Members-only download
Here is a walk through using the new unity exclusive features added to Breeze
Start with hp search
search for 1999, after get hit and search, you will find four entries.
Hack the entries to determine which one is the real address responsible for hp
Freezing entry 1 proper gate to the other entries the same number which is also shown on screen
After confirming the real hp address do a asm watch on this address
With the required files generated for unity game hacking assistance let's see what are the names of the routine that is accessing hp
Select entry then use function up button to search for nearest function above current line
Use the Detail button to bring you to Dump.cs view
Use field view button to see all the fields for this class that the method is under
You see the field at offset 0x50 m_HP, this looks good.
Save this field view
Go back and watch the instruction that access HP
Set X30_catch to none so you only get one entry per address. You see this instruction access 6 address.
This means not just your hero, your enemy also make use of class ActorAttrMgr.
We know which one is our hero as we can see her hp
Select the entry that belongs to our hero
Use the load field view button, select the field view you saved earlier for this class, then use the "Pin gen2 offset" button to make this view for our hero.
When surrounding values make sense you know you are on the right track. We see m_HP is 1999 which make sense. Now we shall edit it to see if it changes out Hero's max hp. For Fp type currently Breeze only support viewing and not yet edit. Edit is very easy as Fp type is just making the upper 32 bit the digits above the decimal point. We go to memory explorer and edit the value.
We need to change the type to u32 to edit the upper 32bit.
We see the display in game changes. We now can confirm we have field view of our hero. We can save this field view pinned to the hero.
As it turns out max hp will revert very soon to 1999, that does not mean we did not have the correct address, it just mean the game updated it base on some data. If we like we can watch what change that memory and hack it such that we have the value we want. We have already confirm earlier that the m_hp value is the one we want to hack and we now need to know how to separate hero from the rest for the methods in this class is applicable to both friend and foe.
Scroll down the list we see m_MPs. [] means it's an array. Use View class button to see what is in the array.
We see 240 that match what we see on screen.Why entry 2? I don't know yet.
If we hack this number our hero's MP can be made to not decrease.
We hack max MP entry 2 and we see our hero's MP is increasing
Scroll down further we see HealthFlash. We note that they game do something unexpected. It record how many you have used and there is a extra field so what you see on screen is what you should have - what you used + what extra you have.
Hack and you will see what I mean.
*** One thing to know about class is it is define for all using entities but not all everything defined is use by all entities.
We can assume, for example, that enemies don’t have a health flask—but we won’t really know until we test it in gameplay. For a quick hack, hooking code that access flask is one possible approach. Once you find the address of our hero’s flask, you can hack HP, MP, and other related values, and vice versa.
Let's find a more secure way to tell friend or foe. Go to dump.cs view. Use the "Search button" to search for the class.
We want to know which class it is a field of.
Next, we want to look for descendants of ActorBase by searching for : ActorBase.
PlayerObj sounds like a good one to investigate
We know how to tell a PlayerObj is friend of foe now. We just need to look at what is at offset 0x2F8
Scroll down to the list of method for PlayerObj, a promising one
We watch it
Use Goto RVA to go ASM explorer
Happy result, we catch our hero and one monster.
By hooking this one line we get to hack a lot.
from [[X0+0x70]+0x50] is m_hp etc etc
Last edited by TomSwitch,
