Looks like all this time no body was able to try out the new feature as my il2cpp has dependency that I did not include in the release. Hopefully now it is fixed.
@ranma99vn I am looking at "Maid of Salvation 1.1.0 TID: 01002AA026586000 BID: FEABE989E734A798" and using @herowang 's cheat as a stating point.
HP does not decrease v1
This would lead to class Character which has field that starts at 0x140 but we are looking for 0x38 that seems to be the hp
scroll up to look for x8 we see offset 0x1e8
Currently Breeze don't let you jump to CharItem definition.
On PC we can easily find it, matched what we want to see
Next I shall look at how this can happen with Breeze
Members-only download
Post automatically merged:
@ranma99vn I am looking at "Maid of Salvation 1.1.0 TID: 01002AA026586000 BID: FEABE989E734A798" and using @herowang 's cheat as a stating point.
HP does not decrease v1
This would lead to class Character which has field that starts at 0x140 but we are looking for 0x38 that seems to be the hp
scroll up to look for x8 we see offset 0x1e8
Currently Breeze don't let you jump to CharItem definition.
On PC we can easily find it, matched what we want to see
Next I shall look at how this can happen with Breeze
Last edited by TomSwitch,
This new feature is great with unity game, will help speed up looking at method and to see what the code line land in which one namespace.
I definitely love this feature
Members-only download
Now you don't need PC to find the definitions.
Keep using "Find definition" to end up with Field at offset 0x38 and this is not related to health. Go back to asm explorer and found one level up from health the offset 0x1E8
Scroll down and use find definition to find the target
Last edited by TomSwitch,
Very nice new feature. Thank you for continuously updating Breeze.
I also look forward to seeing Unreal Engine games supported on Breeze in the future,
with the ability to find related function names or indexes.
I also look forward to seeing Unreal Engine games supported on Breeze in the future,
with the ability to find related function names or indexes.
That would be appreciated
I tried the last weeks to playing around with AI and the Eiffel script for Unreal Engine to enlarge it for more UE versions... no direct success right now but I think from day to day that this is the last day the script is able to do it and it is working as expected (but I also thought so 5 weeks ago so maybe I achieve it in the near future or I die whilst trying)... but having that directly in Breeze and not needing IDA and the python uEngine script would be a game changer as well
I am working on Field view, the idea is mapping it to memory we found and you get to see the rest with label.
We know this one
By watching this asm line we get the memory.
We can proceed to pin this address and we get to see the memory in a new light
What is there with Owner? let's take a look
If you have a memory address found that belong to a class field you can use the class field view to explore all the fields.
Add to cs bookmark a method that belongs to the class.
Go to memory explorer and call up the CS Bookmark. Select the bookmark you want, select field view, locate the entry, pin the address.
Enjoy exploring.
We know this one
By watching this asm line we get the memory.
We can proceed to pin this address and we get to see the memory in a new light
What is there with Owner? let's take a look
Post automatically merged:
Members-only download
If you have a memory address found that belong to a class field you can use the class field view to explore all the fields.
Add to cs bookmark a method that belongs to the class.
Go to memory explorer and call up the CS Bookmark. Select the bookmark you want, select field view, locate the entry, pin the address.
Enjoy exploring.
Last edited by TomSwitch,
Members-only download
Post automatically merged:
Last edited by TomSwitch,
Members-only download
Unity games are now first-class targets in Breeze. With IL2CPP-aware `dump.cs` indexing, live Field View inspection, pointer-chain-aware restore, and one-click cheat generation, Breeze delivers a faster path from structure discovery to working in-game results. You can move from class lookup to verified live values, persist your setup across sessions, and jump between Field View, Memory Explorer, and `dump.cs` without losing context.
Breeze Beta – beta99t_pr12
New demo
Members-only download
- Added static field support.
Members-only download
- Generates a few additional files, allowing Breeze to skip generating them itself.
- Eliminates the short freeze that occurred on first use of some features.
Post automatically merged:
New demo
Last edited by TomSwitch,
today i updated to fw 21.2.0
got error when open breeze 99s
(running just fine if not open any game)
something like
atmosphere error code 2168 0002
program 010000000000100d
read error log, something about out of memory
finally, i removed all files (except cheat folder) in switch/breeze
then copied and merged as usual
WORKINGE!!!
note for anyone may encouter a problem like me
got error when open breeze 99s
(running just fine if not open any game)
something like
atmosphere error code 2168 0002
program 010000000000100d
read error log, something about out of memory
finally, i removed all files (except cheat folder) in switch/breeze
then copied and merged as usual
WORKINGE!!!
note for anyone may encouter a problem like me
Members-only download
Members-only download
Now with jump back
Easy case only one found
Easy case only one found
You found the base with physical address which you can watch or do pointer search
Post automatically merged:
In the case for ActorBase there is actually a link so no need to do jumpback. I use it as an example to illustrate the new feature.
If you perform a jump back from ActorBase you get 67x59 combination. The reason is there are many class with a Owner field
...
Post automatically merged:
if you do a jump back search from ActorBase
There is a lot of class that links back to ActorBase, the reason is there are many that has a Owner field.
You don't need to do jump back from ActionMgr cause at offset 0x10 a pointer is already there to get to ActorBase
Last edited by TomSwitch,
when i was working on this i think i found the hero speed but could not get a hit look through method since you still use this game for testing would you have a look at it?Members-only download
Members-only download
Now with jump back
Easy case only one found
Easy case only one found
You found the base with physical address which you can watch or do pointer search
Post automatically merged:
In the case for ActorBase there is actually a link so no need to do jumpback. I use it as an example to illustrate the new feature.
If you perform a jump back from ActorBase you get 67x59 combination. The reason is there are many class with a Owner field
if you do a jump back search from ActorBase
View attachment 558867
There is a lot of class that links back to ActorBase, the reason is there are many that has a Owner field.
View attachment 558868
You don't need to do jump back from ActionMgr cause at offset 0x10 a pointer is already there to get to ActorBase
View attachment 558870
There is no substitute to hacking and see what happen. If you are able to find the address hack it and see what happen. If you can find a method that looks interesting then intercept it and see if there is any access to this field at offset 0x58.when i was working on this i think i found the hero speed but could not get a hit look through method since you still use this game for testing would you have a look at it?
View attachment 558876
Until you can find one of these field in memory nothing much can be said.
If I want to comment I would say I don't like to see "IMessage". We normally don't want message, we want the source address that matters.
My recommendation to find speed related items is to look at hero's instant of some top level class such as ActorBase
I can tell you that ActorPosition let you have inf jump
ActorAttrMgr has HP and MP and flask and reborn
Other Class from here may have the movement speed you want.
Maybe ActorMotionMgr.
Since we found ActorBase and can follow the class and hack you will probably find more source address from here.
Post automatically merged:
It’s unlikely to be related. It’s like staring at a cloud and seeing a house.
To be more confident, you need to do an A–B–A test:
A shows the problem, B shows no problem, then A shows the problem again.
It's like you are hungry, then you are no longer hungry, then you look at the last cookie you ate. Yes that is the one.
My recommendation to somebody that has this problem, remove some sysmodule.
Post automatically merged:
This is the movement speed
Dig into this one to hack every base and buff
public enum EAttrType // TypeDefIndex: 740
{
// Fields
public int value__; // 0x0
[OriginalName("EAttrType_None")]
public const EAttrType None = 0;
[OriginalName("EAttrType_MaxHp")]
public const EAttrType MaxHp = 1;
[OriginalName("EAttrType_HpRateEq")]
public const EAttrType HpRateEq = 2;
[OriginalName("EAttrType_HpAddPt")]
public const EAttrType HpAddPt = 3;
[OriginalName("EAttrType_HpRateDyn")]
public const EAttrType HpRateDyn = 4;
[OriginalName("EAttrType_Hp")]
public const EAttrType Hp = 5;
[OriginalName("EAttrType_AtkBase")]
public const EAttrType AtkBase = 6;
[OriginalName("EAttrType_AtkRateEq")]
public const EAttrType AtkRateEq = 7;
[OriginalName("EAttrType_AtkAddPt")]
public const EAttrType AtkAddPt = 8;
[OriginalName("EAttrType_AtkRateDyn")]
public const EAttrType AtkRateDyn = 9;
[OriginalName("EAttrType_MaxShield")]
public const EAttrType MaxShield = 10;
[OriginalName("EAttrType_CriRate")]
public const EAttrType CriRate = 11;
[OriginalName("EAttrType_AntiCriRate")]
public const EAttrType AntiCriRate = 12;
[OriginalName("EAttrType_CriValue")]
public const EAttrType CriValue = 13;
[OriginalName("EAttrType_AntiCriValue")]
public const EAttrType AntiCriValue = 14;
[OriginalName("EAttrType_SkRate")]
public const EAttrType SkRate = 15;
[OriginalName("EAttrType_SkFlucMin")]
public const EAttrType SkFlucMin = 16;
[OriginalName("EAttrType_SkFlucMax")]
public const EAttrType SkFlucMax = 17;
[OriginalName("EAttrType_MaxMp")]
public const EAttrType MaxMp = 18;
[OriginalName("EAttrType_MaxMpAdd2")]
public const EAttrType MaxMpAdd2 = 19;
[OriginalName("EAttrType_Mp")]
public const EAttrType Mp = 20;
[OriginalName("EAttrType_FinalDamAddRate")]
public const EAttrType FinalDamAddRate = 21;
[OriginalName("EAttrType_FianlDamReduceRate")]
public const EAttrType FianlDamReduceRate = 22;
[OriginalName("EAttrType_FinalDamAddRateVictim")]
public const EAttrType FinalDamAddRateVictim = 23;
[OriginalName("EAttrType_PhysicalDamAddRate")]
public const EAttrType PhysicalDamAddRate = 25;
[OriginalName("EAttrType_PhysicalDamReduceRate")]
public const EAttrType PhysicalDamReduceRate = 26;
[OriginalName("EAttrType_PhysicalDamAddPt")]
public const EAttrType PhysicalDamAddPt = 27;
[OriginalName("EAttrType_PhysicalDamReducePt")]
public const EAttrType PhysicalDamReducePt = 28;
[OriginalName("EAttrType_ElementDamAddRatio_All")]
public const EAttrType ElementDamAddRatioAll = 29;
[OriginalName("EAttrType_ElementDamAddPt1_Begin")]
public const EAttrType ElementDamAddPt1Begin = 30;
[OriginalName("EAttrType_ElementDamAddPt1_Fire")]
public const EAttrType ElementDamAddPt1Fire = 31;
[OriginalName("EAttrType_ElementDamAddPt1_Ice")]
public const EAttrType ElementDamAddPt1Ice = 32;
[OriginalName("EAttrType_ElementDamAddPt1_Thunder")]
public const EAttrType ElementDamAddPt1Thunder = 33;
[OriginalName("EAttrType_ElementDamAddPt1_Poison")]
public const EAttrType ElementDamAddPt1Poison = 34;
[OriginalName("EAttrType_ElementDamAddPt1_Dark")]
public const EAttrType ElementDamAddPt1Dark = 35;
[OriginalName("EAttrType_ElementDamAddPt1_Light")]
public const EAttrType ElementDamAddPt1Light = 36;
[OriginalName("EAttrType_ElementDamAddPt1_Blade")]
public const EAttrType ElementDamAddPt1Blade = 37;
[OriginalName("EAttrType_ElementDamAddPt1_Chaos")]
public const EAttrType ElementDamAddPt1Chaos = 38;
[OriginalName("EAttrType_ElementDamReducePt1_Begin")]
public const EAttrType ElementDamReducePt1Begin = 40;
[OriginalName("EAttrType_ElementDamReducePt1_Fire")]
public const EAttrType ElementDamReducePt1Fire = 41;
[OriginalName("EAttrType_ElementDamReducePt1_Ice")]
public const EAttrType ElementDamReducePt1Ice = 42;
[OriginalName("EAttrType_ElementDamReducePt1_Thunder")]
public const EAttrType ElementDamReducePt1Thunder = 43;
[OriginalName("EAttrType_ElementDamReducePt1_Poison")]
public const EAttrType ElementDamReducePt1Poison = 44;
[OriginalName("EAttrType_ElementDamReducePt1_Dark")]
public const EAttrType ElementDamReducePt1Dark = 45;
[OriginalName("EAttrType_ElementDamReducePt1_Light")]
public const EAttrType ElementDamReducePt1Light = 46;
[OriginalName("EAttrType_ElementDamReducePt1_Blade")]
public const EAttrType ElementDamReducePt1Blade = 47;
[OriginalName("EAttrType_ElementDamReducePt1_Chaos")]
public const EAttrType ElementDamReducePt1Chaos = 48;
[OriginalName("EAttrType_ElementDamAddPt2_Begin")]
public const EAttrType ElementDamAddPt2Begin = 50;
[OriginalName("EAttrType_ElementDamAddPt2_Fire")]
public const EAttrType ElementDamAddPt2Fire = 51;
[OriginalName("EAttrType_ElementDamAddPt2_Ice")]
public const EAttrType ElementDamAddPt2Ice = 52;
[OriginalName("EAttrType_ElementDamAddPt2_Thunder")]
public const EAttrType ElementDamAddPt2Thunder = 53;
[OriginalName("EAttrType_ElementDamAddPt2_Poison")]
public const EAttrType ElementDamAddPt2Poison = 54;
[OriginalName("EAttrType_ElementDamAddPt2_Dark")]
public const EAttrType ElementDamAddPt2Dark = 55;
[OriginalName("EAttrType_ElementDamAddPt2_Light")]
public const EAttrType ElementDamAddPt2Light = 56;
[OriginalName("EAttrType_ElementDamAddPt2_Blade")]
public const EAttrType ElementDamAddPt2Blade = 57;
[OriginalName("EAttrType_ElementDamAddPt2_Chaos")]
public const EAttrType ElementDamAddPt2Chaos = 58;
[OriginalName("EAttrType_ElementDamReducePt2_Begin")]
public const EAttrType ElementDamReducePt2Begin = 60;
[OriginalName("EAttrType_ElementDamReducePt2_Fire")]
public const EAttrType ElementDamReducePt2Fire = 61;
[OriginalName("EAttrType_ElementDamReducePt2_Ice")]
public const EAttrType ElementDamReducePt2Ice = 62;
[OriginalName("EAttrType_ElementDamReducePt2_Thunder")]
public const EAttrType ElementDamReducePt2Thunder = 63;
[OriginalName("EAttrType_ElementDamReducePt2_Poison")]
public const EAttrType ElementDamReducePt2Poison = 64;
[OriginalName("EAttrType_ElementDamReducePt2_Dark")]
public const EAttrType ElementDamReducePt2Dark = 65;
[OriginalName("EAttrType_ElementDamReducePt2_Light")]
public const EAttrType ElementDamReducePt2Light = 66;
[OriginalName("EAttrType_ElementDamReducePt2_Blade")]
public const EAttrType ElementDamReducePt2Blade = 67;
[OriginalName("EAttrType_ElementDamReducePt2_Chaos")]
public const EAttrType ElementDamReducePt2Chaos = 68;
[OriginalName("EAttrType_ElementDamAddRatio_Begin")]
public const EAttrType ElementDamAddRatioBegin = 70;
[OriginalName("EAttrType_ElementDamAddRatio_Fire")]
public const EAttrType ElementDamAddRatioFire = 71;
[OriginalName("EAttrType_ElementDamAddRatio_Ice")]
public const EAttrType ElementDamAddRatioIce = 72;
[OriginalName("EAttrType_ElementDamAddRatio_Thunder")]
public const EAttrType ElementDamAddRatioThunder = 73;
[OriginalName("EAttrType_ElementDamAddRatio_Poison")]
public const EAttrType ElementDamAddRatioPoison = 74;
[OriginalName("EAttrType_ElementDamAddRatio_Dark")]
public const EAttrType ElementDamAddRatioDark = 75;
[OriginalName("EAttrType_ElementDamAddRatio_Light")]
public const EAttrType ElementDamAddRatioLight = 76;
[OriginalName("EAttrType_ElementDamAddRatio_Blade")]
public const EAttrType ElementDamAddRatioBlade = 77;
[OriginalName("EAttrType_ElementDamAddRatio_Chaos")]
public const EAttrType ElementDamAddRatioChaos = 78;
[OriginalName("EAttrType_ElementDamReduceRatio_Begin")]
public const EAttrType ElementDamReduceRatioBegin = 80;
[OriginalName("EAttrType_ElementDamReduceRatio_Fire")]
public const EAttrType ElementDamReduceRatioFire = 81;
[OriginalName("EAttrType_ElementDamReduceRatio_Ice")]
public const EAttrType ElementDamReduceRatioIce = 82;
[OriginalName("EAttrType_ElementDamReduceRatio_Thunder")]
public const EAttrType ElementDamReduceRatioThunder = 83;
[OriginalName("EAttrType_ElementDamReduceRatio_Poison")]
public const EAttrType ElementDamReduceRatioPoison = 84;
[OriginalName("EAttrType_ElementDamReduceRatio_Dark")]
public const EAttrType ElementDamReduceRatioDark = 85;
[OriginalName("EAttrType_ElementDamReduceRatio_Light")]
public const EAttrType ElementDamReduceRatioLight = 86;
[OriginalName("EAttrType_ElementDamReduceRatio_Blade")]
public const EAttrType ElementDamReduceRatioBlade = 87;
[OriginalName("EAttrType_ElementDamReduceRatio_Chaos")]
public const EAttrType ElementDamReduceRatioChaos = 88;
[OriginalName("EAttrType_San")]
public const EAttrType San = 91;
[OriginalName("EAttrType_HealthFlaskCount")]
public const EAttrType HealthFlaskCount = 92;
[OriginalName("EAttrType_HashrateDropAddRate")]
public const EAttrType HashrateDropAddRate = 93;
[OriginalName("EAttrType_TalentPointDropAddRate")]
public const EAttrType TalentPointDropAddRate = 94;
[OriginalName("EAttrType_SanMax")]
public const EAttrType SanMax = 95;
[OriginalName("EAttrType_SanMin")]
public const EAttrType SanMin = 96;
[OriginalName("EAttrType_HealthFlaskUseCount")]
public const EAttrType HealthFlaskUseCount = 97;
[OriginalName("EAttrType_HealthFlaskCountMax")]
public const EAttrType HealthFlaskCountMax = 98;
[OriginalName("EAttrType_ExtraHealthFlaskCount")]
public const EAttrType ExtraHealthFlaskCount = 99;
[OriginalName("EAttrType_ExtraHashrateAdd")]
public const EAttrType ExtraHashrateAdd = 101;
[OriginalName("EAttrType_ExtraCoinAdd")]
public const EAttrType ExtraCoinAdd = 102;
[OriginalName("EAttrType_ExtraQualityPoint")]
public const EAttrType ExtraQualityPoint = 104;
[OriginalName("EAttrType_AttrDropAdd")]
public const EAttrType AttrDropAdd = 105;
[OriginalName("EAttrType_DungeonHpRecoveryAdd")]
public const EAttrType DungeonHpRecoveryAdd = 106;
[OriginalName("EAttrType_DungeonRoomFinishHpRecovery")]
public const EAttrType DungeonRoomFinishHpRecovery = 107;
[OriginalName("EAttrType_PreferedBlessQualityBonusWeight")]
public const EAttrType PreferedBlessQualityBonusWeight = 108;
[OriginalName("EAttrType_DungeonBossHpRecovery")]
public const EAttrType DungeonBossHpRecovery = 110;
[OriginalName("EAttrType_TeacherAttack1")]
public const EAttrType TeacherAttack1 = 111;
[OriginalName("EAttrType_TeacherAttack2")]
public const EAttrType TeacherAttack2 = 112;
[OriginalName("EAttrType_RebornMax")]
public const EAttrType RebornMax = 113;
[OriginalName("EAttrType_RebornUsed")]
public const EAttrType RebornUsed = 114;
[OriginalName("EAttrType_RebornHpRate")]
public const EAttrType RebornHpRate = 115;
[OriginalName("EAttrType_HpRateLock")]
public const EAttrType HpRateLock = 116;
[OriginalName("EAttrType_HpRateEq2")]
public const EAttrType HpRateEq2 = 117;
[OriginalName("EAttrType_MaxMpAdd3")]
public const EAttrType MaxMpAdd3 = 118;
[OriginalName("EAttrType_AutoSummonTentacle")]
public const EAttrType AutoSummonTentacle = 119;
[OriginalName("EAttrType_AutoSummonLight")]
public const EAttrType AutoSummonLight = 120;
[OriginalName("EAttrType_ExtraRebornMax")]
public const EAttrType ExtraRebornMax = 121;
[OriginalName("EAttrType_HpRateLockTotal")]
public const EAttrType HpRateLockTotal = 122;
[OriginalName("EAttrType_RcDisableAutoJumpDrop")]
public const EAttrType RcDisableAutoJumpDrop = 123;
[OriginalName("EAttrType_HealthFlaskRecoverRate")]
public const EAttrType HealthFlaskRecoverRate = 124;
[OriginalName("EAttrType_FinishRoomAddDamR")]
public const EAttrType FinishRoomAddDamR = 125;
[OriginalName("EAttrType_SkillKillCount8348")]
public const EAttrType SkillKillCount8348 = 126;
[OriginalName("EAttrType_SkillKillCount8359")]
public const EAttrType SkillKillCount8359 = 127;
[OriginalName("EAttrType_Max")]
public const EAttrType Max = 128;
}
Last edited by TomSwitch,
do you get this bug? after getting the breakpoint, sometimes Watch instruction watches X0 offset 0000 instead of the actual register and offsetMembers-only download
Members-only download
Now with jump back
Easy case only one found
Easy case only one found
You found the base with physical address which you can watch or do pointer search
Post automatically merged:
In the case for ActorBase there is actually a link so no need to do jumpback. I use it as an example to illustrate the new feature.
If you perform a jump back from ActorBase you get 67x59 combination. The reason is there are many class with a Owner field
if you do a jump back search from ActorBase
View attachment 558867
There is a lot of class that links back to ActorBase, the reason is there are many that has a Owner field.
View attachment 558868
You don't need to do jump back from ActionMgr cause at offset 0x10 a pointer is already there to get to ActorBase
View attachment 558870
View attachment watch.mp4
t13 can run out of memory if a class has a huge number of fields. I fixed this in pr14. It’s possible your Switch was already memory corrupted, but it wasn’t to the extend that it crashed.
Last edited by TomSwitch,
@TomSwitch in 99t 14 i try on the game Sands of Aura it is unreal engine when view in memory the "jump forward" button did not jump like it used to not sure something broken?
also try it on Xenoblade chronicles X it did no jump forward either, beside unity game other will not jump forward just try it on 2 games not unity
also try it on Xenoblade chronicles X it did no jump forward either, beside unity game other will not jump forward just try it on 2 games not unity
Last edited by ranma99vn,
