Console commands

[Spontaneous]

Wow its been so long since I memory hacked bf games. I got the console unlocked but I sure as hell can not find any of the locked console commands. I know in bfvietnam there was renderer.viewdistance and stuff like that. Has anyone found them for 2142?

[Contrast]

intrep;(s4_find_memcluster4_buy

I know, its alien!

Give it a wizz while in a buggy.

[dubbls]

Hey Spont, so many people overlook the power of console commands, for not only direct game changes but those commands have been a great asset when I'm looking for functions to hack, you can change the values on the fly aiding in "exact value" memory searches. I know you understand that Spont, I'm just stating it for others, In January I made a post about the bf2 ones here: http://www.battlecoders.com/forum/in...p?showtopic=23
But it didn't generate much interest in people helping out to give exact descriptions of each command.

Anyway open up the BF2142 directory /mods/bf2142/levels/(level name)/server.zip and extract the .con files. They hold the maps default settings thus you can put together a list of unauthorised console commands to try.

Example of console commands taken from sky.con from map level "Suez Canal"
The command followed by the argument value settings from that particular map.

Lightmanager.skycolor 1.2/1.05/1
Lightmanager.ambientcolor 0.8/0.95/0.95
Lightmanager.sunColor 1.3/1/0.6
Lightmanager.sunSpecColor 0.98/0.8/0.67

LightSettings.TerrainSunColor 1.31/1.14/0.97
LightSettings.TerrainSkyColor 1.00/0.82/0.69

LightmapSettings.waterSunIntensity 0.8

terrain.sunColor 1.31/1.14/0.97
terrain.GIColor 1.00/0.82/0.69
terrain.waterSunIntensity 0.8

Lightmanager.staticSunColor 0.94/0.62/0.31
Lightmanager.staticSpecularColor 1.88/1.33/0.78
Lightmanager.staticSkyColor 1.22/0.95/0.61
Lightmanager.singlePointColor 1.3/1.8/2.2
Lightmanager.sunDirection -0.897982/-0.239462/0.36917
Lightmanager.enableSun 1
Lightmanager.effectSunColor 1.00/0.70/0.30
Lightmanager.effectShadowColor 0.89/0.89/0.89
Lightmanager.defaultEffectLightAffectionFactor 1
Lightmanager.hemilerpbias 0.25
Lightmanager.treeAmbientColor 0.60/0.55/0.39
Lightmanager.treeSunColor 1.80/1.16/0.77
Lightmanager.treeSkyColor 0.58/0.64/0.77

Skydome.hasCloudLayer 1
Skydome.hasCloudLayer2 0
Skydome.scrolldirection 0.01/0.015
Skydome.scrolldirection2 0.01/0.012
Skydome.domeRotation 110
Skydome.domePosition 0.00/0.00/0.00
Skydome.fadeCloudsDistances 700/770
Skydome.cloudLerpFactors 0.8/0.8
Skydome.flareDirection -0.90/-0.24/0.37

Renderer.fogColor 216.00/174.00/133.00
Renderer.fogStartEndAndBase -10.00/355.00/0.20/0.00
Renderer.BloomFilterContrast 0.4
Renderer.BloomOverlayAmount 0.3
Renderer.BloomSize 0.4
Renderer.BloomWeightScale 0.2
Renderer.ShowBloomOverlayTexture 0
Renderer.DefaultColorTint 1.00/0.92/0.60
Renderer.DefaultSaturation 0.6
Renderer.DefaultContrast 0.55/0.58/0.00

Don't overlook the other .con files for other important commands as well.
hopefully the console commands won't be buried and forgotten about this game. Maybe we can get an exact description list going this time.

[caliber1942]

can't seem to trace the viewdistance variable while playing the game. i tried the .con file method for it and works for fog but viewdisance variable gets loaded as a float and then changed to LONG i think. at any rate, some help unlocking the console and then giving me the console command to use to change the viewdistance would be appreciated or just telling me the basepointer and DMA offsets for viewdistance (you can send PM if ya want) would be nice (for both fog and viewdistance)

also, working on basepointer for zoom-

all for retail-

thanks-
Cal

[Spontaneous]

Yes, people underestimate how powerful these commands can be when tracing down addresses in memory. Its the main reason why Console Unlock is the first hack I do. It helps so much finding everything else.

The only 2 I found which was from searching battlecoders was

gamelogic.maximumlevelviewdistance
renderer.fogstartendandbase

Which i got these from boss's console command tool. I tested the gamelogic one already and that indeed works for 2142. Havent tested the fog one yet.


Caiber, the best way to find a viewdistance one would be using the slider in video settings of the game. I remember that way always worked in the bf games. I havent tested it yet but I am sure it would work.

Also one reason why I wanted console commands is for zoom. Usually there was a console command for fieldofview which worked great in finding the fov addie used for doing zoom hacks.

[[SoB]-Slayer]

I dont understand so you unlock the console so when you enter specific commands then it gives you no fog/longer view distance etc..? If this is so how can this be done (unlocking the console) is this a easy process or quite a involved one?

[fatboy88]

Originally Posted by [SoB]-Slayer

I dont understand so you unlock the console so when you enter specific commands then it gives you no fog/longer view distance etc..? If this is so how can this be done (unlocking the console) is this a easy process or quite a involved one?

very easy unlocking console commands is almost the same as in any game -textS



cvars i use

rainmanager.enabled 0
Renderer.fogstartendandbase 0/600/0/0

i tried
ranksettings.setrank
scoremanager.setkill 8
but i guess its held server lol

[Spontaneous]

Pretty much you need to search the games coding loaded into memory for unauthorized and you will find the string 3 times. One of the jumps around there you need to force the jump. Console is unlocked. Then you can use these commands that are normally locked out.

[DrUnKeN ChEeTaH]

2 Patches to auth commands
2 Patches to list hidden commands

I'm attaching a .dll you can inject to do both...(should work for BF2 and BF2142)

NOT PB SAFE - YOU WILL BE KICKED OR BANNED IF YOU USE IN MULTIPLAYER

I'll leave it as a exercise for people to find "useful" stuff, but here is an example of useless

*do the commands in this order

collisionManager.buildDebugCollisionMeshes
collisionManager.drawMeshes 1

That will give you this:
[img=http://img291.imageshack.us/img291/1593/screen000mh1.th.jpg]

Basic console stuff....
Now you will see so many commands, they will scroll off the console
start by typing like renderer. and hitting tab tab
then you can even narrow it down by typing
renderer.draw tab tab

*hope it works, I made this very quickly by ripping code from my hack...so I didn't test much

[[SoB]-Slayer]

Originally Posted by Spontaneous

Pretty much you need to search the games coding loaded into memory for unauthorized and you will find the string 3 times. One of the jumps around there you need to force the jump. Console is unlocked. Then you can use these commands that are normally locked out.

Haha, sorry should said I was a real noob at this that doesnt make much sense to me.. should I start with a memory hacking tut. and see where that takes me?

[fatboy88]

Originally Posted by DrUnKeN ChEeTaH

2 Patches to auth commands
2 Patches to list hidden commands

I'm attaching a .dll you can inject to do both...(should work for BF2 and BF2142)

NOT PB SAFE - YOU WILL BE KICKED OR BANNED IF YOU USE IN MULTIPLAYER

I'll leave it as a exercise for people to find "useful" stuff, but here is an example of useless

*do the commands in this order

collisionManager.buildDebugCollisionMeshes
collisionManager.drawMeshes 1

That will give you this:
[img=http://img291.imageshack.us/img291/1593/screen000mh1.th.jpg]

Basic console stuff....
Now you will see so many commands, they will scroll off the console
start by typing like renderer. and hitting tab tab
then you can even narrow it down by typing
renderer.draw tab tab

*hope it works, I made this very quickly by ripping code from my hack...so I didn't test much

thanks Drunken

chilled glass of vodka and rasberry for u ;-)

Haha, sorry should said I was a real noob at this that doesnt make much sense to me.. should I start with a memory hacking tut. and see where that takes me?

ok what he is saying its a refrenced textsting.
so...type a known console command in it will say unautorized or like other games "is cheat protected" from there im sure u can figure the rest out

[swiss-bull]

What DO becomes Jo no sow smartly . How does man do di CONSOLE comandos freely switches ? Already everything tried. Does not fold. Punt explain someone times more exactly? Wenns goes on German

[dubbls]

Now that is a handy dll DC, nice, I didn't know about listing them in console.

I did some memory hacking for View-Distance and No-Fog. I'll briefly show my steps and how I utilized the console commands to make it a quick and painless experience.

----No Fog-----
I Start the game, spawn in map, activate unauthorised command hack, go to console and type renderer.fogstartendandbase 0/67.149/0

Fog END VALUE is our target so I set it to a unique float that there probably aren't to many present in memory.

Start up L spiro's memhack, file, open process, bf2142,
Search, Data type search, Float, value to find 67.149, seatch type exact value, OK.

3 DMA addies come back(looks like the value 67.149 was a good number) opened OLY, attached Bf2142, Put DMA1 addy for expression to follow in the hex dump, breakpoint the float on access, nothing is breaking, not sure exactly its purpose but its not active now and we aren't interested in it(I think it breaks on write when the console command function calls it).

Followed dma addy 2 in hex dump, breakpoint on access, It breaks on RendDx9+495E6
FLD DWORD PTR DS:[ESI+30]. Check for other code accessing it, nothing, FLD DWORD PTR DS:[ESI+30]
is the only break.

In Memhack I go to Tools, disassembly, I go to the line under
FLD DWORD PTR DS:[ESI+30]
witch is
MOV DWORD PTR DS:[EAX],ECX
Click on it, choose inject code, make sure everything is checked except allocate code cave cause you have it on auto-find. Overwritten at end is checked so any code you add will go before the MOV DWORD PTR DS:[EAX],ECX and after the FLD DWORD PTR DS:[ESI+30].

(Basically memhack creates the jump-gates to and from the
cave for you, it also rewrites any destroyed code and puts the ASM Code you add above it, very convenient for quick testing were new commands will destroy the old)

So we want to move a new float at ESI+30, I add the ASM command

MOV DWORD PTR DS:[ESI+30],

Open up tools, converter, put 2000 into float value, I see the conversion from floating point decimal to hex is 44 FA 00 00.
So I finish my ASM mo command

MOV DWORD PTR DS:[ESI+30],44FA0000

Hit Apply changes, presto, fog ends 2,000 meters away (basically no fog unless you set your viewdistance past 2,000 meters).
I run around and test it out, no problems.

On to viewdistance...

----View-Distance----------

Console Commands on,
I type gamelogic.maximumlevelviewdistance 1936
In memhack I go to Search > Data Type Search >
Integer 4 bytes > value 1936 > search type exact value > OK

22 thousands + results, open back up console, type gamelogic.maximumlevelveiwdistance 149.
MemHack > SubSearch > Exact Type > Value is 149 now,
Press OK. 1 result, I change the viewdistance in console again to confirm the value changes, Indeed it does.

Go to Oly, expression to follow in hex > Put in my DMA addy. Breakpoint on access, my first break is in the bf2.exe on command FILD DWORD PTR DS:[EAX]
I'm sure we can mov the new value here as well but I know there is another one in the RendDx9 module and we'll go after that one for the folks that find it hard to modify the bf2.exe .text section on PB.

I press F9 again, it keeps breaking on the same code, after about 30+ plus breaks the program flow switches to RendDx9 and breaks on the offset
rend + 000E985C
Command
FILD DWORD PTR DS:[EAX] again.

I use Memhacks injection manager to create the quick jumpgate again
We will make a modification that will move a new value into there

MOV DWORD PTR DS:[EAX],

Were moving the conversion from integer to hex | ie 2,000 meters = 7D0 hex there) So

MOV DWORD PTR DS:[EAX],7D0

Hit inject, test it out, all working well, viewdistance is 2,000 meters away with the fog end value.

Rainmanager huh?
Sounds good lets do it!

---No Rain---------
rainmanager.enabled 1

Memhack> Search > Data Type Search > Type of search>
Byte> value to find 1

7+ million
I type rainmanager.enabled 0

Sub Search > Exact Value 0
I get 593 results

-Switch
Exact Value 1
I get 23

-Switch
Exact value 0
I get 14

Rain is Enabled again
Exact Value 1
I Get 2 results

Follow DMA1 in hex dump, break-point the single byte on access, nothing, (It breaks on write only if the console command function calls it)

On to DMA2
NOTE* My Search Ended With Rain Enabled
DMA2 ADDY VALUE = 1

Set a break on access on the 1 byte:

It breaks at rend+0016B339
command is
CMP BYTE PTR DS:[EDI+64],0

Now, look at the conditional jump underneath it, the condition of the jump is dependant on the 1 or 0 held in your DMA addy, so we can modify the condition of the Jump directly, first, take a look, put a breakpoint toggle on the conditional jump at
rend+16B33D

Notice the Jump is never taken, and and we have rain enabled "1", so I change it to a Permanent JMP.
Check the changes in game, Rain gone and all working well by forcing the JMP at offset rend+0016B33D.

Every map is going to be a clear day with No Fog, Increased Viewdistance, and a no Rain Hack

No Fog: Rend+495E6
View Distance: Rend+E985C
No Rain: Rend+16B33D

[fatboy88]

Originally Posted by dubbls

Now that is a handy dll DC, nice, I didn't know about listing them in console.

I did some memory hacking for View-Distance and No-Fog. I'll briefly show my steps and how I utilized the console commands to make it a quick and painless experience.

----No Fog-----
I Start the game, spawn in map, activate unauthorised command hack, go to console and type renderer.fogstartendandbase 0/67.149/0

Fog END VALUE is our target so I set it to a unique float that there probably aren't to many present in memory.

Start up L spiro's memhack, file, open process, bf2142,Search, Data type search, Float, value to find 67.149, seatch type exact value, OK.

3 DMA addies come back(looks like the value 67.149 was a good number) opened OLY, attached Bf2142, Put DMA1 addy for expression to follow in the hex dump, breakpoint the float on access, nothing is breaking, not sure exactly its purpose but its not active now and we aren't interested in it(I think it breaks on write when the console command function calls it).

Followed dma addy 2 in hex dump, breakpoint on access, It breaks on RendDx9+495E6
FLD DWORD PTR DS:[ESI+30]. Check for other code accessing it, nothing, FLD DWORD PTR DS:[ESI+30]
is the only break.

In Memhack I go to Tools, disassembly, I go to the line under
FLD DWORD PTR DS:[ESI+30]
witch is
MOV DWORD PTR DS:[EAX],ECX
Click on it, choose inject code, make sure everything is checked except allocate code cave cause you have it on auto-find. Overwritten at end is checked so any code you add will go before the MOV DWORD PTR DS:[EAX],ECX and after the FLD DWORD PTR DS:[ESI+30].

(Basically memhacks inject feature creates the jump-gates to and from the
cave for you, it also rewrites any destroyed code and puts the ASM Code you add above it, very convenient for testing new commands that will destroy the old ones)

So we want to move a new float at ESI+30, I add the ASM command

MOV DWORD PTR DS:[ESI+30],

Open up tools, converter, put 2000 into float value, I see the conversion from floating point decimal to hex is 44 FA 00 00.
So I finish my ASM mo command

MOV DWORD PTR DS:[ESI+30],44FA0000

Hit Apply changes, presto, fog ends 2,000 meters away (basically no fog unless you set your viewdistance past 2,000 meters).
I run around and test it out, no problems.

On to viewdistance...

----View-Distance----------

Console Commands on,
I type gamelogic.maximumlevelviewdistance 1936
In memhack I go to Search > Data Type Search >
Integer 4 bytes > value 1936 > search type exact value > OK

22 thousands + results, open back up console, type gamelogic.maximumlevelveiwdistance 149.
MemHack > SubSearch > Exact Type > Value is 149 now,
Press OK. 1 result, I change the viewdistance in console again to confirm the value changes, Indeed it does.

Go to Oly, expression to follow in hex > Put in my DMA addy. Breakpoint on access, my first break is in the bf2.exe on command FILD DWORD PTR DS:[EAX]
I'm sure we can mov the new value here as well but I know there is another one in the RendDx9 module and we'll go after that one for the folks that find it hard to modify the bf2.exe .text section on PB.

I press F9 again, it keeps breaking on the same code, after about 30+ plus breaks the program flow switches to RendDx9 and breaks on the offset
rend + 000E985C
Command
FILD DWORD PTR DS:[EAX] again.

I use Memhacks injection manager to create the quick jumpgate again
We will make a modification that will move a new value into there

MOV DWORD PTR DS:[EAX],

Were moving the conversion from integer to hex | ie 2,000 meters = 7D0 hex there) So

MOV DWORD PTR DS:[EAX],7D0

Hit inject, test it out, all working well, viewdistance is 2,000 meters away with the fog end value.

Rainmanager huh?
Sounds good lets do it!

---No Rain---------
rainmanager.enabled 1

Memhack> Search > Data Type Search > Type of search>
Byte> value to find 1

7+ million
I type rainmanager.enabled 0

Sub Search > Exact Value 0
I get 593 results

-Switch
Exact Value 1
I get 23

-Switch
Exact value 0
I get 14

Rain is Enabled again
Exact Value 1
I Get 2 results

Follow DMA1 in hex dump, break-point the single byte on access, nothing, (It breaks on write only if the console command function calls it)

On to DMA2
NOTE* My Search Ended With Rain Enabled
DMA2 ADDY VALUE = 1

Set a break on access on the 1 byte:

It breaks at rend+0016B339
command is
CMP BYTE PTR DS:[EDI+64],0

Now, look at the conditional jump underneath it, the condition of the jump is dependant on the 1 or 0 held in your DMA addy, so we can modify the condition of the Jump directly, first, take a look, put a breakpoint toggle on the conditional jump at
rend+16B33D

Notice the Jump is never taken, and and we have rain enabled "1", so I change it to a Permanent JMP.
Check the changes in game, Rain gone and all working well by forcing the JMP at offset rend+0016B33D.

Every map is going to be a clear day with No Fog, Increased Viewdistance, and a no Rain Hack

No Fog: Rend+495E6
View Distance: Rend+E985C
No Rain: Rend+16B33D

very nice post dubbls ;-) ,
post like these that help community grow

[caliber1942]

nice explanation dubbls

good work=


best,
Cal