Documenting GTA3/VC memory addresses

[JernejL]

(Colors were changed by altering the exe)

cool stuff, but you forgot the addresses for colors

 

[Squiddy]

 

cool stuff, but you forgot the addresses for colors 

I wasn't sure if I should post them here, but if you think it's okay..

VC uses the function at 0x541570 to set colors, so it's easy to find adresses for other hardcoded adresses. The function for drawing the loading screen is located at 0x4A69D0.

 

The calls should look like that:

 

PUSH alphaPUSH bluePUSH greenPUSH redCALL gta-vc.00541570

I think ModelingMan explained it some pages before. I only list the offsets of the push instructions's values now, all bytes.

 

Border color (call @ 0x4A6ABF)

A 0x4A6A9F

B 0x4A6AB6

G 0x4A6AB8

R 0x4A6ABE

 

Background color (call @ 0x4A6B84)

A 0x4A6B77

B 0x4A6B7C

G 0x4A6B7E

R 0x4A6B80

 

Foreground color (call @ 0x4A6C37)

A 0x4A6C24

B 0x4A6C29

G 0x4A6C2E

R 0x4A6C33

 

 

 

I was bored: http://squiddy.marway.org/gta/screens/menu01.jpg

http://squiddy.marway.org/gta/mods/colors.txt

Edited May 16, 2005 by Squiddy

[jacob.]

Holy balls (lol).. awesome finds squiddy. You rock.

[Squiddy]

Menu

0x68D07C (float) factor that influences the black border in the menu

Cursor Color (asm): 0x4A36D6

Cursor Shadow Color (asm): 0x4A35AA

 

Menu Title (the upper right text)

0x68D128 (float) y scale factor (for both)

0x68D114 (float) relative distance from the right

0x68D118 (float) relative distance from the top

Color (asm): 0x49E33F

 

Menu Title Shadow

0x68D130 (float) relative distance from the right

0x68D134 (float) relative distance from the top

Color (asm): 0x49E274

 

Misc

0x6971C4 (float) Alpha value of game text (includes the hud), set it higher than 255 to make it more transparent

 

Radio Station Display

0x6CD9C8 (float) absolute distance from the top

0x6CD9CC (float) shadow distance

0x6CD9B8 (float) y scale factor

0x6CD9C0 (float) x scale factor

0x6CD9C4 (float) word wrap (e.g. set it to 60 and mp3 player will be displayed in 2 lines)

0x7839C5 (byte) When switching the radio this will count to 0, then disable the display

Shadow Color (asm): 0x5FA1AF

Color1 (asm): 0x5FA223

Color2 (asm): 0x5FA248

[Hammer83]

You could have saved a lot of time with this, Squiddy. Almost all the front-end color addresses are documented in LC launcher source.

[Squiddy]

You could have saved a lot of time with this, Squiddy. Almost all the front-end color addresses are documented in LC launcher source.

Oh, I thought you only documented the hud related addresses.

[DexX]

speaking of colors, i think im getting confused with the formats, theres no consistency.

 

the rgb values for police car lights, loading bar and such are Integers, 0-255 (0-ff) per channel (R, G, B, A )

the rgb values for headlights images* are Floats, 0.0-255.0**

and the rgb values i found for the world ambience are read as int from the timecycle.dat, and divided by 255, to get Floats, 0-1, which is directx standard for lighting and materials.

 

*found a bunch of headlight info, sorting, will post later.

**this was just bizzare. one of the headlight rgb values was 214. it wasn't scaled to 0-1, nor was it D6h, it was actually 214.0 float. i haven't seen lighting storeed in that format before.

[Hammer83]

You could have saved a lot of time with this, Squiddy. Almost all the front-end color addresses are documented in LC launcher source.

Oh, I thought you only documented the hud related addresses.

They are not in GTAMemory anywhere. But the launcher modifies these addresses using WriteProcessMemory after in runs the game. But now that you mention it, it's beena long time since I uploaded the source code. Maybe the last one I uploaded didn't have them.

[Squiddy]

They are not in GTAMemory anywhere. But the launcher modifies these addresses using WriteProcessMemory after in runs the game. But now that you mention it, it's beena long time since I uploaded the source code. Maybe the last one I uploaded didn't have them.

Sure, that's the way I modified them too. But do you really documented ALL colors? That's a hell of work.

[Hammer83]

Yeah, pretty much every front end color had to be changed in LC to match GTA3 colors. The only one I can't find (and it's not really front-end) is the pink of the marker arrow.

[JernejL]

Yeah, pretty much every front end color had to be changed in LC to match GTA3 colors. The only one I can't find (and it's not really front-end) is the pink of the marker arrow.

someone around 10-15 pages back shown how to swap those radar icons,

maybe you should start looking for clues there.

 

[Squiddy]

You could look at these calls, I'm pretty sure it's used for the arrow marker too.

http://squiddy.marway.org/gta/mods/colors.txt

Anyone has a main.scm with an arrow over an actor? I could look through the code later today.

 

I had no luck with that, but instead I did some additional research on the radar, many adresses has been found, but one for the x position is still missing.

 

0x869665 (BYTE) Set it to anything else than 0 and you get a display similar to the one from the map menu

0x68FD2C (FLOAT) Absolute distance from the left

0x68FD34 (FLOAT) Absolute distance from the bottom

Edited May 18, 2005 by Squiddy

[dustcrazy]

Here's another meun adress, this one is where the meun is (this editable)

 

 

0x869728

Decimal

00 - Stats

01 - Start Game

03 - Audio Setup

04 - Display

05 - Language

06 - Map

07 - InGame/ Starts New Game

08 - Load Game

09 - Delete Game

10 - "All unsaved progress..." Load Game

11 - "Proceed wit deleting..." Delete Game

12 - Goes to 01 - Start Game

13 - "Deleting Saved game. Please Wait..." then goes to 14

14 - "Delete Successful. Select OK to continue" "Ok" Delete Game

15 - Save Game List

16 - "Are you sure you want to save this game?"

17 - "Saving current game. Please wait...." Then goes to 18

18 - "Save Successful. Select OK to continue." "OK"

19 - "Ok" Saved Game, this is just a blank screen with no text

20 - "Warning! One or more cheats..." Cheat warning

21 - Player Skin Setup

26 - Controller Setup

27 - Options

29 - Main Meun

30 - RedeFine Controls

31 - Mouse Settings

32 - Resume

33 - "Greetings From Vice City" Then ends game

34 - "Greetings From Vice City" Then ends game

35+ - Blank Screen

Edited May 20, 2005 by dustcrazy

[ModelingMan]

Here is a list of functions that I've found. Some of the addresses might possibly be wrong since I need to compare ASM to MIPS. Also some of the parameters are incorrect...

 

Linkage!

 

Thanks to kyeman for giving me some info on how to do this

Edited July 4, 2005 by ModelingMan

[DexX]

 

Here is a list of functions that I've found. Some of the addresses might possibly be wrong since I need to compare ASM to MIPS. Also some of the parameters are incorrect...

 

Linkage!

 

Thanks to kyeman for giving me some info on how to do this

i love you

 

"useful" would be an understatement, as there is some stuff in there that i had no idea where to look for. enjoy the new star.

[JernejL]

 

Here is a list of functions that I've found. Some of the addresses might possibly be wrong since I need to compare ASM to MIPS. Also some of the parameters are incorrect...

 

Linkage!

 

Thanks to kyeman for giving me some info on how to do this

excellent work indeed!!

 

btw, physicsapplyturnforce looks really suspiciously similar to this "game-standard" function here:

 

procedure Physics_AddForce(Obj: TTssObject; Dir, Orig: TD3DXVector3);

begin

with Obj do begin

if Dir.Y<>0 then Moment.X:=Moment.X-(Orig.Z-Dir.Z/Dir.Y*Orig.Y)*Dir.Y;

if Dir.Z<>0 then Moment.X:=Moment.X+(Orig.Y-Dir.Y/Dir.Z*Orig.Z)*Dir.Z;

 

if Dir.X<>0 then Moment.Y:=Moment.Y+(Orig.Z-Dir.Z/Dir.X*Orig.X)*Dir.X;

if Dir.Z<>0 then Moment.Y:=Moment.Y-(Orig.X-Dir.X/Dir.Z*Orig.Z)*Dir.Z;

 

if Dir.X<>0 then Moment.Z:=Moment.Z-(Orig.Y-Dir.Y/Dir.X*Orig.X)*Dir.X;

if Dir.Y<>0 then Moment.Z:=Moment.Z+(Orig.X-Dir.X/Dir.Y*Orig.Y)*Dir.Y;

 

if Dir.X<>0 then Force.X:=Force.X+Dir.X;

if Dir.Y<>0 then Force.Y:=Force.Y+Dir.Y;

if Dir.Z<>0 then Force.Z:=Force.Z+Dir.Z;

end;

end;

 

which can be seen in action here:

 

http://www.gtatools.com/tss/

 

btw, for everyone that wants to contribute more to this project, me

and smithers (luke) have setup a cool php script for gta memory

database management:

 

http://www.gtaconnection.net/gtamemory/

 

put it into good use, it has also neat feature like page-adress

bookmarks on database page, etc..

 

also, i'm fully open for suggestions / criticism about the gtamemory site project.

[random_download]

The gtamemory project keeps putting a \ in whenever I type a ' symbol

[Luke]

The gtamemory project keeps putting a \ in whenever I type a ' symbol

If the GTAModding project gets off the ground we could have a very nice place to put information about memory and various other things, but we'll have to wait a bit on that to see if it gets setup. The slash is just because stripslashes() isn't used, easy enough to fix, I'm sure it will be. May also be an idea to insist a few more fields are filled in.

 

and James, I love ya too.

[jacob.]

this memory address database is a frickin awesome idea.

 

i'm going to start making submissions, but i have a suggestion.. make the data easier to read! its a strain on my eyes trying to read the data from it, some tables are missing and text is not aligned right.. not bashing whoever made it, but please make it easier to read!!

 

modelingman, those functions rock - big props

Edited May 26, 2005 by !cMc! Jacob

[Hammer83]

ModellingMan, this is awesome. Thanks!

[Squiddy]

 

Updated: http://www.gtaforums.com/index.php?showtop...dpost&p=2860103

 

Marker arrow colors

0x814070 BYTE red

0x814071 BYTE green

0x814072 BYTE blue

0x814073 BYTE alpha

 

0x814074 WORD up and down movement, set to 1 and the arrow stops moving

0x814076 WORD rotation speed

 

Marker arrow corona colors

0x699074 BYTE red

0x699075 BYTE green

0x699076 BYTE blue

 

0x7E4778 FLOAT corona size factor

 

Relating functions:

0x570BA0 C3dMarker::Render

(calls 0x570DA0 to render the arrow)

 

0x574790 CSpecialFX::Render

(calls C3dMarker::Render, CBulletTraces::Render (@0x5729F0) and some other functions)

 

0x4A6510 RenderEffects

(calls some render functions:

CSpecialFX::Render

CShadows::RenderStaticShadows (@0x56C690)

CShadows::RenderStoredShadows (@0x56CC40)

CRubbish::Render (@0x567F20)

CCoronas::Render (@0x543500)

CParticle::Render (@0x5608C0)

 

Vice city set's those values every time a marker is created, so it's currently no real solution. I'll look for a better way

Edited May 29, 2005 by Squiddy

[{DBC}Lance]

 

Marker arrow corona colors

0x699074 BYTE red

0x699075 BYTE green

0x699076 BYTE blue

what do you mean with corona? if it's difficult to explain, could you post another screen?

[Squiddy]

I mean that glow around the arrow.

 

00570F2A |. 8A4424 28 MOV AL,BYTE PTR SS:[ESP+28]

00570F2E 8845 58 MOV BYTE PTR SS:[EBP+58],AL

00570F31 8A4424 2C MOV AL,BYTE PTR SS:[ESP+2C]

00570F35 |. 8845 59 MOV BYTE PTR SS:[EBP+59],AL

00570F38 |. 8A4424 30 MOV AL,BYTE PTR SS:[ESP+30]

00570F3C |. 8845 5A MOV BYTE PTR SS:[EBP+5A],AL

00570F3F |. 8A4424 34 MOV AL,BYTE PTR SS:[ESP+34]

00570F43 |. 8845 5B MOV BYTE PTR SS:[EBP+5B],AL

 

These instructions seem to rest the color of the arrow when a new one is created, I've got no idea now how to change it, as I didn't found the responsible operations on the stack yet.

[JernejL]

 

Marker arrow colors

0x814070 BYTE red

0x814071 BYTE green

0x814072 BYTE blue

0x814073 BYTE alpha

 

0x814074 WORD up and down movement, set to 1 and the arrow stops moving

0x814076 WORD rotation speed

 

Marker arrow corona colors

0x699074 BYTE red

0x699075 BYTE green

0x699076 BYTE blue

 

0x7E4778 FLOAT corona size factor

 

Relating functions:

0x570BA0 C3dMarker::Render

(calls 0x570DA0 to render the arrow)

 

0x574790 CSpecialFX::Render

(calls C3dMarker::Render, CBulletTraces::Render (@0x5729F0) and some other functions)

 

0x4A6510 RenderEffects

(calls some render functions:

CSpecialFX::Render

CShadows::RenderStaticShadows (@0x56C690)

CShadows::RenderStoredShadows (@0x56CC40)

CRubbish::Render (@0x567F20)

CCoronas::Render (@0x543500)

CParticle::Render (@0x5608C0)

 

Vice city set's those values every time a marker is created, so it's currently no real solution. I'll look for a better way

why don't you just edit the \models\generic\arrow.dff?

 

cool stuff about all those function addresses being posted lately, really

good work, i wish i knew some MIPS assembler too

 

[Squiddy]

why don't you just edit the \models\generic\arrow.dff?

I'm sure if it would work this way, the LC mod would have done it, but AFAIK they didn't. VC sets up a material for the arrow, so modifying it might not work.

 

Permanent color change

 

Nop out these instructions:

0x570F2E 8845 58 MOV BYTE PTR SS:[EBP+58],AL

0x570F35 8845 59 MOV BYTE PTR SS:[EBP+59],AL

0x570F3C 8845 5A MOV BYTE PTR SS:[EBP+5A],AL

0x570F43 8845 5B MOV BYTE PTR SS:[EBP+5B],AL

0x570F4A 66:8945 5C MOV WORD PTR SS:[EBP+5C],AX

0x570F59 66:8945 5E MOV WORD PTR SS:[EBP+5E],AX

 

Change these adresses (game code):

Marker red: 0x570CD7 (byte)

Marker green: 0x570CDE (byte)

Marker blue: 0x570CE5 (byte)

Marker alpha: 0x570CEC (byte)

Marker up/down speed: 0x570CF4 (word)

Marker rotation speed: 0x570CFD (word)

 

 

[Hammer83]

Great, Squiddy, thanks! It seems that the contents of al register are arguments 4, 5, 6, 7 to sub_570E90. And in turn, this procedure takes arguments 5, 6, 7, 8 from sub_570340. I think playing around with pushes starting at 0x5708CB will also produce the desired effect.

[DexX]

i've been toying with the idea of adding bullet holes to the game, and most of it should be possible through the directx hook, but one major factor eludes me; the last ...."position"...that a bullet hit. it IS stored somewhere, bullets make sparks when they hit a surface, and where those sparks are created, i need to know. Suggestions or ideas anyone?

[Hammer83]

Weapons related adresses are for 1.1, which probably means -8 for 1.0:

 

Weapon Info - 0x782A14. This is an array of 37 structures each of size 100. The game stores here the data read from weapon.dat. The fields of the structure are follow very closely the columns of weapon.dat.

 

Shot Info - 0x781710. Array of 100 structures each of size 44. Not sure how it is used by the game.

 

Explosion - 0x780C88. Array of 48 structures each of size 56. Each structure holds information about explosions.

 

Projectile Info - 0x7DB890. Array of 32 structures each of size 28. Holds information about projectiles (stuff like hunter missiles I assume). Position stored at offset 0x10 of each structure.

 

Bullet Info - 0x77FB58. Array of 100 structures each of size 44. Probably what ashdexx is looking for. The position is possibly stored at offset 0x10 of each structure.

[dustcrazy]

i've been toying with the idea of adding bullet holes to the game, and most of it should be possible through the directx hook, but one major factor eludes me; the last ...."position"...that a bullet hit. it IS stored somewhere, bullets make sparks when they hit a surface, and where those sparks are created, i need to know. Suggestions or ideas anyone?

LOL this would be pretty cool. We could finnialy have paintball guns (YES, i still have the modele i made)

[Hammer83]

Ok, here is arrow color:

0x68F95C - red

0x68F95D - green

0x68F95E - blue

 

And here is sphere color (the sphere you walk in to start a mission):

0x68F958 - red

0x68F959 - green

0x68F95A - blue