TNC Console Unlock — the Retail Restriction Level, Proven in Game

The retail console of Wolfenstein II only shows 34 of 234 commands and 304 of 3,256 Cvars. That block is not a build-type flag and not an encryption — it is one process-wide integer, and the mod loader already has a proven, no-patch way through it. This page is the practical write-up: what the mechanism is (static, from disassembly), what the loader actually does with it (runtime-proven, tester's own test on 2026-10-01), and what still doesn't exist no matter which door you try.

Grading follows the project convention (see Home): Measured/RUNTIME beats Inferred/CVAR beats Speculated/STRING. Everything under "What was measured in game" below is the first grade; everything under "The mechanism" is a disassembly reading of the running process image, not a game launch.

TL;DR

1. The mechanism: one integer gates both commands and Cvars

Static finding, from a read-only snapshot of the running NewColossus_x64vk.exe (full writeup: Research-Report-R4-Console-Commands).

The engine keeps two lists per system — all 234 commands / all 3,256 Cvars, and a second, "exposed" list of only 34 commands / 304 Cvars — plus a single restriction-level integer shared, bit for bit, between idCmdSystemLocal and idCVarSystemLocal:

• level 0 → the dispatcher searches the full list. Every registered command and every Cvar is reachable.
• level 1 (the only other value ever written anywhere in the image) → the dispatcher searches only the 34/304 exposed entries. This is what the live console, the game's own startup +args, and a .cfg loaded by the normal exec command all run at.

Six call sites set the level to 1 and restore the previous value before returning — the interactive console (both key handlers), +-prefixed startup arguments, the startup-config exec, and the exec command itself. Because every one of them restores what it found, and the constructor default is 0, the level sits at 0 — fully unrestricted — for essentially the whole session, except for the few instructions it takes to process one keystroke, one +arg, or one exec'd line. (Update 2026-10-04: a later full scan found one more bracket, the key-bind dispatcher; bound keys run restricted, see section 7.)

One already-exposed command breaks this pattern on purpose: resourceExec <name> -s sets the level to 0 for the entire duration of the file it loads, then restores it. Since resourceExec is itself one of the 34 commands anyone can type from the plain console, this is a complete, no-patch route to the other 200 commands and ~3,000 Cvars — you just have to get your lines into a file the engine will resourceExec.

A second, better-scaling route exists once the console is open: the compiled-in ImGui DevGUI debug menu calls the dispatcher directly, with no save/restore bracket of its own, so it runs at whatever the level happens to be — 0, essentially always. Setting the non-exposed Cvar devgui 4 once (itself needing one resourceExec call) makes at least 41 confirmed-live, non-exposed debug buttons (toggle g_infiniteAmmo, ai_drawBounds, killAI, disconnect, …) clickable for the rest of the session with no further resourceExec per click.

2. What was measured in game — the tester's test, 2026-10-01

A loader mod (mods/sandbox_tools) replaces two unused SnapMap configs already present in retail, cfile:snapdemo.cfg and cfile:snapedit.cfg, with the loader's own cfile payloads — reusing the same dlc_0-precedence patch route already proven for custom maps, decl edits, and weapon skins, now combined with the solved cfile encryption (AES-128-CBC + HMAC-SHA256, key derived in Research-Report-Cfilekey2; the loader's own encoder lives in wolfsdk/tnccrypt.py). cfile was listed as "definitively not possible" in TNC Modding Surface §6 — that verdict is now superseded for exactly this use: the loader builds valid, game-accepted cfile payloads under names the archive already indexes.

Typed from the live, restricted console in the running game:

resourceExec snapdemo.cfg -s

Result, confirmed across two sessions:

• A main-menu run printed both marker lines from the file and no Unknown command for devgui 4, God, Notarget, g_infiniteAmmo 1, or snapEdit_devMode 1 — all five are non-exposed.
• In an actual save game, the same call printed godmode ON for player 0 and notarget ON for player 0 — non-exposed commands genuinely executing, not just failing to error. g_infiniteAmmo 1 was confirmed by play (ammo no longer depleted).
• devgui 4 was accepted (no error), but no ImGui window became visible on screen in that run — open, see §6.
• Notarget printed ON, but enemies that were already engaged in combat kept attacking — the command ran, but did not retroactively drop existing aggro. Treat Notarget as "stops new detection", not "stops an ongoing fight", until re-tested.

mods/sandbox_tools packages this as two hotkeys, bound once and persisted by the engine's own bind command:

bind F6 "resourceExec snapdemo.cfg -s"   # toggles God, Notarget, infinite ammo
bind F7 "resourceExec snapedit.cfg -s"   # killMonsters — not yet confirmed in game

God mode and infinite ammo are confirmed; killMonsters is shipped but not yet verified at runtime.

3. What was rejected: +args on the startup line

The same test session ran the loader's usual startup tweaks as +-prefixed command-line arguments — +com_skipIntroVideo, +pm_autoSprint, +g_EnableGore, +g_goreBloodyMess, +com_allowConsole — and every one of them came back Unknown command.

This matches §1 exactly: the +args parser is one of the six bracketed sites that forces the level to 1 for the duration of parsing the command line, then restores it. None of those five names are among the 34 exposed commands/Cvars, so at level 1 they are invisible — not locked by content, just not in the list the dispatcher is searching at that moment.

Practical rule for the loader: never ship a cheat or debug toggle as a startup +arg. Ship it as a line inside a loader-patched cfile and fire it with resourceExec <file> -s (console, a bound key, or — untested — the engine's own default.cfg, which it already resourceExecs at startup per Static Research: Retail Command Queue (TNC)).

4. The Kiscule Command-node route — proven by code path, not yet in game

A map's own script can reach the exact same unrestricted window, with no resourceExec call and no DevGUI, purely from gameplay events. Static finding, full disassembly in Research-Report-R5-Kiscule-Command (builds on Research-Report-R4-Console-Commands and the node catalogue in Kiscule Node Reference):

idKisculeNodeCommand's Exec handler does not call the dispatcher directly. It reads the command parameter, appends a newline, and calls idCmdSystemLocal::AppendCommandText — which queues the text into whichever of the engine's two command buffers the restriction level currently selects. Since the level rests at 0 for almost the entire session (§1), a Command node firing during ordinary play — a trigger volume, a timer, a dialogue callback — lands in the same unrestricted buffer resourceExec feeds.

That buffer is drained twice every engine frame, inside the main loop (idCommonLocal::Frame()), against the full 234-command/3,256-Cvar catalog — the same drain mechanism the engine uses once at startup for default.cfg/package.cfg, just reused generically.

Caveat, reported honestly: none of the 7 retail idKisculeNodeCommand instances actually needs this path — 6 use already-exposed names (r_dof, print), and the 7th (triggernextmap) is not a registered command at all and fails identically at any level. The yes/no verdict rests entirely on the disassembled code path, not on an observed retail example, and no custom map has exercised it in game yet. The report's own smallest test: a Trigger_Volume → Command node with command = "God 1" in a custom map, verifying no damage is taken on the next hit without ever opening the console.

5. What doesn't exist at all

Confirmed absent from the 234-entry command table under any name or capitalization, independently re-checked a second way (the DevGUI's own compiled-in buttons reference the identical strings and are themselves dead):

• give, give all — DevGUI's "Give Ammo"/"Give Grenades" buttons build and dispatch the literal string give ammo, which also fails.
• spawn — DevGUI's own spawn %s button references the same non-existent name.
• noclip, god (lowercase; God, capitalized, is the real, flagged 0x200000 command).
• SpawnAI — DevGUI's debug menu references SpawnAI ai/testing/test_elite/test_commander, but the name is not in the 234-entry command table. An earlier pass of the Round-4 static command-table scan misread the table and listed SpawnAI as registered; a static re-check of the same table found that wrong and corrected it (see Research-Report-R4-Console-Commands and Known Contradictions W21). No in-game test of SpawnAI has been logged — the correction is a data fix to the command-table reading, not a runtime result.

These are not console-restricted — they were never compiled into this retail build as callable commands, under either the restricted or unrestricted list. No Cvar, cfile, or decl can reach code that was never registered; only a binary patch could add them, which is out of scope for this project.

6. Open questions

• devgui 4 accepted no error, but no window appeared in the save-game run (§2) — unclear whether DevGUI needs a key bind to toggle visibility that the main-menu session happened to have set and the save-game session did not, or whether something else gates the draw call. Not resolved.
• killMonsters is shipped in mods/sandbox_tools but not yet confirmed to do anything in game.
• Whether default.cfg — which the engine already resourceExecs at startup — can carry these lines so the tweaks apply automatically without the player typing resourceExec at all. Plausible from the command-queue mechanism, not yet runtime-tested. (Update: the loader now writes its non-exposed tweaks there, section 9; still not confirmed in game.)
• Whether a Kiscule Command node's non-exposed call (§4) actually executes once loaded in a real custom map — code-path proof only.
• Case sensitivity of command lookup — unresolved per the static report; relevant to any future hand-written .cfg line.

7. TNC Key Binds Run at the Restricted Level

Inferred (static code reading, report r8). The key-bind dispatcher (function 0xaa8780, write at 0xaa87fb) sets the restriction level to 1, appends the bound command plus a newline to the restricted command buffer, and restores the level. It only buffers; the line later runs at level 1.

So a bound key reaches only the 34 exposed commands: a bind to toggle g_permaGodMode 0 1 or noclip cannot work in The New Colossus (toggle is not exposed, noclip does not exist). resourceExec is exposed, so a key bound to resourceExec <cfile> -s works: the file then runs at level 0. Sandbox Tools (F6, F7) and Photo Mode (F8) use exactly this.

The loader therefore gives The New Colossus no default F-key binds. The New Order keeps its F1–F4 binds.

Keywords: bind, key bind, hotkey, F1 F2 F3 F4, toggle does not work, bind restricted, Tastenbelegung, Taste geht nicht

8. Photo Mode Mod: One Key Freezes the Game for Screenshots

mods/tnc_photo_mode (built by tools/build_photo_mode.py) replaces default_snap.cfg, an unused SnapMap config, with an encrypted cfile. Bind it once in the console (binds are saved):

bind F8 "resourceExec default_snap.cfg -s"

The file runs at level 0 and toggles four non-exposed cvars:

toggle g_freezeTime 0 1
toggle g_showHud 1 0
toggle g_showGuis 1 0
toggle g_showCrosshair 1 0

Press F8 again to return. According to the builder's research, g_freezeTime 1 stops all game time and switches to the free camera. A bind to these lines directly would fail: binds run at the restricted level (section 7).

Not yet confirmed in game.

Keywords: photo mode, screenshot, freeze time, free camera, hide HUD, F8, Fotomodus, Screenshot, Zeit anhalten

9. How the WolfSDK Loader Delivers TNC Cvar Tweaks: +args and default.cfg

The loader's Cheats & QoL page for The New Colossus lists the engine's 3,116 settable cvars. Since +args run at the restricted level (section 3), the loader splits a tweak set:

• cvars the retail console exposes go out as +args on the start line;
• every other cvar becomes a line in cfile:default.cfg, which the engine itself runs with resourceExec default.cfg -s at startup, at level 0.

Revert removes those lines again. Mods can carry cvars the same way ("cvars" in mod.json, used by Hidden Menu Options).

Not yet confirmed in game: that the default.cfg lines take effect. A simple test: switch on a gore tweak, start the game.

Keywords: tweaks, cheats, QoL, default.cfg, launch arguments, +args, cvar delivery, Startparameter, Einstellungen

10. TNC Presets: Ultra+, Clean Image and Photo Mode

One-click cvar groups on the loader's Cheats & QoL page. They only fill in tweak values; section 9 decides how each one is delivered. tools/verify_presets.py checks every name, type and declared range against the engine registry.

• Ultra+ (17 cvars): higher anisotropy (16), decal, shadow and foliage fade distances, virtual texture streaming (vt_maxPPF 64), FFT water.
• Clean Image (11): off for depth of field, motion blur, chromatic aberration, film grain and vignette; r_sharpening 2.5, anisotropy 16, rs_enable 0.
• Photo Mode (3): screenshot quality only: com_captureSamples 4, com_captureTGA 1, image_screenshotQuality 100. Freezing time must toggle mid-game, which needs the Photo Mode mod (section 8).

Not yet confirmed in game.

Keywords: presets, Ultra+, Clean Image, graphics settings, sharpening, motion blur off, screenshot quality, Grafik, Voreinstellungen

11. Developer Menu Lines Also Run at Level 0

A second route to the full command list, proven in game: the developer menu of The New Colossus runs an entry's devMenuCommandStrings lines at level 0. Confirmed in game (2026-10-02): the non-exposed devmap runs from the menu and loads the map. The mod Dev Menu Map Loading uses this to make the menu's map entries work again; its entry "WolfSDK: console test" sets the non-exposed g_debugLayerChanges as a quick check.

Details, addresses and status: TNC Dev Menu.

Keywords: dev menu, developer menu, devmap, unrestricted, devMenuCommandStrings, Dev-Menü, Entwicklermenü

Related pages

TNC Dev Menu · TNC Modding Surface · Kiscule Node Reference · Known Contradictions · Developer Mode (pre-runtime, string-level analysis this page supersedes for the restriction mechanism) · Research-Report-R4-Console-Commands · Research-Report-R5-Kiscule-Command · Static Research: Retail Command Queue (TNC)