Jump to content

» «

Documenting GTA-SA memory adresses

1,352 replies to this topic
  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 05 August 2012 - 12:06 PM

0x6D2BF0 void __thiscall CAutomobile::AddWheelDirtAndWater(CVehicle *this, CColPoint *colPoint)
0x6A6DC0 void __thiscall CAutomobile::dmgDrawCarCollidingParticles(CVehicle *this, CVector *pos, int force, signed int carPart)

0x5E3A90 int __thiscall CPed::AddGooglesModel(CPed *ped, int modelID, int pGooglesType)

0x6D4AD0 void __thiscall CVehicle::CreateGunflashParticles(CVehicle *this, CWeapon *weapon, CVector *particlePos, CVector *gunshellPos, int particleID)
0x6DDF60 void __thiscall CVehicle::CreateWaterSplashesOnModel(CVehicle *this)
0x6D4290 CVector *__thiscall CVehicle::GetGunPos(CVehicle *this, CVector *pPos, float gunID)
0x6D3F30 signed int __thiscall CVehicle::GetNumOfGuns(CVehicle *this)

  • Ify24

    0x00000000 --> invisible

  • Members
  • Joined: 17 Aug 2011


Posted 08 August 2012 - 12:35 PM

Hy guys, I have a question.

How to check if player current weapon is M4?

{$CLEO .cs}
thread 'Memory'
wait 100 ms
0006: 0@ = 0xB6F5F0 //Player pointer (CPed)
000A: 0@ += 0x740 // Current Weapon ID
0A8C: write_memory 0@ size 4 value 1 virtual_protect 0
// What's next ?

  • Jack

    no comment

  • Feroci
  • Joined: 06 Dec 2011
  • Serbia


Posted 08 August 2012 - 01:47 PM

wait 0 ms
0A8D: 0@ = read_memory 0xB6F5F0 size 4 virtual_protect 0  //Player pointer (CPed)
000A: 0@ += 0x740 // Current Weapon ID (offset)
0A8D: 1@ = read_memory 0@ size 1 virtual_protect 0  // reads the offset value
0039:   1@ == 31  // 31 is m4
jf @0
----- do stuff if you have the M4 -----
jump @0

And why doing memory stuff when there's an opcode:
02D8:   actor $PLAYER_ACTOR current_weapon == 31

Also next time ask this in coding section.

  • Ify24

    0x00000000 --> invisible

  • Members
  • Joined: 17 Aug 2011


Posted 08 August 2012 - 01:56 PM


  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 14 August 2012 - 10:08 PM Edited by DK22Pac, 14 August 2012 - 10:33 PM.

CvehicleModelInfo +0x5C > CVehicleStruct +0xB4 > CUpgradeComponent[18]
struct CUpgradeComponent
   RwV3D m_vPosition;
   RtQuat m_qRotation;
   int m_iParentHirerarchyId;

CAutomobile hirerarchy components

  • paulicabos

    Player Hater

  • Members
  • Joined: 27 Jul 2012


Posted 26 August 2012 - 07:02 PM Edited by paulicabos, 27 August 2012 - 06:24 AM.

Hi, i am making a trainer for SAMP / GTA in c# biggrin.gif

Currently i've done some cheats from http://www.gtamoddin..._Addresses_(SA)

I need memory location for

* give gun
* teleport to xyz coords
* change gun ammo

Can you guys help me?

and one more thing


i saw

+1272 = [dword] Car Door Locked State:
1 = open
2 = locked

What memory + 1273 = car locked state? CVehicle?

  • juarez

    Memory Hacking

  • Members
  • Joined: 11 Jun 2011
  • Poland


Posted 27 August 2012 - 06:26 PM

gta sa v.1.0

Some unused functions:

0x5717F0 CPlayer__ResetSkin
int __thiscall CPlayer__ResetSkin(CPlayer *player, const char *skinPath)
 char *skinName; // edi@1
 CPlayer *_player; // esi@1
 int result; // eax@3

 _player = player;
 skinName = player->skinName;
 strncpy(player->skinName, skinPath, 0x20u);
 if ( _player->skinTexture )
   _player->skinTexture = 0;
 result = readPlayerSkin(skinName);
 _player->skinTexture = result;
 return result;

0x56E520 _getPlayerPosZ
double __cdecl getPlayerPosZ()
 CPed *ped; // eax@1
 XYZ *xyz; // ecx@1
 double posZ; // st7@2

 ped = players[currentPlayer].pPed;
 xyz = ped->__parent.__parent.__parent.m_pCoords;
 if ( xyz )
   posZ = xyz->field_0.matrix.pos.z;
   posZ = ped->__parent.__parent.__parent.placement.pos.z;
 return posZ;

  • LINK/2012


  • Feroci
  • Joined: 30 Jan 2011
  • Brazil
  • Contribution Award [Modding]


Posted 27 August 2012 - 07:31 PM Edited by Link2012, 28 August 2012 - 04:34 PM.

struct CBird // sizeof = 0x44
RwV3D pos;              // Bird position
RwV3D field_C;         // Velocity in the current frame
RwV3D Velocity;        // Velocity (constant if the bird is not doing curves)
float angle;               // Bird angle

unsigned int field_28; // Always 0

int WingSpeed;         //
float Size;                // Determins the bird size

float MaxBirdDistance;    // When the bird is in this distance from the camera, it will disappear.
                                           // Used also in rendering process to determine the alpha level of the bird.

char field_38;                // Always 1, if different than 1 or 2 the bird will not be rendered

// Polygons color
unsigned char PolyColor1;//r
unsigned char PolyColor2;//g
unsigned char PolyColor3;//b
unsigned char PolyColor4;//r
unsigned char PolyColor5;//g
unsigned char PolyColor6;//b

bool HasBirdHere;      // This flags indicates if in this index there's a bird created
bool MustDoCurves;  // If this flag is true the bird will do curves

// Unused - padding?
char field_41;
char field_42;
char field_43;

// CBirds is a static class, I prefer to see it in this way :)
// Static members
0xC6A8B0 = CBird CBirds::BirdPool[6];
0xC6AA48 = RwV3D CBirds::LastKilledBirdPos;
0xC6A8A0 = bool CBirds::HasKilledAnyBird;
0xC6A8A4 = int CBirds::nBirdsCreated;

// Static methods - the calling conv. is __cdecl
0x711EC0 = static void CBirds::Init();
0x712300 = static void CBirds::UnInit();
0x711EF0 = static void CBirds::Add(RwV3D pos, RwV3D destination, int numBirds, int birdType, bool checkObstacles);
0x712330 = static void CBirds::Process();
0x712810 = static void CBirds::Render();
0x712E40 = static void CBirds::CheckIfHitByFire(RwV3D* p1, RwV3D* p2);

Birdtypes can be 0, 1, 2 (If different than these values, birdtype will be 0)
Birdtype is only known in Add method and will be converted in it's characteristics (size, wing speed, poly colors, etc) in the method.

Bad, GTAF messed with my tabulation.

  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 30 August 2012 - 10:56 PM Edited by DK22Pac, 30 August 2012 - 11:47 PM.

juarez, cool, there are also some other functions related to player skin.
Link2012, nice! I even didn't know that it is possible to hit these birds smile.gif Maybe if you're working on mod related to birds, you could add some effect after bird was hit.
struct CVehicleStruct
   RwV3D m_vDummyPos[15];
   CUpgradeComponent m_sUpgrade[18];
   RpAtomic *m_pExtra[6];
   char m_cNumExtras;
   BYTE _pad[3];
   int  m_iMaskComponentsDetachable;

Now wanna to have completed CVehicleModelInfo lol.gif . Mta has much, but not all.
CVehicle::DoHeadlightShadow (HR pseudo + edited by me colgate.gif )
void __cdecl CVehicle::DoHeadlightShadow(CVehicle *vehicle, int id, RwTexture *texture, RwV3D *pos, float x1, float y1, float x2, float y2, char red, char green, char blue, float maxViewAngle)
   RwV3D *camPos;
   short camMode;
   char ignoreCamera;
   float distance_q, distance, intensity;
   if (!camera.placeable.m_pCoords)
       camPos = &camera.placeable.placement.pos;
       camPos = &camera.placeable.m_pCoords->pos;
   camMode = camera.cams[camera.activeCam].mode;
   distance_q = (pos->x - camPos->x) * (pos->x - camPos->x) + (pos->y - camPos->y) * (pos->y - camPos->y);
   ignoreCamera = camMode == 1 || camMode == 37 || g_IsCutsceneOn;
   if (distance_q < 729.0)
       if (!ignoreCamera)
           if (-maxViewAngle >= (pos->y - camPos->y) * camera.field_E0 + (pos->x - camPos->x) * camera.field_DC)
       if (!ignoreCamera)
   distance = sqrt(distance_q);
   if (distance >= 20.25 && !ignoreCamera)
       intensity = 1.0 - (distance - 18.0) * 0.11111111;
       red = red * intensity;
       green = green * intensity;
       blue = blue * intensity;
   if (sqrt(vehicle->velocity.x * vehicle->velocity.x + vehicle->velocity.y * vehicle->velocity.y + vehicle->velocity.z * vehicle->velocity.z) * g_fTimerMs > 0.4
       || vehicle == getPlayerVehicle(-1, 0))
       CShadows::StoreShadowToBeRendered(2, texture, pos, x1, y1, x2, y2, 128, red, green, blue, 6.0, 0, 1.0, 0, vehicle == getPlayerVehicle(-1, 0));
       CShadows::StoreStaticShadow((int)vehicle + id, 2, texture, pos, x1, y1, x2, y2, 128, red, green, blue, 6.0, 1.0, 0.0, 0, 0.4);

  • Gramps


  • Feroci
  • Joined: 23 May 2008
  • New-Zealand


Posted 30 August 2012 - 11:59 PM

I didn't know it was possible to hit the birds either .. this is great ^

Maybe a bird hunting mini-game? lol

  • Deji

    Coding like a Rockstar!

  • Feroci
  • Joined: 24 Dec 2007
  • None


Posted 31 August 2012 - 12:40 AM

Dibs on the bird hunting mini-game! tounge2.gif

And what would you know, the good ol' shooting birds "glitch" is intentional. I could guess the moon one is also.

  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 07 September 2012 - 10:00 PM Edited by DK22Pac, 07 September 2012 - 11:03 PM.

CRegisteredShadow +0x32 flags
001 DRAW_ON_WATER - used for searchlights
100 DRAW_ON_BUILDINGS - used for player's headlight
  • 0x6B1480 RwFrame *__thiscall CAutomobile::DamagePanel(CAutomobile *this, int panelId, bool createWindowGlass)
  • 0x73F480 char __cdecl TestShootingWindscreen(CAutomobile **car, CColPoint *colPoint, int weaponType, RwV3D *start, RwV3D *end)
Still can't understand how glass material applies to vehicle collision... Zanoza's and 3ds max's gta plugins can't do it (as I think).

  • LINK/2012


  • Feroci
  • Joined: 30 Jan 2011
  • Brazil
  • Contribution Award [Modding]


Posted 09 September 2012 - 07:58 PM

Just correcting a post from 2005 tounge.gif
[WORD] CPlane + 0x86C = Hydra Thrust Level, 0 is full horizontal thrust and 5000 is full vertical thrust.

  • LINK/2012


  • Feroci
  • Joined: 30 Jan 2011
  • Brazil
  • Contribution Award [Modding]


Posted 10 September 2012 - 11:15 PM Edited by Link2012, 17 September 2012 - 04:01 PM.

CTrain was very bad documented hm? Let me do something about it tounge.gif

Well, I couldn't document it completly since two methods refused to decompile (Well, I would take days reading the complex function ASM code biggrin.gif ), if anyone know how to fix the error I can finish my work cool.gif
FFFFFFFF: variables would overlap: st6@8/1 and fst6@8/12

But let's go to what I've found, some methods listed here was already in the IDB (Bad documented...), but majority was unknown.

The trains seem to have a different path system, let's see it:
struct CTrainNode // sizeof=0xA
// To convert to short x,y,z use (Float * 8.0)
// To convert from x,y,z to floats use (Half * 0.125)
short x;
short y;
short z;

// To convert a float to RailDistance use (Float * 3.0)
// To convert RailDistance to float use (RailDistance * 0.3333333432674408)
short RailDistance;

// These are NOT padding as I saw in MTA Source!
BYTE field_8;
BYTE field_9;

// Only CTrainNode::ClearField9() and CTrainNode::GetCoords(CTrainNode *this, RwV3D *out) are used!
// The rest are unused\inlined
0x6F5370 = void   __thiscall CTrainNode::ClearField9()
0x6F5380 = short  __thiscall CTrainNode::SetX(CTrainNode *this, float val)
0x6F53A0 = short  __thiscall CTrainNode::SetY(CTrainNode *this, float val)
0x6F53C0 = short  __thiscall CTrainNode::SetZ(CTrainNode *this, float val)
0x6F53E0 = double __thiscall CTrainNode::GetX(CTrainNode *this)
0x6F5400 = double __thiscall CTrainNode::GetY(CTrainNode *this)
0x6F5420 = double __thiscall CTrainNode::GetZ(CTrainNode *this)
0x6F5440 = RwV3D* __thiscall CTrainNode::GetCoords(CTrainNode *this, RwV3D *out)
0x6F5490 = short  __thiscall CTrainNode::SetRailDistance(CTrainNode *this, float val)
0x6F54B0 = double __thiscall CTrainNode::GetRailDistance(CTrainNode *this)
0x6F5F80 = char   __thiscall CTrainNode::Unknown(CTrainNode *this)

Hm, why they were using half-precision floating points in 2005? Acceptable in 2001, but 2005...

Ok, now let's see CTrain
struct CTrain // sizeof=0x6AC
CVehicle __parent;

WORD NodeIndex;     // If direction is not clockwise (Next node that the train should go to) else (Previous node that the train traveled on)
char _pad1[2];
float CruiseSpeed;    //
float CurrentRailDistance;  // Current position in the rail
float Lenght;     // Lenght of the carriage?

// Unknown
DWORD field_5B0;
DWORD field_5B4;

// Flags
BYTE Flags1;
BYTE Flags2;

// Unknown
WORD field_5BA;
DWORD field_5BC;

BYTE TrackId;     // The track that the train is travelling on

// Unknown
char _unk[10];

BYTE PassagerFlags;    // When there's a passager inside the train this is 0xF
CPed* pPassager;    // Pointer to the passager (Yes, the train can only have one :P)
CTrain* pPrevCarriage;   // Pointer to the previous carriage
CTrain* pNextCarriage;   // Pointer to the next carriage
CDoor doors[16];   //
RwFrame* myFrames[17];   // Array of RwFrame*

0x4 = Is Streak,
0x8 = Is Front Carriage,
0x10 = Is Last Carriage
0x20 = Script is the owner
0x40 = Clockwise Direction,
0x80 = ?Set to false in mission trains

0x1 = Is derailed

0xF when there's a passager inside.

More flags seem to be in the ProcessControl function that I couldn't decompile, again, help me turn.gif

Static variables
// Train tracks information - we have 4 tracks, only the first track (The main track) is used for random trains in the world.
0xC38014 = static DWORD CTrain::TrainTrackNodeCount[4]  // Number of nodes in the track
0xC38024 = static CTrainNode* CTrain::TrainTracks[4]  // Pointer to a array of CTrainNode with the nodes of the track
0xC37FEC = static float CTrain::TrainTrackDistance[4]  // Distance/Size of the track

// Support for 6 stations, I can only remember 5 stations...
0xC38034 = static float CTrain::StationDistance[6]  // Distance in the main track to the station
0x8D48F8  = static RwV3D CTrain::Stations[6] // Stations coordinates
0x8D44F8  = static int TrainTypeCarriages[16][16] // TrainTypeCarriage[TYPE][CARRIAGE], the CreateTrain method will scan the models of the specific type until it find a null model (0)

// ...
0xC38010 = static bool CTrain::TrainTrafficDisabled
0xC38068 = static bool CTrain::DoesPlayerIsNearStation

// Information about the last random train created
0xC37FFC = static DWORD CTrain::SelectedTrackIndex
0xC38000 = static DWORD CTrain::SelectedTrainType
0xC38004 = static BYTE CTrain::SelectedClockwiseDirection
0xC38008 = static DWORD CTrain::SelectedNodeIndex

Finally, the methods
// Methods
0x6F6030 = CTrain* __thiscall CTrain::constructor(CTrain *this, int model, char a3)
0x6F54D0 = void __thiscall CTrain::destructor(CTrain *this)
0x6F6300 = void __thiscall CTrain::scalar_destructor(CTrain *this, char a2)
0x6F5530 = RwFrame*__thiscall CTrain::SetModelIndex(CTrain *this, int modelIndex)
0x6F5570 = void __thiscall CTrain::PreRender(CTrain *this)
0x6F55C0 = void __thiscall CTrain::Render(CTrain *this)
0x6F5930 = double __thiscall CTrain::GetDoorAngleOpenRatio0(CTrain *this, int a2)
0x6F59C0 = int  __thiscall CTrain::GetDoorAngleOpenRatio(CTrain *this, int a2)
0x6F5BA0 = char __thiscall CTrain::GetDistanceToNextStation(CTrain *this, float *outDistance)
0x6F5CD0 = int  __thiscall CTrain::GetCarriageCount(CTrain *this)
0x6F5EE0 = char __thiscall CTrain::IsRoomForPedToLeaveCar(CTrain *this, CPed *a2)
0x6F5EF0 = char __thiscall CTrain::IsDirectionClockwise(CTrain *this)
0x6F6320 = char __thiscall CTrain::IsUnderground(CTrain *this)
0x6F6370 = void __thiscall CTrain::OpenDoor(CTrain *this, int a2, int a3, char a4, float a5, int a6)
0x6F6850 = void __thiscall CTrain::ProcessExitingPassager(CTrain *this)
0x6F6CC0 = int  __thiscall CTrain::RecalcOnRailDistance(CTrain *this) // Couldn't decompile this, was already on my IDB
0x6F86A0 = void __thiscall CTrain::ProcessControl(CTrain* this)  // Couldn't decompile this also, seems to have important informations, if anyone can help with that error, see the info about the error in the top of the post.
0x6F7190 = void __thiscall CTrain::Teleport(CTrain *this, float x, float y, float z, char a5)
0x6F8170 = void __thiscall CTrain::ProcessEnteringPassager(CTrain *this)

// Static Methods
0x6F7440 = void __cdecl CTrain::InitTrains()
0x6F55D0 = void __cdecl CTrain::ReadAndInterpretTrackFile(char* filename, CTrainNode** outData, int* out_nodeCount, float* out_RailDistance, int TrackID)
0x6F58D0 = void __cdecl CTrain::FreeTracks()
0x6F59E0 = RwV3D* __cdecl CTrain::GetRailDistanceCoordinates(float RailDistance, int TrackID, RwV3D *out) // Unused function
0x6F5DB0 = void __cdecl CTrain::DisableTrainTraffic(char a1)
0x6F5DC0 = void __cdecl CTrain::Destroy(CTrain *train)
0x6F5DF0 = void __cdecl CTrain::RemoveReferences(CTrain *a1)
0x6F5E20 = void __cdecl CTrain::SetCruiseSpeed(CTrain *train, float speed)
0x6F5E50 = void __cdecl CTrain::SetSpeed(CTrain *train, float speed)
0x6F5E70 = CTrain* __cdecl CTrain::GetLastCarriage(CTrain *train)
0x6F5E90 = CTrain* __cdecl CTrain::GetFirstCarriage(CTrain *train) // Unused function
0x6F5EB0 = CTrain* __cdecl CTrain::GetCarriage(CTrain *train, char position)
0x6F5F00 = void __cdecl CTrain::GetNextStationInfo(char IsClockwise, float currentTrainDistance, float *outStationDistance, int *outStationID)
0x6F6A20 = void __cdecl CTrain::DestroyScriptTrains()
0x6F6AA0 = void __cdecl CTrain::DestroyAllTrains()
0x6F6B60 = void __cdecl CTrain::RemoveReferenceToAllTrains()
0x6F6BD0 = int __cdecl CTrain::GetTrainNodeNearPoint(float x, float y, float z, int *pOutTrackId)
0x6F7090 = CTrain* __cdecl CTrain::GetTrainNearPoint(RwV3D pos, char MustBeMainTrain)
0x6F7140 = int __cdecl CTrain::PutAt(CTrain *train, float x, float y, float z)
0x6F7260 = char __cdecl CTrain::NextStationIsAllowed(CTrain *train)
0x6F72F0 = void __cdecl CTrain::PutAtNextStation(CTrain *train)
0x6F7550 = CTrain* __cdecl CTrain::CreateTrain(float x, float y, float z, char ClockwiseDirection, int type, CTrain **outFirstCarriage, CTrain **outLastCarriage, int NodeIndex, int TrackId, char IsMissionTrain)
0x6F7900 = void __cdecl CTrain::ProcessRandomTrains()

I hope my indentation isn't screwed devil.gif
EDIT: Yes, it is screwed =/
EDIT2: Sorry, I forgot to post 2 static variables since they were in another sequence of addresses, updated smile.gif

  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 12 September 2012 - 06:58 PM Edited by DK22Pac, 12 September 2012 - 07:04 PM.

if anyone know how to fix the error I can finish my work

I know only one way: decompile gta_sa.exe. There is some problem with .idb which was created in previous IDA versions.

  • LINK/2012


  • Feroci
  • Joined: 30 Jan 2011
  • Brazil
  • Contribution Award [Modding]


Posted 13 September 2012 - 03:40 AM


if anyone know how to fix the error I can finish my work

I know only one way: decompile gta_sa.exe. There is some problem with .idb which was created in previous IDA versions.

Updated, Added "CAutomobileDoor[6] doors" to the CTrain struct, U should update this russian structure with the passager fields too tounge.gif

About the error, I will have to continue with this then, because I have problems with my IDA 6, it doesn't save the database properly, so I have to use IDA 5 ;3

  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 13 September 2012 - 07:33 PM

Will update it later.
Beginning of CAutomobile...
struct CAutomobile : public CVehicle
   CDamageManager m_sDamageManager;
   CDoor          m_sDoor[6];
   RwFrame       *m_pFrame[25];
   CPanel         m_sPanel[3];
   CDoor          m_sSwingingChassis;
   CColPoint      m_sWheelColPoint[4];

  • LINK/2012


  • Feroci
  • Joined: 30 Jan 2011
  • Brazil
  • Contribution Award [Modding]


Posted 15 September 2012 - 10:55 PM

0xB9ACCC = CPtrNodeDouble* SpecialObjectsList
0x59F400 = void __thiscall CObject__AddToSpecialObjectList(CObject *this)
0x59F450 = void __thiscall CObject__RemoveFromSpecialObjectList(CObject *this)
0x5A29A0 = void __thiscall CObject__ProcessSpecialObject(CObject* this)

0x448AF0 = bool __cdecl CGarages__IsModelIndexADoor(int index)
0x44A4D0 = void __thiscall CGarages__ProcessGarageDoor(CObject *this)

CObject + 0x138 = pMeInSpecialObjectsList

That SpecialObjectsList have the currently created train crosses, garage doors, cranes and SAM's.

  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 20 September 2012 - 04:38 PM

CParticle +0x8 -> CFxSystem
struct CFxSystem
   CLink                m_sLink;
   int                  m_iKey;
   float                m_fLength;
   float                m_fLoopIntervalMin;
   float                m_fLoopLength;
   short                m_sCullDist;
   char                 m_cPlayMode;
   char                 m_cNumPrims;
   CFxPrimEmitterData **m_pPrimsPtrList;
   CBoundingSphere     *m_pBoundingSphere;

  • Midnightz

    Populus vult decipi.

  • Members
  • Joined: 05 Feb 2007
  • United-States


Posted 10 October 2012 - 03:07 PM

Earlier in this topic...

The actual array of carcol colors is at 0x00B4E480
There's space allocated for 128 colors (at 4 bytes per color, though alpha isn't used), although it would probably be possible to create a new array of colors, and modify the game to point to the new array. You'd have to update the carcols.dat file though to actually set the extra colors to a non-zero value, and actually have vehicles that use the new colors. You'd still be limited to 256 colors though, unless you changed the indices at B4E3F0x to use something with a larger storage capacity. This is all completely untested of course.

In this section:
//-------------External script 66 (CARMOD1)---------------

...it's easy to edit table size to allow room for more colors to show but how the game actually pulls the colors is odd to me.

user posted image
...as you can see, it skips certain carcols and is of course showing only 8x8=64 colors total.

I would like it to show 12x12=144 instead. Is there a safe way to use the address 0x00B4E480 from within the external CARMOD script to achieve this?

  • SparkleCalibreDF

    Player Hater

  • Members
  • Joined: 20 Aug 2012


Posted 21 October 2012 - 09:39 AM

SA has known design flaw: trains, rc vehicles and planes are non-collidble with vehicle of same type (if you don't understand: spawn 2 planes and push them on each other). Is there workaround for this?

  • juarez

    Memory Hacking

  • Members
  • Joined: 11 Jun 2011
  • Poland


Posted 28 October 2012 - 05:55 PM Edited by juarez, 01 November 2012 - 03:31 PM.

0x6D64F0 RpClump *__thiscall CVehicle__assignPaintjob(CVehicle *veh)
0x6D0B70 signed int __thiscall CVehicle__getPaintjob(CVehicle *veh)

0x6A2F00 RpMaterial *__thiscall CVehicle__AssignLicensePlateMaterialTextureToVehicle(CVehicle *this, int a2)
0x6D10E0 char __thiscall CVehicle__GenerateLicensePlateMateralAndAssignToVehicleStruct(CVehicle *this, int a2)
0x4C8970 int __thiscall CVehicleModel__HaveVehicleModelLicensePlateText(CModelCars *this)

and one unused...
0x6D1150 int __thiscall CVehicle__destroyLicensePlateTexture(CVehicle *veh)

  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 17 November 2012 - 11:32 AM Edited by DK22Pac, 17 November 2012 - 11:53 AM.

struct CFxPrimEmitterData
   CFxPrimEmitterDataVmt   *vmt;
   BYTE                     field_4;
   BYTE                     m_bSrcBlendId;
   BYTE                     m_bDstBlendId;
   BYTE                     m_bAlphaOn;
   CCompressedMatrix       *m_pMatrixCompressed;
   RwTexture               *m_pTexture[4];
   DWORD                    field_1C;
   CLListHead               m_sList;
   CFxPrimEmitterDataInfos  m_sInfos;
   WORD                     m_wLodStart;
   WORD                     m_wLodEnd;
   BYTE                     m_bHasInfoFlatData;
   BYTE                     m_bHasInfoHeatHazeData;
   BYTE                     field_3E;
   BYTE                     field_3F;

struct CFxPrimEmitterDataInfos
   WORD             m_dwNumInfos;
   CFxInfo         *m_pInfos;
   BYTE             m_bNumInfos;
   BYTE             field_9;
   BYTE             _pad[2];

struct CFxInfo
   CFxInfoDataBase m_sBase;
   CFxInfoData     m_sData;

struct CFxInfoDataBase
   CFxInfoDataBaseVmt *vmt;
   WORD                m_wInfoFlags;
   BYTE                m_bTimeModePrt;
   BYTE                _pad;

struct CFxInfoData
   CFxInfoDataVmt *vmt;
   BYTE            m_bLooped;
   BYTE            m_bNumKeys;
   BYTE            m_bNumInterpDatas;
   BYTE            field_7;
   WORD           *m_pTimeKeys;
   WORD           *m_pValKeysPtrList;

CParticle +0x78 CParticlePrimData ** m_pPrimsPtrList
struct CParticlePrimData
   CParticlePrimDataVmt *vmt;
   CFxPrimEmitterData   *m_pFxPrimData;
   CParticle            *m_pParticle;
   BYTE                  field_C;
   BYTE                  _pad[3];
   DWORD                 field_10;

  • JoeBullet

    Player Hater

  • Members
  • Joined: 04 Dec 2011


Posted 23 December 2012 - 03:22 PM Edited by JoeBullet, 23 December 2012 - 03:56 PM.

Some functions for license plates and roadsign texts...

006FD500     CLicensePlate__ReadFile
006FD5B0     char __cdecl CLicensePlate__GenerateText(_BYTE *buf, signed int len)
006FD720     CLicensePlate__Shutdown
006FD7C0     CLicensePlate__GetArrayDimFromChar
006FDD70     CLicensePlate__RenderToRaster
006FDE50     CLicensePlate__SetTexture
006FDEA0     RwTexture *__cdecl CLicensePlate__Create(char *name, char ucDesign)
006FDF50     RpMaterial *__cdecl CLicensePlateManager__SetTextureMaterialCB(RpMaterial *material, RpGeometry *a2)
006FDFC0     int __cdecl CLicensePlateManager__SetTextureAtomicCB(RpAtomic *atomic)
006FDFE0     char __cdecl CLicensePlateManager__SetTexture(RpClump *clump, RpMaterial *a2, char ucPlateDesign)
006FE020     CLicensePlate__CreateApplyTexture
006FE060     int __cdecl CLicensePlateManager__SetTextMaterialCB(RpMaterial *material, void *pData)
006FE0D0     int __cdecl CLicensePlateManager__SetTextAtomicCB(RpAtomic *atomic, void *pData)
006FE0F0     CLicensePlateManager__SetText
006FE120     CRoadSignText__Load
006FE180     CRoadSignText__Shutdown
006FE220     CRoadSignText__HasAlphaMaterialCB
006FE260     CRoadSignText__GetArrayDimFromChar
006FEB70     char __cdecl CRoadSignText__Render(int a1, int charCount, RwRaster *a3, int a4, RwRaster *raster)
006FECA0     RwTexture *__cdecl CRoadSignText__Create(const char *name_, int height)
006FEDA0     RpAtomic *__cdecl CRoadSignText__CreateGeometry(float a1, float a2, signed int a3, char *szText, int geometry, int a6, int morphTarget, int height, unsigned __int8 a9)
006FF2D0     CRoadSignText__SetupGeometry
006FF350     CRoadSignText__SetAtomicRendererCB

Incomplete CPhysical

0046A760     char __cdecl CPhysical__IsGlass(CPhysical *a1)
00404460     RwV3D *__thiscall CPhysical__GetMoveSpeed(CPhysical *this)
004241C0     int __thiscall CPhysical__SetPosition(int this, RwV3D *a2)
004633E0     CPhysical__IsStatic
0046A760     char __cdecl CPhysical__IsGlass(CPhysical *a1)
00542260     CPhysical__constructor
00542450     CPhysical__destructor
005424C0     CPhysical__Remove
00542560     CPhysical__Add
00542800     CPhysical__AddToMovingList
00542860     CPhysical__RemoveFromMovingList
00542CE0     int __thiscall CPhysical__GetSpeed(CPhysical *this, RwV3D *pOutVector, RwV3D a)
00542DD0     CPhysical__ApplyMoveSpeed
00542E20     CPhysical__ApplyTurnSpeed
00542FE0     CPhysical__ApplyGravity
005430A0     int __thiscall CPhysical__ApplyFrictionMoveForce(CPhysical *this, float fForceX, float fForceY, float fForceZ)
00543490     int __stdcall CPhysical__ProcessEntityCollision(CPhysical *a1)
00543540     char __thiscall CPhysical__IsCollidedWithEntity(CPhysical *this, int pEntity)
00544C40     CPhysical__ApplyAirFriction
005454C0     char __thiscall CPhysical__ApplyFriction2(CPhysical *this, float fFriction, CColPoint *a3)
00545980     char __thiscall CPhysical__ApplyFriction(CPhysical *this, CPhysical *a2, float fFriction, CColPoint *pColPoint)
00546FF0     CPhysical__ProcessAttachedEntity

  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 27 December 2012 - 05:58 PM

0x709CF0 RwV3D *__usercall ShadowRenderTriangle<eax>(RwV3D *pNormal<eax>, RwV3D *pTriangleVertsPos<ebx>, _ProjectionParam *param<edi>)
struct __ProjectionParam
   RwV3D    at;
   RwMatrix invMatrix;
   BYTE     shadowValue;
   BYTE     _pad0[3];
   DWORD    fade;
   DWORD     __unused__;
   RwMatrix entityMatrix;

Could someone look to 0x4165B0? Called it "IsFaceInsideSphere"...

  • JoeBullet

    Player Hater

  • Members
  • Joined: 04 Dec 2011


Posted 27 December 2012 - 08:19 PM

0x4165B0 CCollision::IsFaceInsideSphere
004A1410 CFx__RenderAddTri
004A13B0 CFx__SetupRender
004A1600 CFx__RenderEnd
004A1660 CFx__RotateVecIntoVec
004A1780 CFx__RotateVecAboutVec
004A1940 int __thiscall CFxEmitterBP__RenderTextures(CFxEmitterBP *this, int a2, int a3, int a4)
004A21D0 char __thiscall CFxEmitterBP__RenderParticles(CFxEmitterBP *this, float fBlur, CParticleStorage *ParticleStorage)
00416330 void __cdecl CCollision__CalculateTrianglePlanes(CColData *a1)
00418580 int __cdecl CCollision__CalculateColModelTrianglePlanes(CColModel *a1)
004120C0 char __cdecl ColSphere__TestAABB(ColSphere *a1, CColModel *a2)

  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 27 December 2012 - 08:41 PM

lol biggrin.gif Thank you.

  • DK22Pac

  • Feroci
  • Joined: 12 Apr 2009
  • Ukraine


Posted 06 January 2013 - 03:30 PM Edited by _DK, 06 December 2013 - 05:08 PM.

Finally researched all available rendering pipelines.
_gta_pipelines:            pointer:
// basic
0x00000001 Im3D                       // Particles, Sky, Water, Ped Shadows
0x00000002 DefaultAtomic              // Weapons, Non-prelited objects
// rw plugins
0x00000116 SkinAtomic      0xC978C4   // Peds
0x00000120 MatFX           0xC9AB8C   // Rw bump, envmap, dualpass, uvtransform
// gta plugins                        
0x53F20098 NVCObjects      0xC02C1C   // NVC + prelit
0x53F2009A Vehicles        0xC02D24   // Vehicles, Cutscene Vehicles
0x53F2009C PrelitObjects   0xC02C68   // NVC without prelit? Strange...

  • juarez

    Memory Hacking

  • Members
  • Joined: 11 Jun 2011
  • Poland


Posted 07 January 2013 - 11:58 AM

Found some stuff of generate police roadblocks spawn ...

SA 1.0
0x4629E0 int __cdecl roadBlocksProcess()
0x4619C0 int __cdecl createPoliceRoadBlock(float a1, float a2, float a3, float a4, float a5, float a6, int a7)

VC 1.0
0x444280 int __cdecl roadBlocksProcess()
0x4434B0 int __cdecl createPoliceRoadBlock(float a1, float a2, float a3, float a4, float a5, float a6)

  • Silent

    Moderating Cookie Monster

  • Feroci
  • Joined: 01 Feb 2010
  • Poland
  • Most Helpful [GTA] 2013
    Most Helpful [Modding] 2013
    Most Talented [Modding] 2013
    Best Map 2013 "ViceCityStories PC Edition"
    Best Vehicle 2013 "III Aircraft"
    Most Helpful [Modding] 2012
    Modder of the Year 2012


Posted 03 February 2013 - 01:29 PM Edited by SilentPL, 03 February 2013 - 09:04 PM.

Some completely random stuff, added on request. Jeez, that looks simple compared to the previous posts.

No onscreen stats box:
Write 0xEB to 0x58FC2C (1 byte)

player.img & clothes.dat scratched:
NOP 5 bytes at 0x5A834D

Hunger scratched:
NOP 5 bytes at 0x5700F0


CEntity.m_pRwObject is actually an union:

   RpAtomic* m_pAtomic;
   RpClump* m_pClump;

CEntity::Render shows it obivious:
if ( RwObjectGetType(this->m_pRwObject) == rpATOMIC ) // RwObject.type when inlined

But union is better than typecasting, isn't it? tounge2.gif

1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users