Mortal Kombat 11 - table v: 1.0.8 CT

[TroliusMaximus]

Question:
Does anyone know if the finisher abilities (Fatalities / Brutalities) can be used, irrespective of having them unlocked via the Krypt or wherever...?

The thing is, the diminishing returns of their ransomware content gating system has already kicked in for me -- with barely any skins dropping from the Shrine, only gear and augments (which may also start dwindling), and all chests but a couple, having been opened -- yet, I've only unlocked <1/3 of the skins on average, and sometimes only 2~3 of the Brutalities of the few characters I care about (about half-a-dozen of them)... And at the rate they're not dropping now, I'm about to give up on this pursuit in time-wasting.

Also, there any way to hack or dupe the Time Krystals, in order use the to buy said abilities from their in-game store?... How is this particular currency even acquired -- through chests?

(thanks)

How to use this cheat table?

1. Install Cheat Engine
2. Double-click the .CT file in order to open it.
3. Click the PC icon in Cheat Engine in order to select the game process.
4. Keep the list.
5. Activate the trainer options by checking boxes or setting values from 0 to 1

[SunBeam]

So the "data" function is hit here:

Code: Select all

MK11.exe+40F4B0 - 48 89 4C 24 08        - mov [rsp+08],rcx
MK11.exe+40F4B5 - 57                    - push rdi
MK11.exe+40F4B6 - 48 83 EC 30           - sub rsp,30 { 48 }
MK11.exe+40F4BA - 48 C7 44 24 28 FEFFFFFF - mov qword ptr [rsp+28],FFFFFFFE { (166) }
MK11.exe+40F4C3 - 48 89 5C 24 50        - mov [rsp+50],rbx
MK11.exe+40F4C8 - 48 8B DA              - mov rbx,rdx
MK11.exe+40F4CB - 48 8B F9              - mov rdi,rcx
MK11.exe+40F4CE - C7 44 24 20 00000000  - mov [rsp+20],00000000 { 0 }
MK11.exe+40F4D6 - E8 7598AD00           - call MK11.exe+EE8D50
MK11.exe+40F4DB - C7 44 24 20 01000000  - mov [rsp+20],00000001 { 1 }
MK11.exe+40F4E3 - 48 89 7C 24 48        - mov [rsp+48],rdi
MK11.exe+40F4E8 - 48 8D 53 08           - lea rdx,[rbx+08]
MK11.exe+40F4EC - 4C 8D 05 45F3F001     - lea r8,[MK11.exe+231E838] { ("data") }
MK11.exe+40F4F3 - 48 8D 4C 24 48        - lea rcx,[rsp+48]
MK11.exe+40F4F8 - E8 83180000           - call MK11.exe+410D80 <--
MK11.exe+40F4FD - 48 8B C7              - mov rax,rdi
MK11.exe+40F500 - 48 8B 5C 24 50        - mov rbx,[rsp+50]
MK11.exe+40F505 - 48 83 C4 30           - add rsp,30 { 48 }
MK11.exe+40F509 - 5F                    - pop rdi
MK11.exe+40F50A - C3                    - ret 

And writing the stuff (contacting MK11 server) happens in that CALL:

Code: Select all

MK11.exe+410D80 - 4C 89 44 24 18        - mov [rsp+18],r8
MK11.exe+410D85 - 48 89 4C 24 08        - mov [rsp+08],rcx
MK11.exe+410D8A - 55                    - push rbp
MK11.exe+410D8B - 53                    - push rbx
MK11.exe+410D8C - 56                    - push rsi
MK11.exe+410D8D - 57                    - push rdi
MK11.exe+410D8E - 41 54                 - push r12
MK11.exe+410D90 - 41 55                 - push r13
MK11.exe+410D92 - 41 56                 - push r14
MK11.exe+410D94 - 41 57                 - push r15
MK11.exe+410D96 - 48 8D 6C 24 E1        - lea rbp,[rsp-1F]
MK11.exe+410D9B - 48 81 EC F8000000     - sub rsp,000000F8 { 248 }
MK11.exe+410DA2 - 48 C7 45 9F FEFFFFFF  - mov qword ptr [rbp-61],FFFFFFFE { (166) }
..
MK11.exe+410F05 - 4C 8D 05 54E5F001     - lea r8,[MK11.exe+231F460] { ("items") }

Then goes inside this call:

Code: Select all

MK11.exe+411BB0 - 40 55                 - push rbp
MK11.exe+411BB2 - 56                    - push rsi
MK11.exe+411BB3 - 57                    - push rdi
MK11.exe+411BB4 - 41 54                 - push r12
MK11.exe+411BB6 - 41 55                 - push r13
MK11.exe+411BB8 - 41 56                 - push r14
MK11.exe+411BBA - 41 57                 - push r15
MK11.exe+411BBC - 48 8B EC              - mov rbp,rsp
MK11.exe+411BBF - 48 83 EC 60           - sub rsp,60 { 96 }
MK11.exe+411BC3 - 48 C7 45 D0 FEFFFFFF  - mov qword ptr [rbp-30],FFFFFFFE { (166) }
MK11.exe+411BCB - 48 89 9C 24 B0000000  - mov [rsp+000000B0],rbx
..
MK11.exe+411CED - 4C 8D 05 44D7F001     - lea r8,[MK11.exe+231F438] { ("itemType") }
MK11.exe+411CF4 - 48 8D 4D 58           - lea rcx,[rbp+58]
MK11.exe+411CF8 - E8 33090000           - call MK11.exe+412630
MK11.exe+411CFD - 48 8D 53 18           - lea rdx,[rbx+18]
MK11.exe+411D01 - 4C 8D 05 3CCBF001     - lea r8,[MK11.exe+231E844] { ("slug") }
MK11.exe+411D08 - 48 8D 4D 58           - lea rcx,[rbp+58]
MK11.exe+411D0C - E8 1F090000           - call MK11.exe+412630
MK11.exe+411D11 - 48 8D 53 28           - lea rdx,[rbx+28]
MK11.exe+411D15 - 4C 8D 05 8445EF01     - lea r8,[MK11.exe+23062A0] { ("amount") }
MK11.exe+411D1C - 48 8D 4D 58           - lea rcx,[rbp+58]
MK11.exe+411D20 - E8 EBE4FFFF           - call MK11.exe+410210
MK11.exe+411D25 - 48 8D 53 30           - lea rdx,[rbx+30]
MK11.exe+411D29 - 4C 8D 05 14D7F001     - lea r8,[MK11.exe+231F444] { ("source") }
MK11.exe+411D30 - 48 8D 4D 58           - lea rcx,[rbp+58]
MK11.exe+411D34 - E8 F7080000           - call MK11.exe+412630
MK11.exe+411D39 - 48 8D 53 40           - lea rdx,[rbx+40]
MK11.exe+411D3D - 4C 8D 05 0CD7F001     - lea r8,[MK11.exe+231F450] { ("source_detail") }
MK11.exe+411D44 - 48 8D 4D 58           - lea rcx,[rbp+58]
MK11.exe+411D48 - E8 E3080000           - call MK11.exe+412630
MK11.exe+411D4D - 48 8D 4D C8           - lea rcx,[rbp-38]
MK11.exe+411D51 - E8 1AB81E00           - call MK11.exe+5FD570
MK11.exe+411D56 - 4C 8B 00              - mov r8,[rax]
MK11.exe+411D59 - 48 8D 55 C0           - lea rdx,[rbp-40]
MK11.exe+411D5D - 48 8B C8              - mov rcx,rax
MK11.exe+411D60 - 41 FF 90 D0000000     - call qword ptr [r8+000000D0]

[Kenshi]

It's working fine on my end, try verifying the game files. Both the harts chests and the kronika orbs show 0 with the unlocker and you should only use the "Krypt Orb Cost Hook" to get koins if needed, but having them both enabled works it's just the the unlocker keeps the orb cost hook from even running. Did you try using too large a value with the "Krypt Orb Cost Hook"?

I verified and it's fixed! Thanks!

[maine]

Question:
Does anyone know if the finisher abilities (Fatalities / Brutalities) can be used, irrespective of having them unlocked via the Krypt or wherever...?

The thing is, the diminishing returns of their ransomware content gating system has already kicked in for me -- with barely any skins dropping from the Shrine, only gear and augments (which may also start dwindling), and all chests but a couple, having been opened -- yet, I've only unlocked <1/3 of the skins on average, and sometimes only 2~3 of the Brutalities of the few characters I care about (about half-a-dozen of them)... And at the rate they're not dropping now, I'm about to give up on this pursuit in time-wasting.

Also, there any way to hack or dupe the Time Krystals, in order use the to buy said abilities from their in-game store?... How is this particular currency even acquired -- through chests?

(thanks)

fatalities can be performed without owning them. you just need the input. Brutalities have to be unlocked. Some of which are gated behind towers of time. you can summon a tower for your character to unlock some but there are also towers that pop up which contain brutalities.

[SunBeam]

@Tim: I owed you an example with the UObjects Here goes. Say you have your PlayerController while in the Krpyt:

Code: Select all

UObject[045917] MK11GamePlayerController | 0x00000041F2146910 ( MK11GamePlayerController Transient.Level.MK11GamePlayerController )

You then want to find the Player Camera to fetch the NV or Rotator. You do a search for "Camera" in the ObjectDump.txt file and find a big ass list. Among them you'll see this:

Code: Select all

UObject[020783] PlayerCamera | 0x000000001EE9DD40 ( ObjectProperty Engine.PlayerController.PlayerCamera )

So.. PlayerCamera.. ObjectProperty.. PlayerController Now.. if you browse that structure's memory and check 0xA8 offset you'll see this:



And if I look for that pointer at 0x3E8 inside my MK11GamePlayerController, I see that it is..

Code: Select all

UObject[045914] DefaultCamera | 0x00000041ED00E000 ( MKCamera Transient.Level.DefaultCamera             )

Tanaaaa

[TimFun13]

^^ I don't know what I did wrong.
But in the dump I have:

Code: Select all

UObject[001231] MK11GamePlayerController | 0x0000000013E0EEC0 ( Class MK11Game.MK11GamePlayerController )

Code: Select all

UObject[020783] PlayerCamera | 0x000000001E24DD40 ( ObjectProperty Engine.PlayerController.PlayerCamera )

But I'm not understanding where you got the 0xA8 offset.
[Link]
But the offset is the same, so I check that in the "MK11GamePlayerController".
But I just have a Zero value there:
[Link]

[SunBeam]

In the Krypt? Mine's valid. 0xA8 is from my analysis the offset at which you find the ObjectProperty offset in the UObject. I got it from analyzing the code. It's always the same for the game you're working with You can find other ObjectProperty offsets checking 0xA8 in typed-objects like that. You just need to know which Transient.Level UObject to apply it to

Here's another one:

Code: Select all

UObject[019418] bShowDebugInfo                                     0x000000001EDB8820 ( BoolProperty Engine.HUD.bShowDebugInfo             )
UObject[045909] HUD                                                0x00000041F2144490 ( HUD Transient.Level.HUD                            )

Offset is 0x3E0 in HUD My value is 0x9. If you OR it by 0x1, you can hide the left-side resourcing HUD and Alt-Tab-ing won't show the map



Will see if I can disable the god damn vignette. It's been annoying me for a while now.

[TimFun13]

^^ I figured it out, there is more the one "MK11GamePlayerController" I was at "UObject[001231]" and noticed you were at "UObject[045917]".

[SunBeam]

The id for the UObjects is irrelevant; as in you won't have an identical one with mine. But sure, if you think of the position from top or bottom, you can think like that All the "Transient" UObjects are created post-level load. So they're bound to be among the last ones in the list If you exit to main menu and back in the Krypt, you'll see it's changed (of course, since the Engine reinitializes base UObjects; but most that don't need to won't have been reinitialized). So Numpad / again and find it near the end of the file

Oh.. and since you asked about 0xA8.. debug it on access, see where it's used. You'll find an operation like this:

Code: Select all

MK11.exe+120C4200 - 48 63 83 A8000000     - movsxd  rax,dword ptr [rbx+000000A8] // reads offset
MK11.exe+120C4207 - BA 00200000           - mov edx,00002000 { 8192 }
MK11.exe+120C420C - 48 89 D9              - mov rcx,rbx
MK11.exe+120C420F - 4A 8D 34 20           - lea rsi,[rax+r12] // applies it to UObject to then read from UObject+Offset
MK11.exe+120C4213 - 4A 8D 2C 28           - lea rbp,[rax+r13]

[SunBeam]

Also, check these out

Code: Select all

MK11.exe+169515D - 48 8D 15 7C5EF800     - lea rdx,[MK11.exe+261AFE0] { ("physics") }
MK11.exe+1695164 - 48 8D 4D 67           - lea rcx,[rbp+67]
MK11.exe+1695168 - E8 63C40E00           - call MK11.exe+17815D0
MK11.exe+169516D - 48 8B 10              - mov rdx,[rax]
MK11.exe+1695170 - 49 8B CD              - mov rcx,r13
MK11.exe+1695173 - FF 93 A0020000        - call qword ptr [rbx+000002A0]
MK11.exe+1695179 - 85 C0                 - test eax,eax
MK11.exe+169517B - 0F84 15010000         - je MK11.exe+1695296 <-- NOP this
MK11.exe+1695181 - 45 33 C0              - xor r8d,r8d
MK11.exe+1695184 - 48 8D 55 DF           - lea rdx,[rbp-21]
MK11.exe+1695188 - 48 8B CE              - mov rcx,rsi
MK11.exe+169518B - E8 00A00100           - call MK11.exe+16AF190
MK11.exe+1695190 - F3 41 0F10 14 24      - movss xmm2,[r12]
MK11.exe+1695196 - F3 41 0F58 16         - addss xmm2,dword ptr [r14]
MK11.exe+169519B - F3 41 0F11 16         - movss [r14],xmm2
MK11.exe+16951A0 - 0F28 CE               - movaps xmm1,xmm6
MK11.exe+16951A3 - 48 8B CE              - mov rcx,rsi
MK11.exe+16951A6 - E8 95180200           - call MK11.exe+16B6A40
MK11.exe+16951AB - 49 8D 8F 24010000     - lea rcx,[r15+00000124]
MK11.exe+16951B2 - 48 8D 55 0F           - lea rdx,[rbp+0F]
MK11.exe+16951B6 - E8 A54089FF           - call MK11.exe+F29260
MK11.exe+16951BB - 48 8B D8              - mov rbx,rax
MK11.exe+16951BE - 49 8D 8F 18010000     - lea rcx,[r15+00000118]
MK11.exe+16951C5 - 48 8D 55 FF           - lea rdx,[rbp-01]
MK11.exe+16951C9 - E8 C24089FF           - call MK11.exe+F29290
MK11.exe+16951CE - 90                    - nop 
MK11.exe+16951CF - 83 7B 08 00           - cmp dword ptr [rbx+08],00 { 0 }
MK11.exe+16951D3 - 74 05                 - je MK11.exe+16951DA
MK11.exe+16951D5 - 4C 8B 0B              - mov r9,[rbx]
MK11.exe+16951D8 - EB 03                 - jmp MK11.exe+16951DD
MK11.exe+16951DA - 4C 8B CF              - mov r9,rdi
MK11.exe+16951DD - 83 78 08 00           - cmp dword ptr [rax+08],00 { 0 }
MK11.exe+16951E1 - 74 03                 - je MK11.exe+16951E6
MK11.exe+16951E3 - 48 8B 38              - mov rdi,[rax]
MK11.exe+16951E6 - 4C 8B C7              - mov r8,rdi
MK11.exe+16951E9 - 48 8D 15 F85DF800     - lea rdx,[MK11.exe+261AFE8] { ("Location: %s Rotation %s") }
MK11.exe+16951F0 - 48 8D 4D EF           - lea rcx,[rbp-11]
MK11.exe+16951F4 - E8 4740BEFE           - call MK11.AK::MemoryMgr::GetPoolName+4E0
MK11.exe+16951F9 - 48 8B D8              - mov rbx,rax <-- check [RAX] after the CALL

Code: Select all

Location: X=1169.966 Y=-6240.760 Z=190.186 Rotation P=-1542 Y=32202 R=0

The above one breaks ONLY when you set 0x9+0x1 to 0x3E0 in Transient.Level.HUD. While in the Krypt.

And:

Code: Select all

MK11.exe+169587D - 66 49 0F7E D0         - movq r8,xmm2
MK11.exe+1695882 - 48 8D 15 E75BF800     - lea rdx,[MK11.exe+261B470] { ("FOV: %f") }
MK11.exe+1695889 - 48 8D 4C 24 28        - lea rcx,[rsp+28]
MK11.exe+169588E - E8 AD39BEFE           - call MK11.AK::MemoryMgr::GetPoolName+4E0
MK11.exe+1695893 - 90                    - nop <-- check [RAX] after the CALL
MK11.exe+1695894 - 45 33 C0              - xor r8d,r8d

Code: Select all

FOV: 75.000000

[andawra]

[Link]

Yo I wanna be Kronika

[EchoDog]

You can do an AOB scan to see if you can figure out what's different. But you might just need to restart the PC and verify the game files.

This 100% was the issue. it works perfectly now.

[TimFun13]

The fatalities are pretty good in this one, my favorite so far is Johnny Cage's "Who Hired This Guy".
[Link]

[TimFun13]

Use this at your own risk, but "Premium Shop" items for 1 time crystal. Might even want to give it a day see if I get banned, up to you.

Code: Select all

{
	Process			: MK11.exe  -  (x64)
	Module			: MK11.exe
	Game Title		: Mortal Kombat 11
	Game Version	: 1.0.0.0
	CE Version		: 6.83
	Script Version	: 0.0.1
	Date			: 04/29/19
	Author			: ShyTwig16
	Name			: StoreCostHook

	Store Cost Hook
}

{$STRICT}

define(address, MK11.exe+A9E3CC)
define(bytes, 48 63 F0 85 FF)

////
//// ------------------------------ ENABLE ------------------------------
[ENABLE]
aobScanModule(aobStoreCostHook, MK11.exe, 49xxxxE8xxxxxxxx48xxxx85xx79xx41)
define(injStoreCostHook, aobStoreCostHook+8)
assert(injStoreCostHook, bytes)
registerSymbol(injStoreCostHook)

alloc(memStoreCostHook, 0x400, injStoreCostHook)

label(intStoreCostHook)
registerSymbol(intStoreCostHook)

label(ptrStoreCostHook)
registerSymbol(ptrStoreCostHook)

label(n_code)
label(o_code)
label(exit)
label(return)

memStoreCostHook:
	intStoreCostHook:
		dd (int)1
	align 10
	ptrStoreCostHook:
		dq 0
	align 10 CC
	n_code:
		cmp r14,0
		jne o_code
			mov [ptrStoreCostHook],ecx
			mov eax,[intStoreCostHook]
			mov [rcx+8],eax
	o_code:
		movsxd  rsi,eax
		test edi,edi
	exit:
		jmp return


////
//// ---------- Injection Point ----------
injStoreCostHook:
	jmp n_code
	return:


////
//// ------------------------------ DISABLE ------------------------------
[DISABLE]
////
//// ---------- Injection Point ----------
injStoreCostHook:
	db bytes

unregisterSymbol(injStoreCostHook)

unregisterSymbol(intStoreCostHook)

unregisterSymbol(ptrStoreCostHook)

dealloc(memStoreCostHook)

{
//// Injection Point: MK11.exe+A9E3CC  -  0000000140A9E3CC
//// AOB address: 0000000140A9E3C4  -  MK11.exe+A9E3C4
//// Process: MK11.exe  -  0000000140000000
//// Module: MK11.exe  -  0000000140000000
//// Module Size: 0000000018215000
MK11.exe+A9E382:  48 8B CA                    -  mov rcx,rdx                        
MK11.exe+A9E385:  E8 E6A14100                 -  call 140EB8570                     
MK11.exe+A9E38A:  48 8D 4C 24 40              -  lea rcx,[rsp+40]                   
MK11.exe+A9E38F:  E8 1CE04000                 -  call 140EAC3B0                     
MK11.exe+A9E394:  90                          -  nop                                
MK11.exe+A9E395:  EB 2D                       -  jmp 140A9E3C4                      
MK11.exe+A9E397:  85 FF                       -  test edi,edi                       
MK11.exe+A9E399:  79 05                       -  jns 140A9E3A0                      
MK11.exe+A9E39B:  41 8B C6                    -  mov eax,r14d                       
MK11.exe+A9E39E:  EB 0A                       -  jmp 140A9E3AA                      
MK11.exe+A9E3A0:  B8 01000000                 -  mov eax,00000001                   
MK11.exe+A9E3A5:  3B F8                       -  cmp edi,eax                        
MK11.exe+A9E3A7:  0F4C C7                     -  cmovl eax,edi                      
MK11.exe+A9E3AA:  48 98                       -  cdqe                               
MK11.exe+A9E3AC:  48 6B C8 38                 -  imul rcx,rax,38                    
MK11.exe+A9E3B0:  48 8D 15 8D118501           -  lea rdx,[1422EF544]                [00000000]
MK11.exe+A9E3B7:  4A 8B 8C 21 80000000        -  mov rcx,[rcx+r12+00000080]         
MK11.exe+A9E3BF:  E8 5C81ACFF                 -  call 140566520                     
MK11.exe+A9E3C4:  49 8B CF                    -  mov rcx,r15                        <<<--- AOB Starts Here
MK11.exe+A9E3C7:  E8 84D89EFF                 -  call 14048BC50                     
////  INJECTING START  ----------------------------------------------------------
MK11.exe+A9E3CC:  48 63 F0                    -  movsxd  rsi,eax                    
MK11.exe+A9E3CF:  85 FF                       -  test edi,edi                       
////  INJECTING END  ----------------------------------------------------------
MK11.exe+A9E3D1:  79 05                       -  jns 140A9E3D8                      
MK11.exe+A9E3D3:  41 8B DE                    -  mov ebx,r14d                       
MK11.exe+A9E3D6:  EB 0A                       -  jmp 140A9E3E2                      
MK11.exe+A9E3D8:  BB 01000000                 -  mov ebx,00000001                   
MK11.exe+A9E3DD:  3B FB                       -  cmp edi,ebx                        
MK11.exe+A9E3DF:  0F4C DF                     -  cmovl ebx,edi                      
MK11.exe+A9E3E2:  BA 01000000                 -  mov edx,00000001                   
MK11.exe+A9E3E7:  48 8D 4C 24 40              -  lea rcx,[rsp+40]                   
MK11.exe+A9E3EC:  E8 DFAE4000                 -  call 140EA92D0                     
MK11.exe+A9E3F1:  90                          -  nop                                
MK11.exe+A9E3F2:  45 33 C0                    -  xor r8d,r8d                        
MK11.exe+A9E3F5:  48 8D 15 94878601           -  lea rdx,[142306B90]                ["DigitSeparator"]
MK11.exe+A9E3FC:  48 8D 0D 15AA8501           -  lea rcx,[1422F8E18]                ["General"]
MK11.exe+A9E403:  E8 B8944500                 -  call 140EF78C0                     
MK11.exe+A9E408:  4C 8B C0                    -  mov r8,rax                         
MK11.exe+A9E40B:  48 8B CE                    -  mov rcx,rsi                        
MK11.exe+A9E40E:  48 8D 54 24 40              -  lea rdx,[rsp+40]                   
MK11.exe+A9E413:  E8 98D5FCFF                 -  call 140A6B9B0                     
MK11.exe+A9E418:  48 8D 4C 24 40              -  lea rcx,[rsp+40]                   
//// Template: I2CEA_AOBFullInjectionWithValues
//// Generated with: I2 Cheat Engine Auto Assembler Script Template Generator
//// Code Happy, Code Freely, Be Awesome.
}

[KS212]

So, unlike the version number of this table... PS4 just got ANOTHER patch while us PC third class citizens are still waiting for the rest of the 'day 1' patch and for even frame data to be on parity so the game can actually be played as intended...

And ppl wonder why some of us want to fuck WB so hard...