Finally got some free time to work some more on this
So, this is what I've discovered, aside from the fact that the game has updated to
v1.0.7. Remember how I told you LocalPlayer leads to PlayerController? Well, you can hook creation of PlayerController in LocalPlayer here:
Code: Select all
OTWD-Win64-Shipping.exe+13D3BE1 - 48 89 7E 30 - mov [rsi+30],rdi
// this is where PlayerController is written to LocalPlayer ^
OTWD-Win64-Shipping.exe+13D3BE5 - 48 8B 07 - mov rax,[rdi]
What that location will give you is this kind of pointer:
Code: Select all
PlayerController_BP_C MainMenu.MainMenu.PersistentLevel.PlayerController_BP_C_1
So..
[LocalPlayer+0x30] = PlayerController.
Then I wanted to find out the relationship between PlayerController and our Pawn (our player). So I entered a map and found my ammo, then from ammo I found the player via the relationship I described in page 17. Then I scanned the memory for pointers to the player pointer and looked for one that's close or within PlayerController. And found it
So.. this is my player:
Code: Select all
CH_Maya_C CampAnderson_Defend_TheFirstShot_02.CampAnderson_Defend_TheFirstShot_02.PersistentLevel.CH_Maya_C_1
And the relationship is here:
Code: Select all
OTWD-Win64-Shipping.exe+13BA2EB - 4C 8B A9 20040000 - mov r13,[rcx+00000420]
This is where PlayerController is accessed and the read return is CH_Maya_C (let's call it
player; in reality, this is called a Pawn in Engine terminology). So..
[PlayerController+0x420] = Player.
Then what I wanted to find out is where exactly in our Player structure is the weapon swapping occurring. And it didn't take me long:
Code: Select all
OTWD-Win64-Shipping.exe+17DD75F - 48 89 BB 980B0000 - mov [rbx+00000B98],rdi
What that location holds is the pointer to the structure of the weapon you are changing by pressing 1,2,3 keys. Why is this important? Because we can then map contents of the weapon structure directly, without the need to look for it in memory. It's linked to our player
Isn't it?
So..
[Player+0xB98] = Weapon.
So far so good. Let's take a look at
God and see what happens in reality when we toggle it on. Find references to "God mode on" in memory (use x64dbg if you can't do it with CE). Or scan memory for this array:
Code: Select all
48 89 5C 24 08 48 89 7C 24 10 55 48 8B EC 48 83 EC 50 48 8B 41 20 33 DB 48 8B F9 48 89 5D E0 48 8D 4D E0 48 8B 90 20 04 00 00
You should find only one result: "OTWD-Win64-Shipping.exe+107A610". First-up dump objects with
TheWalkingDead.dll and open up ObjectsDump.txt. Then head to the address I've just given you, set a breakpoint, open console and type in "god" [Enter]. CE will break.
When it does, look at RCX and search for it in the .txt file. You'll find something like this:
Code: Select all
[389165] OTWDCheatManager CampAnderson_Defend_TheFirstShot_02.CampAnderson_Defend_TheFirstShot_02.PersistentLevel.PlayerController_BP_C_1.OTWDCheatManager_1 0x0000013C28D8C640
OK, so OTWDCheatManager UObject is used here ("U" stands for Unreal; just in case you wondered). Trace a bit till you get here:
Code: Select all
OTWD-Win64-Shipping.exe+107A633 - 48 8B 90 20040000 - mov rdx,[rax+00000420]
OTWD-Win64-Shipping.exe+107A63A - 48 85 D2 - test rdx,rdx // stop here
Let's check RDX:
Code: Select all
[388730] CH_Maya_C CampAnderson_Defend_TheFirstShot_02.CampAnderson_Defend_TheFirstShot_02.PersistentLevel.CH_Maya_C_1 0x0000013C73C6C720
So..
[OTWDCheatManager + 0x420] = Player. Now you understand why, when typing "god" at main menu, the response is "No APawn* possessed"?
Because at main menu there's no Pawn player entity having been yet generated.
Let's continue:
Code: Select all
OTWD-Win64-Shipping.exe+107A63F - 0FB6 82 3C010000 - movzx eax,byte ptr [rdx+0000013C]
OTWD-Win64-Shipping.exe+107A646 - A8 02 - test al,02
OTWD-Win64-Shipping.exe+107A648 - 74 24 - je OTWD-Win64-Shipping.exe+107A66E
OTWD-Win64-Shipping.exe+107A64A - 24 FD - and al,-03
OTWD-Win64-Shipping.exe+107A64C - 48 C7 45 E8 0C000000 - mov qword ptr [rbp-18],0000000C
OTWD-Win64-Shipping.exe+107A654 - 88 82 3C010000 - mov [rdx+0000013C],al
OTWD-Win64-Shipping.exe+107A65A - 33 D2 - xor edx,edx
OTWD-Win64-Shipping.exe+107A65C - E8 0FA8A2FF - call OTWD-Win64-Shipping.exe+AA4E70
OTWD-Win64-Shipping.exe+107A661 - 44 8D 43 18 - lea r8d,[rbx+18]
OTWD-Win64-Shipping.exe+107A665 - 48 8D 15 0C717E01 - lea rdx,[OTWD-Win64-Shipping.exe+2861778] { ["God mode on"] }
OTWD-Win64-Shipping.exe+107A66C - EB 42 - jmp OTWD-Win64-Shipping.exe+107A6B0
OTWD-Win64-Shipping.exe+107A66E - 0C 02 - or al,02
OTWD-Win64-Shipping.exe+107A670 - 48 C7 45 E8 0D000000 - mov qword ptr [rbp-18],0000000D
OTWD-Win64-Shipping.exe+107A678 - 88 82 3C010000 - mov [rdx+0000013C],al
OTWD-Win64-Shipping.exe+107A67E - 33 D2 - xor edx,edx
OTWD-Win64-Shipping.exe+107A680 - E8 EBA7A2FF - call OTWD-Win64-Shipping.exe+AA4E70
OTWD-Win64-Shipping.exe+107A685 - 41 B8 1A000000 - mov r8d,0000001A
OTWD-Win64-Shipping.exe+107A68B - 48 8D 15 FE707E01 - lea rdx,[OTWD-Win64-Shipping.exe+2861790] { ["God Mode off"] }
OTWD-Win64-Shipping.exe+107A692 - EB 1C - jmp OTWD-Win64-Shipping.exe+107A6B0
OTWD-Win64-Shipping.exe+107A694 - 33 D2 - xor edx,edx
OTWD-Win64-Shipping.exe+107A696 - 48 C7 45 E8 14000000 - mov qword ptr [rbp-18],00000014
OTWD-Win64-Shipping.exe+107A69E - E8 CDA7A2FF - call OTWD-Win64-Shipping.exe+AA4E70
OTWD-Win64-Shipping.exe+107A6A3 - 41 B8 28000000 - mov r8d,00000028
OTWD-Win64-Shipping.exe+107A6A9 - 48 8D 15 00717E01 - lea rdx,[OTWD-Win64-Shipping.exe+28617B0] { ["No APawn* possessed"] }
So.. a byte from
[Player+0x13C] is being checked out. In my case, the value I found there is
0x3A.
Code: Select all
movzx eax,byte ptr [rdx+0000013C]
test al,02
je "off"
on:
do_on
off:
do_off
If the logical test of this byte against 0x2 succeeds, then the JE under it leads to "off". Else, leads to "on". Let's see what happens at "on":
Code: Select all
OTWD-Win64-Shipping.exe+107A64A - 24 FD - and al,-03
..
OTWD-Win64-Shipping.exe+107A654 - 88 82 3C010000 - mov [rdx+0000013C],al
And that, for me, turns 0x3A into 0x38.
Then the "off" branch does:
Code: Select all
OTWD-Win64-Shipping.exe+107A66E - 0C 02 - or al,02
..
OTWD-Win64-Shipping.exe+107A678 - 88 82 3C010000 - mov [rdx+0000013C],al
Which will turn 0x38 back into 0x3A.
From experience I can tell you that you can view the operation as add/sub 0x2. Thus for on, you do 0x3A-0x2. For off, you do 0x38+0x2
And that's
God.
So..
[Player+0x13C] = God (as byte).
Will post more soon
BR,
Sun
L.E.: Quick table coming up: