21
"Info (Useless)"
1
0
"Player (BPChar_Player_C)"
1
0
8 Bytes
GEngine
488
30
0
38
190
88
7B0
1
"CharacterMovement"
1
0
8 Bytes
GEngine
4C8
488
30
0
38
190
88
7B0
2
"CapsuleComponent"
1
0
8 Bytes
GEngine
4D0
488
30
0
38
190
88
7B0
22
"Pointers"
1
26510
"Find+Register GEngine and Show Pointers"
Auto Assembler Script
[ENABLE]
{$lua}
if not syntaxcheck then
local function isValidPointer(addr)
if not addr or addr == 0 then return false end
if addr < 0x10000 then return false end
if addr % 8 ~= 0 then return false end
return true
end
local function hasValidVTable(objectPtr)
local success, vtable = pcall(readPointer, objectPtr)
if not success or not isValidPointer(vtable) then return false end
if vtable < 0x100000000 or vtable > 0x7FFFFFFFFFFF then return false end
return true
end
local function validateGEngine(gEngineAddr)
local success, enginePtr = pcall(readPointer, gEngineAddr)
if not success or not isValidPointer(enginePtr) or not hasValidVTable(enginePtr) then
return false, 0
end
local score = 0
for viewportOffset = 0x700, 0x900, 0x8 do
local success1, viewportPtr = pcall(readPointer, enginePtr + viewportOffset)
if success1 and isValidPointer(viewportPtr) and hasValidVTable(viewportPtr) then
score = score + 10
for worldOffset = 0x70, 0x100, 0x8 do
local success2, worldPtr = pcall(readPointer, viewportPtr + worldOffset)
if success2 and isValidPointer(worldPtr) and hasValidVTable(worldPtr) then
score = score + 20
for giOffset = 0x150, 0x200, 0x8 do
local success3, giPtr = pcall(readPointer, worldPtr + giOffset)
if success3 and isValidPointer(giPtr) and hasValidVTable(giPtr) then
score = score + 30
return true, score
end
end
end
end
end
end
return score >= 30, score
end
local function isLikelyModuleAddress(addr)
local addrStr = string.format("%X", addr)
if #addrStr < 12 then return false end
local prefix = tonumber(addrStr:sub(1, 3), 16)
if prefix >= 0x7FF and prefix <= 0x7FF then return true end
if prefix >= 0x140 and prefix <= 0x180 then return true end
return false
end
local function findGEngine()
local patterns = {
{"48 8B 0D ?? ?? ?? ?? 48 85 C9 74", 3, 7, 3},
{"48 8B 05 ?? ?? ?? ?? 48 8B 88 ?? ?? ?? ??", 3, 7, 2},
{"48 8B 0D ?? ?? ?? ?? 48 8B 01 FF", 3, 7, 3},
{"48 89 0D ?? ?? ?? ?? 48 85 C9", 3, 7, 1},
{"48 8B 05 ?? ?? ?? ?? 48 85 C0 74", 3, 7, 2},
{"48 8B 0D ?? ?? ?? ?? 4C 8B 01", 3, 7, 3},
{"4C 8B 05 ?? ?? ?? ?? 4C 85 C0", 3, 7, 2},
{"48 8B 15 ?? ?? ?? ?? 48 85 D2 74", 3, 7, 2},
}
print("Scanning for GEngine...")
local candidates = {}
for i, patternData in ipairs(patterns) do
local pattern = patternData[1]
local offsetPos = patternData[2]
local instrLen = patternData[3]
local weight = patternData[4]
local result = AOBScan(pattern, "+X")
if result and result.Count > 0 then
local maxCheck = math.min(result.Count, 50)
for j = 0, maxCheck - 1 do
pcall(function()
local instructionAddrStr = result.getString(j)
local instructionAddr = getAddress(instructionAddrStr)
local offsetAddr = instructionAddr + offsetPos
local ripOffset = readInteger(offsetAddr)
local gEngineAddr = instructionAddr + instrLen + ripOffset
if not isLikelyModuleAddress(gEngineAddr) then return end
local isValid, validationScore = validateGEngine(gEngineAddr)
if isValid then
if not candidates[gEngineAddr] then
candidates[gEngineAddr] = {count = 0, score = 0, uniquePatterns = {}}
end
candidates[gEngineAddr].count = candidates[gEngineAddr].count + weight
candidates[gEngineAddr].score = math.max(candidates[gEngineAddr].score, validationScore)
candidates[gEngineAddr].uniquePatterns[i] = true
end
end)
end
result.destroy()
end
end
local bestAddr = nil
local bestScore = 0
for addr, data in pairs(candidates) do
local uniquePatternCount = 0
for _ in pairs(data.uniquePatterns) do
uniquePatternCount = uniquePatternCount + 1
end
local ratio = data.count / uniquePatternCount
local ratioPenalty = 0
if ratio > 20 then
ratioPenalty = math.pow(ratio - 20, 2) * 2
end
local singlePatternPenalty = 0
if uniquePatternCount == 1 and data.count > 20 then
singlePatternPenalty = (data.count - 20) * 15
end
local excessCountPenalty = 0
if data.count > 50 then
excessCountPenalty = (data.count - 50) * 5
end
local diversityBonus = math.pow(uniquePatternCount, 2) * 300
local countBonus = 0
if data.count >= 15 and data.count <= 40 then
countBonus = 200
end
local finalScore = (data.count * 10) + (data.score * 0.5) + diversityBonus + countBonus - ratioPenalty - singlePatternPenalty - excessCountPenalty
print(string.format(" %X: count %d, patterns %d, ratio %.1f, score %d",
addr, data.count, uniquePatternCount, ratio, finalScore))
if finalScore > bestScore then
bestAddr = addr
bestScore = finalScore
end
end
if bestAddr then
registerSymbol("GEngine", bestAddr, true)
print(string.format("GEngine registered: %X", bestAddr))
return true
end
print("GEngine not found!")
return false
end
findGEngine()
end
{$asm}
[DISABLE]
{$lua}
if not syntaxcheck then
if getAddress("GEngine") then
unregisterSymbol("GEngine")
print("GEngine unregistered")
end
end
{$asm}
4
"bGodmode"
0
Byte
GEngine
840
910
488
30
0
38
190
88
7B0
27
"GiveUpDownTimeConsumptionRate"
0
Float
GEngine
88
50
3B8
3420
488
30
0
38
190
88
7B0
28
"bInfiniteAmmo (ammo regen is better)"
0
Byte
GEngine
1728
2C70
488
30
0
38
190
88
7B0
12
"AmmoRegenRate (no reload)"
0
Float
GEngine
2AF4
488
30
0
38
190
88
7B0
19
"CharacterMovement (1,3,5)"
0
Byte
GEngine
248
4C8
488
30
0
38
190
88
7B0
20
"Clipping (0,3)"
0
Byte
GEngine
3BC
4D0
488
30
0
38
190
88
7B0
32
"MaxFlySpeed (600)"
0
Float
GEngine
29C
4C8
488
30
0
38
190
88
7B0
29
"MaxWalkSpeed"
0
Float
GEngine
278
4C8
488
30
0
38
190
88
7B0
30
"MaxWalkSpeedCrouched"
0
Float
GEngine
284
4C8
488
30
0
38
190
88
7B0
33
"CustomTimeDilation (alt speed hack)"
0
Float
GEngine
0D0
488
30
0
38
190
88
7B0
3
"JumpMaxCount"
0
4 Bytes
GEngine
580
488
30
0
38
190
88
7B0
34
"bCanUseWeaponWhileSprinting"
0
Byte
GEngine
1122
488
30
0
38
190
88
7B0
16
"Att_SlideSpeedMultiplier"
0
Float
GEngine
354C
488
30
0
38
190
88
7B0
13
"MeleeCooldownEndTime (5354.833008)"
0
Float
GEngine
2F0
3428
488
30
0
38
190
88
7B0
14
"MeleeHitTime (0.2112877667)"
0
Float
GEngine
2E8
3428
488
30
0
38
190
88
7B0
5
"WeaponSwapTimeScale"
0
Float
GEngine
1CC4
488
30
0
38
190
88
7B0
6
"ExperienceLevel"
0
4 Bytes
GEngine
1A8
2AD0
488
30
0
38
190
88
7B0
7
"Experience"
0
4 Bytes
GEngine
1D8
2AD0
488
30
0
38
190
88
7B0
8
"UncappedExperience"
0
4 Bytes
GEngine
1DC
2AD0
488
30
0
38
190
88
7B0
9
"CombatExperienceScale"
0
Float
GEngine
1E4
2AD0
488
30
0
38
190
88
7B0
10
"MissionExperienceScale"
0
Float
GEngine
1F0
2AD0
488
30
0
38
190
88
7B0
11
"AllExperienceScale"
0
Float
GEngine
1FC
2AD0
488
30
0
38
190
88
7B0
17
"Att_CashMultiplier"
0
Float
GEngine
3558
488
30
0
38
190
88
7B0
18
"Att_AmmoMultiplier"
0
Float
GEngine
3564
488
30
0
38
190
88
7B0
35
"GrenadeThrowCooldown"
0
Float
GEngine
26C0
488
30
0
38
190
88
7B0
26505
"MaxInventoryItems (doesn't save but doesn't delete)"
0
4 Bytes
GEngine
2A8
33F0
488
30
0
38
190
88
7B0
26506
"Eridium"
0
4 Bytes
GEngine
58
228
33F0
488
30
0
38
190
88
7B0
26507
"Money"
0
4 Bytes
GEngine
18
228
33F0
488
30
0
38
190
88
7B0
26509
"Scripts (reload save to disable some)"
1
26501
"No Spread"
Auto Assembler Script
[ENABLE]
aobscanmodule(spread,Borderlands3.exe,F3 0F 10 81 F4 02 00 00 C3)
alloc(newmem,$1000,spread)
label(code)
label(return)
newmem:
code:
mov [rcx+000002F4],(float)0
movss xmm0,[rcx+000002F4]
jmp return
spread:
jmp newmem
nop 3
return:
registersymbol(spread)
[DISABLE]
spread:
db F3 0F 10 81 F4 02 00 00
unregistersymbol(*)
dealloc(*)
26504
"Perfect Accuracy"
Auto Assembler Script
[ENABLE]
aobscanmodule(accuracy,Borderlands3.exe,F3 0F 10 B3 00 03 00 00 44)
alloc(newmem,$1000,accuracy)
label(code)
label(return)
newmem:
code:
mov [rbx+00000300],(float)0
movss xmm6,[rbx+00000300]
jmp return
accuracy:
jmp newmem
nop 3
return:
registersymbol(accuracy)
[DISABLE]
accuracy:
db F3 0F 10 B3 00 03 00 00
unregistersymbol(*)
dealloc(*)
26490
"No Recoil"
Auto Assembler Script
[ENABLE]
aobscanmodule(recoil,Borderlands3.exe,0F 84 93 00 00 00 48 8B 01 FF 90 48)
alloc(newmem,$1000,recoil)
label(code)
label(return)
newmem:
push rbp
mov [rbp+1AC],(float)0
mov [rbp+1B0],(float)0
mov [rbp+1B8],(float)0
mov [rbp+1BC],(float)0
pop rbp
code:
je Borderlands3.exe.text+3066403
jmp return
recoil:
jmp newmem
nop
return:
registersymbol(recoil)
[DISABLE]
recoil:
db 0F 84 93 00 00 00
unregistersymbol(recoil)
dealloc(newmem)
26508
"Rapid Fire"
Auto Assembler Script
[ENABLE]
aobscanmodule(firerate,Borderlands3.exe,0F 2F 81 1C 02 00 00 0F 83)
alloc(newmem,$1000,firerate)
label(code)
label(return)
newmem:
code:
mov [rcx+0000021C],(float)50
comiss xmm0,[rcx+0000021C]
jmp return
firerate:
jmp newmem
nop 2
return:
registersymbol(firerate)
[DISABLE]
firerate:
db 0F 2F 81 1C 02 00 00
unregistersymbol(firerate)
dealloc(newmem)
26482
"100% Legendary Spawn"
Auto Assembler Script
[ENABLE]
aobscanmodule(droprate,Borderlands3.exe,F3 0F 10 81 E0 06 00 00)
alloc(newmem,$1000,droprate)
label(code)
label(return)
newmem:
push rcx
mov rcx,[rcx+5B0]
test rcx,rcx
je @f
mov [rcx+4C0],(float)0
mov [rcx+4C4],(float)0
mov [rcx+4CC],(float)0
mov [rcx+4D0],(float)0
mov [rcx+4D8],(float)0
mov [rcx+4DC],(float)0
mov [rcx+4E4],(float)0
mov [rcx+4E8],(float)0
mov [rcx+490],(float)100
mov [rcx+494],(float)100
mov [rcx+49C],(float)100
mov [rcx+4A0],(float)100
mov [rcx+4F0],(float)0
mov [rcx+4F4],(float)0
mov [rcx+4FC],(float)100
mov [rcx+500],(float)100
@@:
pop rcx
code:
movss xmm0,[rcx+000006E0]
jmp return
droprate:
jmp newmem
nop 3
return:
registersymbol(droprate)
[DISABLE]
droprate:
db F3 0F 10 81 E0 06 00 00
unregistersymbol(*)
dealloc(*)
26458
"Easy Kills"
Auto Assembler Script
[ENABLE]
aobscanmodule(damage,Borderlands3.exe,48 8B 07 48 8B CF FF 90 D0 05)
alloc(newmem,$1000,damage)
label(code)
label(return)
newmem:
push rdi
mov rdi,[rdi+0918]
test rdi,rdi
je @f
mov [rdi+284],(float)999999
mov [rdi+288],(float)999999
mov [rdi+290],(float)999999
mov [rdi+294],(float)999999
mov [rdi+29C],(float)999999
mov [rdi+2A0],(float)999999
mov [rdi+2AC],#1
mov [rdi+2A8],#1
mov [rdi+2B8],(float)999999
mov [rdi+2bC],(float)999999
mov [rdi+31C],(float)999999
mov [rdi+320],(float)999999
mov [rdi+328],(float)999999
mov [rdi+320],(float)999999
mov [rdi+334],(float)999999
@@:
pop rdi
code:
mov rax,[rdi]
mov rcx,rdi
jmp return
damage:
jmp newmem
nop
return:
registersymbol(damage)
[DISABLE]
damage:
db 48 8B 07 48 8B CF
unregistersymbol(damage)
dealloc(newmem)