Intro
This is a Cheat Engine table made for three main purposes.
  1. Data-mining, displaying (or making the game display) additional information that's helpful when making decisions or filling out charts. Character data, item data, etc.

  2. Mods/patches to fix client-side bugs, remove slowdown, or introduce alternative (more desired) behavior/values for the user interface.

  3. Previewing changes before committing to them.
    • Seeing what an outfit would looks like on you (not just the icon or what it looks like on a model).

    • Checking out how specific dye colors would apply to the outfit you're wearing (not just the inventory pixel art preview).

    • Previewing various face parts before trying to roll it in a gacha or buy the coupon from players.

Technical Breakdown

Here's an overview of how many of the patches in this table work. If you want more technical details such as example signatures and code snippets, then check out the comments on each script in the table.

Rendering
  • FOV Mod
    • Why: Mabinogi has no FoV setting, but the FoV in the game is different from most MMOs. It's designed more for a theater-style side view, opposed to the around-the-character view most players expect from an MMO.

    • Patch: At one point, the game engine takes a hardcoded value of 180 (double) and divides by it. By allocating some memory for a custom value and then patching the function to load that address instead, the client ends up loading our value. The game's rendering is a bit weird and FoV values used in Mabinogi don't map to the same range as in other games.

    • Code Snippet: fdiv qword ptr [Client.exe+202D9F0]

  • Ignore Translucency Changes
    • Why: Mabinogi likes to make objects and other players transluscent or invisible to try to avoid blocking the view of the player. However the actual detection is wonky and the radius at which it will do this is massive for large things (such as giant-race players). This can make it difficult to get good views of some things.

    • Patch: I searched in memory for a flag (0 or 1) on whether the effect was happening or not on a specific tree branch in my homestead. I then found the code that was reading that flag and patched it to do nothing instead of making a decision to fade the object out.

    • Code Snippet: cmp DWORD PTR [eax+0x4],esi

  • Ultra Super Saiyan Draw Distance
    • Why: The game's render distance can be modified, but not enough for some desires. For example environmental screenshots and peeking into out-of-bounds areas doesn't work well with the game's default render distance.

    • Patch: The game has a slider in the settings that adjusts the render distance. This means that there's an easy way (fiddling with the slider) to change a relevant value in memory on demand, making searching for it simple. By finding this value and checking what writes to it, we can see the code that stores the render distance value so that we can overwrite it with our own.

    • Code Snippet: fst dword ptr [esi+40]

  • Resize TTF Text
    • Why: The game used a font size of 11 and a fixed UI size. It may have worked fine in the 4:3 Windows XP days, but some players want a UI that's easier to read. While this only modifies the font size and not the UI (as there's no UI scaling in-game), it helps some players.

    • Patch: Counting the pixels and comparing the font file to find the size, I searched around for various bits of code that would be moving that font size as a hardcoded value into something. Eventually I found the code that loaded the font size, so I could overwrite it.

    • Code Snippet: mov [esi+000000A4],0000000B

  • Hide Second Titles
    • Why: Mabinogi, like many MMOs, lets players earn and wear titles above thier heads. Mabinogi also added multiple "slots" for titles, with the "second title" being a small icon to the right of the main title. The problem is that this icon can be visually disruptive, and it actually has its own dead click box for some reason. Players want to gain the stat benefit of the title, while hiding theirs (and those of other players) to prevent dead clicks.

    • Patch: Titles each have their own ID in the game's databases (which are XML files and easy to look into). By searching for the IDs of worn titles as I changed them, I was able to find the memory address hodling my current second title. Looking at all the code snippets that read this value, I found the one that read it for display and just set it to 0 so it would render as if there was no second title.

    • Code Snippet: movzx eax,word ptr [ecx+20]

Patches / Fixes
  • Fake Title Reads
    • Why: Sometimes new titles will get added in an update, but the actual stats/icon/effect isn't known until somebody earns/buys it. By faking the worn title client-side, we can see the information as it would be presented to the player.

    • Patch: There's a small cooldown on changing titles, but it's short enough that it's simple to change titles and search for a changing ID in memory. Find what's reading that and patch that code to read our own set title ID/value we want to check out.

    • Code Snippet: mov ax,[ecx+10]

  • Client-Side Devcat Effects
    • Why: "Devcat" is Nexon's development team for Mabinogi (and maybe other titles). There's a specific title for the devs and they set the game up to check for this title in order to enable various debugging options. By patching the main check for this title, we can turn on a bunch of debug data readouts at once. This is very helpful for data mining.

    • Patch: As mentioned above, each title in the game has its own numerical ID. Thankfully the title ID isn't just 0 or 1 or something hard to isolate. It's 60001, and by searching for comparisons to that, we can find numerous checks for it in the game code and then modify the jump/decision to always act as if it's true.

    • Code Snippet: je -> jmp

  • CP View
    • Why: Mabinogi's method of comparing players and enemies is CP, or Combat Power. This is used to determine when a player is fighting a stronger or weaker enemy, and there's various comparison levels. These are used for various training methods that the game requires, so it's generally very helpful for a player to know their exact CP value instead of just the vauge range that the game displays normally.

    • Patch: While in the past a CP view patch had to be made manually by converting the CP value into a string and appending it to the player's name... nowadays the devs themselves made CP viewing a debug option, so we can just find the dev code and patch it on. It's related to the above script, as it's one of the checks for the Devcat title.

    • Code Snippet: jne 0x125 -> nop

  • Item ID View
    • Why: Mabinogi, like some games, makes duplicate copies of existing items with various small changes (or none at all and the devs are just being annoying). This causes issues with skills or quests not recognizing some items that appear to be the same. There's also cases where data miners will want to look up an item in the database, and need to know the exact class id.

    • Patch: As above, this is something the dev title adds. Just have to figure out which dev title check turn this on and patch it to always act as if the title was on for this check.

    • Code Snippet: jne 0xe -> je

  • Always Collect Mode (Trans Mastery)
    • Why: Transformation Mastery is a skill for killing monsters to collect their souls to be able to change into that monster. There was little to no use to it, but it was fun! There's a UI setting to make transformation-related information show up on monsters, and this was useful to make decisions. However it defaulted to off, and it never saved. It would reset itself back to off in many instances, which was frustrating.

    • Patch: By toggling the setting on and off in the UI repeatedly, I was able to find the value in memory. Then I could find what read that value and make it act as if the value was always on.

    • Code Snippet: je 0x2d8 -> jne

  • Log Off During Conversation
    • Why: Mabinogi's not the most well-made game, and there are times where a player can end up stuck in a looping conversation with an NPC. However the client does not allow players to log off during conversation with NPCs. The player can try, but they are given a unique UI popup that tells them no. This is ironic, as the only time players can't log out is the only situation in which they can get softlocked...

    • Patch: By talking to and then shunning NPCs reepeatedly, I was able to find a flag in memory regarding whether the player was talking to an NPC or not. Instead of patching this flag to not be set (which could cause issues elsewhere in the game), I watched reads on this value to see the specific one for the log off prompt in order to patch just that one.

    • Code Snippet: je 0x21 -> jmp

  • Ignore Maintain Frame
    • Why: Mabinogi has a setting that watches the current framerate, and tries to make adjustments to rendering to keep it steady. However the setting cannot be disabled and only can only be set to track up to 60 FPS. This means that it can trigger in way more situations than the player wants. As well, Mabinogi doesn't have an actual LoD system, and instead replaces players and items by loading generic models in their place and re-building the character. This actually causes an additional lag spike, which is contrary to the idea of speeding things up. So in many cases, disabling this setting would actually result in smoother gameplay.

    • Patch: The FPS threshold for the "simplified rendering" kicking in can be modified by the player in the settings. As such it's simple to modify this a few times to isolate the address in memory that holds the FPS. Using the debugger we can find what checks that, and have it check against an insane value so it won't actually trigger.

    • Code Snippet: mov [esi+50],ecx

  • Enable Minimap Zoom
    • Why: Mabinogi originally started with relatively small play maps. Small enough to need no zoom levels on the minimap. Like many projects, it grew and grew until the play maps were so large that it needed to add zoom options to the minimap. However, in typical Nexon fashion, only the new areas that needed it got this functionality and older maps (and their associated minimaps) can't do it. This became a problem when the devs redid the old minimap images in a new visual style. The new style was about 4x the resolution of the old one, so suddenly the minimaps were much larger but still couldn't zoom. This lead to them being effectively zoomed way in by default, which made them less useful.

    • Patch: The value for the maximum zoom level is right next to the value for the current zoom level. By zooming in and out repeatedly to find the current zoom, we go 4 bytes to the right to find the max zoom. Find whatever's reading that and have it read a different value instead. In this case I did a quick and dirty hack to have it read epb instead to make sure that a massive effective value would be fed to the function without requiring me to hook and allocate code to feed a custom one.

    • Code Snippet: mov DWORD PTR [esi+0x74],ecx

  • Don't Move To Squad Chat
    • Why: After many years, Mabinogi added a raid system. This system required the creation of a new type of party that could take more than 8 players. They added a new specific chat channel for this type of party, and when you join this type of party your chat automatically switches to that channel. Lots of players don't want their chat automatically changing.

    • Patch: By changing what my current chat tab was numerous times, I could isolate the address for the value in memory. I added a check to see if a forceful switch to that specific chat channel ID was happening (via checking the ID in the register), and then skip over the switch if so. The check was to make it so players could still switch manually.

    • Code Snippet: mov [esi+00000158],edi

  • Uncap Auto-Production
    • Why: While crafting is thought of as producing "finished" items with their own stats, in practice there's a lot of intermediary steps that involve churning through stacks of materials to make more stacks of materials. For the stackable crafting, the game has a queue system that will automatically craft up to a certain stack size, depending on the type of item being crafted. Unfortunately which queue sizes are available for what item type never remained consistent and varied in frustrating ways.

    • Patch: When preparing a craft, the game presents the queue size it detects from your inventory. By swapping items around between the inventroy and storage, I could get it to present different queue sizes. Finding this value in memory and then finding the code that reads it, it could be patched to always return the same queue size.

    • Code Snippet: mov [esi+000001FC],ax

  • Debug Master Code
    • Why: Many of the client's debug functions were found and could help when data mining.

    • Patch: This section turns on the client's main debug mode (for rendering and such), and then has a bunch of sub-patches to toggle various things on and off. As none of these were made by me and are part of the client, there's nothing interesting to write about.

    • Code Snippet: (lots of small patches)

Data Mining
These often involve explosing related structures. This means I find an address that I believe to be in a structure (for example the player's current stamina is problably in the player structure). Then I find the base address for that structure by taking the address I know and subtracting an offset from it. Said offset is usually found by logging what reads/writes to that address. Once I have the base address for that structure, I can make the script expose it by copying that to another memory location and referencing it in the table.
  • Find Camera Values
    • Why: The player has little control over the game's camera. By default we can only have it point at ourselves and the available angles are somewhat limited. Players may want to experiment with the camera values more for custom views.

    • Patch: Using the draw distance (explained in an earlier section), we can find the structure for camera stff. By fiddling with values in that structure (via watching memory addresses starting from that base address) we can find the target coordinates and other sorts of information to mess with.

    • Code Snippet: fstp dword ptr [esi+20]

  • Find Zoom Values
    • Why: Mabinogi was clearly made for 4:3 aspect ratio displays, as the zoom limits get more restrictive the wider your display is. Even at normal aspect ratios like 16:9 the camera can often feel stuck up against the player.

    • Patch: The min and max zoom values are actually set per-map in Mabinogi. The game has a slider for maximum zoom in the settings, and this slider adjusts proportionally to the max zoom of the map. This means that a maximum zoom value in memory can easily be found by adjusting the slider and then doing comparative scans (larger/smaller, etc). By finding code that reads the base address of that zoom structure, it can be exposed so the table's user can watch and modify/lock the values.

    • Code Snippet:

  • Find Weather Info
    • Why: Mabinogi has a weather system, with various regions being on different schedules. While most things are not affected by weather, some gathering skills and quests get bonuses from it or need it to be at least a certain intensity. Being able to see what the value is can help players know if they're getting a certain bonus or if they have to wait for a stronger storm.

    • Patch: The weather value is a floating point number, 0 when clear and higher for some sort of storm intensity. It took a while, but finding this value allowed me to find the structure and copy the base address out. I exposed it as a structure despite only knowing one related value, just in case more became known later.

    • Code Snippet: fstp dword ptr [eax+10]

  • Find Skill Information
    • Why: Mabinogi requires most skills to be trained, which usually involves using them in certain situations to fulfill requirements to get enough points to rank up. However as the game went on the devs started making newer skills take more and more uses by having them give fewer and fewer points each use. Eventually they had skills giving points are a granularity smaller than the UI would actually display, and then round them. This lead to players being given incorrect values and bar fills in the UI.

    • Patch: Like many things, skills each have their own database IDs that the game uses. By packet logging I was able to see what a skill info request looked like, and then try to find anything reading that in memory. By exposing the data in this structure, the table can show the true training points. A side effect is also being able to fake skill IDs/ranks client-side to make the UI pull up information on unreleased or unvailable skills/ranks.

    • Code Snippet: mov esi,eax

  • Find Combat Target
    • Why: Sometimes when trying to log specific data (packets, memory, etc) it's important to narrow the results down to a specific in-game target.

    • Patch: The goal is to find an address that's 0 when the player isn't targeting anything, and something lese (which will be an instance ID) when the player is targeting something. Once this is found, the structure can be exposed.

    • Code Snippet: mov [esi+10],ebx

  • Find L-Rod Stats
    • Why: Mabinogi has an interesting activity where you can use some tools to play warmer/colder in order to find buried artifacts. However the feedback is given via audio and visual effects, neither of which always work for one reason or another.

    • Patch: It's easy enough to find a digging spot when the audio and visuals are functioning. Moving closer to and further away from that spot will change things. By finding the floating point value related to the intensity of the feedback, it can be exposed for players to see even when the normal feedback is being buggy and/or the player has their game audio muted.

    • Code Snippet: fld dword ptr [esi+18]

  • Find Cooking Values
    • Why: Mabinogi has a cooking system that has players adding ingredients in different proportions. However due to various reasons, it's often unclear just ho much a player has added. The UI bar is not 1:1 to the ratios in pixels, the bar shakes depending on some player stats (stats that do NOT affect the resulting output!), the fill speed is subject to FPS lag, and there's even a float/int conversion in there to muddle it even more.

    • Patch: By doing many unknown searches (equal/not/greater/less/etc) I was able to find the value for the first ingredient. By exposing the base address of the structure, players can see how much they have added.

    • Code Snippet: mov [ebp+08],edi

  • Find Player Stats
    • Why: The game doesn't display every stat, and some of them are displayed truncated despite having decimal portions. Players often want to know their actual stats and not just the portions the game decided to show.

    • Patch: The player structure is kind of important and often modified, so this one would break on a regular basis. However it's simple to recreate as the player's current stamina is very easy to find and is constantly read, thus hooking that code gives easy access to the structure.

    • Code Snippet: fcom dword ptr [esi+000002F0]

  • Find Appearance
    • Why: Mabinogi often releases new character part styles, but almost always as event or gacha items only. This means that previewing them in the normal interface doesn't work as they don't show up there until owned. As well, Mabinogi has a history of only allowing certain features on certain races, despite them technically working on all. I wanted the ability to forcefully preview these things any time.

    • Patch: Like many things, face parts have thier own IDs. By previewing the changes I was allowed to in the UI, I could pinpoint a changing address in memory and then use the debugger to find what was reading that address. Exposing that structure gives easy access to read/write those IDs once the offsets are found.

    • Code Snippet: mov [esi+00000180],ebx

Item Data
  • Find Normal Item Stats
    • Why: Items in Mabinogi can have stat modifications, gain/lose durability, have various flags, and other such stats that players may want to see in more detail than the item hover description gives.

    • Patch: One stat tracked in the item structure is the x/y coordinates of where it is in the current inventory grid. This is something that's easy to change, so this can be found to find the base address of that item's structure.

    • Code Snippet: mov [ecx+34],edx

  • Find Item Quality
    • Why: Mabinogi has a crafting system, and items are given a crafting quality. However this quality value is not displayed to the player and is not in the normal item structure. Thus there's a separate patch here in order to display this value.

    • Patch: The game pushes the string "QUAL" around a bit, and then pushes the actual quality value around shortly after. By finding the right string we can trace until the quality value shows up in eax.

    • Code Snippet: mov esi,eax

Previews
  • 3D Item Color Override
    • Why: Dye items are single-use, some dyes are rarer and more valuable than others, and the game has very limited preview options. Players may want to see what certain dye colors will look like on certain items as they would be worn.

    • Patch: First, find the hex color codes of an item in memory. They are in order with nothing between them, 4 bytes each. MRGB format, with M being a meta/flag byte. When an item is worn, the game reads the hex color codes on that item instance's data and then passes those over for use in rendering. By finding the code that reads these color addresses we can patch it to feed our desired colors over instead.

    • Code Snippet: mov eax,[edx+00000084]

  • 3D Item Model Override
    • Why: Many players want to see what a new outfit or weapon will look like on them, not what it looks like in a screenshot on somebody else's character.

    • Patch: The game tracks what the class ID of your worn items is. By finding this value and then seeing what reads it, we can make the game target a different class ID and thus load the model associated with that one instead.

    • Code Snippet: mov [esi+0C],eax

  • 3D Hair Override
    • Why: Similar to the above two, players often want to see what a hair style would look like on them, not on another player. Many hair styles are event/gacha only and thus do not show up in the normal dressing room interface for preview.

    • Patch: Like most things, each hair has its own ID. We can find the ID of the currently-worn hair (which can be changed in the dressing room) in order to find the code that reads that address.

    • Code Snippet: mov [esi+43],edi

  • Height/Weight Override
    • Why: Mabinogi tracks a few different values for weight gain and loss that are adjusted if the player eats various foods and such. I wanted to be able to read (and mess with) these values easily.

    • Patch: The weight stats are in the player structure, so once identified we figure out the offset (a weight stat address minus the current player's base address) and then we can modify it in other code that references the structure.

    • Code Snippet: mov eax,[ecx+0000013C]



Preview Image



Download

Table: Client.ct
Autorun: Lua Script

- Instructions
  1. Put the lua script in the /autorun/ folder inside the Cheat Engine install directory.
  2. Run Cheat Engine.
  3. Click the glowing button in the upper-left, scroll down and select Client.exe or Mabinogi near the bottom.
  4. File - Load, choose the .CT table.
  5. Now that CE is attached and the scripts are loaded, check and uncheck things and fiddle around with it.
  6. When you're done, make sure to uncheck the scripts before closing CE, or they'll stay patched/modded!
Note
This table itself is not maintained (I have quit the game) and most patches in it will likely not work on the current version of the game. Many of these patches and much of this functionality was ported over to Kanan's mod, which may still function.