Documenting GTA3/VC memory addresses

[HackMan128]

VC

struct CBuildingModel{0x00 __parent        CModel ?0x2C                 db ? ; undefined0x2D                 db ? ; undefined0x2E                 db ? ; undefined0x2F                 db ? ; undefined0x30 weaponId        dd ?0x34 field_34        dd ?0x38                 db ? ; undefined0x39                 db ? ; undefined0x3A                 db ? ; undefined0x3B                 db ? ; undefined0x3C                 db ? ; undefined0x3D                 db ? ; undefined0x3E                 db ? ; undefined0x3F                 db ? ; undefined0x40 field_40        db ?0x41                 db ? ; undefined0x42 flags           dw ?0x44 minGameHoursWhenRendering db ?0x45                 db ? ; undefined0x46                 db ? ; undefined0x47                 db ? ; undefined0x48 maxGameHoursWhenRendering db ?};

Does anyone has more?

 

BTW, LODs function, it's described and commented how the LODs works, they are getting the value of draw distance of short distance object when from which far they should appear.

 

 

//IDE list loop  for ( i = loopStart; i <= loopEnd; ++i )  {    lodID = mdlPtrs[i];    if ( lodID )    {      mdlType = lodID->Modeltype;      if ( mdlType == 1 || mdlType == 3 ) //objs or tobj        sub_56F420((int)lodID, loopStart, loopEnd);    }  }void __thiscall findSODtoLOD(int lodID, int loopStart, int loopEnd){  int lodID_2; // [email protected]  int i; // [email protected]  CModel*sodID; // [email protected]  char*mdlLODname; // [email protected]  char*mdlSODname; // [email protected]  bool chr; // [email protected]  int modelID; // [email protected]  float drawDist; // [email protected]  lodID_2 = lodID; // CBuildingModel  if ( *(float*)(lodID + 52) > (long double)flt_698FE0 && ! *(DWORD*)(lodID + 48) )  {   *(SHORT*)(lodID + 66) |= 0x10u; // set flag 5    i = loopStart;    if ( loopStart <= loopEnd )    {      while ( true )      {        sodID = mdlPtrs[i]; // search SOD for LOD        if ( sodID != (CModel*)lodID && sodID )        {          mdlLODname = (char*)(lodID + 7); // Get LOD model name          mdlSODname = &sodID->modelName[3]; // Get SOD Model Name after "LOD" (0, 1, 2)          while ( *mdlSODname ) // text          {            if ( *mdlLODname != *mdlSODname ) // compare            {              chr = true;              goto LABEL_12;            }            ++mdlLODname;            ++mdlSODname;          }          chr = ( *mdlSODname != 0); // if end of name (null terminated), return falseLABEL_12:          if ( !chr ) //doesn't match            break;        }		        if ( ++i > loopEnd )          goto LABEL_15;      }	       *(DWORD*)(lodID + 48) = sodID; // set ID of SOD model to the LOD model if found    }LABEL_15:    modelID = *(DWORD*)(lodID + 48); // check if it has some SOD model    if ( modelID )    {      if (*(SHORT*)(modelID + 66) & 3 && !(*(SHORT*)(modelID + 66) & 8) ) // check flags 3 and 8        drawDist = *(float*)(modelID + 4 * (*(SHORT*)(modelID + 66) & 3) + 48);      else        drawDist = *(float*)(modelID + 4 * *(_BYTE*)(modelID + 64) + 48);      *(float*)(lodID_2 + 60) = drawDist* camera.field_F0 / camera.field_F0;      if ( *(SHORT*)(lodID_2 + 66) & 0x40 ) // check flag (if it's Disable Shadow Culling)      {       *(SHORT*)(lodID_2 + 66) &= 0xFFBFu; // set flags        //gta_log(aSWasDrawLast, lodID_2 + 4);      }    }    else    {     *(DWORD*)(lodID_2 + 60) = 0; // there was no SOD, default draw distance (appear distance) set to 0    }  }}

 

 

0x0056F516 set to 299.0 to use multilods in Vice City.

Edited February 24, 2017 by HM128

[DK22Pac]

Does anyone has more?

CModel => CBaseModelInfo

 

There are few classes that are inherited from CBaseModelInfo: CVehicleModelInfo (vehicle models), CPedModelInfo (peds), CSimpleModelInfo (objects), CTimeModelInfo (time objects ('tobj')), CWeaponModelInfo, etc.

 

The class you showed here (named "CBuildingModel") includes members from some of these different classes.

 

The function you showed here (named "findSODtoLOD") is a method SetupBigBuilding of a class CSimpleModelInfo

 

 

 

 

void CSimpleModelInfo::SetupBigBuilding( int startIndex, int endIndex ) {    if ( this->m_afLodDistances[0] > 300.0f && !this->m_pLodModelInfo ) {        this->m_nFlags.bIsBigBuilding = true;        this->FindRelatedModel(startIndex, endIndex); // inlined        if ( this->m_pLodModelInfo ) {            this->m_fLodModelDistance = this->m_pLodModelInfo->GetLargestLodDistance() / TheCamera.m_fLodDistance; // inlined            if ( this->m_nFlags.bDrawLast ) {                this->m_nFlags.bDrawLast = false;                dbgprint("%s was draw last\n", this->m_szName);            }        }        else            this->m_fLodModelDistance = 0.0f;    }}

 

 

UP:

 

VC Model classes hierarchy

 

CBaseModelInfo

|

+------------------+------------------+

| |

CSimpleModelInfo CClumpModelInfo

| |

+-------+------+ +-------+------+

| | | |

CTimeModelInfo CWeaponModelInfo CVehicleModelInfo CPedModelInfo

Edited February 25, 2017 by DK22Pac

[HackMan128]

Thank You DK

 

VC 1.0

 

Sometimes modded game keeps crashing with "unloaded" message, so I have found that the

.text:0060063C 0E0 push    eax             ; hWnd.text:0060063D 0E4 call    ds:DestroyWindow ; Indirect Call Near Procedure

Makes crash more often. After nopping the call:

0x0060063C NOP0x0060063D NOP 6

This minimized the occurs to zero.

I still don't know if it's right to do such thing but it seems to work.

 

//EDIT:

Just to be clear, to get rid of crashes after game quit, NOP the function above.

Edited March 18, 2017 by HM128

[DK22Pac]

GTA 3 idb by Kenking

[HackMan128]

Very well documented

 

But I think there are few mistakes with typecast of CSprite2D and RwRect.

 

//EDIT:

(III) 1.0

Loading and drawing own font example:

// TxdStore Classauto CTxdStore__FindTxdSlot = (int(__cdecl *)(char *name))0x5275D0;auto CTxdStore__SetCurrent = (int(__cdecl *)(int index))0x5278C0;auto CTxdStore__RwTextureRead = (CSprite2d *(__cdecl*)(char *name, char *mask))0x5A7580;auto CTxdStore__PushCurrentTxd = (int(*)(void))0x527900;auto CTxdStore__PopCurrentTxd = (int(*)(void))0x527910;// Sprite2d Classclass CSprite2d;auto CSprite2d__AddSpriteToBank = (void(__cdecl *)(WORD textureId, RwRect const&posInfo, RwRGBA const&color, float u1, float v1, float u2, float v2, float u3, float v3, float u4, float v4))0x51EBC0;auto CSprite2d__DrawBank = (int(__cdecl *)(CSprite2d *))0x51EC50;auto CSprite2d__GetBank = (int(__cdecl *)(int a1, int texAddr))0x51EB70;//Load texture on initCTxdStore__PushCurrentTxd();CTxdStore__SetCurrent(CTxdStore__FindTxdSlot("fonts"));CSprite2d *tex = CTxdStore__RwTextureRead("font3", 0);CTxdStore__PopCurrentTxd();//Redirect call at 0x0048C8D7 and 0x005928BF byint _ZN5CFont12InitPerFrameEv(){    *(DWORD*)0x8F31B4 = CSprite2d__GetBank(30, *(DWORD*)0x95CC04);    CSprite2d__GetBank(15, *(DWORD*)0x95CC08);    CSprite2d__GetBank(15, *(DWORD*)0x95CC0C);    CSprite2d__GetBank(15, *(DWORD*)tex);    return true;}//Draw symbols as the part of textures in loop//DWORD texAddr = CSprite2d__GetBank(10, *(DWORD*)tex); //the 10 number is slot probably, improper can be crashyint textAddr = 3; //added new font textureCSprite2d__AddSpriteToBank(texAddr, rect, color, U1lef, V1bot, U2rig, V2bot, U3lef, V3top, U4rig, V4top);CSprite2d__DrawBank((CSprite2d *)texAddr);

Edited March 23, 2017 by HM128

[Cell Tennyson]

Any memory address which increases the chances of 3 or 4 peds sitting in a 4 seater car? Like in FBI Rancher.

[Nick007J]

Game uses a probability for a passenger seat be taken (0.125). Increasing it would cause generally higher number of passenger in a vehicle, including 4 seater cars. Constant itself is used in multiple places, so you would have to find unused 4 bytes, fill them with required float, and then substitute address at 0x428DE3 to address of new float. Originally it refers to 0x687050, which contains 0.125.

 

Example: set 0x6874EC to a required float, then set value at 0x428DE3 to 0x6874EC (4 bytes). If the float is 1.0, all spawned random vehicles will have maximum passengers (except hardcoded exceptions, like taxis and limos can only have passengers in back seats).

[Cell Tennyson]

Game uses a probability for a passenger seat be taken (0.125). Increasing it would cause generally higher number of passenger in a vehicle, including 4 seater cars. Constant itself is used in multiple places, so you would have to find unused 4 bytes, fill them with required float, and then substitute address at 0x428DE3 to address of new float. Originally it refers to 0x687050, which contains 0.125.

 

Example: set 0x6874EC to a required float, then set value at 0x428DE3 to 0x6874EC (4 bytes). If the float is 1.0, all spawned random vehicles will have maximum passengers (except hardcoded exceptions, like taxis and limos can only have passengers in back seats).

 

Nice I got it thanks.

[XMDS]

Have a memory address can change model(object）size?

[DK22Pac]

There are no memory addresses for 'everything'.

 

That's something similar to SA's object scaling (08D2)

 

#include "plugin_vc.h" class ScaledObject {public:    ScaledObject() {        plugin::Events::objectRenderEvent.before += [](CObject *object) {            if (object->m_pRwObject && object->m_nModelIndex == 337) { // money model                object->m_placement.UpdateRW();                RwFrame *frame = reinterpret_cast<RwFrame *>(object->m_pRwObject->parent);                RwV3d scale = { 5.0f, 5.0f, 5.0f };                RwMatrixScale(&frame->modelling, &scale, rwCOMBINEPRECONCAT);                RwFrameUpdateObjects(frame);            }        };    }} plg;

 

Or, if you want it as a separate function:

 

ObjectScalingExtension.h

 

#include "plugin_vc.h"class ObjectScalingExtension {public:    struct ExtensionInfo {        bool  m_bObjectScaled = false;        float m_fObjectScale = 1.0f;        ExtensionInfo(CObject *) {}    };    static plugin::ObjectExtendedData<ExtensionInfo> extensionData;    static float GetObjectScale(CObject *object);    static void SetObjectScale(CObject *object, float scale);    ObjectScalingExtension();};extern ObjectScalingExtension extensionInstance;

ObjectScalingExtension.cpp

 

#include "ObjectScalingExtension.h"float ObjectScalingExtension::GetObjectScale(CObject *object) {    return extensionData.Get(object).m_fObjectScale;}void ObjectScalingExtension::SetObjectScale(CObject *object, float scale) {    extensionData.Get(object).m_fObjectScale = scale;}ObjectScalingExtension::ObjectScalingExtension() {    plugin::Events::objectRenderEvent.before += [](CObject *object) {        auto &data = extensionData.Get(object);        if (data.m_fObjectScale != 1.0f || data.m_bObjectScaled)        if (object->m_pRwObject) {            object->m_placement.UpdateRW();            RwFrame *frame = reinterpret_cast<RwFrame *>(object->m_pRwObject->parent);            RwV3d scale = { data.m_fObjectScale, data.m_fObjectScale, data.m_fObjectScale };            RwMatrixScale(&frame->modelling, &scale, rwCOMBINEPRECONCAT);            RwFrameUpdateObjects(frame);            if (data.m_fObjectScale != 1.0f)                data.m_bObjectScaled = true;            else                data.m_bObjectScaled = false;        }    };}ObjectScalingExtension extensionInstance;plugin::ObjectExtendedData<ObjectScalingExtension::ExtensionInfo> ObjectScalingExtension::extensionData;

Usage

 

#include "plugin_vc.h"#include "ObjectScalingExtension.h"class ScaledObject {public:    ScaledObject() {        plugin::Events::gameProcessEvent += [] {            for (int i = 0; i < CPools::ms_pObjectPool->m_nSize; i++) {                CObject *object = CPools::ms_pObjectPool->GetAt(i);                if (object && object->m_nModelIndex == 337)                    ObjectScalingExtension::SetObjectScale(object, 5.0f);            }        };    }} plg;

 

Edited August 25, 2017 by DK22Pac

[XMDS]

There are no memory addresses for 'everything'.

 

That's something similar to SA's object scaling (08D2)

 

#include "plugin_vc.h" class ScaledObject {public:    ScaledObject() {        plugin::Events::objectRenderEvent.before += [](CObject *object) {            if (object->m_pRwObject && object->m_nModelIndex == 337) { // money model                object->m_placement.UpdateRW();                RwFrame *frame = reinterpret_cast<RwFrame *>(object->m_pRwObject->parent);                RwV3d scale = { 5.0f, 5.0f, 5.0f };                RwMatrixScale(&frame->modelling, &scale, rwCOMBINEPRECONCAT);                RwFrameUpdateObjects(frame);            }        };    }} plg;

 

Or, if you want it as a separate function:

 

ObjectScalingExtension.h

 

#include "plugin_vc.h"class ObjectScalingExtension {public:    struct ExtensionInfo {        bool  m_bObjectScaled = false;        float m_fObjectScale = 1.0f;        ExtensionInfo(CObject *) {}    };    static plugin::ObjectExtendedData<ExtensionInfo> extensionData;    static float GetObjectScale(CObject *object);    static void SetObjectScale(CObject *object, float scale);    ObjectScalingExtension();};extern ObjectScalingExtension extensionInstance;

ObjectScalingExtension.cpp

 

#include "ObjectScalingExtension.h"float ObjectScalingExtension::GetObjectScale(CObject *object) {    return extensionData.Get(object).m_fObjectScale;}void ObjectScalingExtension::SetObjectScale(CObject *object, float scale) {    extensionData.Get(object).m_fObjectScale = scale;}ObjectScalingExtension::ObjectScalingExtension() {    plugin::Events::objectRenderEvent.before += [](CObject *object) {        auto &data = extensionData.Get(object);        if (data.m_fObjectScale != 1.0f || data.m_bObjectScaled)        if (object->m_pRwObject) {            object->m_placement.UpdateRW();            RwFrame *frame = reinterpret_cast<RwFrame *>(object->m_pRwObject->parent);            RwV3d scale = { data.m_fObjectScale, data.m_fObjectScale, data.m_fObjectScale };            RwMatrixScale(&frame->modelling, &scale, rwCOMBINEPRECONCAT);            RwFrameUpdateObjects(frame);            if (data.m_fObjectScale != 1.0f)                data.m_bObjectScaled = true;            else                data.m_bObjectScaled = false;        }    };}ObjectScalingExtension extensionInstance;plugin::ObjectExtendedData<ObjectScalingExtension::ExtensionInfo> ObjectScalingExtension::extensionData;

Usage

 

#include "plugin_vc.h"#include "ObjectScalingExtension.h"class ScaledObject {public:    ScaledObject() {        plugin::Events::gameProcessEvent += [] {            for (int i = 0; i < CPools::ms_pObjectPool->m_nSize; i++) {                CObject *object = CPools::ms_pObjectPool->GetAt(i);                if (object && object->m_nModelIndex == 337)                    ObjectScalingExtension::SetObjectScale(object, 5.0f);            }        };    }} plg;

 

I do not understand the c/c + +, can you tell me how to use it in cleo

[DK22Pac]

Sorry, I don't understand cleo.

[Cell Tennyson]

Hi.

 

Which memory address is responsible for the accident victim ped model in GTA Vice City. By default its ped model is Male01, that guy always dies in front of car or maybe spawns dead in front of cars and the driver comes out to see his death . Can that ped model be changed?

[DK22Pac]

Check CPopulation::AddDeadPedInFrontOfCar (0x53B180 in GTA VC 1.0).

[ModelingMan]

Creating subclasses of CEntity

 

The above linked post describes how a new CEntity subclass is created which can be managed by VC's existing code. This particular example is derived from CObject, which when instantiated will call VC's CObject::operator new which of course returns a free slot in CPool<CObject>. I've yet to try allocating the memory outside of the CPool as in this instance the index of the object in the CPool is passed back to the SCM for later use.

 

Hopefully at least 1 person can learn from this. I know I have a couple ideas up the sleeve.

[Jennawright]

anyone know the memory address for when  txd is applied to a vehicle? vc 1.0

[HackMan128]

I need an simple weather address for Vice City : ). I have no time to discover for it and my life seems to stay opposite to me when I'm trying to. Like there is no site with that pity address documented, there is no time for me right now to play around with cheat engine, then blablabla etc and comparing and filter it.

I had it somewhere, it was BYTE 0-5 I guess.

Edited September 18, 2019 by HackMan128

[Jack]

7 hours ago, HackMan128 said:

blablabla

Take a look at the plugin-sdk next time:

CWeather.cpp

eWeather.h

[HackMan128]

A bit meany bone instead of an answer. I'm not like that when someone need help from me. Should I change?

Edited September 18, 2019 by HackMan128

[Jack]

49 minutes ago, HackMan128 said:

A bit meany bone instead of an answer. I'm not like that when someone need help from me. Should I change?

My reply was more then just a direct answer:

short &CWeather::OldWeatherType = *(short*)0xA10AAA;

I just wanna point out that the addresses are well documented in the plugin-sdk. I meant nothing wrong.

[HackMan128]

Thanks. I meant that any searching at the moment meets frustration to me because I'm lacking of time in these days.

[HackMan128]

On 9/18/2019 at 11:44 AM, Jack said:

short &CWeather::OldWeatherType = *(short*)0xA10AAA;

 I meant nothing wrong.

 

Quote

oh how nice ...

You people didn't change. Still treat me like trash for the smallest reason, just because I wasn't begged. You have bad habit with punching me mentally and there will be time you will change your mind, if not by getting wise, then by force.

 

Quote

My reply was more then just a direct answer:

When a surgeon asks you for a scalpel, would you give him a whole case?

 

I'm tired, I'm not as young as I was. I thought if I'm a developer of something big for the community, I will get some kindness for that. It didn't workout.

 

 

I will find the address myself when I will get some sleep. thank you.

 

by the way

It was suspiciously weird it is not on the net as a single addr, like no one asked for it before.

 

 

//EDIT

Maybe I exagregated a little bit. That's because I was tired and sleepy perhaps.

Edited September 20, 2019 by HackMan128

[Shagg_E]

Disabling bike fall-offs:

0A8C: write_memory 0x4F4FB9 size 1 value 0x40 virtual_protect 1 // Disable vehicle jacking for everybody except cops. Original value is 0x84
0A8C: write_memory 0x691C74 size 4 value -9999.0 virtual_protect 1 // Disable vehicle jacking for cops. Original value is 0.30000001
0A8C: write_memory 0x694150 size 4 value 9999.0 virtual_protect 1 // Disable bike fall-offs by moving backwards. Original value is 0.090000004
0A8C: write_memory 0x69415C size 4 value 9999.0 virtual_protect 1 // Disable bike fall-offs by moving backwards. Original value is 3.5
0A8C: write_memory 0x694160 size 4 value 9999.0 virtual_protect 1 // Disable bike fall-offs by moving backwards. Original value is -0.5
0A8C: write_memory 0x60A183 size 1 value 255 virtual_protect 1 // Disable bike fall-offs by road tricks. Original value is 13
0A8C: write_memory 0x613663 size 1 value 0xAC virtual_protect 1 // Disable bike fall-offs by fly tricks. Original value is 0x80
0A8C: write_memory 0x6D77BC size 4 value 9999.0 virtual_protect 1 // Disable bike fall-offs by fly tricks. Original value is 0.4
0A8C: write_memory 0x6D7950 size 4 value 9999.0 virtual_protect 1 // Disable bike fall-offs by collisions. Original value is 75.0

The only way to exit the vehicle now if only ped/player wants to exit or if he died(but you can set him some special behavior or immunities).
It works for everyone.
Enabling all this stuff again:

0A8C: write_memory 0x4F4FB9 size 1 value 0x84 virtual_protect 1 // Enable vehicle jacking for everybody except cops.
0A8C: write_memory 0x691C74 size 4 value 0.30000001 virtual_protect 1 // Enable vehicle jacking for cops.
0A8C: write_memory 0x694150 size 4 value 0.090000004 virtual_protect 1 // Enable bike fall-offs by moving backwards.
0A8C: write_memory 0x69415C size 4 value 3.5 virtual_protect 1 // Enable bike fall-offs by moving backwards.
0A8C: write_memory 0x694160 size 4 value -0.5 virtual_protect 1 // Enable bike fall-offs by moving backwards.
0A8C: write_memory 0x60A183 size 1 value 13 virtual_protect 1 // Enable bike fall-offs by road tricks.
0A8C: write_memory 0x613663 size 1 value 0x80 virtual_protect 1 // Enable bike fall-offs by fly tricks.
0A8C: write_memory 0x6D77BC size 4 value 0.4 virtual_protect 1 // Enable bike fall-offs by fly tricks.
0A8C: write_memory 0x6D7950 size 4 value 75.0 virtual_protect 1 // Enable bike fall-offs by collisions.

Also, it's kind of proper "steed" mod(you can use this code for stunts)

[Jennawright]

Menu highlight text VC 1.0 (green bar behind selection in menu)

 

red component

0x49F320

0x49F7DF

0x49F9C8

 

green component

0x49F31B

0x49F7DA

0x49F9C3 

 

blue component

0x49F319

0x49F7D8

0x49F9C1

 

Transparancy component

0x49F314

0x49F7D3

0x49F9BC

 

 

[NTxC]

Is there an updated IDB file for GTA VC? Anyone?

[Be0il]

Hi, does anyone know the memory address of "Process_FollowPed" function in vice city?

Edited June 9, 2021 by Be0il