a9c-aaf4-939a-c843e2ea2394 ->Leg Plate/Boots Magdeburg Plate chausses
wh_cheat_addItem 4fbc8b16-6e58-af4e-8b95-59963da5ef96 ->Head Chainmail Noble's Mail coif
wh_cheat_addItem 431a2a36-312d-d6b0-ddff-fcaddc294291 ->Body Chainmail Long Noble Hauberk
wh_cheat_addItem 44135951-cf1c-f2fd-15f0-0f0ea223a584 ->Leg Chainmail Mail Chausses
wh_cheat_addItem 46f0f01a-ec0e-82af-8947-fc15bcf1df82 ->Gloves Noblemans Gauntlets
wh_cheat_addItem 4e1c3929-0e6d-e0c2-61e0-363f8e7ac289 ->Outer Garment Quartered Combat Jacket
wh_cheat_addItem 48dafad3-3606-b7e8-d1dc-ebc1de6b99bd ->Outer Garment Dark Combat Jacket
wh_cheat_addItem 42bb0602-e6bc-5edd-b91c-ebc319568bad ->Outer Garment Cuffed Combat Jacket
wh_cheat_addItem 4e392593-3a86-318b-65bc-05907a52fe8a ->Body Garment Decorated Arming Doublet
wh_cheat_addItem 4c159c35-5ccd-9eed-4b5b-85f24af989a6 ->Coif Dyed Quilted Coif
wh_cheat_addItem fda33b13-125c-4d88-8a71-790c77c044be ->Silver Ring
wh_cheat_addItem 88e2cfca-1f87-40f6-9691-4406676d702c ->Family Ring (High Charisma)
wh_cheat_addItem b20baf24-2cc2-4a7d-91d8-f494c6575042 ->Necklace (High Charisma)

For Horse (Can't find horse body armor):
wh_cheat_addItem 4a346515-2839-801d-3172-826486b9ee9d ->Horse Caparison Green
wh_cheat_addItem 4849903a-5dd2-e0b8-bfd0-2e599509c68e ->Horse Caparison Red/Yellow/Orange
wh_cheat_addItem 46021c09-1a2e-2683-bd92-d17cb66fb390 ->Horse Head Armor Chanfron and criniere
wh_cheat_addItem 41f6e46c-bca6-16da-169a-f0c8f1a6e2ab ->Noble Saddle 4 saddlebags
wh_cheat_addItem 9f30ca3f-65c0-42f4-be71-cb8f4cc2af7f ->Nobles Bridal
wh_cheat_addItem af6f2946-ce54-4e38-9b2b-5ab95d5c4777 ->Golded Spurs
wh_cheat_addItem a9d80dd4-2792-463a-9fcb-825677667e69 ->Military Horse Shoes

[kucing13]

Is it possible to modify town reputation. I dont know why my reputation at Skalitz is -100. Is it a bug?

[gideon25]

I bought this game also. Been watching some youtube of it to get a feel for it. I don't enjoy Western RPG's as well as some JRPG's, but I still enjoy some of them. I see you all have done well with getting started with some cheats. I may be interested in learning how to hack western style RPG's. Do you all still see things that need to be done cheat table wise and want some help?

Still needs reputation hacks and complete invisibility (complete invisibility like no reaction at all from stealing in broad daylight directly in front of someone). Also Clothes/person never gets dirty and never has to take a bath. Also fast travel sucks ass its not fast at all.

[juka]

Enable Console Functions:

Hopefully the aobscan works, whatever game version I am using seems to differ from everyone else's here.

Console Unlocker

Code: Select all

{ Game   : KingdomCome.exe
  Version: 
  Date   : 2018-02-18
  This script enables the KCD console for variables and functions that were dev disabled
}

[ENABLE]

aobscanmodule(VariableExec,WHGame.DLL,81 E3 02 00 00 03) // should be unique
alloc(newmem,$1000,"WHGame.DLL"+6F7882)

label(code)
label(return)

newmem:

code:
  and ebx,03000000
  jmp return

VariableExec:
  jmp newmem
  nop
return:
registersymbol(VariableExec)

aobscanmodule(FunctionExec,WHGame.DLL,F7 47 18 02 00 00 03) // should be unique
alloc(newmem2,$1000,"WHGame.DLL"+6F7AF8)

label(code2)
label(return2)

newmem2:

code2:
  test [rdi+18],3000000
  jmp return2

FunctionExec:
  jmp newmem2
  nop
  nop
return2:
registersymbol(FunctionExec)

[DISABLE]

VariableExec:
  db 81 E3 02 00 00 03

unregistersymbol(VariableExec)
dealloc(newmem)

{
// ORIGINAL CODE - INJECTION POINT: "WHGame.DLL"+6F7882

"WHGame.DLL"+6F7861: 4D 8B F8                 -  mov r15,r8
"WHGame.DLL"+6F7864: 48 8B FA                 -  mov rdi,rdx
"WHGame.DLL"+6F7867: FF 90 88 00 00 00        -  call qword ptr [rax+00000088]
"WHGame.DLL"+6F786D: 4C 8B 0F                 -  mov r9,[rdi]
"WHGame.DLL"+6F7870: 48 8B CF                 -  mov rcx,rdi
"WHGame.DLL"+6F7873: 40 8A E8                 -  mov bpl,al
"WHGame.DLL"+6F7876: 41 FF 51 60              -  call qword ptr [r9+60]
"WHGame.DLL"+6F787A: 4C 8B 07                 -  mov r8,[rdi]
"WHGame.DLL"+6F787D: 48 8B CF                 -  mov rcx,rdi
"WHGame.DLL"+6F7880: 8B D8                    -  mov ebx,eax
// ---------- INJECTING HERE ----------
"WHGame.DLL"+6F7882: 81 E3 02 00 00 03        -  and ebx,03000002
// ---------- DONE INJECTING  ----------
"WHGame.DLL"+6F7888: 41 0F 95 C4              -  setne r12l
"WHGame.DLL"+6F788C: 41 FF 50 60              -  call qword ptr [r8+60]
"WHGame.DLL"+6F7890: 48 8B 17                 -  mov rdx,[rdi]
"WHGame.DLL"+6F7893: 48 8B CF                 -  mov rcx,rdi
"WHGame.DLL"+6F7896: 44 8B F0                 -  mov r14d,eax
"WHGame.DLL"+6F7899: 41 81 E6 00 08 00 00     -  and r14d,00000800
"WHGame.DLL"+6F78A0: 41 0F 95 C5              -  setne r13l
"WHGame.DLL"+6F78A4: FF 52 60                 -  call qword ptr [rdx+60]
"WHGame.DLL"+6F78A7: 25 00 00 00 40           -  and eax,40000000
"WHGame.DLL"+6F78AC: 0F 95 84 24 80 00 00 00  -  setne byte ptr [rsp+00000080]
}
FunctionExec:
  db F7 47 18 02 00 00 03

unregistersymbol(FunctionExec)
dealloc(newmem2)

{
// ORIGINAL CODE - INJECTION POINT: "WHGame.DLL"+6F7AF8

"WHGame.DLL"+6F7ACC: 48 8B 51 08                 -  mov rdx,[rcx+08]
"WHGame.DLL"+6F7AD0: 0F B6 05 31 06 77 01        -  movzx eax,byte ptr [WHGame.DLL+1E68108]
"WHGame.DLL"+6F7AD7: 44 0F B6 02                 -  movzx r8d,byte ptr [rdx]
"WHGame.DLL"+6F7ADB: 44 2B C0                    -  sub r8d,eax
"WHGame.DLL"+6F7ADE: 75 0F                       -  jne WHGame.DLL+6F7AEF
"WHGame.DLL"+6F7AE0: 44 0F B6 42 01              -  movzx r8d,byte ptr [rdx+01]
"WHGame.DLL"+6F7AE5: 0F B6 05 1D 06 77 01        -  movzx eax,byte ptr [WHGame.DLL+1E68109]
"WHGame.DLL"+6F7AEC: 44 2B C0                    -  sub r8d,eax
"WHGame.DLL"+6F7AEF: 45 85 C0                    -  test r8d,r8d
"WHGame.DLL"+6F7AF2: 0F 84 DA F3 A0 00           -  je WHGame.DLL+1106ED2
// ---------- INJECTING HERE ----------
"WHGame.DLL"+6F7AF8: F7 47 18 02 00 00 03        -  test [rdi+18],3000002
// ---------- DONE INJECTING  ----------
"WHGame.DLL"+6F7AFF: 0F 85 E2 F3 A0 00           -  jne WHGame.DLL+1106EE7
"WHGame.DLL"+6F7B05: 48 8B 47 20                 -  mov rax,[rdi+20]
"WHGame.DLL"+6F7B09: 48 85 C0                    -  test rax,rax
"WHGame.DLL"+6F7B0C: 0F 84 17 F4 A0 00           -  je WHGame.DLL+1106F29
"WHGame.DLL"+6F7B12: 48 8D 0D 97 08 78 01        -  lea rcx,[WHGame.DLL+1E783B0]
"WHGame.DLL"+6F7B19: 48 89 75 07                 -  mov [rbp+07],rsi
"WHGame.DLL"+6F7B1D: 48 89 4D F7                 -  mov [rbp-09],rcx
"WHGame.DLL"+6F7B21: 48 8D 4D D7                 -  lea rcx,[rbp-29]
"WHGame.DLL"+6F7B25: 48 89 4D FF                 -  mov [rbp-01],rcx
"WHGame.DLL"+6F7B29: 48 8D 4D F7                 -  lea rcx,[rbp-09]
}

Should allow you to use commands like:
wh_cheat_addItem
wh_cheat_money
It also allows setting of some cVars that are normally not allowed to be set, though it seems many of the interesting ones do nothing.

wh_cheat_addItem takes the item GUID, these can be found in
Data\Tables.pak\Libs\Tables\item\item.xml

For Example:
wh_cheat_addItem 57ace80d-3683-486a-93b1-1bbe4c21e598
Would give you a Yew Longbow

when i try to add this as a LUA script ii keep getting errors :/