How to hack achievements

Originally posted by DesertSheep :. Washell View Profile View Posts. Originally posted by MancSoulja :. Last edited by Washell ; 2 Sep, am. Originally posted by Washell :. Last edited by MancSoulja ; 2 Sep, am. Ron View Profile View Posts. Ron: basicly everything you said is wrong, dumb and unprofounded and made up with zero background knowledge about everything and i can assure you everyone at the top achievement ranking websites uses a well-known tool to unlock their stuff.

Originally posted by wuddih :. Per page: 15 30 Date Posted: 9 Mar, am. Posts: Sometimes translation patches may critically differ from the developer MD5 in memory differences that you may find online.

Before linking these patches check with the original developer or do deep memory tests to ensure total compatibility. You can link translation patches you find online to core sets as long as the game's core achievements all function correctly and do not make the game more or less difficult. Tip: For games with text-triggered achievements especially RPGs it's recommend to find an event flag instead of hooking onto text or text ID.

Text presentation varies between regional versions making multi-region support difficult. Consult the community via the forum and Discord for review and approval. You can get a good view-port of what the community likes to see by asking. Asking for approval before linking is an integral Developer practice, and falls within your code of conduct as a developer here at RetroAchievements.

Skip to content. Difficulty and Story Hacks link Often allowed If a ROM hack has sufficient enough differences from the licensed game insomuch that the game can be considered an entirely different game than a unique set is usually acceptable. Remember that: If a rom hack has sufficient enough differences from the licensed game insomuch that the game can be considered an entirely different game than its original existing set, it is usually acceptable.

See what happens. So I restored the code, exited this function and RET'd the prologue of the outer function: haloreach. If you head there, put a 0xC3 so the function exits quick, you will find that you've gotten no recoil As a bonus, try jumping, then on land notice there's no screen shake as well. So this function, accessed from several locations, processes screen shake for various actions. In a similar fashion you could disable the screen shake for the Sprint active skill. Then the function that contains haloreach.

Am sure inside this function you'll find references to shot distance, power, etc. Just do some digging in. BR, Sun. Oh, coded in ASM, like a true super-star. Why is that.. For example, 0x4 from DeviceIoControl at top of the decoded buffer means "debugger detected".

Additional checks are performed and the computed signal value is then used to determine which branch should the CreateProcessW perform the launch: 0x0 starts the process with no command-line; 0x1 starts the process with -eac-nop-loaded command-line appended to what EAC reads from settings.

Bottom line is EAC will run the game itself with -eac-nop-loaded command-line. Why am I talking about it? So NULL or valid pointer. And no other conditions.

Since the handle to the process is stripped by the driver, you will not see this command-line in any tool at your disposal: Just know that it is there and it is what was used when EAC launched the game. So there you go.. I checked the one in Gears 5, as well as Wildlands. Present in both games' EAC. Furthermore, developers often opt to add additional checks; in Gears 5 they are computing MD5 hashes of all binaries in the game folder, just so you can't tamper the files.

If the hashes don't check out, then main. Of course, it's also checked by EAC on initialization. Slight variations in how developers implement this EAC shit.

And I didn't need to hard-code the process name or folder path Why? Because there's no need to run it with "-eac-nop-loaded" parameter, as explained above. At 0x0 offset in this structure there is a pointer to a vtable of functions, called member-functions.

This is where the trick lies with the x64 DLL: resolving these member-functions so when your fake DLL is loaded, any dynamic call to either of those won't crash the game they need to exist!

That's Features also the "EasyAntiCheat successfully initialized" ripped function, just in case your game would make use of it for.. And something tells me this will work with other games, like Wildlands. BAK , so you have a backup of these files I know you could always verify integrity of game files if you accidentally overwrite them, but why waste time waiting for validation of 32GB?..

No need to select the 2nd one with EAC disabled Profit.